• IDA .edata .rdata .idata .text segments


    .rdata is for const data. It is the read only version of the .data segment.

    .idata holds the import directory (.edata for exports).

    It is used by EXE's and DLL's to designate the imported and exported functions.

    See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.

    Summarizing typical segment names:

    .text: Code 
    .data: Initialized data
    .bss: Uninitialized data
    .rdata: Const/read-only (and initialized) data
    .edata: Export descriptors .idata: Import descriptors

    In fact, the names of the segments are ignored by Windows.

    There are linkers that use different segment names and it is even possible

    to store the Import Descriptors, Export descriptors, Resources etc.

    in the ".text" segment instead of using separate segments.

    However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.

    This means:

    Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
    but they contain meta information that is used by the operating system.

    The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.

    ".idata" contains information about all DLL files required by the program.

  • 相关阅读:
    160-13. 罗马数字转整数
    159-118. 杨辉三角
    158-190. 颠倒二进制位
    157-461. 汉明距离
    156-412. Fizz Buzz
    155-278. 第一个错误的版本
    154-108. 将有序数组转换为二叉搜索树
    153-101. 对称二叉树
    152-234. 回文链表
    秒杀程序架构演进
  • 原文地址:https://www.cnblogs.com/shangdawei/p/4788503.html
Copyright © 2020-2023  润新知