IDA .edata .rdata .idata .text segments

本文介绍了PE格式文件中常见段的功能及用途,如.text、.data、.bss、.rdata、.edata和.idata等,并解释了这些段如何帮助操作系统理解和加载程序所需的元数据。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

.rdata is for const data. It is the read only version of the .data segment.

.idata holds the import directory (.edata for exports).

It is used by EXE's and DLL's to designate the imported and exported functions.

See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.

Summarizing typical segment names:

.text: Code 
.data: Initialized data
.bss: Uninitialized data
.rdata: Const/read-only (and initialized) data
.edata: Export descriptors .idata: Import descriptors

In fact, the names of the segments are ignored by Windows.

There are linkers that use different segment names and it is even possible

to store the Import Descriptors, Export descriptors, Resources etc.

in the ".text" segment instead of using separate segments.

However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.

This means:

Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
but they contain meta information that is used by the operating system.

The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.

".idata" contains information about all DLL files required by the program.

 

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值