In this new version of pecheck.py, a tool to analyze PE files, overlay offset calculations are improved when a digital signature is present, and the output has changed slightly:
- the name of the export DLL is included (right before the list of exported functions)
- lists of relocation addresses are dropped
- TLS callbacks are reported
No TLS data:
TLS data present, but no callbacks:
One TLS callback:
pecheck-v0_7_10.zip (https)
MD5: D0C4332B1BD231AA131FBCDCD3BBBA33
SHA256: 0E57A50590D59321CCD0BECE0936CF9523668F86516F56F5B2A21B9DCA9B4788
Didier Stevens 