Quote:
|
But, since they're not holding anything physically on disk (and are essentially just wasting space, as you noted), what you can do is leave the section headers in the PE header, delete their physical storage in the file (such that RSize is 0), and set their RSize to 0 in the section header.
|
I've just tried this out - works like a charm (of course after updating the other section's ROffset)!
Quote:
|
The good news is, you dont have to do this yourself. A good PE Rebuild process (like the one in PE Tools) will detect that a section is all 00s, and do this exact thing for you. So leave those alone, and since it is best to do a Rebuild PE once you're done editing the file anyway, just let PE Tools do all the work
|
Till it gets boring I'll try it manually - I enjoy the "WOW! IT WORK'S!" feeling
Quote:
|
313000 .mackt -- as you said, holds the new IAT created by ImpRec
|
Okay. As for this one I could try to put it at raw location 226000 since there's enough space.
Quote:
|
2EA000 .data -- this section is named randomly by ASProtect
|
Hmmm... this section's raw size is too big to put it somewhere inside a zero block. What should I do now?
All in all I should be able to reduce the file size by nearly 160000 bytes, perhaps some more when fiddling with the alignment.
So... here we go!
Thanks again
Wurstgote