I am trying to understand how the VirtualSize and SizeOfRawData are used in the PE Section Header when Windows loads a executable or DLL into memory. So far here is what I understand. If the VirtualSize is greater or equal to the SizeOfRawData then the loader reads N bytes of section data with N = SizeOfRawData. Yet if the SizeOfRawData is greater than VirtualSize then it was rounded up to the nearest segment so the loader reads N bytes of section data with N = VirtualSize. Is this a correct assessment of how these two variables are used? My problem is how to determine the real length of data to be read from the file.
Stephen