PhysicalAddress
is a member of the Misc
union, defined as follows:
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
I know that VirtualSize
is usually used instead of PhysicalAddress
, but there is very little information about PhysicalAddress
on Internet.
I am curious about the actual purpose of this field? Has this field been used in history, are there any relevant examples?
Per Peering Inside the PE: A Tour of the Win32 Portable Executable File Format, Table 6, "IMAGE_SECTION_HEADER Formats":
union { DWORD PhysicalAddress DWORD VirtualSize } Misc;
This field has different meanings, in EXEs or OBJs. In an EXE, it holds the actual size of the code or data. This is the size before rounding up to the nearest file alignment multiple. The SizeOfRawData field (seems a bit of a misnomer) later on in the structure holds the rounded up value. The Borland linker reverses the meaning of these two fields and appears to be correct. For OBJ files, this field indicates the physical address of the section. The first section starts at address 0. To find the physical address in an OBJ file of the next section, add the SizeOfRawData value to the physical address of the current section.
So, PhysicalAddress
is used in an OBJ
file during linking, and VirtualSize
is used in the final EXE
/DLL
executable file.