IDA .edata .rdata .idata .text segments

.rdata is for const data. It is the read only version of the .data segment.

.idata holds the import directory (.edata for exports).

It is used by EXE's and DLL's to designate the imported and exported functions.

See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.

Summarizing typical segment names:

.text: Code 
.data: Initialized data
.bss: Uninitialized data
.rdata: Const/read-only (and initialized) data
.edata: Export descriptors .idata: Import descriptors

In fact, the names of the segments are ignored by Windows.

There are linkers that use different segment names and it is even possible

to store the Import Descriptors, Export descriptors, Resources etc.

in the ".text" segment instead of using separate segments.

However it seems to be simpler to create separate sections for such metadata so most linkers will use separate sections.

This means:

Sections ".idata", ".rdata", ".rsrc", ... do not contain program data (although their name ends with "data")
but they contain meta information that is used by the operating system.

The ".rsrc" section for example holds information about the icon that is shown when looking at the executable file in the Explorer.

".idata" contains information about all DLL files required by the program.

 

posted @   IAmAProgrammer  阅读(1120)  评论(0编辑  收藏  举报
(评论功能已被禁用)
编辑推荐:
· Linux系列:如何用heaptrack跟踪.NET程序的非托管内存泄露
· 开发者必知的日志记录最佳实践
· SQL Server 2025 AI相关能力初探
· Linux系列:如何用 C#调用 C方法造成内存泄露
· AI与.NET技术实操系列(二):开始使用ML.NET
阅读排行:
· 被坑几百块钱后,我竟然真的恢复了删除的微信聊天记录!
· 【自荐】一款简洁、开源的在线白板工具 Drawnix
· 没有Manus邀请码?试试免邀请码的MGX或者开源的OpenManus吧
· 园子的第一款AI主题卫衣上架——"HELLO! HOW CAN I ASSIST YOU TODAY
· 无需6万激活码!GitHub神秘组织3小时极速复刻Manus,手把手教你使用OpenManus搭建本
历史上的今天:
2012-09-07 =Git常用命令及使用心得=
2012-09-07 Google Code在Windows下面设置.netrc
点击右上角即可分享
微信分享提示