Search code examples
windowsassemblyportable-executable

ImageBase + SizeOfHeaders will jump at the section table

I was reading a tutorial on PE and it says

Go to the section table either by adding ImageBase to SizeOfHeaders

but SizeOfHeaders is

The size of all headers+section table

so if we add SizeOfHeaders to ImageBase won't we jump at the sections rather than the table?

Solution

  • SizeOfHeaders indeed is the size of the entire header, including the DOS stub.

    To get the address of the section table, first get the address of the optional header, and add FileHeader.SizeOfOptionalHeader.