Skip to content
This repository has been archived by the owner on Apr 27, 2023. It is now read-only.

Address of first section in Section Map substream #53

Open
ent0m0l0gist opened this issue Mar 3, 2021 · 2 comments
Open

Address of first section in Section Map substream #53

ent0m0l0gist opened this issue Mar 3, 2021 · 2 comments

Comments

@ent0m0l0gist
Copy link

The section map substream has lengths of each section, which allows us to cumulatively add and get the address of the sections.
But, the length of first section (0th) is not there.
I used to assume the length to be 0x1000, and hence, the address of first section as 0x1000.
But in some PDB files, i have seen it to be 0x2000.

Where in the PDB file is this information mentioned?

@skochinsky
Copy link

skochinsky commented Mar 3, 2021

IIRC section numbers are 1-based (CodeView convention)

@ent0m0l0gist
Copy link
Author

Thank you for pointing me to the thread.
The first section I understand is .text

If I use cvdump to view the virtual address of sections, on some files the address for .text is 0x1000 and for some it is 0x2000.

Can you help me out with where in pdb I can find this information? What is the "imagebase" for the pdb? (If that is the correct terminology)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants