Click here to Skip to main content
15,885,161 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 14:21
Bram van Kampen28-Jun-17 14:21 
QuestionDisecting a PE File Pin
Bram van Kampen16-Jun-17 14:19
Bram van Kampen16-Jun-17 14:19 
AnswerRe: Disecting a PE File Pin
leon de boer17-Jun-17 3:17
leon de boer17-Jun-17 3:17 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 12:46
Bram van Kampen18-Jun-17 12:46 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 3:11
harold aptroot18-Jun-17 3:11 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 13:05
Bram van Kampen18-Jun-17 13:05 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 13:39
harold aptroot18-Jun-17 13:39 
GeneralRe: Disecting a PE File Pin
Bram van Kampen19-Jun-17 13:27
Bram van Kampen19-Jun-17 13:27 
C++

Hi,
Well I agree that section names are meaningless. and that different Compilers and Linkers have their own ways and means.
However, there must be documentation about what
C++
Kernel32::LoadLibrary(...};
and
C++
Kernel32::GetProcAddress(...)
expect a PE File to look like, and what it natively expects. It is that sort of documentation that I am after.

The Section Table still serves a useful purpose. The PE File is not a memory image of the loaded executable. Trivial areas, such as the BSS, are typically left out of the File, but included in the memory image. The Section table informs the loader where to load each section, irrespective of the Name. The User (Program Writer) may also include Zero Set named sections of interest, for instance an unlimited number of named data sections which are shared between instances (Ouch..., but apparently Allowed). After this loading the Data Directory List points indeed to the correct RVA for each item. The thing is here too, that if something is allowed by the specification, however daft, some one some where in the world may just try that at some time.

So, in essence when we get an RVA from the data directory, it appears that we have to decide whether the RVA points into a section,(in which case we need an adjustment to compensate for the loading position vs file position) or, it is an RVA into the File. To muddy the waters further, we may have absolute or relative addressing in a File. In the former case, a relocation may be applied to the RVA. To muddy it further again, DllMain() may modify a lot of daft things.

I will probably end up using LoadLibrary() to dig deeper, but, at least as a first sanity check, I need to load the file manually, if for no other reason as to investigate why for instance LoadLibrary() fails on a PE File.

Afterall, the purpose of the tool I'm trying to write is not to show that everything is working perfectly, it is to provide a rich environment in which to take things apart to get to the bottom of a problem.

Friendly thanks for your reply, Smile | :)
Bram van Kampen

GeneralRe: Disecting a PE File Pin
harold aptroot19-Jun-17 14:27
harold aptroot19-Jun-17 14:27 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan19-Jun-17 20:57
mveRichard MacCutchan19-Jun-17 20:57 
GeneralRe: Disecting a PE File Pin
Bram van Kampen29-Jun-17 12:00
Bram van Kampen29-Jun-17 12:00 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan29-Jun-17 21:28
mveRichard MacCutchan29-Jun-17 21:28 
GeneralRe: Disecting a PE File Pin
Bram van Kampen30-Jun-17 14:19
Bram van Kampen30-Jun-17 14:19 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan30-Jun-17 21:30
mveRichard MacCutchan30-Jun-17 21:30 
GeneralRe: Disecting a PE File Pin
Bram van Kampen2-Jul-17 13:26
Bram van Kampen2-Jul-17 13:26 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan2-Jul-17 21:42
mveRichard MacCutchan2-Jul-17 21:42 
QuestionStreamin proc for Rich edit Pin
ForNow16-Jun-17 9:27
ForNow16-Jun-17 9:27 
QuestionRe: Streamin proc for Rich edit Pin
David Crow16-Jun-17 17:40
David Crow16-Jun-17 17:40 
AnswerRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 15:43
ForNow17-Jun-17 15:43 
GeneralRe: Streamin proc for Rich edit Pin
David Crow17-Jun-17 16:09
David Crow17-Jun-17 16:09 
GeneralRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 16:28
ForNow17-Jun-17 16:28 
Questionikspropertset declaring variable ksps Pin
Member 1326135415-Jun-17 5:58
Member 1326135415-Jun-17 5:58 
AnswerRe: ikspropertset declaring variable ksps Pin
Richard MacCutchan15-Jun-17 6:13
mveRichard MacCutchan15-Jun-17 6:13 
GeneralRe: ikspropertset declaring variable ksps Pin
Member 1326135415-Jun-17 8:35
Member 1326135415-Jun-17 8:35 
GeneralRe: ikspropertset declaring variable ksps Pin
Richard MacCutchan15-Jun-17 8:49
mveRichard MacCutchan15-Jun-17 8:49 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.