none
Portable Executable - Importsection RRS feed

  • Question

  • Hello everybody!

    Im trying to create a PE-Disassembler. I got pretty much things allready done but i got a problem at the Dataentries listet after the COFF optional Header.

    These are (as i have seen) pairs of 4byte virtual address and 4 byte size. That acutally works great to read and after that i get sectionheaders as desired. Thats how it looks like at the moment:
    	for(UINT i = 0; i < m_optionalHeader.m_numRVA; ++i)
    	{
    		RVATableEntry rte;
    		fread(&rte, 8, 1, pFile);
    		m_rvaEntries.push_back(rte);
    	}		
    }
    
    m_sectionHeaders = new SectionHeader[m_header.m_numSections];
    for(UINT i = 0; i < m_header.m_numSections; ++i)
    {
    	fread(m_sectionHeaders + i, sizeof(SectionHeader), 1, pFile);
    }
    Ok, now, what is wierd? If i print the names of the sections i get only the following:
    .text
    .rdata
    .data
    .zdata
    .tls
    .rsrc

    But why are there no .idata and .edata even if i know that the executable is importing libraries and exporting functions (i know it becaus i compiled and coded it)?

    Greetings
    Cromon
    Sunday, November 15, 2009 11:22 PM