PE Loading: What to do with resource section?When Resources of a PE file are loadedQuestions Regarding DLL Loading in a Process Address SpaceFailed to load the JNI shared Library (JDK)Discarding DLL's resource after using itWhen Resources of a PE file are loadedPE File sections - SizeOfRawData or VirtualSizeSize of exe file vs available memoryWhat parts of a PE file are mapped into memory by the MS loader?How and where is the heap allocated in regards to a portable executable on Windows NT/10?Does ELF or PE loader support sections for GPUs, or some OS have any plans in implementing this functionality?Why does a loaded PE binary need IAT?
Checkmate in 1 on a Tangled Board
How do I tell the reader that my character is autistic in Fantasy?
How do I ensure my employees don't abuse my flexible work hours policy?
Why was Pan Am Flight 103 flying over Lockerbie?
Missing root certificates on Windows Server 2016 (fresh install)
Cooking a nice pan seared steak for picky eaters
Reusable spacecraft: why still have fairings detach, instead of open/close?
Simple logic puzzle
Can I use Alchemist's fire to turn my sword into a virtual Flame Blade?
If I were to build a J3 cub twice the size of the original using the same CG would it fly?
Bin Packing with Relational Penalization
List Manipulation : a,b,c,d,e,f,g,h into a,b,c,d,e,f,g,h
Why is it important to have a receptacle next to load centers?
Compiling all Exception messages into a string
What is the proper markup for a Math operator in boldface?
Conference in Los Angeles, visa?
What European countries have secret voting within the Legislature?
How can I know if a PDF file was created via LaTeX or XeLaTeX?
Why would anyone even use a Portkey?
Can European countries bypass the EU and make their own individual trade deal with the U.S.?
A quine of sorts
Converting Geographic Coordinates into Lambert2008 coordinates
Adjective for 'made of pus' or 'corrupted by pus' or something of something of pus
I just started should I accept a farewell lunch for a coworker I don't know?
PE Loading: What to do with resource section?
When Resources of a PE file are loadedQuestions Regarding DLL Loading in a Process Address SpaceFailed to load the JNI shared Library (JDK)Discarding DLL's resource after using itWhen Resources of a PE file are loadedPE File sections - SizeOfRawData or VirtualSizeSize of exe file vs available memoryWhat parts of a PE file are mapped into memory by the MS loader?How and where is the heap allocated in regards to a portable executable on Windows NT/10?Does ELF or PE loader support sections for GPUs, or some OS have any plans in implementing this functionality?Why does a loaded PE binary need IAT?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I'm studying PE file format and how windows loads them. I already know about most sections and how they get loaded/mapped in memory. But I have no idea what happens to resource section since all addresses in there seem to be sequential and doesn't seem to need any change.
I've made a test loader that does the basic loading but the target .exe file has resources in it and they never get loaded.
windows winapi portable-executable
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
|
show 3 more comments
I'm studying PE file format and how windows loads them. I already know about most sections and how they get loaded/mapped in memory. But I have no idea what happens to resource section since all addresses in there seem to be sequential and doesn't seem to need any change.
I've made a test loader that does the basic loading but the target .exe file has resources in it and they never get loaded.
windows winapi portable-executable
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.LoadResourcenot actually load any data, but return address in memory where resource already mapped.
– RbMm
Mar 25 at 15:58
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,LoadIconand friends won't ever find the resource at expected location.
– MadZarx
Mar 25 at 17:40
1
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41
|
show 3 more comments
I'm studying PE file format and how windows loads them. I already know about most sections and how they get loaded/mapped in memory. But I have no idea what happens to resource section since all addresses in there seem to be sequential and doesn't seem to need any change.
I've made a test loader that does the basic loading but the target .exe file has resources in it and they never get loaded.
windows winapi portable-executable
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
I'm studying PE file format and how windows loads them. I already know about most sections and how they get loaded/mapped in memory. But I have no idea what happens to resource section since all addresses in there seem to be sequential and doesn't seem to need any change.
I've made a test loader that does the basic loading but the target .exe file has resources in it and they never get loaded.
windows winapi portable-executable
windows winapi portable-executable
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
asked Mar 25 at 14:55
MadZarxMadZarx
381 silver badge5 bronze badges
381 silver badge5 bronze badges
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.LoadResourcenot actually load any data, but return address in memory where resource already mapped.
– RbMm
Mar 25 at 15:58
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,LoadIconand friends won't ever find the resource at expected location.
– MadZarx
Mar 25 at 17:40
1
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41
|
show 3 more comments
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.LoadResourcenot actually load any data, but return address in memory where resource already mapped.
– RbMm
Mar 25 at 15:58
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,LoadIconand friends won't ever find the resource at expected location.
– MadZarx
Mar 25 at 17:40
1
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.
LoadResource not actually load any data, but return address in memory where resource already mapped.– RbMm
Mar 25 at 15:58
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.
LoadResource not actually load any data, but return address in memory where resource already mapped.– RbMm
Mar 25 at 15:58
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,
LoadIcon and friends won't ever find the resource at expected location.– MadZarx
Mar 25 at 17:40
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,
LoadIcon and friends won't ever find the resource at expected location.– MadZarx
Mar 25 at 17:40
1
1
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41
|
show 3 more comments
1 Answer
1
active
oldest
votes
According to PE Format
It is important to recognize that PE files are not loaded into memory as single memory mapping files.Windows loader (also known as PE loader) traverses PE files and decides which part of the file is mapped. This mapping method maps the higher offset of the file to the higher memory address. PE file structure is basically the same in disk and memory, but it is not completely copied when loaded into memory. The Windows loader decides which parts to load and which parts do not need to be loaded. Moreover, due to the inconsistency between disk alignment and memory alignment, the distribution of PE files loaded into memory will be different from that of PE files on disk.
Here is a picture :application loaded into memory
Memory mapping picture
The base address value is set by PE file itself. According to the default settings, the EXE file established by visual c++ has the base address of 00400000h and the base address of DLL file is 10000000h. However, you can change this address when creating an application by using the connector / BASE option when connecting to the application, or by setting it up through the REBASE application after linking.
In addition, this question is similar to what you asked. You can refer to it.
When Resources of a PE file are loaded
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55340622%2fpe-loading-what-to-do-with-resource-section%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
According to PE Format
It is important to recognize that PE files are not loaded into memory as single memory mapping files.Windows loader (also known as PE loader) traverses PE files and decides which part of the file is mapped. This mapping method maps the higher offset of the file to the higher memory address. PE file structure is basically the same in disk and memory, but it is not completely copied when loaded into memory. The Windows loader decides which parts to load and which parts do not need to be loaded. Moreover, due to the inconsistency between disk alignment and memory alignment, the distribution of PE files loaded into memory will be different from that of PE files on disk.
Here is a picture :application loaded into memory
Memory mapping picture
The base address value is set by PE file itself. According to the default settings, the EXE file established by visual c++ has the base address of 00400000h and the base address of DLL file is 10000000h. However, you can change this address when creating an application by using the connector / BASE option when connecting to the application, or by setting it up through the REBASE application after linking.
In addition, this question is similar to what you asked. You can refer to it.
When Resources of a PE file are loaded
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
add a comment |
According to PE Format
It is important to recognize that PE files are not loaded into memory as single memory mapping files.Windows loader (also known as PE loader) traverses PE files and decides which part of the file is mapped. This mapping method maps the higher offset of the file to the higher memory address. PE file structure is basically the same in disk and memory, but it is not completely copied when loaded into memory. The Windows loader decides which parts to load and which parts do not need to be loaded. Moreover, due to the inconsistency between disk alignment and memory alignment, the distribution of PE files loaded into memory will be different from that of PE files on disk.
Here is a picture :application loaded into memory
Memory mapping picture
The base address value is set by PE file itself. According to the default settings, the EXE file established by visual c++ has the base address of 00400000h and the base address of DLL file is 10000000h. However, you can change this address when creating an application by using the connector / BASE option when connecting to the application, or by setting it up through the REBASE application after linking.
In addition, this question is similar to what you asked. You can refer to it.
When Resources of a PE file are loaded
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
add a comment |
According to PE Format
It is important to recognize that PE files are not loaded into memory as single memory mapping files.Windows loader (also known as PE loader) traverses PE files and decides which part of the file is mapped. This mapping method maps the higher offset of the file to the higher memory address. PE file structure is basically the same in disk and memory, but it is not completely copied when loaded into memory. The Windows loader decides which parts to load and which parts do not need to be loaded. Moreover, due to the inconsistency between disk alignment and memory alignment, the distribution of PE files loaded into memory will be different from that of PE files on disk.
Here is a picture :application loaded into memory
Memory mapping picture
The base address value is set by PE file itself. According to the default settings, the EXE file established by visual c++ has the base address of 00400000h and the base address of DLL file is 10000000h. However, you can change this address when creating an application by using the connector / BASE option when connecting to the application, or by setting it up through the REBASE application after linking.
In addition, this question is similar to what you asked. You can refer to it.
When Resources of a PE file are loaded
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
According to PE Format
It is important to recognize that PE files are not loaded into memory as single memory mapping files.Windows loader (also known as PE loader) traverses PE files and decides which part of the file is mapped. This mapping method maps the higher offset of the file to the higher memory address. PE file structure is basically the same in disk and memory, but it is not completely copied when loaded into memory. The Windows loader decides which parts to load and which parts do not need to be loaded. Moreover, due to the inconsistency between disk alignment and memory alignment, the distribution of PE files loaded into memory will be different from that of PE files on disk.
Here is a picture :application loaded into memory
Memory mapping picture
The base address value is set by PE file itself. According to the default settings, the EXE file established by visual c++ has the base address of 00400000h and the base address of DLL file is 10000000h. However, you can change this address when creating an application by using the connector / BASE option when connecting to the application, or by setting it up through the REBASE application after linking.
In addition, this question is similar to what you asked. You can refer to it.
When Resources of a PE file are loaded
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
answered Mar 27 at 8:17
Strive Sun - MSFTStrive Sun - MSFT
5501 silver badge8 bronze badges
5501 silver badge8 bronze badges
add a comment |
add a comment |
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55340622%2fpe-loading-what-to-do-with-resource-section%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Doesn't it happen on demand when the program attempts to load resources?
– David Heffernan
Mar 25 at 15:21
not need any special processing. @DavidHeffernan - no, resourse mapped to memory when pe loaded.
LoadResourcenot actually load any data, but return address in memory where resource already mapped.– RbMm
Mar 25 at 15:58
@RbMm That's a yes then, the virtual memory system loads the data on page fault when first accessed
– David Heffernan
Mar 25 at 16:03
@DavidHeffernan It might not need any manual mapping if the PE is loaded at default address (0x00400000). But since the PE could load at any virtual address manually,
LoadIconand friends won't ever find the resource at expected location.– MadZarx
Mar 25 at 17:40
1
What you are talking about there is not mapping. You are talking about relocations. Resources don't need relocations. You need to read up on what mapping is.
– David Heffernan
Mar 25 at 18:41