Get proper overlay address on UPX #21

Open
opened 2026-01-29 21:16:38 +00:00 by claunia · 0 comments
Owner

Originally created by @HeroponRikiBestest on GitHub (Jan 29, 2026).

Note to self so I don't forget it later.

At the moment, some UPX executables get the wrong overlay address slightly. The OptionalHeader.SizeOfHeaders is 4096, which doesn't actually seem to be true. Going by the pointer to raw data on the sections, the actual start is at 1024. If the logic continues from this point, it gets the correct overlay address. Obviously UPX executables themselves aren't supported for decompression, but this still matters for extracting various SFX archives, since those aren't affected by the UPX compression.

File used as reference: WorldwideSoccerManager2008_dd_setup_v802.exe

Originally created by @HeroponRikiBestest on GitHub (Jan 29, 2026). Note to self so I don't forget it later. At the moment, some UPX executables get the wrong overlay address slightly. The OptionalHeader.SizeOfHeaders is 4096, which doesn't actually seem to be true. Going by the pointer to raw data on the sections, the actual start is at 1024. If the logic continues from this point, it gets the correct overlay address. Obviously UPX executables themselves aren't supported for decompression, but this still matters for extracting various SFX archives, since those aren't affected by the UPX compression. File used as reference: WorldwideSoccerManager2008_dd_setup_v802.exe
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SabreTools/SabreTools.Serialization#21