문제

I'm trying to add a new section header in the PE but I don't know how to calculate the PointerToRawData for the new section .

As I know , it should be the size of raw data + the PointerToRawData of the last section but the section's SizeOfRawData I'm adding into the PE is equal to 0 and the virtual size to 1000.

Could someone help with some tips?

Thanks in advance,

도움이 되었습니까?

해결책

PointerToRawData is the file location of the data that belongs to this section. If your section does not have any data associated with it, it can be the same as the value for the previous section, or - I think - zero.

다른 팁

please see the《Portable Executable File Format – A Reverse Engineer View》 at links follows: http://index-of.es/Windows/pe/CBM_1_2_2006_Goppit_PE_Format_Reverse_Engineer_View.pdf

It exactly says “ it is the offset from the file's beginning to the section's data. ” in it at page 18. Another useful reference is 《Microsoft Portable Executable and Common Object File Format Specification》,you can find it on Google I am also searching for this information and share this with you~ good lucks~

라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top