From d6a89c8905f53ca7f6371a0882776d0fde2380d1 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Fri, 26 Sep 2025 21:45:01 -0400 Subject: [PATCH] Partially revert and clarify --- BinaryObjectScanner/Packer/PECompact.cs | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/BinaryObjectScanner/Packer/PECompact.cs b/BinaryObjectScanner/Packer/PECompact.cs index 386b08e2..c1dba8e8 100644 --- a/BinaryObjectScanner/Packer/PECompact.cs +++ b/BinaryObjectScanner/Packer/PECompact.cs @@ -23,16 +23,14 @@ namespace BinaryObjectScanner.Packer if (exe.ContainsSection("pec1", exact: true)) return "PE Compact v1.x"; - // TODO: The last 4 bytes of the PEC2 section name appear to be the version - // For v2.20 - v3.02 this value is 0 - // For internal version v20240 this is [10 4F 00 00] (20240) + // Get the .text section, if it exists + var textSection = exe.GetFirstSection(".text", exact: true); - // Get the PEC2 section, if it exists - var pec2Section = exe.GetFirstSection("PEC2", exact: false); - if (pec2Section?.PointerToRelocations == 0x32434550) + // Check for "PEC2" in the pointer to relocations + if (textSection?.PointerToRelocations == 0x32434550) { - if (pec2Section.PointerToLinenumbers != 0) - return $"PE Compact v{pec2Section.PointerToLinenumbers} (internal version)"; + if (textSection.PointerToLinenumbers != 0) + return $"PE Compact v{textSection.PointerToLinenumbers} (internal version)"; return "PE Compact v2.x (or newer)"; }