Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

EXE header information (.reloc & .rsrc meaning )

Tags:

exe

If you do dumpbin /header it will give you all 7 section data dumps. .data .idata .rdata .reloc .rsrc .text .textbss

Among this .rsrc and .idata are both content initialized data. These sections are read-only. Then what is the difference between these two? What is the purpose of the .reloc section?

like image 292
San Avatar asked Nov 30 '14 15:11

San


1 Answers

The .rdata section represents read-only data, such as literal strings, constants, and debug directory information.

The .rsrc section contains resource information for a module. It begins with a resource directory structure like most other sections, but this section's data is further structured into a resource tree. The IMAGE_RESOURCE_DIRECTORY, shown below, forms the root and nodes of the tree.

source for EXE Format description : http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html

you can find more information here: http://msdn.microsoft.com/en-us/library/ms809762.aspx

like image 188
Ashkan Nourzadeh Avatar answered Sep 19 '22 04:09

Ashkan Nourzadeh