PE
In memory and its difference from a file on disk

So far we have talked about Private Memory Image-backed Memory and VAD

Now we want to see what happens to a Windows executable file when it enters memory and why the version in memory is usually not the same as the version on disk

First, let's see what PE is

The main executable format of many Windows programs is PE or Portable Executable

Consider files like these:

program.exe
library.dll

The general structure of a PE file is approximately as follows:

PE File
│
├── DOS Header
├── PE Signature
├── COFF File Header
├── Optional Header
├── Section Headers
│
├── .text
├── .rdata
├── .data
├── .pdata
└── Other Sections

Not all files necessarily have all of these sections, and their order and details may also vary

Each section has specific information, and Windows uses the PE structure to recognize and load the executable file. Uses

What happens when PE enters Memory?

Suppose this file is on disk:

C:\Program Files\App\program.exe

When Windows runs it, the operating system Loader performs the upload process

Simple view:

PE File on Disk
|
v
Windows Loader
|
v
Virtual Address Space
|
v
Program Execution

But the point is that Windows usually does not copy the file into memory as a raw, unmodified piece

The Loader must process the file structures and place the different parts in the appropriate places

The difference between Raw Offset and RVA

Here we come to one of the basic concepts

Raw Offset

Is the address used to find the information inside the file itself on the disk

For example:
File Offset = 0x600

That is, the desired information starts from Offset equal to 0x600 in the file

RVA
is the abbreviation for this phrase:

RVA = Relative Virtual Address

That is, the address of a section relative to ImageBase in the virtual address space

For example:

ImageBase = 0x140000000

RVA = 0x2000

In this example:

VA = ImageBase + RVA

So:

VA = 0x140002000

This calculation calculates the desired virtual address It is obtained provided that we use the actual
ImageBase
of the loaded Image

The main difference

Raw Offset
|
+--> Location in the file on disk

RVA
|
+--> Location relative to
ImageBase
in the virtual address space

Raw Offset and RVA are not necessarily equal
To convert between them, we must also consider the relevant Section information such as
PointerToRawData and VirtualAddress

In addition, not all virtual addresses
necessarily correspond to a section of the data in the file, for example, a section in memory may be larger than its corresponding raw data

ImageBase

Each Image in the uploaded state has a Base Address, which we call ImageBase

For example:

Preferred ImageBase:
0x140000000

This address is the preferred location defined for loading the Image in the PE file

But Windows does not always have to place the Image exactly there

Why?

Because that range of virtual address space may not be available or there may be other conditions

In this situation, the Image may be loaded to another address

Here we go to the next concept

Base Relocation

Suppose the program expects the Image to be located at this address:

Preferred Base = 0x140000000

But in practice it is uploaded to another address:

Actual Base = 0x180000000

The difference between these two addresses:

Delta = Actual Base - Preferred Base

If the Image needs Relocation and the necessary information is available, the Loader uses the Relocation information to correct the addresses dependent on the loading location

We call this process Base Relocation

The important point is that not all addresses in the file require Relocation, only those that are dependent on the loading location according to the PE structure and have appropriate Relocation information must be corrected

What does Import Table
do?

Programs often use functions from other libraries

For example, a program might need functions from these modules:

KERNEL32.dll

USER32.dll

ADVAPI32.dll

Information about external dependencies is placed in the Import structures of the PE file