PE FORMAT] -5- Section Header
参考:
PE FILEを多数のSECTION構造にした時得られる利点→安定性
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
<member>
Name
An 8-byte, null-padded UTF-8 string. There is no terminating null character if the string is exactly eight characters long. For longer names, this member contains a forward slash (/) followed by an ASCII representation of a decimal number that is an offset into the string table. Executable images do not use a string table and do not support section names longer than eight characters.
Misc.VirtualSize
The total size of the section when loaded into memory, in bytes. If this value is greater than the SizeOfRawData member, the section is filled with zeroes. This field is valid only for executable images and should be set to 0 for object files.
VirtualAddress
The address of the first byte of the section when loaded into memory, relative to the image base. For object files, this is the address of the first byte before relocation is applied.
SizeOfRawData
The size of the initialized data on disk, in bytes. This value must be a multiple of the FileAlignment member of the IMAGE_OPTIONAL_HEADER structure. If this value is less than the VirtualSize member, the remainder of the section is filled with zeroes. If the section contains only uninitialized data, the member is zero.
PointerToRawData
A file pointer to the first page within the COFF file. This value must be a multiple of the FileAlignment member of the IMAGE_OPTIONAL_HEADER structure. If a section contains only uninitialized data, set this member is zero.
Characteristics
The characteristics of the image. The following values are defined.
(sectionの属性)
Flag | Meaning |
---|---|
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. |
|
Reserved. |
|
The section contains executable code. |
|
The section contains initialized data. |
|
The section contains uninitialized data. |
|
Reserved. |
|
The section contains comments or other information. This is valid only for object files. |
|
Reserved. |
|
The section will not become part of the image. This is valid only for object files. |
|
The section contains COMDAT data. This is valid only for object files. |
|
Reserved. |
|
Reset speculative exceptions handling bits in the TLB entries for this section. |
|
The section contains data referenced through the global pointer. |
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
Align data on a 1-byte boundary. This is valid only for object files. |
|
Align data on a 2-byte boundary. This is valid only for object files. |
|
Align data on a 4-byte boundary. This is valid only for object files. |
|
Align data on a 8-byte boundary. This is valid only for object files. |
|
Align data on a 16-byte boundary. This is valid only for object files. |
|
Align data on a 32-byte boundary. This is valid only for object files. |
|
Align data on a 64-byte boundary. This is valid only for object files. |
|
Align data on a 128-byte boundary. This is valid only for object files. |
|
Align data on a 256-byte boundary. This is valid only for object files. |
|
Align data on a 512-byte boundary. This is valid only for object files. |
|
Align data on a 1024-byte boundary. This is valid only for object files. |
|
Align data on a 2048-byte boundary. This is valid only for object files. |
|
Align data on a 4096-byte boundary. This is valid only for object files. |
|
Align data on a 8192-byte boundary. This is valid only for object files. |
|
The section contains extended relocations. The count of relocations for the section exceeds the 16 bits that is reserved for it in the section header. If the NumberOfRelocations field in the section header is 0xffff, the actual relocation count is stored in the VirtualAddress field of the first relocation. It is an error if IMAGE_SCN_LNK_NRELOC_OVFL is set and there are fewer than 0xffff relocations in the section. |
|
The section can be discarded as needed. |
|
The section cannot be cached. |
|
The section cannot be paged. |
|
The section can be shared in memory. |
|
The section can be executed as code. |
|
The section can be read. |
|
The section can be written to. |