What's the difference between .rdata and .idata segments?

前端 未结 2 953
无人及你
无人及你 2020-12-07 21:20

I noticed in IDA that the PE file which I analyze has not only the .rdata section but also .idata. What\'s the difference?

2条回答
  •  余生分开走
    2020-12-07 21:42

    In fact, the names of the segments are ignored by Windows.

    There are linkers that use different segment names and it is even possible to store the Import Descriptors, Export descriptors, Resources etc. in the ".text" segment instead of using separate segments.

    However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.

    This means: Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data") but they contain meta information that is used by the operating system. The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.

    ".idata" contains information about all DLL files required by the program.

提交回复
热议问题