WATCOM compiled programs leave VirtualSize to zero which triggers the
virus check. Use SizeOfRawData instead.
diff --git a/loader/pe_image.c b/loader/pe_image.c
index 3b025b5..8775c1f 100644
--- a/loader/pe_image.c
+++ b/loader/pe_image.c
@@ -521,7 +521,7 @@
{
if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress)
continue;
- if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress+sec->Misc.VirtualSize)
+ if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress+sec->SizeOfRawData)
break;
}
if (i == nt->FileHeader.NumberOfSections)