Question

I'm trying to add a new section header in the PE but I don't know how to calculate the PointerToRawData for the new section .

As I know , it should be the size of raw data + the PointerToRawData of the last section but the section's SizeOfRawData I'm adding into the PE is equal to 0 and the virtual size to 1000.

Could someone help with some tips?

Thanks in advance,

Was it helpful?

Solution

PointerToRawData is the file location of the data that belongs to this section. If your section does not have any data associated with it, it can be the same as the value for the previous section, or - I think - zero.

OTHER TIPS

please see the《Portable Executable File Format – A Reverse Engineer View》 at links follows: http://index-of.es/Windows/pe/CBM_1_2_2006_Goppit_PE_Format_Reverse_Engineer_View.pdf

It exactly says “ it is the offset from the file's beginning to the section's data. ” in it at page 18. Another useful reference is 《Microsoft Portable Executable and Common Object File Format Specification》,you can find it on Google I am also searching for this information and share this with you~ good lucks~

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top