PE File sections - SizeOfRawData or VirtualSize

Question

Lately I've been messing around with PE files at my workplace and became interested in the work of the Windows' loader behind the scenes. I know that when loading a PE file, the loader needs to copy the PE sections to the allocated PE memory, some loaders commit SizeOfRawData bytes, some commit VirtualSize bytes for the section and sometimes SectionAlignment (When SizeOfRawData equals 0, for uninitialized data). My question is how can I know that SectionAlignment bytes will be enough for all the section's uninitialized data? maybe I have an uninitialized buffer that is much bigger than SectionAlignment , so how can I be sure that it won't override other sections? and I can I predict the size needed to be allocated? Can I commit VirtualSize bytes instead of SectionAlignment bytes to be safe?

Answer 1

As far as I understand it, the Windows loader does not generally copy the PE sections to the allocated PE memory . Rather, it creates a file mapping for each relevant section of the PE, each with its virtual size, and then lets the paging system bring the file content into committed memory as needed.

Section alignment normally refers to the minimum section resolution size, typically 4096 bytes (the size of a traditional memory page).

Size of raw data is the size of the data actually present in the PE image on disk for the section.