-
Notifications
You must be signed in to change notification settings - Fork 4
Open
Description
Note to self so I don't forget it later.
At the moment, some UPX executables get the wrong overlay address slightly. The OptionalHeader.SizeOfHeaders is 4096, which doesn't actually seem to be true. Going by the pointer to raw data on the sections, the actual start is at 1024. If the logic continues from this point, it gets the correct overlay address. Obviously UPX executables themselves aren't supported for decompression, but this still matters for extracting various SFX archives, since those aren't affected by the UPX compression.
File used as reference: WorldwideSoccerManager2008_dd_setup_v802.exe
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels