Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PE from scratch example (x86) produces the wrong optional header size #1118

Open
czechmate247 opened this issue Oct 21, 2024 · 0 comments
Open
Assignees

Comments

@czechmate247
Copy link

czechmate247 commented Oct 21, 2024

When running the lief/examples/python/pe_from_scratch.py script, the 32-bit (x86) binary that is produced has the wrong size of optional header in the file header. The incorrect value it keeps producing is 0x60 which prevents tools like CFF Explorer or PE Bear from being able to read the PE file correctly saying section misaligned to file alignment. When I examine other x86 Windows binaries, they all have 0xE0 for the size. When I use a hex editor to manually change this optional header size value from 0x60 to 0xE0, the PE reader tools I previously mentioned work again and the binary runs correctly.

The pe_from_scratch.py file is slightly out of date in the fact I had to remove the name string from the call to binary32 = PE.Binary(PE.PE_TYPE.PE32). Also, I have to add the line binary32.header.add_characteristic(lief.PE.Header.CHARACTERISTICS.EXECUTABLE_IMAGE) before the final building steps in the script to actually get generated pe_from_scratch.exe binary to run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants
@romainthomas @czechmate247 and others