section header location in an exe

This is a discussion on section header location in an exe within the Windows Programming forums, part of the Platform Specific Boards category; Does the following code indicate that in an exe, the section header comes after the section itself, or am I ...

  1. #1
    Registered User
    Join Date
    Aug 2011
    Posts
    385

    section header location in an exe

    Does the following code indicate that in an exe, the section header comes after the section itself, or am I missing on something? Also the value of lpFileBase is diffent from the value held in pimnth->OptionalHeader.ImageBase. Aren't they supposed to be the same??

    Code:
    #include<iostream>
    #include<Windows.h>
    #include<stdio.h>
    #include<WinNT.h>
    
    
    int main()
    {
    
    
    HANDLE  hFile,hFileMapping;
    LPVOID lpFileBase;
    LPVOID lp;
    long offset;
    
    if((hFile = CreateFile(TEXT("c:\\linked list.exe"),GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0)) == INVALID_HANDLE_VALUE)
        std::cout<<"unable to open";
    
    if((hFileMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL)) == 0)
    {
        CloseHandle(hFile);
        std::cout<<"unable to open for mapping";
    }
    
    if((lpFileBase = MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0))== 0)
    {
        CloseHandle(hFile);
        CloseHandle(hFileMapping);
        std::cout<<"couldn't map view of file";
    }
    
    PIMAGE_DOS_HEADER pimdh;
    pimdh = (PIMAGE_DOS_HEADER)lpFileBase;
    
    PIMAGE_NT_HEADERS pimnth;
    pimnth = (PIMAGE_NT_HEADERS)(pimdh->e_lfanew + (char *)lpFileBase);
    
    
    PIMAGE_SECTION_HEADER pimsh;
    pimsh = (PIMAGE_SECTION_HEADER)(pimnth + 1);
    
    
    
    printf("Address of section header:%x\n",pimsh);
    
    for(int i = 0; i<pimnth->FileHeader.NumberOfSections; i++)
    {
        if(!strcmp((char *)pimsh->Name,".text"))
        {
            printf("Virtual Address:%x\n\n\n",pimsh->VirtualAddress);
        }
        pimsh++;
    }
    
    }

  2. #2
    Super Moderator VirtualAce's Avatar
    Join Date
    Aug 2001
    Posts
    9,598
    The PE file format and header are well documented on MSDN.

  3. #3
    Registered User
    Join Date
    Aug 2011
    Posts
    385
    Quote Originally Posted by VirtualAce View Post
    The PE file format and header are well documented on MSDN.

    but they don't tell you whether the actual sections come after the section header or before it. From the program above, the address of the section header appears to be greater than the virtual address of the section. So does that mean that the section header comes after the section itself?

  4. #4
    - - - - - - - - oogabooga's Avatar
    Join Date
    Jan 2008
    Posts
    2,808
    You've added the file base to one value but not to the other. Presumably it should be added to both.
    The cost of software maintenance increases with the square of the programmer's creativity. - Robert D. Bliss

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Replies: 5
    Last Post: 11-22-2011, 07:51 AM
  2. location of header file definitions
    By NuNn in forum C Programming
    Replies: 4
    Last Post: 03-25-2009, 10:26 AM
  3. Header file location confusion
    By Pele in forum C Programming
    Replies: 6
    Last Post: 09-13-2006, 04:16 PM
  4. Need help with section of Code
    By Harkin1987 in forum C Programming
    Replies: 9
    Last Post: 08-27-2006, 02:55 PM
  5. MSVC getline() header location?
    By Hunter2 in forum C++ Programming
    Replies: 3
    Last Post: 08-14-2004, 01:01 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21