4

I'm writing a program in C# where I read a PE's bytes. But in order to get the RVA I need to use the sections headers. I'd like to know what the maximum number of sections headers is?

I tried Google and I've looked here but I haven't found anything that could point me in the right direction

Thanks.

old_timer
  • 69,149
  • 8
  • 89
  • 168
Jevgeni Geurtsen
  • 3,133
  • 4
  • 17
  • 35
  • 1
    Why would you need to know the max? Read the actual value and use it. It's not 1989, you can allocate memory dynamically and don't have to reserve it for the worst case. – Igor Skochinsky Jul 04 '13 at 13:22

2 Answers2

5

Since the number of sections is stored in a 16bit integer, the most sections there could ever possibly be is 65535. On XP, programs with more than 96 sections will not run. On Vista and W7, you can use all 65535 sections and the program will still run. Other limits may exist on other operating systems.

harold
  • 61,398
  • 6
  • 86
  • 164
0

You must read the PE header. You can find a description here or you can download a full description from MSDN

Basically you must read the MZ header and after that the PE header. The number of sections is written there, so you can not simply say there are N sections in an average executable.

A rather good introduction, along with some sample code can be found here as well.

Devolus
  • 21,661
  • 13
  • 66
  • 113
  • 1
    I already written the part where it reads the FileHeader for NumberOfSections, I just need to know if there is some value I can compare it with? For example, that it would never exceed 20 sections headers? – Jevgeni Geurtsen Jul 04 '13 at 10:36
  • 1
    You shouldn't rely on such an arbitrary limit. The number of sections is written there, so this is what you should work with. – Devolus Jul 04 '13 at 10:38
  • 1
    @HenkdeVries there are programs that use 65535 sections. Not many I grant you, but there exists at least one that I know of. – harold Jul 04 '13 at 11:12
  • 1
    @harold, I was already wondering how you knew that XP had this limit. :) Which program would that be? – Devolus Jul 04 '13 at 11:13
  • 1
    @Devolus a program from corkami's test set of "unusual pe files", so maybe it doesn't count :) – harold Jul 04 '13 at 11:22