0

After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?

  • 2
    how big of a gap? show some examples maybe. – Igor Skochinsky Oct 1 '17 at 19:02
  • Well, on PEview I can see that size(SizeOfRawData) of the .text section is 0x2C00 and its RVA is 0x10000, So I assume that this section will be between 0x10000 and 0x12C00, which means that the next one(.data) should start at 0x12C01, but that's not the case. – Trey Oct 2 '17 at 1:37
  • 1
    In memory, I believe the minimum alignment is 4096 bytes (the arch page size on x86) so that sections can have different memory permissions. So I would expect the next section to start at 0x13000. – Brendan Dolan-Gavitt Oct 2 '17 at 4:20
5

Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by 512 bytes which is the traditional size of a disk sector (stored in IMAGE_OPTIONAL_HEADER.FileAlignment). In memory, they are usually page aligned (stored in IMAGE_OPTIONAL_HEADER.SectionAlignment). It allows the loader to apply different memory protection permissions on different sections since permissions are applied on page by page basis. Example: .text can have PAGE_EXECUTE_READ while .data might have PAGE_READONLY permission only, if .data isn't aligned, it's content that fits in the last .text's page will have PAGE_EXECUTE_READ permission instead of PAGE_READONLY.

  • 1
    there is also a performance gain to seek to an aligned offset and read without spanning pages. – peter ferrie Oct 6 '17 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.