|
-
December 19th, 2003, 05:12 PM
#13
Member
Just a quick note on WFP. To my understanding the WFP calculates the file checksum and verifies it against the checksum located in the header of the PE file.
So in order to make WFP happy, whenever you alter a PE file(.dll .sys .exe..), call the
MapFileAndCheckSum() function located in imagehlp.dll this will give you a new file checksum. Then open the PE file in hex editor and replace the checksum. Replacing the checksum value located in the header will not alter the checksum of the PE file. I tried this on XP and w2k.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|