Hello,
I’ve noticed something interesting.
If I extract a module - at its top level - using “Extract as-is” - I get a 4K file (approx) (an .ffs file).
If I extract the module’s main body, by using “Extract body” on the PE32 Executable section, I get a 8K file (approx) (a .bin file).
Which is strange, b/c the .ffs file of the module seems to contain the PE32 Executable section, but yet it’s smaller…
(I’ve confirmed this: I can extract a module using “Extract as-is” to an .ffs file, then use “Replace as-is” to drop it in place of a different module, then use “Extract body” to extract he PE32 Executable body from it, and it will be the body of the module that I had originally extracted.)
Why is the.ffs file half the size of the .bin file???
I thought it might be compression, but I don’t think so, b/c I can see the GUID in the .ffs file, unencoded, right at the top, and then the GUID of the “GUID defined” section ~100 bytes down.
Thanks!