Ресурсы программ

Лекция 6

Перед нами структура PE(PortableExecutable)файла Win (.EXE) и Common Object File Format (COFF). Далее идет описание секций и их атрибутов в порядке Section Name Content Characteristics.

.arch Alpha architecture information
IMAGE_SCN_MEM_READ | IMAGE_SCN_CNT_INITIALIZED_DATA |
IMAGE_SCN_ALIGN_8BYTES | IMAGE_SCN_MEM_DISCARDABLE
.bss Uninitialized data
IMAGE_SCN_CNT_UNINITIALIZED_DATA | IMAGE_SCN_MEM_READ |
IMAGE_SCN_MEM_WRITE
.data Initialized data
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE
.edata Export tables
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ
.idata Import tables
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ |
IMAGE_SCN_MEM_WRITE
.pdata Exception information
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ
.rdata Read-only initialized data
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ
.reloc Image relocations
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_DISCARDABLE
.rsrc Resource directory
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ |
IMAGE_SCN_MEM_WRITE
.text Executable code
IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE |
IIMAGE_SCN_MEM_READ
.tls Thread-local storage
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ |
IMAGE_SCN_MEM_WRITE
.xdata Exception information
IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ

Бывают еще секции .debug и .drectve но их, как правило, в исполняемом файле нет, поскольку они содержат информацию для линкера и отладчика соответственно.