View Single Post
  #11  
Old 11-19-2011, 03:45
gigaman gigaman is offline
Friend
 
Join Date: Jun 2002
Posts: 87
Rept. Given: 0
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 14 Times in 11 Posts
gigaman Reputation: 4
Why isn't it a gap? I suppose we should define what a "gap" actually is first...

As the ntdll.dll example shows, when the virtual size of a section is considered rounded up to the section size (0x10000 in this case), then there really isn't any gap between the addresses. But since the PE loader actually rounds the virtual size up to the page size only (0x1000) when mapping the image, then there are unallocated/inaccessble blocks of memory between the sections (and it has nothing to do with the physical size, SizeOfRawData, it's all about virtual addresses and sizes). I would probably call it a gap, but yes, it's a bit special
Reply With Quote