3

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected.

The documentation says that this value can change (though I've never seen it), which would mean there were greater than of fewer than 16 entries.

Immediatly after there's a list of 16 data directories complete with names.

  1. Are these names just always the same, in that exact order?
  2. If there are fewer, will it always be whatever directories are at the end that will be missing?
  3. If there are greater than 16, what are they called?
3

In short:

  1. Yes
  2. Correct
  3. You have to have a specification to know.

The data directories are a fixed sparse array, and the meaning of each slot is defined by the specification, so (for example) the Export table is always the first entry, it can't move. If you don't have an Export table (but you do have other directories), then the Size and VirtualAddress fields will be zero.

Note that the number of directories is not fixed. Before looking for a specific directory, check the NumberOfRvaAndSizes field in the optional header.

So if the NumberOfRvaAndSizes member is 2, then you can look at the Export table and the Import table, but nothing else.

Parsers are built against the specification, so if they encounter a PE file with a NumberOfRvaAndSizes value greater than what they know about, then they don't know what the data is or how to interpret it (and no way to find out by inspecting the PE file). Same goes for any Directory that is reserved or otherwise undocumented.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.