Hi,
The kernel already has all the information needed; its header information and associated data structures are in memory at the image base address. It can obtain the locations and sizes of all the sections there.
To provide a little more context, this is a small snippet from our system:
Code:
PUBLIC size_t PeGetImageSize(IN char* imageBase) {
IMAGE_DOS_HEADER* p;
IMAGE_NT_HEADERS* ntHeaders;
p = (IMAGE_DOS_HEADER*)imageBase;
ntHeaders = (IMAGE_NT_HEADERS*) (p->lfanew + imageBase);
return (size_t) ntHeaders->optionalHeader.sizeOfImage;
}
...
PeGetImageSize (KERNEL_PHYSICAL)