PE sections limit

[lallous]

Hello

Can someone please explain to me the legal section headers count limit that
a PE file can have and still run?

Visual Studio 2008 linker says that 96 is the limit and after that the file
may not run.

On Win 7 x64 (RC1) it looks like I could compile and run a program with
10003 sections.

C:\Temp\run>cl32 sects.cpp user32.lib
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 15.00.30729.01 for
80x86
Copyright (C) Microsoft Corporation. All rights reserved.

sects.cpp
Microsoft (R) Incremental Linker Version 9.00.30729.01
Copyright (C) Microsoft Corporation. All rights reserved.

/out:sects.exe
sects.obj
user32.lib
LINK : warning LNK4031: no subsystem specified; CONSOLE assumed
sects.exe : warning LNK4072: section count 10003 exceeds max (96); image may
not
run

I tried to generate a C++ file with 40,000 sections but the linker cannot
handle such an input file w/o crashing.

--
Elias

[Tim Roberts]

"lallous" <lal...@lgwm.org> wrote:
>
>Can someone please explain to me the legal section headers count limit that
>a PE file can have and still run?

Can you share with us what kind of a design you are considering where
knowing this information would make a difference?

Perhaps I'm just not imaginative enough, but I can't think of a practical
use for more than a dozen or so sections.
--
Tim Roberts, ti...@probo.com
Providenza & Boekelheide, Inc.

[lallous]

Hello Tim,

Well, my job is to explore possibilities and take such limitations into
consideration while enhancing our product (IDA Pro)
For instance, in IDA Pro 5.5 we hardcoded this 96 sections limit into the PE
loader plugin (making it impossible for IDA Pro to load files with more than
96 sections), but now we discovered that the limit is not really there
anymore.

We've seen malware using such weird PE formats (unusual PE fields values,
too many sections, etc...) to fool the disassembler and stuff.

So my initial question is that if someone can refer me to an official
documentation to learn what is the actual number of sections that a certain
version of windows can handle and load.

--
Elias
"Tim Roberts" <ti...@probo.com> wrote in message
news:p3mpg5pn70rjn74po...@4ax.com...

[Jochen Kalmbach [MVP]]

Hi lallous!

> So my initial question is that if someone can refer me to an official
> documentation to learn what is the actual number of sections that a
> certain version of windows can handle and load.

I think, you are aware of the offical documentation....
http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx

Quote:
Note that the Windows loader limits the number of sections to 96.

Maybe the documentation is out-dated...

--
Greetings
Jochen

My blog about Win32 and .NET
http://blog.kalmbachnet.de/