Search code examples
cbinaryfilesportable-executableida

Finding the raw offset of .text section in a PE file

In IDA the .text section begins at 0x01001630.

In the file, these bytes are located at a raw offset of 0xA30.

The PointerToRawData field in the Section Table for the .text segment is 0x400, which is the distance between 0xA30 and 0x630.

I'm not sure how to get 0xA30 from the file headers of a PE file. Any help is appreciated.

Solution

  • The first 0x630 bytes of the .text section is the IAT (import address table) which IDA has converted to a new section .idata:

    1000 [     630] RVA [size] of Import Address Table Directory

Name   Start    End      
----   -----    ---      
HEADER 01000000 01001000 
.idata 01001000 01001630   <- added by IDA
.text  01001630 01054000 
.idata 01054000 01054004   <- added by IDA
.data  01054004 01059000

    If you uncheck [x] Make imports segment in the initial load dialog, you'll get the unmodified section table:

    Name   Start    End      
----   -----    ---      
HEADER 01000000 01001000 
.text  01001000 01054000 
.data  01054000 01059000