After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?
3
-
2how big of a gap? show some examples maybe.– Igor Skochinsky ♦Oct 1, 2017 at 19:02
-
Well, on PEview I can see that size(SizeOfRawData) of the .text section is 0x2C00 and its RVA is 0x10000, So I assume that this section will be between 0x10000 and 0x12C00, which means that the next one(.data) should start at 0x12C01, but that's not the case.– TreyOct 2, 2017 at 1:37
-
1In memory, I believe the minimum alignment is 4096 bytes (the arch page size on x86) so that sections can have different memory permissions. So I would expect the next section to start at 0x13000.– Brendan Dolan-GavittOct 2, 2017 at 4:20
Add a comment
|
1 Answer
Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by 512 bytes which is the traditional size of a disk sector (stored in IMAGE_OPTIONAL_HEADER.FileAlignment). In memory, they are usually page aligned (stored in IMAGE_OPTIONAL_HEADER.SectionAlignment). It allows the loader to apply different memory protection permissions on different sections since permissions are applied on page by page basis. Example: .text can have PAGE_EXECUTE_READ while .data might have PAGE_READONLY permission only, if .data isn't aligned, it's content that fits in the last .text's page will have PAGE_EXECUTE_READ permission instead of PAGE_READONLY.
-
1there is also a performance gain to seek to an aligned offset and read without spanning pages. Oct 6, 2017 at 16:27