What implications has the low alignment mode of a PE file?

Question

I only found this term "low alignment mode" in the corkami wiki.

• standard mode: 200 <= FileAlignment <= SectionAlignment and 1000 <= SectionAlignment

• low alignment: 1 <= FileAlignment = SectionAlignment <= 800

The numbers are hex values.

Some possible implications are described by ReversingLabs

It seems low alignment is necessary to make the PE Header writable. However, FileAlignment and SectionAlignment have to be lower than or equal to 200h, which is more restrictive than the low alignment mode above. So I am not sure if this is really a consequence of low alignment or if low alignment mode is just one part of that trick.

In addition it seems that the virtual addresses have to be equal to the physical ones.

I would like to understand this better.
My questions are: What implications has the low alignment mode? How is the way changed the loader loads the PE? Why is it that way?

Answer 1

A writable header is a side-effect of the low alignment. More interestingly, an executable header is possible, too, bypassing DEP restrictions even when set to enable for all processes. That allows code to execute directly from the header, which would normally not be allowed. When used for a DLL, the ImageBase can become the entrypoint (i.e. call LoadLibrary; call eax), which might be a bit unexpected.

Other implications include that some tools cannot disassemble or dump such files properly. A low alignment allows for the creation of very small files (as small as 268 bytes on 64-bit or 255 bytes on 32-bit Vista and later systems (XP allows the file to be 233 bytes long)), by overlapping the tables, and even removing all of the sections. This small size has been proven to be sufficient for a downloader.