View Single Post
  #5  
Old 09-28-2003, 17:13
amitophia
 
Posts: n/a
You can remove this sections manually


You have to remove this section from section list in PE-header an move up ther sections to fill up the gaps, so it would be like this (but you shouldn't change header size)

1000 .data
1000 .mackt
1000 .rdata
2000 .rsrc
1000 .text
10000 .tex1
Then you'll have to correct the Phys Address and RVA's.
If this sections were placed at the end of file.
This is needed only for sections that goes after removed sections. So If section .pdata were 600 phys bytes long (for example) then all other sections phys addresses will reduce by 600 bytes in the "removed" version.
The RVA's need to be corrected to fill the RVA gaps (because win2k and XP (maybe, NT) don't allow the holes betweebn sections)
So you have to increase RVA size of sections to the beginning of next section.

Last edited by amitophia; 09-29-2003 at 05:41.
Reply With Quote