Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PE-bear can’t handle the tiniest PEs from the Corkami collection #22

Open
hasherezade opened this issue Mar 30, 2022 · 1 comment
Open
Assignees
Labels
bug Something isn't working enhancement New feature or request

Comments

@hasherezade
Copy link
Owner

hasherezade commented Mar 30, 2022

PE-bear can’t handle tiny, but valid (working) PE files: 61 bytes, 97 bytes, 252 bytes and so on, while CFF Explorer handles this files correctly.

Here is a collection of valid (working) tiny PE files for testing:
https://github.com/corkami/pocs/tree/master/PE/bin

reported by PE-bear Tester via blog

@hasherezade hasherezade added the bug Something isn't working label Mar 30, 2022
@hasherezade hasherezade self-assigned this Mar 30, 2022
@hasherezade hasherezade added the enhancement New feature or request label Sep 18, 2022
@hasherezade hasherezade transferred this issue from hasherezade/pe-bear-releases Mar 4, 2023
@DrakoPensulo
Copy link

DrakoPensulo commented Sep 14, 2024

On Vista and above PE has to have at least 252 bytes (32bit) or 268 bytes (x64) to execute. https://stackoverflow.com/questions/553029/what-is-the-smallest-possible-windows-pe-executable

Version 0.7.0 does not show disassembled code for this one https://github.com/DrakoPensulo/DPE64small

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants