none
PE Image Size RRS feed

  • Question

  •  

    Hi,

     

    I'm writing a C# application that will extract data that has been appended at the end of itself. Pretty much like the old zip self extractor used to do in dos. This application will need to be aware of its own size to be able to figure out where the data begins. How can this be achieved? I've been looking at the IMAGE_COR20_HEADER structure but can't seem to find what I'm looking for. I know this is possible as I've seen other softwares that do this.

     

    Thanks

    Nic

    Wednesday, March 19, 2008 1:33 PM

Answers

  • IMAGE_COR20_HEADER is specific to managed modules. You probably want to look at IMAGE_OPTIONAL_HEADER.SizeOfImage instead.

     

     

    Wednesday, March 19, 2008 3:18 PM
    Moderator

All replies

  • IMAGE_COR20_HEADER is specific to managed modules. You probably want to look at IMAGE_OPTIONAL_HEADER.SizeOfImage instead.

     

     

    Wednesday, March 19, 2008 3:18 PM
    Moderator
  • I'm not fully aware of the details of PE files, but it may be possible that there is blank padding at the end of the file.

     

    When I implemented something like this awhile ago, I prefixed my data with a sequence of header bytes.  Then, I searched the executable for the header bytes to find out where my data was located.  The EXE file should be small enough that there is no real impact from searching the file until you find these bytes.

     

     

    Saturday, March 22, 2008 2:45 PM