Memory-mapped files: Reading beyond the border

[qWord]

The file on the disk has:

At offset: 1D86049

02186049 9C                                            pushf
0218604A 50                                            push    eax
0218604B 51                                            push    ecx
0218604C 52                                            push    edx
0218604D 53                                            push    ebx
0218604E 54                                            push    esp

You got this information from a hex editor or from a debugger/disassembler?

[FlySky]

Got it with IDA Pro loading the file from my disk.

[qWord]

The relative offsets of a loaded PE are not equal to the file offsets. If you want to read or write data in a PE's section, you must parse the file header: Microsoft PE and COFF Specification

[dedndave]

here it is in PDF format
http://www.masm32.com/board/index.php?topic=13135.0