flat assembler
Message board for the users of flat assembler.

Index > Windows > VirtualSize and SizeofRawData

Thread Post new topic Reply to topic

Joined: 08 Feb 2005
Posts: 2
ambassador 08 Feb 2005, 00:24
I'm working about PE on those days and I have some troubles

1) How can be VirtualSize greater than SizeofRawData. SizeofRawData is still rounded with FileAlignment.

2) What is the different of FileAlignment and SectionAlignment exactly. And why sectionalignment must be greater or equal to File Alignment.

might anybody help me for those problem.Thans a lot.
Post 08 Feb 2005, 00:24
View user's profile Send private message Reply with quote

Joined: 09 Jan 2004
Posts: 173
Location: Ru#27
S.T.A.S. 09 Feb 2005, 13:26
Well, this is rather hard to explain by couple of words..
so, oversimplified and perhaps not 100% correct:

The smallest addressable part of a disk is sector, and its size is 512Kb. Two section can't be placed in one sector (this is OS' memory manager restriction), that's why FileAlignment should be a power of 2 between 512 and 64K inclusive. And SizeofRawData actually depends on size of sector, too (FileAlignment is just to abstrac from hardware).

When file is mapped to memory, each section should fit one or more pages (because each section may have different attributes) and page size on x86 windos is 4K. That's why SectionAlignment is usually greater than FileAlignment (and is equal to 4K Smile)
(if PE is a kernel mode driver, 512-byte SectionAlignment is also available, since kernel may have different memory model (4Mb pages), so its possible to put many section in one page anyway)
Post 09 Feb 2005, 13:26
View user's profile Send private message Reply with quote

Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend 09 Feb 2005, 15:17
Default values for alignments are:

FileAlignment = 200h
SectionAlignment = 1000h

Now you see why VirtualSize is larger. Let's say we have 496h bytes in a section. Then in a file it'll be padded to 600h (600h mod 200h == 0) and in memory it'll be padeed to 1000h (1000h mod 200h == 0).

You can change values of alignments manually, but the new values must be multiplies of primary one, and cannot be less than it. For example for FilAlignment it can be 200h, 400h, ..., 1000h, even 0A00000h.

Drivers can also have alignment that is a multiply of 2 (at least I know it about FileAlignment). But remember that it is only up to drivers.

There's also one thing you should know. Every last section in a PE file doesn't need to be aligned. It is well loaded on all win version although it's not specified and theoretically it's incorrect. Some PE-packers use such trick
Post 09 Feb 2005, 15:17
View user's profile Send private message Visit poster's website Reply with quote

Joined: 08 Feb 2005
Posts: 2
ambassador 10 Feb 2005, 10:10
Thanks a lot for your interest. I read some documents, article (from microsoft). I saw in several documents the reason of the difference with virtual size and sizeofrawdata is the events in the running time. So, creating dynamic arrays or some memory reservation. Can that be true ? Because I read from microsof PECOFF document "If sizeofrawdata is less than VirtualSize the remainder of the section is zero filled". So if we do that I think the dynamic array or another memory rezervation aren't be happy. Am I missing somethink ?
Post 10 Feb 2005, 10:10
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum

Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.