You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Don't compact raw data means keep the RawOffset/RawSize the same as VirutalOffset/VirutalSize.
Why?
In most case, we are researching the dumped file. Keep the same address/offset makes it easier to locate the data in hex editors, debuggers and other PE tools.
Of course, we can compact raw data giving a smaller final PE file.
Don't compact raw data
means keep theRawOffset/RawSize
the same asVirutalOffset/VirutalSize
.Why?
In most case, we are researching the dumped file. Keep the same address/offset makes it easier to locate the data in hex editors, debuggers and other PE tools.
Of course, we can compact raw data giving a smaller final PE file.
Related code:
Scylla/Scylla/PeParser.cpp
Lines 1083 to 1092 in 0ca2c1a
https://github.com/NtQuery/Scylla/search?q=alignAllSectionHeaders&unscoped_q=alignAllSectionHeaders
The text was updated successfully, but these errors were encountered: