I am reading this article and I can't understand what is the diffence between the VirtualAddress and PointerToRawData fields of IMAGE_SECTION_HEADER structure in a Portable Executable?? Why do we have these two different fields anyways, and what do they really mean??
Suppose you only had VirtualAddress. In that case, the file would have to contain padding in order to place sections at the proper virtual addresses. Not all executables are packed full of initialized data. Sometimes there may be big blocks of uninitialized data as well. It would be wasteful to store, say, 8 megabytes of zeros in an executable just to avoid the need for a PointerToRawData field in the header.
Code://try //{ if (a) do { f( b); } while(1); else do { f(!b); } while(1); //}
