How to determine the size of an PE executable file from headers and or footers
If the PE file is well formed, the calculation can be simplified as (pseudo-code):
size = IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeadersforeach section_header in section_headers: size += section_header.SizeOfRawDataWhere:
SizeOfHeadersis a member ofIMAGE_OPTIONAL_HEADERstructure.- (
IMAGE_OPTIONAL_HEADERstructure is part ofIMAGE_NT_HEADERS)
SizeOfHeaders field gives the length of all the headers (note: including the 16-bit stub).
- Each section header is an
IMAGE_SECTION_HEADERstructure SizeOfRawDatafield gives the length of each section on disk.
Example with notepad (Windows 10):
SizeOfHeaders: 0x400
SizeOfRawDataof each sections :- .text: 0x15400
- .data: 0x800
- .idata: 0x1A00
- .rsrc: 0x19C00
- .reloc: 0x1600
(note: SizeOfRawData is called Raw Size in the below picture):
Sum everything:
>>> size_of_headers = 0x400>>> sec_sizes = [0x15400, 0x800, 0x1a00, 0x19c00, 0x1600]>>> size_of_headers + sum(sec_sizes)207872>>> Total size: 207872 bytes.
Verification:
Note: the above calculation doesn't take into account if the PE is badly formed or if there is an overlay.