Finding the start and end address of my section in PE files

NTDEV
1

Hi,

I have my own section (like .data) in my w2k driver file(.sys). From my driver code i want to know where it is loaded in memory and also the length of the section. Since this section is created by linker from 100’s of object files, it will not be easy to hard code the length.

In gcc this can be done by creating a linker script file , where i can embed the section between two variables which i designate as start and end. From the source i can access this value and find out the start and length.

Any help will be appreciated,

Thanks

Venkatesh

Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more

2

Read the PE docs. You would find these on microsoft/msdn web site. There are two good articles in msdn magazine. Here are the links for your convenience.

http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

With this information, you can get all the sections, there relative virtual addresses and sizes.

Have Fun,
-Srin.

-----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Finding the start and end address of my section in PE files

Hi,

I have my own section (like .data) in my w2k driver file(.sys). From my driver code i want to know where it is loaded in memory and also the length of the section. Since this section is created by linker from 100’s of object files, it will not be easy to hard code the length.

In gcc this can be done by creating a linker script file , where i can embed the section between two variables which i designate as start and end. From the source i can access this value and find out the start and length.

Any help will be appreciated,

Thanks

Venkatesh

Do you Yahoo!?
Yahoo! Tax http: Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com</http:>

3

All:
The API’s to access the sections in the article you had sent me are user mode API’s. My question is , I have a section in my driver file, already loaded in memory. My code wants to know where the particular section is loaded in memory and also the size ( as i said previous, there is no easy way to compute or hard code the size of my section)
Cheers,
Venkatesh
xxxxx@NAI.com wrote:Read the PE docs. You would find these on microsoft/msdn web site. There are two good articles in msdn magazine. Here are the links for your convenience. http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspxhttp://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx With this information, you can get all the sections, there relative virtual addresses and sizes. Have Fun,-Srin. -----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Finding the start and end address of my section in PE files

Hi,

I have my own section (like .data) in my w2k driver file(.sys). From my driver code i want to know where it is loaded in memory and also the length of the section. Since this section is created by linker from 100’s of object files, it will not be easy to hard code the length.

In gcc this can be done by creating a linker script file , where i can embed the section between two variables which i designate as start and end. From the source i can access this value and find out the start and length.

Any help will be appreciated,

Thanks

Venkatesh

Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com—
You are currently subscribed to ntdev as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more

4

Hey man,
What r u upto now? Have u quit ami?

How is life with a wife? Sorry, Very sorry… I missed
ur marriage completely. But ur mistake too… u
informed it very close :)-

I’m currently working on a network card used in GSM.

How about a reply :)-

Regards,
Sajeev
— Venkatesh Ramamurthy
wrote: >
> Hi,
>
> I have my own section (like .data) in my w2k driver
> file(.sys). From my driver code i want to know where
> it is loaded in memory and also the length of the
> section. Since this section is created by linker
> from 100’s of object files, it will not be easy to
> hard code the length.
>
> In gcc this can be done by creating a linker script
> file , where i can embed the section between two
> variables which i designate as start and end. From
> the source i can access this value and find out the
> start and length.
>
> Any help will be appreciated,
>
> Thanks
>
> Venkatesh
>
>
>
> ---------------------------------
> Do you Yahoo!?
> Yahoo! Tax Center - File online, calculators, forms,
> and more
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

________________________________________________________________________
Missed your favourite TV serial last night? Try the new, Yahoo! TV.
visit http://in.tv.yahoo.com

5

Forget API’s, get the load address of the driver and use the PE header structures to list the sections and get the section sizes. I was pointing at the information you could use, not the APIs. with the information in the article you could write your own code to get the information. Atleast I did.

-Srin.

-----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 11:38 AM
To: NT Developers Interest List
Cc: Kumar, Srin
Subject: [ntdev] RE: Finding the start and end address of my section in PE files

All:

The API’s to access the sections in the article you had sent me are user mode API’s. My question is , I have a section in my driver file, already loaded in memory. My code wants to know where the particular section is loaded in memory and also the size ( as i said previous, there is no easy way to compute or hard code the size of my section)

Cheers,

Venkatesh

xxxxx@NAI.com wrote:

Read the PE docs. You would find these on microsoft/msdn web site. There are two good articles in msdn magazine. Here are the links for your convenience.

http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

With this information, you can get all the sections, there relative virtual addresses and sizes.

Have Fun,
-Srin.

-----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Finding the start and end address of my section in PE files

Hi,

I have my own section (like .data) in my w2k driver file(.sys). From my driver code i want to know where it is loaded in memory and also the length of the section. Since this section is created by linker from 100’s of object files, it will not be easy to hard code the length.

In gcc this can be done by creating a linker script file , where i can embed the section between two variables which i designate as start and end. From the source i can access this value and find out the start and length.

Any help will be appreciated,

Thanks

Venkatesh

Do you Yahoo!?
Yahoo! http: Tax Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com

—
You are currently subscribed to ntdev as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

_____

Do you Yahoo!?
Yahoo! Tax http: Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></http:>

6

Srin, All:I thought about this apporach, before i decided to jump, i wanted to know whether anybody had any other good idea. ThanksVenkatesh

xxxxx@NAI.com wrote:Forget API’s, get the load address of the driver and use the PE header structures to list the sections and get the section sizes. I was pointing at the information you could use, not the APIs. with the information in the article you could write your own code to get the information. Atleast I did. -Srin.-----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 11:38 AM
To: NT Developers Interest List
Cc: Kumar, Srin
Subject: [ntdev] RE: Finding the start and end address of my section in PE files

All:
The API’s to access the sections in the article you had sent me are user mode API’s. My question is , I have a section in my driver file, already loaded in memory. My code wants to know where the particular section is loaded in memory and also the size ( as i said previous, there is no easy way to compute or hard code the size of my section)
Cheers,
Venkatesh
xxxxx@NAI.com wrote: Read the PE docs. You would find these on microsoft/msdn web site. There are two good articles in msdn magazine. Here are the links for your convenience. http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspxhttp://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx With this information, you can get all the sections, there relative virtual addresses and sizes. Have Fun,-Srin. -----Original Message-----
From: Venkatesh Ramamurthy [mailto:xxxxx@yahoo.com]
Sent: Wednesday, April 09, 2003 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Finding the start and end address of my section in PE files

Hi,

I have my own section (like .data) in my w2k driver file(.sys). From my driver code i want to know where it is loaded in memory and also the length of the section. Since this section is created by linker from 100’s of object files, it will not be easy to hard code the length.

In gcc this can be done by creating a linker script file , where i can embed the section between two variables which i designate as start and end. From the source i can access this value and find out the start and length.

Any help will be appreciated,

Thanks

Venkatesh

Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com—
You are currently subscribed to ntdev as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more — You are currently subscribed to ntdev as: xxxxx@nai.com To unsubscribe send a blank email to xxxxx@lists.osr.com—
You are currently subscribed to ntdev as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.