Forum > Windows

Getting File Size from PE Header Fails with Lazarus

<< < (2/8) > >>

Fibonacci:

--- Quote from: msintle on October 24, 2023, 09:29:29 pm ---How do you mean? In Delphi, it works properly even with debug info. Is the way Lazarus is adding debug information then non-standard and breaking the standard header based file size calculation process?

--- End quote ---

I dont have Delphi so cant compare the outputs, but FPC is adding debug info after EOF, overlay. If you build your exe without debug info, your function will display correct size. In my case debug info adds ~60 KB after PE sections (with only uses Windows).

170496 {your function} + 62931 {overlay size} = 233427 {actual file size on the disk}

Other than overlay debug info, it also creates many actual PE sections.

440bx:

--- Quote from: Fibonacci on October 25, 2023, 09:01:23 am --- but FPC is adding debug info after EOF, overlay.

--- End quote ---
I'm probably misunderstanding something but, I have not seen an instance where FPC adds debug info _after_ the executable's EOF in a PE file. 

Do you have an example of such an occurrence and/or how to produce such a file ?   TIA.

The following is what I've always seen (Note: details for non-debug sections have been removed for brevity):

--- Code: Text  [+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i < x.length; i++) { x[i].style.maxHeight='none'; x[i].style.height = Math.min(x[i].clientHeight+15,306)+'px'; x[i].style.resize = "vertical";}};} ---      40.0178            - IMAGE_SECTION_HEADER(s) - Number of sections : 10      40.0178              SECTION:  1 of 10      40.0178     178  [8]                                 Name : .text       40.01a0              SECTION:  2 of 10  contains: Thread Local Storage (TLS) directory      40.01a0     1a0  [8]                                 Name : .data       40.01c8              SECTION:  3 of 10      40.01c8     1c8  [8]                                 Name : .rdata       40.01f0              SECTION:  4 of 10      40.01f0     1f0  [8]                                 Name : .bss       40.0218              SECTION:  5 of 10      40.0218     218  [8]                                 Name : .CRT       40.0240              SECTION:  6 of 10  contains: Imports directory     40.0240 +                                         Imports address table directory      40.0240     240  [8]                                 Name : .idata       40.0268              SECTION:  7 of 10      40.0268     268  [8]                                 Name : /4              1.c3f0  [12]                                       .debug_info      40.0270     270  [4]                         Virtual size :      9202    (37,378)      40.0274     274  [4]           (Relative) Virtual address :    1.6000    [Va:     41.6000] [FO:   ea00] [      /4]      40.0278     278  [4]                     Size of raw data :      9400    (37,888)      40.027c     27c  [4]      File offset/pointer to raw data :      ea00    [Va:     41.6000] [FO:   ea00] [      /4]     40.0280     280  [4]   File offset/pointer to relocations :         0     40.0284     284  [4]   File offset/pointer to linenumbers :         0      40.0288     288  [2]                Number of relocations :         0     40.028a     28a  [2]                Number of linenumbers :         0      40.028c     28c  [4]                      Characteristics : 4200.0040     40.028c +                        SCN_CNT_INITIALIZED_DATA          40     40.028c +                          SCN_ALIGN_NOTSPECIFIED     0     40.028c +                             SCN_MEM_DISCARDABLE    200.0000     40.028c +                                    SCN_MEM_READ   4000.0000       40.0290              SECTION:  8 of 10      40.0290     290  [8]                                 Name : /16              1.c3fc  [14]                                       .debug_abbrev      40.0298     298  [4]                         Virtual size :       244    (  580)      40.029c     29c  [4]           (Relative) Virtual address :    2.0000    [Va:     42.0000] [FO: 1.7e00] [     /16]      40.02a0     2a0  [4]                     Size of raw data :       400    (1,024)      40.02a4     2a4  [4]      File offset/pointer to raw data :    1.7e00    [Va:     42.0000] [FO: 1.7e00] [     /16]     40.02a8     2a8  [4]   File offset/pointer to relocations :         0     40.02ac     2ac  [4]   File offset/pointer to linenumbers :         0      40.02b0     2b0  [2]                Number of relocations :         0     40.02b2     2b2  [2]                Number of linenumbers :         0      40.02b4     2b4  [4]                      Characteristics : 4200.0040     40.02b4 +                        SCN_CNT_INITIALIZED_DATA          40     40.02b4 +                          SCN_ALIGN_NOTSPECIFIED     0     40.02b4 +                             SCN_MEM_DISCARDABLE    200.0000     40.02b4 +                                    SCN_MEM_READ   4000.0000       40.02b8              SECTION:  9 of 10      40.02b8     2b8  [8]                                 Name : /30              1.c40a  [12]                                       .debug_line      40.02c0     2c0  [4]                         Virtual size :       bd5    (3,029)      40.02c4     2c4  [4]           (Relative) Virtual address :    2.1000    [Va:     42.1000] [FO: 1.8200] [     /30]      40.02c8     2c8  [4]                     Size of raw data :       c00    (3,072)      40.02cc     2cc  [4]      File offset/pointer to raw data :    1.8200    [Va:     42.1000] [FO: 1.8200] [     /30]     40.02d0     2d0  [4]   File offset/pointer to relocations :         0     40.02d4     2d4  [4]   File offset/pointer to linenumbers :         0      40.02d8     2d8  [2]                Number of relocations :         0     40.02da     2da  [2]                Number of linenumbers :         0      40.02dc     2dc  [4]                      Characteristics : 4200.0040     40.02dc +                        SCN_CNT_INITIALIZED_DATA          40     40.02dc +                          SCN_ALIGN_NOTSPECIFIED     0     40.02dc +                             SCN_MEM_DISCARDABLE    200.0000     40.02dc +                                    SCN_MEM_READ   4000.0000       40.02e0              SECTION: 10 of 10      40.02e0     2e0  [8]                                 Name : /42              1.c416  [13]                                       .debug_frame      40.02e8     2e8  [4]                         Virtual size :       29c    (  668)      40.02ec     2ec  [4]           (Relative) Virtual address :    2.2000    [Va:     42.2000] [FO: 1.8e00] [     /42]      40.02f0     2f0  [4]                     Size of raw data :       400    (1,024)      40.02f4     2f4  [4]      File offset/pointer to raw data :    1.8e00    [Va:     42.2000] [FO: 1.8e00] [     /42]     40.02f8     2f8  [4]   File offset/pointer to relocations :         0     40.02fc     2fc  [4]   File offset/pointer to linenumbers :         0      40.0300     300  [2]                Number of relocations :         0     40.0302     302  [2]                Number of linenumbers :         0      40.0304     304  [4]                      Characteristics : 4200.0040     40.0304 +                        SCN_CNT_INITIALIZED_DATA          40     40.0304 +                          SCN_ALIGN_NOTSPECIFIED     0     40.0304 +                             SCN_MEM_DISCARDABLE    200.0000     40.0304 +                                    SCN_MEM_READ   4000.0000        40.0308             - IMAGE HEADER - 248 filler bytes -      40.0308     308  [ 8]   __ __ __ __ __ __ __ __  00 00 00 00 00 00 00 00   ________........     40.0310     310  [16]   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................     40.0320     320  [16]   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................      etc     etc     etc  
In the above, all file offsets are within the real size of the PE file (IOW, not appended to what "used to be" its real size)

KodeZwerg:
My app does confirm what Fibonacci say.
I attached an Image that visualize it.

Fibonacci:

--- Quote from: 440bx on October 25, 2023, 09:43:12 am ---Do you have an example of such an occurrence and/or how to produce such a file ?   TIA.

--- End quote ---

1. OPs function returns real image size, which is different than file size, ergo "there is something more in the file"
2. Open binary in eg. PE-Bear and see Overlay

440bx:
@KodeZwerg & @Fibonacci

Which binary ?... I don't see a binary anywhere in this thread ... did I miss an elephant in the room ?

Navigation

[0] Message Index

[#] Next page

[*] Previous page

Go to full version