CODEWITHSUNDEEP
windowsassemblywindows-10portable-executable
Shuzheng
Shuzheng

Reputation: 13830

PE: Relation between SizeOfRawData and VirtualSize fields of the section header

I see that for sections in image files the VirtualSize field is the total size of the section when loaded into memory, while the SizeOfRawData field is the size of the section's initialized data on disk.

While examining an .idata section, the VirtualSize field was set to 0x14, while the SizeOfRawData field was set to 0x400.

Why would the linker - in this case MinGW ld - make the file section so large, while the section when loaded into memory is only a fraction it's size?

Also, what is the purpose of the VirtualSize field? Why not always load the whole section, i.e. load the SizeOfRawData bytes?

I don't see a description or their relation in the official PE documentation.

Upvotes: 6

Views: 3871

Answers (1)

RbMm
RbMm

Reputation: 33706

SizeOfRawData(size of raw data sections in the image file) is always multiple IMAGE_OPTIONAL_HEADER.FileAlignment

FileAlignment

The alignment of the raw data of sections in the image file, in bytes. The value should be a power of 2 between 512 and 64K (inclusive). The default is 512. If the SectionAlignment member is less than the system page size, this member must be the same as SectionAlignment.

the purpose of the VirtualSize field is how many memory need allocate and copy for section. without this field how loader can know this ?

VirtualSize can be more or less than SizeOfRawData.

we for example can have only several bytes of initialized actual data in section and no uninitialized data - so VirtualSize will be only several bytes size, while SizeOfRawData 512 bytes

in another case in .data or .bss section - can be no initialized data at all (so SizeOfRawData == 0) but VirtualSize != 0.

so loader is allocate (VirtualSize + SectionAlignment - 1) & ~(SectionAlignment-1) bytes for section and copy min(VirtualSize, SizeOfRawData) bytes to it from file

Upvotes: 8

Related Questions