zoukankan      html  css  js  c++  java
  • IDA .edata .rdata .idata .text segments

    .rdata is for const data. It is the read only version of the .data segment.

    .idata holds the import directory (.edata for exports).

    It is used by EXE's and DLL's to designate the imported and exported functions.

    See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.

    Summarizing typical segment names:

    .text: Code 
    .data: Initialized data
    .bss: Uninitialized data
    .rdata: Const/read-only (and initialized) data
    .edata: Export descriptors .idata: Import descriptors

    In fact, the names of the segments are ignored by Windows.

    There are linkers that use different segment names and it is even possible

    to store the Import Descriptors, Export descriptors, Resources etc.

    in the ".text" segment instead of using separate segments.

    However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.

    This means:

    Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
    but they contain meta information that is used by the operating system.

    The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.

    ".idata" contains information about all DLL files required by the program.

  • 相关阅读:
    JDBC
    过滤器
    Servlet-web.xml 常见配置
    Servlet-HttpSession接口
    Servlet-Cookie对象
    Servlet-HttpServlet对象
    kmp算法及应用
    线段树入门到自闭
    tarjan算法与拓扑排序
    马拉车模板
  • 原文地址:https://www.cnblogs.com/shangdawei/p/4788503.html
Copyright © 2011-2022 走看看