Understanding VirtualSize and SizeOfRawData in PE Section header
13 Nov
2006
13 Nov
'06
11:41 p.m.
I am trying to understand how the VirtualSize and SizeOfRawData are used in the PE Section Header when Windows loads a executable or DLL into memory. So far here is what I understand. If the VirtualSize is greater or equal to the SizeOfRawData then the loader reads N bytes of section data with N = SizeOfRawData. Yet if the SizeOfRawData is greater than VirtualSize then it was rounded up to the nearest segment so the loader reads N bytes of section data with N = VirtualSize. Is this a correct assessment of how these two variables are used? My problem is how to determine the real length of data to be read from the file. Stephen
6968
Age (days ago)
6968
Last active (days ago)
0 comments
1 participants
participants (1)
-
Stephen Torri