Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #17  
Old 04-02-2018, 17:35
dosprog dosprog is offline
Friend
 
Join Date: Feb 2018
Posts: 114
Rept. Given: 0
Rept. Rcvd 17 Times in 16 Posts
Thanks Given: 33
Thanks Rcvd at 147 Times in 74 Posts
dosprog Reputation: 17
Here is a little and very useful 32-bit calculator
32-bit ASM Calculator 1.6 (c)PCL

--Add--


And here is a specific calculator for calculate offsets in 32-bit PE-EXE file:
File Location Calculator (c)PCL

His little-modified version 1.4.0.4(+) is attached to this message (See attachement).
Added option - displays "<TaiL>" string after section name if (given address > FileOffset+VirtualSize) for this section.

Example of PE-sections table in 32-bit PE-EXE with tails in sections:

Quote:
N Name.... VirtSize...... RVA....... PhysSize.... Offset..... Flag
1 .text...... 00028874 00001000 00028A00 00000400 60500060
2 .data..... 00000084 0002A000 00000200 00028E00 C0300040
3 .rdata.... 00008970 0002B000 00008A00 00029000 40700040
4 .eh_fram 000065A8 00034000 00006600 00031A00 40300040
5 .bss...... 00010F20 0003B000 00000000 00000000 C0700080
6 .idata.... 00000A68 0004C000 00000C00 00038000 C0300040
7 .CRT...... 00000018 0004D000 00000200 00038C00 C0300040
8 .tls........ 00000020 0004E000 00000200 00038E00 C0300040
See ".text" section for example:
VirtSize =00028874h
PhisSize=00028A00h
Then:
<Tail>Size= PhisSize-VirtSize=018Ch


--Add--

For "Triming tails" of all sections in PE-section table of file
use HIEW32 HEM-Plugin PE_TAILS.HEM.



Attached Files
File Type: rar FLC.RAR (9.6 KB, 4 views)

Last edited by dosprog; 04-02-2018 at 18:29.
Reply With Quote
The Following 3 Users Say Thank You to dosprog For This Useful Post:
c0rin (04-17-2018), Stingered (04-15-2018), VodoleY (05-02-2018)
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
kernel-based keylogger for Linux nimaarek Source Code 7 10-30-2017 14:51


All times are GMT +8. The time now is 22:22.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )