The result of PEView and HxD is different. Is it possible?

Viewed 195

The result of PEView and HxD is different. Is it possible? I thought it should be same because it is raw data.

In PEveiw: In PEveiw

In HxD: In HxD

1 Answers

The correct value is `F8' according to all my tools on Windows 10, including PEView 0.9.9. Are you running both tools in the exact same environment? In a VM?

F8 is part of the e_lfanew field value in the DOS header, i.e. offset to the new executable header. In layman's terms, it points to the actual NT header (IMAGE_NT_HEADERS in PEView). lfa means long file address. It is a 32-bit (DWORD) relative virtual address (RVA) value. IMAGE_NT_HEADERS is located after the DOS stub and the Rich Signature header if one exists (it does in notepad.exe).

Of interest, using PEView and notepad.exe on a Windows 7 32-bit VN, the value displayed is D8 due to a different Rich Signature header.

Related