Log in

View Full Version : getting Virtual Size of Section in PE

Vigual
November 14th, 2009, 02:28
The structure of the Section table is
Code:
typedef struct _IMAGE_SECTION_HEADER {

  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];

  union {

    DWORD PhysicalAddress;

    DWORD VirtualSize;

  } Misc;

  DWORD VirtualAddress;

  DWORD SizeOfRawData;

  DWORD PointerToRawData;

  DWORD PointerToRelocations;

  DWORD PointerToLinenumbers;

  WORD  NumberOfRelocations;

  WORD  NumberOfLinenumbers;

  DWORD Characteristics;

}IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

I'm trying to get the value for VirtualSize but I don't know how to write this in assembly because of the Union Structure. I currently have
Code:


add ecx, [eax.IMAGE_SECTION_HEADER.VirtualSize]

but masm says that it does not recognize the VirtualSize field. How do I get it's value
Indy
November 14th, 2009, 04:35
Code:
IMAGE_SECTION_HEADER struct

    _Name			CHAR 8 dup (?)

    VirtualSize			ULONG ?

    VirtualAddress		ULONG ?

    SizeOfRawData		ULONG ?

    PointerToRawData		ULONG ?

    PointerToRelocations	ULONG ?

    PointerToLineNumbers	ULONG ?

    NumberOfRelocations		USHORT ?

    NumberOfLineNumbers		USHORT ?

    Characteristics		ULONG ?

IMAGE_SECTION_HEADER struct

PIMAGE_SECTION_HEADER typedef ptr IMAGE_SECTION_HEADER

Code:
add ecx,IMAGE_SECTION_HEADER.VirtualSize[eax]

Code:
assume eax:PIMAGE_SECTION_HEADER

add ecx,[eax].VirtualSize
evlncrn8
November 14th, 2009, 09:55
or (easier imho)

add ecx, [eax.IMAGE_SECTION_HEADER.Misc.VirtualSize]