PeSection
Description
Decoded section header. PE section names are at most 8 bytes (longer names exist for object files via /N offsets into the string table, but executables don’t use them); we store them as a fixed 9-byte buffer (8 + NUL).
Usage example (Cross-references)
Usage examples (Cross-references)
- In
Pe.h:50:
u32 raw_offset; // file offset
u32 characteristics;
} PeSection;
typedef Vec(PeSection) PeSections;- In
Pe.h:52:
} PeSection;
typedef Vec(PeSection) PeSections;
///
- In
Pe.c:383:
return false;
}
PeSection s;
// 8-byte name: bytes, not a numeric, so copy + advance manually.
// IterRemainingLength >= 40 bound above proves 8 bytes are live.
- In
Pe.c:577:
}
const PeSection *pe_find_section_zstr(const Pe *self, Zstr name) {
if (!self || !name)
return NULL;- In
Pe.c:581:
return NULL;
for (size i = 0; i < VecLen(&self->sections); ++i) {
const PeSection *s = VecPtrAt(&self->sections, i);
if (ZstrCompare(s->name, name) == 0) {
return s;- In
Pe.c:589:
}
const PeSection *pe_find_section_str(const Pe *self, const Str *name) {
if (!self || !name)
return NULL;- In
Pe.c:599:
return false;
for (size i = 0; i < VecLen(&self->sections); ++i) {
const PeSection *s = VecPtrAt(&self->sections, i);
// Compute the section end in u64; u32 + u32 can wrap.
u64 vstart = (u64)s->virtual_address;- In
Pe.c:559:
}
const PeSection *s = PeFindSection(&pe, ".debug");
bool ok = s != NULL && s->virtual_address == SECTION_VA && s->raw_offset == DEBUG_RAW_OFF;
ok = ok && PeFindSection(&pe, ".nope") == NULL;- In
Pe.c:1339:
return false;
}
const PeSection *s = VecPtrAt(&pe.sections, 0);
bool ok = VecLen(&pe.sections) == 1;
ok = ok && ZstrLen(s->name) == 8;- In
Pe.c:1544:
return false;
}
const PeSection *s = PeFindSection(&pe, "ABCDEFGH");
bool ok = s != NULL && s->virtual_address == 0x2000 && s->raw_offset == 0x321;
ok = ok && PeFindSection(&pe, ".text") != NULL;
Last updated on