In the section table PE tutorial it says that you can use the SizeOfHeaders member of the optional header as an offset to the section table as the section table is after the IMAGE_NT_HEADERS. Well I have found this to not point to the section table and to get to the section table I have to use SIZEOF IMAGE_NT_HEADERS, so I think the value in SizeOfHeaders also includes the section table as well.
Posted on 2001-10-28 11:40:44 by Predator
I do the "SIZEOF(IMAGE_NT_HEADERS)" as well.
Posted on 2001-10-28 12:21:11 by f0dder
Predator, you're correct. SizeOfHeaders includes the size of section table as well. Thanks for pointing it out.
Posted on 2001-11-01 08:06:25 by Iczelion