IDA .edata .rdata .idata .text segments
2015-09-07 11:59
369 查看
.rdata is for const data. It is the read only version of the .data segment.
.idata holds the import directory (.edata for exports).
It is used by EXE's and DLL's to designate the imported and exported functions.
See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.
Summarizing typical segment names:
In fact, the names of the segments are ignored by Windows.
There are linkers that use different segment names and it is even possible
to store the Import Descriptors, Export descriptors, Resources etc.
in the ".text" segment instead of using separate segments.
However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.
This means:
Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
but they contain meta information that is used by the operating system.
The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.
".idata" contains information about all DLL files required by the program.
.idata holds the import directory (.edata for exports).
It is used by EXE's and DLL's to designate the imported and exported functions.
See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.
Summarizing typical segment names:
.text: Code .data: Initialized data .bss: Uninitialized data .rdata: Const/read-only (and initialized) data .edata: Export descriptors .idata: Import descriptors
In fact, the names of the segments are ignored by Windows.
There are linkers that use different segment names and it is even possible
to store the Import Descriptors, Export descriptors, Resources etc.
in the ".text" segment instead of using separate segments.
However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.
This means:
Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
but they contain meta information that is used by the operating system.
The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.
".idata" contains information about all DLL files required by the program.
相关文章推荐
- ThreadLocal的使用和理解
- 转:[ASP.NET]重構之路系列v4 – 簡單使用interface之『你也會IoC』
- 每天进步一点点————MUMA架构优化和应用优化
- Android基础入门教程——7.1.1 Android网络编程要学的东西与Http协议学习
- c语言之数据拷贝memcpy strcpy
- 计算机网络各层对应协议
- 文件外部排序
- MAC下安装多版本JDK和切换几种方式
- 配置ADT
- matlab操作之--读取指定文件夹下的“指定格式”文件
- NodeJs http.get 方法请求时间过长问题处理!
- 每天进步一点点————磁盘I/O问题
- 事件 ID: 10016 解决方案
- jquery实现标题字体变换的滑动门菜单效果
- 苹果iPhone 6S将逼死iPad Mini
- 在eclipse中如何查找指定文文件
- Light oj 1025 (区间dp)
- IDEA+jetty配置jndi数据源
- R语言入门学习
- Scala总结