Portable Executable Sections contain the code and data of an executable.
Sections may contain code, variables, or resource information.
Programs may contain an arbitrary number of sections, but typically contain the following:
- .text - the executable code.
- .data - initialized data
- .rdata - read-only data (variables defined as const)
- .idata - import tables
- .reloc - relocation/“fix-up” table
- .rsrc - resources such as icons and bitmaps
Each PE section has an IMAGE_SECTION_HEADER structure defining it.
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;