VMProtect strips discardable section flag on protected PE files

Issues related to VMProtect
Post Reply
3dsboy08
Posts: 8
Joined: Sat Aug 03, 2019 2:54 pm

VMProtect strips discardable section flag on protected PE files

Post by 3dsboy08 »

Hello,

When using VMProtect to protect any PE file, any section marked as discardable has the flag in the PE segment header (IMAGE_SCN_MEM_DISCARDABLE) stripped after protection.

I have no options enabled in VMProtect (all protections are disabled) along with packing not being enabled.

This happens with or without strip debug information being enabled on both EXE and DLL files.

You can check this by opening up a file before/after protection into CFF explorer and seeing that segments once marked as discardable before protection are now not anymore.

Thanks!
Admin
Site Admin
Posts: 2566
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: VMProtect strips discardable section flag on protected PE files

Post by Admin »

When using VMProtect to protect any PE file, any section marked as discardable has the flag in the PE segment header (IMAGE_SCN_MEM_DISCARDABLE) stripped after protection.
Are you sure?
Post Reply