Section Headers

The Section Headers follow immediately after the Optional Header, and contain information about the various sections of the PE file.

PE Section Table

Each section has a corresponding Section Header. Taken together, the Section Headers comprise the Section Table, with each row of the Section Table containing a Section Header.

The following image shows the Section Table of a PE file, with each row corresponding to a Section Header:

PE file Section Table as seen in PE-Bear.
Fig 1: The Section Table as seen in PE-Bear.

Note that each Section Header corresponds to a section in the PE: .text, .rdata, .data. .pdata, .rsrc, .reloc.

Section Header Struct

Each Section header has the following structure:

typedef struct _IMAGE_SECTION_HEADER {
  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];
  union {
    DWORD PhysicalAddress;
    DWORD VirtualSize;
  } Misc;
  DWORD VirtualAddress;
  DWORD SizeOfRawData;
  DWORD PointerToRawData;
  DWORD PointerToRelocations;
  DWORD PointerToLinenumbers;
  WORD  NumberOfRelocations;
  WORD  NumberOfLinenumbers;
  DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

Section Header Elements

Name

The first member of the Section Header is the name of the section. It’s actually a byte array with a size of IMAGE_SIZEOF_SHORT_NAME, which is set to 8, meaning that the maximum number of allowed characters is 8.

PhysicalAddress/VirualSize

The size of the section when it’s in memory.

VirtualAddress

The offset to the start of the section in memory.

SizeOfRawData

The size of the section on disk. Must be a multiple of the FileAlignment member of the Optional Header, i.e. IMAGE_OPTIONAL_HEADER.FileAlignment.

PointerToRawData

File pointer to the first page of the section.

PointerToRelocations

File pointer to the beginning of the relocation entries for the section.

PointerToLinenumbers

File pointer to the beginning of the line-number entries for the section

NumberOfRelocations

The number of relocation entries. For executables, this is set to zero (0).

NumberOfLinenumbers

Number of line-number entries for the section. This is no longer used and is set to zero (0).

Characteristics

A DWORD that uses flags to signal various characteristics of the PE. For reference, the following table shows the defined flags:

FlagNameMeaning
0x00000000Reserved.
0x00000001Reserved.
0x00000002Reserved.
0x00000004Reserved.
0x00000008IMAGE_SCN_TYPE_NO_PADThe section should not be padded to the next boundary. This flag is obsolete and was replaced by IMAGE_SCN_ALIGN_1BYTES.
0x00000010Reserved.
0x00000020IMAGE_SCN_CNT_CODEThe section contains executable code.
0x00000040IMAGE_SCN_CNT_INITIALIZED_DATAThe section contains initialized data.
0x00000080IMAGE_SCN_CNT_UNINITIALIZED_DATAThe section contains uninitialized data.
0x00000100IMAGE_SCN_LNK_OTHERReserved.
0x00000200IMAGE_SCN_LNK_INFOThe section contains comments or other information. Valid only for object files.
0x00000400Reserved.
0x00000800IMAGE_SCN_LNK_REMOVEThe section will not become part of the image. Valid only for object files.
0x00001000IMAGE_SCN_LNK_COMDATThe section contains COMDAT data. Valid only for object files.
0x00002000Reserved.
0x00004000IMAGE_SCN_NO_DEFER_SPEC_EXCReset speculative exceptions handling bits in the TLB entries for this section.
0x00008000IMAGE_SCN_GPRELThe section contains data referenced through the global pointer.
0x00010000Reserved.
0x00020000IMAGE_SCN_MEM_PURGEABLEReserved.
0x00040000IMAGE_SCN_MEM_LOCKEDReserved.
0x00080000IMAGE_SCN_MEM_PRELOADReserved.
0x00100000IMAGE_SCN_ALIGN_1BYTESAlign data on a 1-byte boundary. Valid only for object files.
0x00200000IMAGE_SCN_ALIGN_2BYTESAlign data on a 2-byte boundary. Valid only for object files.
0x00300000IMAGE_SCN_ALIGN_4BYTESAlign data on a 4-byte boundary. Valid only for object files.
0x00400000IMAGE_SCN_ALIGN_8BYTESAlign data on a 8-byte boundary. Valid only for object files.
0x00500000IMAGE_SCN_ALIGN_16BYTESAlign data on a 16-byte boundary. Valid only for object files.
0x00600000IMAGE_SCN_ALIGN_32BYTESAlign data on a 32-byte boundary. Valid only for object files.
0x00700000IMAGE_SCN_ALIGN_64BYTESAlign data on a 64-byte boundary. Valid only for object files.
0x00800000IMAGE_SCN_ALIGN_128BYTESAlign data on a 128-byte boundary. Valid only for object files.
0x00900000IMAGE_SCN_ALIGN_256BYTESAlign data on a 256-byte boundary. Valid only for object files.
0x00A00000IMAGE_SCN_ALIGN_512BYTESAlign data on a 512-byte boundary. Valid only for object files.
0x00B00000IMAGE_SCN_ALIGN_1024BYTESAlign data on a 1024-byte boundary. Valid only for object files.
0x00C00000IMAGE_SCN_ALIGN_2048BYTESAlign data on a 2048-byte boundary. Valid only for object files.
0x00D00000IMAGE_SCN_ALIGN_4096BYTESAlign data on a 4096-byte boundary. Valid only for object files.
0x00E00000IMAGE_SCN_ALIGN_8192BYTESAlign data on a 8192-byte boundary. Valid only for object files.
0x01000000IMAGE_SCN_LNK_NRELOC_OVFLThe section contains extended relocations. See the Microsoft documentation for more information.
0x02000000IMAGE_SCN_MEM_DISCARDABLEThe section can be discarded as needed.
0x04000000IMAGE_SCN_MEM_NOT_CACHEDThe section cannot be cached.
0x08000000IMAGE_SCN_MEM_NOT_PAGEDThe section cannot be paged.
0x10000000IMAGE_SCN_MEM_SHAREDThe section can be shared in memory.
0x20000000IMAGE_SCN_MEM_EXECUTEThe section can be executed as code.
0x40000000IMAGE_SCN_MEM_READThe section can be read.
0x80000000IMAGE_SCN_MEM_WRITEThe section can be written to.
Scroll to Top