hey i got something again i got confused by in PE files and they don't rlly explain why happens oke so what im confused with FileAlignment and SectionAlignment
files must be aligned or sections to whatever count is right ? like if the it's less than the number (x) then it will aligned to certain number so and stuff there is filled with zeros ?
Yes, null bytes with a value of 0x00 are used as padding for alignment purposes.
oke but there something that bugging 2 questions acctually
does it chooses the multipales randomly ? of the file or in memory for example file alignments is 0x200 does it chooses it's stuff randomly ? or based on some facts ? also for pe files in memory version is aligned to 0x100 wouldn't that make program bigger in memory than in file ?
does it chooses the multipales randomly ?
IIRC, the architecture's page size is the determining factor for the file and section sizes.
also for pe files in memory version is aligned to 0x100 wouldn't that make program bigger in memory than in file ?
The section alignment can be the same as the file alignment or bigger. If it is bigger, then more padding is used in memory, which can be used for data storage.
oke thanks again mate for answering my questions
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.