Andrey Turkin [EMAIL PROTECTED] wrote:
-mapping-header_size = pos + size;
+mapping-header_size = max( pos + size,
nt.OptionalHeader.SizeOfHeaders );
You're reading my mind (or my hard drive), don't you? :) Ok, but if you
going to change server code here, then you should probably align
Andrey Turkin [EMAIL PROTECTED] writes:
I believe this is incorrect with regard to native Windows loader. As I
already said, I've tried to change PointerToRawData field on some files
with big FileAlignment and they load correctly if I or'ed them with some
value in range 0..0x1FF. Files
Andrey Turkin [EMAIL PROTECTED] wrote:
if (map_file_into_view( view, fd, 0, header_size, 0, VPROT_COMMITTED |
VPROT_READ,
-removable ) != STATUS_SUCCESS) goto error;
+TRUE ) != STATUS_SUCCESS) goto error;
This chunk has nothin to do
Dmitry Timoshkov wrote:
Andrey Turkin [EMAIL PROTECTED] wrote:
if (map_file_into_view( view, fd, 0, header_size, 0,
VPROT_COMMITTED | VPROT_READ,
-removable ) != STATUS_SUCCESS) goto error;
+TRUE ) != STATUS_SUCCESS) goto error;
Andrey Turkin [EMAIL PROTECTED] wrote:
if (map_file_into_view( view, fd, 0, header_size, 0,
VPROT_COMMITTED | VPROT_READ,
-removable ) != STATUS_SUCCESS) goto error;
+TRUE ) != STATUS_SUCCESS) goto error;
This chunk has nothin to do
Dmitry Timoshkov wrote:
Andrey Turkin [EMAIL PROTECTED] wrote:
if (map_file_into_view( view, fd, 0, header_size, 0,
VPROT_COMMITTED | VPROT_READ,
-removable ) != STATUS_SUCCESS) goto
error;
+TRUE ) != STATUS_SUCCESS) goto error;
Andrey Turkin [EMAIL PROTECTED] wrote:
What is the file alignment of the problematic PE file? Is
it 512
(0x200) by any chance?
Yep. However, I've made some quick tests (that is, I've used PE tools to
rebuild some apps with larger file alignment and then tried to change
physical offset) and
Some comments inside. Sorry for over-quoting :)
Dmitry Timoshkov wrote, on 11/13/06 10:19 MSK:
Andrey Turkin [EMAIL PROTECTED] wrote:
What is the file alignment of the problematic PE file? Is it 512
(0x200) by any chance?
Yep. However, I've made some quick tests (that is, I've used PE
