Skip to content

Vftables in multiple sections not correctly parsed #3

@edeca

Description

@edeca

At present the code enforces that virtual function tables only exist in one section. Examples have been found where vftables can be found in multiple code sections. It is unknown whether this is default Delphi behaviour or a modified executable (e.g. malware).

Find an example that triggers the exception to add extra parsing.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions