I am currently writing GDB extensions using Python, GDB, and GEF. Due to project requirements, I need to support PE binary formats. To do this I've been using Cygwin's GDB version 8.3.1-1. Note: the current stable GEF build does not fully support Cygwin GDB and I used this feature branch https://github.com/davidhcefx/gef. So far everything is working fairly smoothly and I can run GEF in Windows via Cygwin GDB and even write my own extensions.

One of the features I'm working on is determining the load location and size of all binary segments (.text, .bss, etc) during runtime. In the Linux (ELF) world I'd generally use info proc mappings or just reference the /proc/<pid>/maps file. In Windows (PE) this of course does not work. I managed to identify the location of binary segments in memory using the maintenance info sections command.

The final bit of information that I need is the PE header itself. More specifically, I would like to know the load location of the raw binary, so I can include the PE header data and size along with the segment data and sizes. When working with 32-bit example binary, I know that the load location is at 0x400000 and in this instance the .text section starts at 0x401000. However, I cannot find a method (or command) to programmatically identify the PE header load location (I know it is 0x400000 through manual investigation).

Is there a way in GDB or GEF to determine the location and size of a PE header for a debugged process?


It occurs to me that I might could parse the PE header from the raw binary file itself, then use the AddressOfEntryPoint and BaseOfCode fields to determine the offset to the .text section (it will always be the .text section, right?). Since I know the address of the .text section I could use the offset to calculate the address of the PE header. Does this seem reasonable? Are there any edge-cases that I am not considering?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.