Sorry guys but when you talk PE stuff to me you must be more clear.

phax, are you saying that UPX packing and upacking left PE section flags untouched but it did alter relocation, debug and import table values in PE header?

archphase, I suppose you are saying that olly's message disappears if BaseOfCode and SizeOfCode are such that the EP is included in what PE header declares being code.
But I did not understand the following sentences in your post:

1) yielding alignment to the Memory Alignment that adheres to AddrOfEntrypoint field
2) so if .foo is at rva 4000h just set baseofcode to that and then keep the ep of .foo like what it might be like 4028h

Could you please clarify their meaning?


yaa