Re: How to find file size from pe32 header

Not exactly,

PE files cand have any kind of data attached to their end... aka after
the last section of the fille. This is called an "overlay". And many
p-code compilers use it for the real application code.

So the general answer is NO.
You still do need to know the file size from the filesystem.

Best regards,
Bogdan Ontanu


Ole Nielsby a scris:
> "be.geek" <spamtrap@xxxxxxxxxx> wrote:
>
> > This may not be the right forum (pls. point me if not)
> >
> > Is it possible to find the size of a pe32 file just from the header
> > information?
> >
> > This question is pertinent when the file is not on the disk but rather
> > embedded in a network flow, and I want to know where it begins and
> > where it ends.
>
> You need to walk the segment descriptors and find the last segment.
> The info you need is in a sdk header file, winnt.h or something like that.

.