Deep Dive Into PeCoff Structure Part 2

part 1 : https://medium.com/@rootuser62/deep-dive-into-pecoff-structure-part-1-0e459a7b15e2

after read from part 1 now i write from my case which use msvc gui app x86 as example. tool use is peview and dumpbin.

this my code to test it:

now we open ida or similar disassembler to view symbol relocation address in .obj address for the string offset still 0:

now let analysis from part1 article:

1. number of section
   number of section in offset 0x3 from start file or from 0 offset, from offset we can know number of section is 6 section:

now let calculate ton of things:
end of file header = size of file header == 14
total size of section = 6 x 0x28(size section) == f0
end section header offset = 14 + f0 == 104
start 1st image section header = 14 + 28 * 0 = 14
start 2nd image section header = 14 + 28 * 1 = 3c
start 3rd image section header = 14 + 28 * 2 = 64
start 4th image section header = 14 + 28 * 3 = 8c
start 5th image section header = 14 + 28 * 4 = b4
start 6th image section header = 14 + 28 * 5 = dc
section to data offset = section header[i].pointerToRawData
relocation image = image section header[i].pointerToRelocations
characteristic = image section header[i].characteristic
symbols name = symbolStringTable + image Symbol table.first.value
start image symbol table f1 = last image section.pointerToRawData + last image section.sizeRawData
start image symbol table f2 = image file header.pointer to symbol table
number of image symbol table = image file header.number of symbol
start image symbol string table = start image symbol table + size image symbol table * number image symbol table

Get root user’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

from list formula we can get every data as need when read in link job or make own coff load tool.

now late take a look another case for global variable, i have give command global variable for instance trigger CRT$XCU section it use for global initialization for class or struct at link.exe:

and we can fin coff binary generate CERT$XC* section: