Hi

in some PE there is some empty section, or zero size section that start from the same location with previous or next section, removing them using LordPE make EXE crash ? any help or clue how to fix that ?


ps:i done a search in this board using some words as "Zero section, empty section" but got not the answer for what i want. maybe i do need learm more abour the art of searching.

Thank you

maybe that section will be filled by the exe at runtime..

LordPE's PE structure editor isn't perfect. I find that you can usually fix its mistakes using 'Rebuild PE' with 'Validate' checked afterwards.

like fighter said, such sections are normally filled @runtime by the app. this is an advantage because you have fixed space and don't need to allocate new space.

Many packers e.g. Armadillo will have these sections which have 0 size on the disk, but have a virtual size in memory. They are used to contain the unpacked code in the memory. You should not remove such sections unless you are absolutely certain that your targer does not utilise them. Sections such as .bss are empty on-disk but are used to hold uninitialised data. If the section is not present, you get an exception (IPF) when the program tries to read/write to it.

Thank you all for enlighting me.
seems a need alot of things to learn!