0

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.

  • If the embedded PE file is in a resource, you can simply retrieve the size of the resource. Also, I think I remember that the Authenticode signatures are outside of the actual image, i.e. an overlay. – 0xC0000022L Jul 30 at 7:35
0

As far as I know, you can't.

While IMAGE_OPTIONAL_HEADER.SizeOfImage gives you the size of the whole PE file mapped to memory, it does not account for appended data.

Appended data is commonly called "overlay" and tools actually detect if overlay data is present by checking if the file contains more data than accounted for by the SizeOfImage field.

As far as I know it is even more problematic - the PE loader does not load overlay data to memory. If an application wants to access overlay data it will have to access the file on disk, and if you take a memory dump only it will definitely lack any overlay data the application might have had.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.