79422883

Date: 2025-02-08 09:04:55
Score: 2
Natty:
Report link

Take a look for Why is it said that IMAGE_OPTIONAL_HEADER doesn't have a fixed size?

Why would you compare SizeOfOptionalHeader instead of using OptionalHeader.Magic? because of this comment:

This is stated in the documentation for IMAGE_OPTIONAL_HEADER32 and IMAGE_OPTIONAL_HEADER64: "The number of directories is not fixed. Check the NumberOfRvaAndSizes member before looking for a specific directory." So, while the struct has a fixed size, the header does not

So you shouldn't compare using SizeOfOptionalHeader, instead comparing by OptionalHeader.Magic.

Reasons:
  • RegEx Blacklisted phrase (1.5): fixed size?
  • Has code block (-0.5):
  • Contains question mark (0.5):
  • Low reputation (0.5):
Posted by: winapiadmin