CODEWITHSUNDEEP
windowsportable-executable
Idov
Idov

Reputation: 5124

The size of a PE Header

Is there a way to find out the size of a PE Header without reading all of it or the entire file?

Upvotes: 6

Views: 8701

Answers (1)

pezcode
pezcode

Reputation: 5759

You can calculate the total size of the PE header like this:

sizeof(Signature) + sizeof(FileHeader) + sizeof(OptionalHeader) + sizeof(SectionTable)

The file header always has the same size but the OptionalHeader's size can differ, as can the section table size.

The OptionalHeader's size is stored in FileHeader.SizeOfOptionalHeader, and the section table size equals FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)

And some C code:

DWORD SizeOfPEHeader(const IMAGE_NT_HEADERS * pNTH)
{
    return (offsetof(IMAGE_NT_HEADERS, OptionalHeader) + pNTH->FileHeader.SizeOfOptionalHeader + (pNTH->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)));
}

All you have to do is read the DOS header, get the PE offset (e_lfanew) and read PE.Signature + PE.FileHeader into memory. That's two reading operations of fixed size and you have all the info you need.

Upvotes: 6

Related Questions