True, and since the windows kernel is page aligned that's why I haven't seen an issue. OK. I guess we need two separate get-valid pe image functions.

----- Original message -----
> > @@ -271,6 +271,117 @@
> > }
> > 
> > status_t
> > +peparse_get_valid_pe_image(
> > +       vmi_instance_t vmi,
> > +       addr_t base_paddr,
> > +       size_t len,
> > +       const uint8_t * const image)
> > +{
> > +
> > +       uint32_t nbytes = vmi_read_pa(vmi, base_paddr, (void *)image,
> > len);
> 
> Well, it all depends on where on the page you start reading :-)
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/bdpayne/libvmi/pull/13/files#r2796126