Windows可执行文件的“数据目录”条目和“节头”条目之间有什么区别？

Question

I have a Windows executable .exe file. I peeked inside the file and found the Data Directory. Within it is a directory entry for Thread Local Storage . That entry specifies this:

RVA (Relative Virtual Address) of the data: 10000
Size of the data: 24

I found the Section Table in the executable and it contains a Section Header named .tls (Thread Local Storage). That header specifies this:

Pointer to the raw data: A400
Size of the raw data: 512

What is the difference between these two parts of the executable? They both seem to be talking about Thread Local Storage but they point to different places and specify different sizes.

That is just one example. Here's another example: In the Data Directory is an Import Directory and in the Section Table is a Section Header named .idata (import data). They contain seemingly conflicting values.

And there are other examples.

What is the difference between the entries in the Data Directory and the entries in the Section Table ?

Answer 1

exes are typically loaded in ram to adres 0c00400000 and further

rva adressas is an offset after that (like 0x00401000 which may be begining of code in ram is rva of 0x1000)

exes are also build from sections, those sections when loaded to ram are typicaly aligned to 4096 (to be in different ram pages) where when in exe file on disk, they are usually aligned to 512 (to save space)

so for example 0x00401007 adres in ram, will be 0x1007 in rva, and 0x207 in file... PE format some informations gives as rvas and some as a file ofsets... also sizes of data contained in that section may be given as unaligned (like say 177) and aligned (like 512), this is the same size then but one is aligned and one not..

which exact fields in pe stores info in which format is needed to be checked in pe format details (which is confusing format but after learning it shows not being so scarry)