Thread: section header location in an exe

Does the following code indicate that in an exe, the section header comes after the section itself, or am I missing on something? Also the value of lpFileBase is diffent from the value held in pimnth->OptionalHeader.ImageBase. Aren't they supposed to be the same??

Code:

#include<iostream>
#include<Windows.h>
#include<stdio.h>
#include<WinNT.h>


int main()
{


HANDLE  hFile,hFileMapping;
LPVOID lpFileBase;
LPVOID lp;
long offset;

if((hFile = CreateFile(TEXT("c:\\linked list.exe"),GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0)) == INVALID_HANDLE_VALUE)
    std::cout<<"unable to open";

if((hFileMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL)) == 0)
{
    CloseHandle(hFile);
    std::cout<<"unable to open for mapping";
}

if((lpFileBase = MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0))== 0)
{
    CloseHandle(hFile);
    CloseHandle(hFileMapping);
    std::cout<<"couldn't map view of file";
}

PIMAGE_DOS_HEADER pimdh;
pimdh = (PIMAGE_DOS_HEADER)lpFileBase;

PIMAGE_NT_HEADERS pimnth;
pimnth = (PIMAGE_NT_HEADERS)(pimdh->e_lfanew + (char *)lpFileBase);


PIMAGE_SECTION_HEADER pimsh;
pimsh = (PIMAGE_SECTION_HEADER)(pimnth + 1);



printf("Address of section header:%x\n",pimsh);

for(int i = 0; i<pimnth->FileHeader.NumberOfSections; i++)
{
    if(!strcmp((char *)pimsh->Name,".text"))
    {
        printf("Virtual Address:%x\n\n\n",pimsh->VirtualAddress);
    }
    pimsh++;
}

}

The PE file format and header are well documented on MSDN.

Originally Posted by VirtualAce

The PE file format and header are well documented on MSDN.

but they don't tell you whether the actual sections come after the section header or before it. From the program above, the address of the section header appears to be greater than the virtual address of the section. So does that mean that the section header comes after the section itself?