Tutorial 5: Section Table
Tutorial 5: Section Table
Theory:
Up to this tutorial, we learned about the DOS header, the PE header. What remains is the section table. A section table is actually an array of structure immediately following the PE header. The number of the array members is determined by NumberOfSections field in the file header (IMAGE_FILE_HEADER) structure. The structure is called IMAGE_SECTION_HEADER.
IMAGE_SIZEOF_SHORT_NAME equ 8
Again, not all members are useful. I'll describe only the ones that are really important.
| Field | Meanings |
|---|---|
| Name1 | Actually the name of this field is "name" but the word "name" is an MASM keyword so we have to use "Name1" instead. This member contains the name of the section. Note that the maximum length is 8 bytes. The name is just a label, nothing more. You can use any name or even leave this field blank. Note that there is no mention of the terminating null. The name is not an ASCIIZ string so don't expect it to be terminated with a null. |
| VirtualAddress | The RVA of the section. The PE loader examines and uses the value in this field when it's mapping the section into memory. Thus if the value in this field is 1000h and the PE file is loaded at 400000h, the section will be loaded at 401000h. |
| SizeOfRawData | The size of the section's data rounded up to the next multiple of file alignment. The PE loader examines the value in this field so it knows how many bytes in the section it should map into memory. |
| PointerToRawData | The file offset of the beginning of the section. The PE loader uses the value in this field to find where the data in the section is in the file. |
| Characteristics | Contains flags such as whether this section contains executable code, initialized data, uninitialized data, can it be written to or read from. |
Now that we know about IMAGE_SECTION_HEADER structure, let's see how we can emulate the PE loader's job:
- Read NumberOfSections in IMAGE_FILE_HEADER so we know how many sections there are in the file.
- Use the value in SizeOfHeaders as the file offset of the section table and moves the file pointer to that offset.
- Walk the structure array, examining each member.
- For each structure, we obtain the value in PointerToRawData and move the file pointer to that offset. Then we read the value in SizeOfRawData so we know how many bytes we should map into memory. Read the value in VirtualAddress and add the value in ImageBase to it to get the virtual address the section should start from. And then we are ready to map the section into memory and mark the attribute of the memory according to the flags in Characteristics.
- Walk the array until all the sections are processed.
Note that we didn't make use the the name of the section: it's not really necessary.
Example:
This example opens a PE file and walks the section table, showing the information about the sections in a listview control.
Analysis:
This example reuses the code of the example in PE tutorial 2. After it verifies that the file is a valid PE, it calls a function, ShowSectionInfo.
We use edi as the pointer to the data in the PE file. At first, we initialize it to the value of pMapping which is the address of the DOS header. Then we add the value in e_lfanew to it so it now contains the address of the PE header.
Since we need to walk the section table, we must obtain the number of sections in this file. That's the value in NumberOfSections member of the file header. Don't forget that this member is of word size.
add edi,sizeof IMAGE_NT_HEADERS
Edi currently contains the address of the PE header. Adding the size of the PE header to it will make it point at the section table.
invoke DialogBoxParam, hInstance, IDD_SECTIONTABLE,NULL, addr DlgProc, edi
Call DialogBoxParam to show the dialog box containing the listview control. Note that we pass the address of the section table as its last parameter. This value will be available in lParam during WM_INITDIALOG message.
In the dialog box procedure, in response to WM_INITDIALOG message, we store the value of lParam (address of the section table) in esi, the number of sections in edi and then dress up the listview control. When everything is ready, we enter a loop which will insert the info about each section into the listview control. This part is very simple.
Put this string in the first column.
We will display the name of the section but we must convert it to an ASCIIZ string first.
invoke SendDlgItemMessage,hDlg,IDC_SECTIONLIST,LVM_INSERTITEM,0,addr lvi
We decrement the value in edi for each section processed. And we add the size of IMAGE_SECTION_HEADER to esi so it contains the address of the next IMAGE_SECTION_HEADER structure.
The steps in walking the section table are:
- Verify that the file is a valid PE
- Go to the beginning of the PE header
- Obtain the number of sections from NumberOfSections field in the file header.
- Go to the section table either by adding ImageBase to SizeOfHeaders or by adding the address of the PE header to the size of the PE header. (The section table immediately follows the PE header). If you don't use file mapping, you need to move the file pointer to the section table using SetFilePointer. The file offset of the section table is in SizeOfHeaders.(SizeOfHeaders is a member of IMAGE_OPTIONAL_HEADER)
- Process each IMAGE_SECTION_HEADER structure.
- ۰۱/۰۳/۲۱