If you do dumpbin /header it will give you all 7 section data dumps. .data .idata .rdata .reloc .rsrc .text .textbss
Among this .rsrc and .idata are both content initialized data. These sections are read-only. Then what is the difference between these two? What is the purpose of the .reloc section?
The .rdata section represents read-only data, such as literal strings, constants, and debug directory information.
The .rsrc section contains resource information for a module. It begins with a resource directory structure like most other sections, but this section's data is further structured into a resource tree. The IMAGE_RESOURCE_DIRECTORY, shown below, forms the root and nodes of the tree.
source for EXE Format description : http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html
you can find more information here: http://msdn.microsoft.com/en-us/library/ms809762.aspx
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With