Search code examples
windowsassemblyx86windows-10portable-executable

Does the PointerToRawData entries within section headers in a PE file hold offsets in ascending order?


Does the PointerToRawData entries within section headers in a PE file hold offsets in ascending order?

Can I assume that PointerToRawData entries of section headers in a PE file hold offsets in ascending order, with respect to their ordering in the section table?

I see that the documentation says:

In an image file, the VAs for sections must be assigned by the linker so that they are in ascending order and adjacent, and they must be a multiple of the SectionAlignment value in the optional header.

However, I can't find any information regarding the PointerToRawData member?

Please, if possible, provide source of information.

Thank you.


Solution

  • Yes, the section data, what the PointerToRawData value points to, needs to be in same order as the section headers, which need to be in VA order as you noted.

    According to the Microsoft Portable Executable and Common Object File Format Specification - Revision 8.3 - February 6, 2013:

    Section Data

    [...] Section data must appear in order of the RVA values for the corresponding sections (as do the individual section headers in the section table).

    There are additional restrictions on image files if the SectionAlignment value in the optional header is less than the page size of the architecture. For such files, the location of section data in the file must match its location in memory when the image is loaded, so that the physical offset for section data is the same as the RVA.