PDA

View Full Version : PE Section aligned


chamsy
04-15-2004, 03:05 PM
Hi,

I have read in an article that the sections in a PE file is aligned to 512 bytes.
But I don't know what this 'aligned' mean. Plz help me to understand this concept.

Thanks a lot,
Chamal.

kw
04-16-2004, 08:08 AM
Sections have an alignment value, which has to be a power of 2, and 512 is the lowest one. So valid options for alignment are 512, 1024, 2048,.. etc.
Now, what this alignment does, is make sure the section is a multiple of this alignment value. It is rounded off (upwards of course, otherwise code would get lost) to the nearest multiple of this alignment. The remaining space is filled with garbage (usually 0's).
For example, if alignment is set to 512 and your section's useful code is 1031 bytes in size.. The section would contain those 1025 bytes first, followed by 505 garbage bytes to fill it up to the nearest multiple of 512, being 3*512 = 1536.
As rough sketch, it looks like:
[CODE CODE CODE | CODE CODE CODE | CODE FILLING FILLING]
Aligning sections improves speed, because they're now made out of blocks of convenient size. Of course, the lower the alignment is (512 being the lowest), the less space gets wasted.
In the 1031 bytes example above, if the file alignment had been set to 1024, then it would have filled up the section up to 2*1024 = 2048.

Hope this helped,

KW

chamsy
04-16-2004, 12:27 PM
Hi kw,

Your explanation was so useful. Now I understand it.

Thanks a lot,
Chamal.