VMProtect strips discardable section flag on protected PE files
Posted: Tue Aug 16, 2022 5:59 pm
Hello,
When using VMProtect to protect any PE file, any section marked as discardable has the flag in the PE segment header (IMAGE_SCN_MEM_DISCARDABLE) stripped after protection.
I have no options enabled in VMProtect (all protections are disabled) along with packing not being enabled.
This happens with or without strip debug information being enabled on both EXE and DLL files.
You can check this by opening up a file before/after protection into CFF explorer and seeing that segments once marked as discardable before protection are now not anymore.
Thanks!
When using VMProtect to protect any PE file, any section marked as discardable has the flag in the PE segment header (IMAGE_SCN_MEM_DISCARDABLE) stripped after protection.
I have no options enabled in VMProtect (all protections are disabled) along with packing not being enabled.
This happens with or without strip debug information being enabled on both EXE and DLL files.
You can check this by opening up a file before/after protection into CFF explorer and seeing that segments once marked as discardable before protection are now not anymore.
Thanks!