I still see writeups treating the rich header as 'packer residue'. It is a compiler/linker fingerprint. Useful, not magic.
On a public MSVC 19.3x lab binary the @comp.id values matched the documented table. Where is the current public table people actually use?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. You wrote «I still see writeups treating the rich header as 'packer residue'». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Was this on the licensed corpus or a crackme you wrote? I still have the snapshot named reve-24-pre.
@zonedude
The screenshot is the useful part of the post. You wrote «I still see writeups treating the rich header as 'packer residue'». That is the se
I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. You wrote «I still see writeups treating the rich header as 'packer residue'». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1142.
I would have written the opposite conclusion a year ago. «PE rich header as a compiler fingerprint, not a packer» — specifically I still see writeups treating the rich header as 'packer residue'. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x140002fae in the listing.
@andrewflex
This is the kind of thread that should be a sticky and is not. You wrote «I still see writeups treating the rich header as 'packer residue'»
Please keep the hashes and drop the mystery zips. You wrote «I still see writeups treating the rich header as 'packer residue'». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 7 hours the first time.
This is the kind of thread that should be a sticky and is not. The load-bearing line: I still see writeups treating the rich header as 'packer residue'. Listing first. The decompiler invented a cast last week that hid a signed compare. Version in my shot: current lab snapshot, not last year's blog.
@white
This is the kind of thread that should be a sticky and is not. The load-bearing line: I still see writeups treating the rich header as 'pack
The screenshot is the useful part of the post. You wrote «I still see writeups treating the rich header as 'packer residue'». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. Took me 11 hours the first time.