You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In a memory mapped image, regions that exist due to section/page alignment requirements should contain zeroes. Currently, pefile bleeds section data into such regions.
Reproduction: Take any Windows binary that has file-aligned sections (so not a memory dump) and check what's at offset 0x400 (which in most common binaries is where the PE header ends).
In a memory mapped image, regions that exist due to section/page alignment requirements should contain zeroes. Currently, pefile bleeds section data into such regions.
Reproduction: Take any Windows binary that has file-aligned sections (so not a memory dump) and check what's at offset 0x400 (which in most common binaries is where the PE header ends).
This can cause considerable confusion if you're doing a regex search over the mapped image and RIP-relative data references get screwed up.
The text was updated successfully, but these errors were encountered: