#1
|
|||
|
|||
How to reduce the size of dumped exe
As a test, I use Armadillo to protect a exe(24K), then unpack it,
dump the exe, but this one is bigger than the original(348K). there are several sections: 1000 .data 20000 .data1 1000 .mackt 20000 .pdata 1000 .rdata 2000 .rsrc 1000 .text 10000 .text1 and I think maybe the .data1 & .pdata section could be removed. I tried PE explorer, PETools to remove the section, but always get corrupted EXE. Is there any good tools? or other method to reduce the file size? thanks |
#2
|
||||
|
||||
i think you shoud use LordPe by y0da and select Rebuild PE
|
#3
|
||||
|
||||
yeah...and don't forget check DUMPFiX...
|
#4
|
|||
|
|||
Quote:
but when I want to fix a big exe it report no sufficient memory and doesn't work. |
#5
|
|||
|
|||
You can remove this sections manually
You have to remove this section from section list in PE-header an move up ther sections to fill up the gaps, so it would be like this (but you shouldn't change header size) 1000 .data 1000 .mackt 1000 .rdata 2000 .rsrc 1000 .text 10000 .tex1 Then you'll have to correct the Phys Address and RVA's. If this sections were placed at the end of file. This is needed only for sections that goes after removed sections. So If section .pdata were 600 phys bytes long (for example) then all other sections phys addresses will reduce by 600 bytes in the "removed" version. The RVA's need to be corrected to fill the RVA gaps (because win2k and XP (maybe, NT) don't allow the holes betweebn sections) So you have to increase RVA size of sections to the beginning of next section. Last edited by amitophia; 09-29-2003 at 05:41. |
#6
|
||||
|
||||
Don't forget that if you do remove sections and then move the other sections to fill the gaps, then you'll also need to relocate the data inside any section which contains RVA's, such as import sections, resource, etc.
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Instruction Size | visu | General Discussion | 9 | 05-16-2005 18:23 |
10 lines code dumped themida | pll823 | General Discussion | 3 | 04-23-2005 17:36 |
Dumped File / DLL Missing | rf1911 | General Discussion | 7 | 08-24-2003 06:19 |