Following the 16 entries of the Data directory array come the section headers. This is a list of headers with each header representing a section of the PE file. The number of headers in total is the exact number stored in the NumberOfSections field in FileHeader.
The section header is a very simple header and it looks like this:
Figure 4: Example of a section table
And these fields are used for the following:
- Name: The name of the section (8 bytes max).
- VirtualAddress: The pointer to the beginning of the section in memory (relatively to the start of the file). These types of addresses are called RVA addresses.
- VirtualSize: The size of a section (in memory).
- SizeOfRawData: The size of a section (on the hard disk).
- PointerToRawData: The pointer to the beginning of the section in the file on the hard disk (relatively to the start of the file). These types of addresses are called offsets.
- Characteristics: Memory protection flags (EXECUTE, READ, or WRITE).
