Scylla icon indicating copy to clipboard operation
Scylla copied to clipboard

Published 20 hours ago • verified publisher icon NtQuery

Can there be an option that "Don't compact raw data"?

Open lifenjoiner opened this issue 5 years ago • 0 comments

Don't compact raw data means keep the RawOffset/RawSize the same as VirutalOffset/VirutalSize.

Why? In most case, we are researching the dumped file. Keep the same address/offset makes it easier to locate the data in hex editors, debuggers and other PE tools. Of course, we can compact raw data giving a smaller final PE file.

Related code: https://github.com/NtQuery/Scylla/blob/0ca2c1a0da5dca4bf124cbc9ab127439b2b8c097/Scylla/PeParser.cpp#L1083-L1092 https://github.com/NtQuery/Scylla/search?q=alignAllSectionHeaders&unscoped_q=alignAllSectionHeaders

lifenjoiner avatar Sep 17 '19 07:09 lifenjoiner