filebytes icon indicating copy to clipboard operation
filebytes copied to clipboard

64 bit import thunks, cross section RVAs in import table

Open sevaa opened this issue 1 year ago • 0 comments

Addresses the issues uncovered by the binary in https://github.com/sevaa/dwex/issues/57 :

  • in PE32+, the thunks in the import lookup/address tables are 64 bit
  • the RVAs in the import table (both import directory and thunks) may be cross section
  • also, there are more 64 bit architectures than AMD64

The PE format reference doc I went by is here.

Windows Defender might complain the binary contains a virus. Nothing wrong with that binary as far as I could see.

sevaa avatar Aug 19 '24 00:08 sevaa