windowswinapireverse-engineeringportable-executable

What is `PhysicalAddress` used for in `IMAGE_SECTION_HEADER`?


PhysicalAddress is a member of the Misc union, defined as follows:

typedef struct _IMAGE_SECTION_HEADER {
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
    union {
            DWORD   PhysicalAddress;
            DWORD   VirtualSize;
    } Misc;
    DWORD   VirtualAddress;
    DWORD   SizeOfRawData;
    DWORD   PointerToRawData;
    DWORD   PointerToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

I know that VirtualSize is usually used instead of PhysicalAddress, but there is very little information about PhysicalAddress on Internet.

I am curious about the actual purpose of this field? Has this field been used in history, are there any relevant examples?


Solution

  • Per Peering Inside the PE: A Tour of the Win32 Portable Executable File Format, Table 6, "IMAGE_SECTION_HEADER Formats":

    union {
        DWORD PhysicalAddress
        DWORD VirtualSize
    } Misc;
    

    This field has different meanings, in EXEs or OBJs. In an EXE, it holds the actual size of the code or data. This is the size before rounding up to the nearest file alignment multiple. The SizeOfRawData field (seems a bit of a misnomer) later on in the structure holds the rounded up value. The Borland linker reverses the meaning of these two fields and appears to be correct. For OBJ files, this field indicates the physical address of the section. The first section starts at address 0. To find the physical address in an OBJ file of the next section, add the SizeOfRawData value to the physical address of the current section.

    So, PhysicalAddress is used in an OBJ file during linking, and VirtualSize is used in the final EXE/DLL executable file.