Home/ Questions/Q 9034337
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T08:26:53+00:00

I’ve been trying to do this for about two days, with no success. I

  • 0

I’ve been trying to do this for about two days, with no success. I have been reading over many PE file format tutorials to no avail.

I map a 32 bit executable into memory via CreateFileMapping which works perfectly. My program then loops through the section headers, and checks the characteristics against my default characteristics (to make sure the section is executable and is code). If it is true the program returns the (PIMAGE_SECTION_HEADER) pointer to that section header (program works perfectly so far).

Now that I have the pointer, there are two specific entries to the structure that have baffled me, and that is PointerToRawData and VirtualAddress, when I cout the entries;
VirtualSize = 4096, PointerToRawData = 1536.

From what I have read in PE documentation, is that PointerToRawData is a supposed offset (RVA???) to the first byte of data in the section on disk (am I correct?), and is a multiple of a alignment value (512). The question is what do I set this value to, to obtain a pointer which I can use to access the section’s data. On a memory-mapped file would it be better to use (VirtualAddress value + the imagebase value) to find the first byte of the section?

Another point of confusion is VirtualSize vs SizeOfRawData. This has confused me because in this article – http://msdn.microsoft.com/en-us/library/ms809762.aspx, it says “The SizeOfRawData field (seems a bit of a misnomer) later on in the structure holds the rounded up value” yet my VirtualSize is greater than my SizeOfRawData value which has led to confusion on which one I should use.

The object of this program is to find the executable section (.text section) and perform a bitwise operation on all the bits in the section, and end the operation before the next section.

I don’t want it to seem like I expect a spoonfeed, I just want some clarifications.

Thank you for your time/help, it is appreciated.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I don’t happen to have the spec handy or any PE code to look at for reference (I’m writing this on my iPad from my couch 😉 but the key point to realize is that there are two modes to consider: all talk of RVAs is only relevant when the PE is mapped into memory and the alignment there is page-alignment. When you’re reading the file off disk, the offsets are file offsets and each section is using the file alignment.

    I hope this helps.

    • 0