On Mon, 2022-06-27 at 16:32 +0200, Heinrich Schuchardt wrote:
> On 6/24/22 07:32, Su, Bao Cheng wrote:
> > During PE hashing, when holes exists between sections, the extra
> > data
> > calculated could be a dupulicated region of the last section.
> >
> > Such PE image with holes existing between s
On 6/24/22 07:32, Su, Bao Cheng wrote:
During PE hashing, when holes exists between sections, the extra data
calculated could be a dupulicated region of the last section.
Such PE image with holes existing between sections may contain the
symbol table for the kernel, for example.
The Authenticod
On Fri, 2022-06-24 at 11:44 +0200, Jan Kiszka wrote:
> On 24.06.22 10:53, Heinrich Schuchardt wrote:
> > On 6/24/22 07:32, Su, Bao Cheng wrote:
> > > During PE hashing, when holes exists between sections, the extra
> > > data
> > > calculated could be a dupulicated region of the last section.
> > >
On Mon, 2022-06-27 at 06:55 +0200, Heinrich Schuchardt wrote:
> On 6/27/22 05:43, Su, Bao Cheng wrote:
> > On Fri, 2022-06-24 at 11:44 +0200, Jan Kiszka wrote:
> > > On 24.06.22 10:53, Heinrich Schuchardt wrote:
> > > > On 6/24/22 07:32, Su, Bao Cheng wrote:
> > > > > During PE hashing, when holes
On 6/27/22 05:43, Su, Bao Cheng wrote:
On Fri, 2022-06-24 at 11:44 +0200, Jan Kiszka wrote:
On 24.06.22 10:53, Heinrich Schuchardt wrote:
On 6/24/22 07:32, Su, Bao Cheng wrote:
During PE hashing, when holes exists between sections, the extra
data
calculated could be a dupulicated region of the
During PE hashing, when holes exists between sections, the extra data
calculated could be a dupulicated region of the last section.
Such PE image with holes existing between sections may contain the
symbol table for the kernel, for example.
The Authenticode_PE spec does not rule how to deal with
On 24.06.22 10:53, Heinrich Schuchardt wrote:
> On 6/24/22 07:32, Su, Bao Cheng wrote:
>> During PE hashing, when holes exists between sections, the extra data
>> calculated could be a dupulicated region of the last section.
>>
>> Such PE image with holes existing between sections may contain the
>
On 6/24/22 07:32, Su, Bao Cheng wrote:
During PE hashing, when holes exists between sections, the extra data
calculated could be a dupulicated region of the last section.
Such PE image with holes existing between sections may contain the
symbol table for the kernel, for example.
The Authenticod
8 matches
Mail list logo
