Segments, sections, file offsets and virtual memory

A segment is a mapping-level object. A section is a finer-grained logical region inside a segment.

For a 64-bit segment command, the important mapping fields are:

• vmaddr — preferred virtual address;
• vmsize — virtual-memory size;
• fileoff — first backing byte in the file;
• filesize — number of file-backed bytes;
• maxprot and initprot — memory-protection masks;
• nsects — number of section records following the segment command.

The simplest useful translation is:

file offset → segment-relative offset → virtual address

For a byte at file offset x inside a file-backed portion of a segment:

virtual = vmaddr + (x - fileoff)

This is not a universal address for every runtime execution. ASLR and image slides can move the mapped image. But it gives you the preferred-image relationship encoded by the file.

filesize can be smaller than vmsize

That is not automatically corruption. A segment can reserve more virtual memory than it has bytes in the file. The remainder can become zero-filled memory.

Sections add semantic structure

Section records name regions and describe address, size, file offset, alignment, relocation information, flags, and reserved fields whose interpretation depends on section type.

Do not infer permissions from section names alone. Permissions are segment-level mapping properties.

Analysis habit

Whenever a disassembler reports an address, practice tracing it back to:

1. the containing segment;
2. the containing section;
3. the corresponding file offset, when file-backed.

That one skill makes later symbol, signature, and runtime-metadata analysis much easier.