• bobef <aasd.aasdasd.asd.ad.ad.as.d.a asdasdas.das.da.d.ad.sa.d> Jan 27 2010

bobef <aasd.aasdasd.asd.ad.ad.as.d.a asdasdas.das.da.d.ad.sa.d> writes:

Walter Bright Wrote:

 bobef wrote:
 I'm walking the PE header sections to find out the file size. I find
 the maximum PointerToRawData and add SizeOfRawData of the section to
 find where the exe ends. It works with the files I've tested. When
 compiling exe file with DMD 1.055 and -g there are additional four
 bytes after the last section. Why is that? Is SizeOfRawData wrong or
 there is something else at the end?


 
 I don't know. Could be alignment padding.


I found some article on MSDN that says that SizeOfRawData includes the
alignment padding and something other was indicating the actual size, so this
shouldn't be the case.

I do like this:

uint peFileSize(void[] data) {
	auto dos_header = cast(PIMAGE_DOS_HEADER)data;
	if(dos_header.e_magic != IMAGE_DOS_SIGNATURE) return -1;
	auto nt_header = cast(PIMAGE_NT_HEADERS)&data[dos_header.e_lfanew];
	if(nt_header.Signature != IMAGE_NT_SIGNATURE) return -1;

	uint maxpointer, exesize;
	PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(nt_header);
	for(uint i=0; i<nt_header.FileHeader.NumberOfSections; i++, section++) {
		if(section.PointerToRawData > maxpointer) {
			maxpointer = section.PointerToRawData;
			exesize = section.PointerToRawData + section.SizeOfRawData;
		}
	}
	return exesize;
}

and if I do 

exesize = section.PointerToRawData + section.SizeOfRawData +
section.SizeOfRawData%nt_header.OptionalHeader.SectionAlignment;

then I get wrong results don't know why.