
----W95OSR2----
            file lastsec   phys   phys   virt   virt   file  image   ovrl
           align name      offs   size   .rva   size   size   size
; PHYSSIZE > VIRSIZE
calc.exe     200 .reloc    D600   1200  11000   1040   E800  13000      0 c
cdplayer.exe 200 .reloc   14600   1600  18000   14F4  15C00  1A000      0 c
explorer.exe 200 .reloc   2F200   3000  32000   2E64  32200  35000      0 c
iexplore.exe 200 .reloc    9400    200   C000     84   9600   D000      0 c
mplayer.exe  200 .reloc   21A00   2C00  2A000   2B80  24600  2D000      0 c
notepad.exe  200 .reloc    7C00    A00   B000    91E   8600   C000      0 c
pbrush.exe   200 .reloc    1000    200   4000     34   1200   5000      0 c
tracert.exe  200 .reloc    2000    200   4000     88   2360   5000    160 c
gdi32.dll    200 .reloc   1E800   1800  23000   17F0  20000  25000      0 c
mshtml.dll   200 .reloc   C7800   7800  CE000   763C  CF110  D6000    110 c
ole32.dll    200 .reloc   79000   5600  82000   54E4  88680  88000   A080 c
wininet.dll  200 .reloc   44000   2C00  48000   2A28  46D10  4B000    110 c
wsock32.dll  200 .reloc    FE00    A00  13000    9CE  10800  14000      0 c
----W98SE----
            file lastsec   phys   phys   virt   virt   file  image   ovrl
           align name      offs   size   .rva   size   size   size
; PHYSSIZE == VIRSIZE
calc.exe    1000 .rsrc    14000   3000  14000   3000  17000  17000      0 c
; PHYSSIZE > VIRTSIZE
cdplayer.exe1000 .reloc   18000   2000  18000   1562  1A000  1A000      0 c
explorer.exe1000 .reloc   2A000   2000  2A000   19B4  2C000  2C000      0 c
iexplore.exe 200 .rsrc     1A00   D200   4000   D030   ED10  12000    110 c
mplayer.exe 1000 .reloc   24000   3000  2A000   2B8E  27000  2D000      0 c
mspaint.exe 1000 .rsrc    3D000  17000  3E000  163E0  54000  55000      0 c
notepad.exe 1000 .reloc    D000   1000   D000    A9C   E000   E000      0 c
pbrush.exe  1000 .reloc    4000   1000   4000     34   5000   5000      0 c
tracert.exe 1000 .reloc    4000   1000   4000     D6   5000   5000      0 c
gdi32.dll   1000 .reloc   24000   2000  24000   1764  26000  26000      0 c
mshtml.dll  1000 .reloc  220000  20000 220000  1F464 240110 240000    110 c
msvcrt.dll  1000 .reloc   3E000   3000  3D000   22CC  41035  40000     35 c
ole32.dll   1000 .reloc   B8000   9000  B8000   860C  C1000  C1000      0 c
wininet.dll 1000 .reloc   6D000   4000  6D000   3A3C  71110  71000    110 c
wsock32.dll 1000 .reloc    9000   1000   9000    392   A000   A000      0 c
----NT2K----
            file lastsec   phys   phys   virt   virt   file  image   ovrl
           align name      offs   size   .rva   size   size   size
; PHYSSIZE > VIRTSIZE
; overlay = sign, certificate or something else
msvcrt.dll  1000 .reloc   44000   3000  43000   2600  48058  46000   1058 c
; overlay == some debug stuff, 110h bytes
calc.exe     200 .rsrc    13800   2C00  16000   2B98  16510  19000    110 c
cdplayer.exe 200 .rsrc    24000  2E600  26000  2E518  52710  55000    110 c
explorer.exe 200 .reloc   38200   2000  3A000   1ED8  3A310  3C000    110 c
iexplore.exe 200 .rsrc     1A00   D200   4000   D030   ED10  12000    110 c
mplay32.exe  200 .rsrc    15C00   7000  1E000   6FB0  1CD10  25000    110 c
mspaint.exe  200 .rsrc    3C600  11800  3F000  116C8  4DF10  51000    110 c
notepad.exe  200 .rsrc     7200   5400   A000   5238   C710  10000    110 c
tracert.exe  200 .rsrc     1600   1200   3000   11B8   2910   5000    110 c
gdi32.dll    200 .reloc   37C00   1600  3A000   151C  39310  3C000    110 c
mshtml.dll   200 .reloc  21FE00  1F800 223000  1F738 23F710 243000    110 c
ole32.dll    200 .reloc   E7600   A200  EA000   A168  F1910  F5000    110 c
wininet.dll  200 .reloc   6E400   3E00  70000   3CB4  72310  74000    110 c
wsock32.dll  200 .reloc    5200    200   7000     28   5510   8000    110 c
----OTHER----
            file lastsec   phys   phys   virt   virt   file  image   ovrl
           align name      offs   size   .rva   size   size   size
; PHYSSIZE > VIRTSIZE
adinf.exe    200 .rsrc    35C00  6DE00  38000  6DDD0  A3A00  A6000      0 0
avp32.exe   1000 .rsrc    29000  19000  29000  18258  42040  42000     40 0
avpi.exe     200 .rsrc    1EA00  17C00  25000  17AAC  36640  3D000     40 0
bcb.exe      200 .rsrc   201000  F6400 207000  F6400 2F7400 2FE000      0 0
excel.exe   1000 .rsrc   54A000  12000 54F000  1198C 55C000 561000      0 c
netscape.exe 200 .rsrc   4EEE00   3E00 50C000   3D40 53B270 510000  48670 c
photoshp.exe 200 .reloc  527C00  44C00 581000  44A7C 56C800 5C6000      0 c
winamp.exe  1000 .rsrc    4F000  84000  5F000  83C08  D3000  E3000      0 0
winword.exe 1000 .rsrc   506000  11000 514000  108AC 517000 525000      0 c
; PHYSSIZE < VIRTSIZE
mirc32.exe   200 .rsrc   11A000  2C400 142000  2D000 147000 16F000    C00 0
hdr.exe      200 .debug   1AC00  6F9DE  20000  6FA00  8A6DC  90000     DC c
far.exe      200 .rsrc    66200    800  72000   1000  66A20  73000     20 0
ha32.exe     200 .reloc   12A00   1600  60000   2000  14000  70000      0 0
ilink32.exe  200 .rsrc    41600    600  E5000   1000  42000  E6000    400 0
upx.exe      200 UPX2     14A00    200  35000   1000  14C00  36000      0 0
tasm32.exe   200 .reloc   29400   4600  31000   5000  2E000  36000    600 0
tlink32.exe  200 .rsrc    38600   2200  51000   3000  3B000  54000    800 0
bcc32.exe    200 .reloc   C7000   C800 119000   D000  D3800 126000      0 0
1.exe        200 .reloc     A00    200   4000   1000   1000   5000    400 0
winrar.exe   200 .rsrc    71400  19800  E2000  1A000  8AC20  FC000     20 0
drweb32w.exe 200 .data    3B400      0  B5000   1000  3B400  B6000      0 0
----ARCHIVE----
            file lastsec   phys   phys   virt   virt   file  image   ovrl
           align name      offs   size   .rva   size   size   size
; PHYSSIZE < VIRTSIZE
!drw32r.exe  200 .rsrc     E200   A200  13000   A0C0 32FCC1  1E000 3178C1 0
far164.exe   200 .rsrc    10200   1400  19000   2000  8D97B  1B000  7C37B 0
mirc57t.exe  200 .rsrc    13E00  E1E00  1C000  E2000  F6000  FE000    400 0
sfxrar.exe   200 .rsrc     3C00    A00  13000   1000   E874  14000   A274 0
sfxzip.exe   200 .rsrc     4400    A00  1B000   1000   F5AE  1C000   A7AE 0
; PHYSSIZE == VIRTSIZE
wircsrv.exe  200 .rsrc     B600   1200  12000   1200  AE5A8  14000  A1DA8 0
; PHYSSIZE > VIRTSIZE
lingvo5a.exe 200 .rsrc    40400   3C00  4A000   3A6C 154A70  4E000 110A70 0
setupins.exe 200 .rsrc     3000    800   5000    640  E5983   6000  E2183 0
si401w95.exe 200 .rsrc    15A00   A400  1B000   A2A8 594006  26000 574206 0
winace13.exe 200            400    600  3C000    444 1E6120  3D000 1E5720 0
; all VIRTSIZEs == 0, and it works
winimp11.exe 200 .rsrc     4400    800   8000      0  443AC   9000  3F7AC 0

  0/c -- pe header checksum presence
