Virtual Size = Raw Size (Why?)
Posted: Sun May 17, 2009 6:09 pm
When I add a new section Stud_PE said this:
"VirtualSize must be greater or equal than raw size" Why???
This is not correct, Virtual Size can be smaller and greater than RawSize. Some compilers put the value of Virtual Size as the exact number of bytes of code.
Virtual Size may be less than Raw Size, is very normal. Virtual Size < Raw Size can help us to know where the code ends.
For example:
Image Base = 400000
Section .text
Virtual Offset = 00001000
Virtual Size = 00000076
Raw Offset = 00000200
Raw Size = 00000200
With these data, it is very possible that in the address 400000+1000+76 = 401076, no code. (address > 401076), it is possible that all the bytes are 0 (o another). vacuum source that can be used. However, (Raw Size = 200) while (Virtual Size = 76) because File Alignment=200!!!
In the above example, Virtual Size = 200, is correct but is not correct.
Un saludo.
"VirtualSize must be greater or equal than raw size" Why???
This is not correct, Virtual Size can be smaller and greater than RawSize. Some compilers put the value of Virtual Size as the exact number of bytes of code.
Virtual Size may be less than Raw Size, is very normal. Virtual Size < Raw Size can help us to know where the code ends.
For example:
Image Base = 400000
Section .text
Virtual Offset = 00001000
Virtual Size = 00000076
Raw Offset = 00000200
Raw Size = 00000200
With these data, it is very possible that in the address 400000+1000+76 = 401076, no code. (address > 401076), it is possible that all the bytes are 0 (o another). vacuum source that can be used. However, (Raw Size = 200) while (Virtual Size = 76) because File Alignment=200!!!
In the above example, Virtual Size = 200, is correct but is not correct.
Un saludo.