Fix PE-executable file

Question

will say that I loaded the PE executable into memory and picked it up with dos, nt header structures, and now I want to know its offset .text / code segement (not VA) offset + size, how to do this? is there a win32 api to search for the start offset .text or maybe a pointer from sturcture which indicates the offset of the beginning of this segment

thanks.

Answer 1

IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER have some of this information. You can get them using the GetNTHeaders () function. From there you can get the title of the first section with IMAGE_FIRST_SECTION (pNtHeaders). Section headings are consistent and contain all the information you are interested in. The file header contains the number of sections.

Answer 2

Yes, see Peering Inside PE: Win32 Portable Executable Overview .

Answer 3

Try using the PE File Format DLL to get the information. The full source code with a non-GPL cover, so you can use it in your commercial project just fine.

A PE File Explorer is also available (with source) to show you how to use the DLL. about