I'm trying to add a new section header in the PE but I don't know how to calculate the PointerToRawData for the new section .

As I know , it should be the size of raw data + the PointerToRawData of the last section but the section's SizeOfRawData I'm adding into the PE is equal to 0 and the virtual size to 1000.

Could someone help with some tips?

Thanks in advance,

有帮助吗?

解决方案

PointerToRawData is the file location of the data that belongs to this section. If your section does not have any data associated with it, it can be the same as the value for the previous section, or - I think - zero.

其他提示

please see the《Portable Executable File Format – A Reverse Engineer View》 at links follows: http://index-of.es/Windows/pe/CBM_1_2_2006_Goppit_PE_Format_Reverse_Engineer_View.pdf

It exactly says “ it is the offset from the file's beginning to the section's data. ” in it at page 18. Another useful reference is 《Microsoft Portable Executable and Common Object File Format Specification》,you can find it on Google I am also searching for this information and share this with you~ good lucks~

许可以下: CC-BY-SA归因
不隶属于 StackOverflow
scroll top