find int(AddressOfEntryPoint) is greater than get_memory_mapped_image()

[KatherineLiu-holdon]

Hi, I just start on learning. I wonder why in the showing case , buffer actually gets nothing.

ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint
buffer=pe.get_memory_mapped_image()[ep:ep+100]
print(buffer)

it shows like buffer has nothing

b''

and I find that ep is greater than the length of pe.get_memory_mapped_image() the AddressOfEntryPoint checked in petools is same as pefile Am I wrong in something? Being so confused as a green hand. Thank you for viewing.

[erocarrera]

That should work in most cases. Have you tried with more than one PE file? is there a chance that you could share the file?