1

Learning some nasm, and fileformats for my assembly project. I am currently very confused about SizeOfHeaders.

Taking a look at the documentation https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)?redirectedfrom=MSDN

The size of the PE header and the section (object) table. The raw data for the sections starts immediately after all the header components.

Lets take a look at another official documentation https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header32 .

The combined size of the following items, rounded to a multiple of the value specified in the FileAlignment member.

e_lfanew member of IMAGE_DOS_HEADER

4 byte signature

size of IMAGE_FILE_HEADER

size of optional header

size of all section headers

Other sources online say

The combined size of an MS‑DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.

As you can see each source is giving a different explanation of what is comprised of SizeOfHeaders.

What I've tried:

In NASM, the SizeOfHeaders could be computed as such:

dd sections_start - dos_stub_start + (FileAlignment - 1)) // FileAlignment

That would be the example of the implementation of simplest source, and one that I have used, however the second official source that I listed, specifically says the e_lfanew member of the dos header, not the whole dos stub or not any of the dos header or stub at all for the first source.

So that example may very well be incorrect. Looking online, there doesn't seem to be any conclusive information previously recorded on the internet about this issue.

J. Doe
  • 171
  • 4
  • 11
  • I can't remember the answer off the top of my head. My suggestion would be to look for a PE dump utility. For traditional reasons I personally use TDump that comes with Borland/Embarcadero dev tools, but I believe there's one from Microsoft too, and no doubt others as well. – 500 - Internal Server Error Aug 02 '23 at 00:15
  • [Last time I played with this](https://stackoverflow.com/a/65434734/2189500), I tried to use computed sizes (rather than hardcoded values) and cite my sources. FWIW. – David Wohlferd Aug 02 '23 at 06:31

1 Answers1

1

This is how I calculate value of the member SizeOfHeaders in IMAGE_OPTIONAL_HEADER:

PE executable file begins with DOS_HEADER (size 64), followed by MZ executable 16bit DOS stub file, which may have variable size.

DOS_HEADER.e_lfanew (the last DWORD) specifies file address (offset) of PE, LE or NE signature in the executable file. Adding the signature size (4) to e_lfanew value gives the offset of IMAGE_FILE_HEADER. Size of this file header is fixed (20).

File header is followed by IMAGE_OPTIONAL_HEADER with size 224 or 240 bytes for 32bit or 64bit versions.

Member IMAGE_FILE_HEADER.NumberOfSections specifies how many IMAGE_SECTION_HEADER instances follow the optional header. Each section header is 40 bytes long. Adding it all together and rounding it up to IMAGE_OPTIONAL_HEADER.FileAlignment (usually 512) gives the final value of IMAGE_OPTIONAL_HEADER.SizeOfHeaders.

A good GUI tool for inspection of 32bit COFF and PE files is PEview by W.J.Radburn.

vitsoft
  • 5,515
  • 1
  • 18
  • 31