CODEWITHSUNDEEP
windowsexeportable-executable
IBreakThingsElegantly
IBreakThingsElegantly

Reputation: 1147

In a windows pe(exe,sys,dll etc) file how is the size of initialized data calculated

I would think the size of initialized data field located in a pe file's optional header would be the size of all initialized data sections rounded up to the nearest file alignment just how the size of code field is calculated. When trying to calculate the size of initialized data by adding sections marked as containing initialized data it never adds up correctly. How exactly is the size calculated?

Upvotes: 0

Views: 491

Answers (1)

IBreakThingsElegantly
IBreakThingsElegantly

Reputation: 1147

After testing a couple things so far I have seen this to hold true. If the section is marked to contain initialized data add either the virtual size rounded to the nearest file alignment multiple or the raw data size which ever is greater and the total should add up to the amount in the initialized data section. Confirmed for 4 dll files so far

Upvotes: 3

Related Questions