If you remove "data directory" from a "PE file" what will happen ? I think loader will give an error, but I'm not sure. Please try to correct me.
2 Answers
You can't exactly "delete" this directory, however you can set the NumberOfRvaAndSizes
field to 0 and then the system loader won't use the entries from it. From the TinyPE page:
The PE specification says that the number of data directories is specified in the NumberOfRvaAndSizes header field and the size of the PE optional header is variable. If we set NumberOfRvaAndSizes to 0 and decrease SizeOfOptionalHeader, we can remove the data directories from the file.
However, the resulting file won't work in Windows 2000 "because the loader tries to call a function from KERNEL32, but KERNEL32.DLL is not loaded". So normally you should add at least an Import Table directory, which needs NumberOfRvaAndSizes
to be at least 2. (You also need an import directory if you want your file to do anything useful, like call functions from other DLLs :)
-
-
2
-
I'm sure you CAN delete this directory, after setting the NumberOfRvaAndSizes to 0, you cut the next 128 bytes and move every following byte to the left 128. Oh, and is Windows2000 still a thing? Jan 4, 2020 at 6:10
I haven't done this since the early days of MSDOS filenames in 8.3 form. If you edit the dard disc directory area with a hex editor and change the flag byte(s) which signify that a file is an extended directory then you can open that file as if it was a file. I don't know what happens with later Ms DOSs, though. Easy enough to test with WinHex, if you want.
-
1
.data
and not directory you meanSection
orSegment
right? deleting it is pretty simple just get a PEditor by yoda and delete it, you won't be able to run the program it will just sayis not a valid Win32 application