News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

simple pe

Started by ecube, December 26, 2007, 12:47:07 AM

Previous topic - Next topic

ecube

IMAGE_SECTION_HEADER STRUCT
   Name1   db       IMAGE_SIZEOF_SHORT_NAME   dub(?)   ; 8 bytes section name
   union    Misc
      PhysicalAddress    dd   ?
      VirtualSize    dd   ?   ; section size
   ends
   VirtualAddress       dd   ?   ; section RVA
   SizeOfRawData       dd   ?   ; VirtualSize round up to file alignment
   PointerToRawData    dd   ?   ; offset in file
   PointerToRelocations    dd   ?
   PointerToLinenumbers    dd   ?
   NumberOfRelocations    dw   ?
   NumberOfLinenumbers    dw   ?
   Characteristics       dd   ?   ; section attribute
IMAGE_SECTION_HEADER ENDS

how do I access the PhysicalAddress part?

MichaelW

According to this:
Quote
The next member of the IMAGE_SECTION_HEADER is a 32-bit-union of 'PhysicalAddress' and 'VirtualSize'. In an object file, this is the address the contents is relocated to; in an executable, it is the size of the contents. In fact, the field seems to be unused; There are linkers that enter the size, and there are linkers that enter the address, and I've also found a linker that enters a 0, and all the executables run like the gentle wind.

Testing an EXE linked with the Microsoft linker included in the MASM32 package, the value for the PhysicalAddress member was the virtual size. I was using a modified version of Iczelion's PE Tutorial 5, and my quick attempt to make it work for an object file failed.
eschew obfuscation

ecube

thanks MichaelW, yeah I thought the union was something special as it threw me off with testing but I accessed what I wanted with

eax=section header
mov esi,eax
assume esi:ptr IMAGE_SECTION_HEADER
mov edx,[esi].Misc.PhysicalAddress  <--- is what I was after

Appreciate your help.