Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Structures contained in the .pdata section

I need to read the ".pdata" section of a x64 PE file.
I've seen that the structures in the ".pdata" section differ from one platform to another
http://msdn.microsoft.com/en-us/library/aa448751.aspx
It also says the same thing in the PE specifications document.
But I dont understand what it is for the regular windows (XP/Vista/Win7 etc.)

Does anybody what it is?

like image 861
Idov Avatar asked Mar 20 '12 20:03

Idov


Video Answer


1 Answers

The .pdata section is an array of RUNTIME_FUNCTION. It gives you a code range (first two members) and an RVA to the corresponding UNWIND_INFO.

From there you get info like exception handler RVA, size of prolog, etc.

like image 182
pezcode Avatar answered Oct 17 '22 01:10

pezcode