PE文件读取c中的一节

Question

I just read one section in PE file. I have output like this:

Section Info (1 of 6)
---------------------
Section Header name :               .text
ActualSize of code or data :        0x49937
Virtual Address(RVA) :              0x1000
Size of raw data (rounded to FA) :  0x49a00
Pointer to Raw Data :               0x400
Pointer to Relocations :            0
Pointer to Line numbers :           0
Number of relocations :             0
Number of line numbers :            0
Characteristics :                   Contains executable code, Readable,

Section Info (2 of 6)
---------------------
Section Header name :               .rdata
ActualSize of code or data :        0x1ed60
Virtual Address(RVA) :              0x4b000
Size of raw data (rounded to FA) :  0x1ee00
Pointer to Raw Data :               0x49e00
Pointer to Relocations :            0
Pointer to Line numbers :           0
Number of relocations :             0
Number of line numbers :            0
Characteristics :                   Contains initialized data, Readable,

I just want to read executable sections. For example, how can read.text section?

Answer 1

Caveat: Don't know for sure, but the following is based on some [obvious] deductions...

1. In .text , the Pointer to Raw Data value is 0x400 .

2. This [probably] isn't a valid memory address. So, it's [probably] a file offset (as this is what makes sense).

3. This is further supported by the fact that the .text section Size of raw data is 0x49a00 .

4. Now, 0x400 + 0x49a00 --> 0x49e00 which is the Pointer to Raw Data value of the next section .rdata

So, if you seek the PE file to 0x400 and read 0x49a00 bytes, you'll be getting the contents of the .text section [as you desire]. That length is the rounded up length [to align to the next section's data], so a better length to read might be the ActualSize of code or data value of 0x49937

Side note: Although it's not a guarantee, the 0x400 offset of the .text section (the first section) data implies that the PE file header and all the [basic] section header structs fit in the first 0x400 (1024 decimal) bytes of the file. This is a reasonable assumption, given that PE is a simple format with a fixed number of section types (vs ELF that can have arbitrary/extensible sections).