Skip to main content
Tweeted twitter.com/#!/StackReverseEng/status/552883972049731584
removed code tags from title
Link
asdf
  • 113
  • 1
  • 1
  • 5

PE <code>.rdata</code>rdata section contents

Source Link
asdf
  • 113
  • 1
  • 1
  • 5

PE <code>.rdata</code> section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found that .rdata contains the IAT, load configuration table, and safe exception handler table. Can someone please clarify the purpose of .rdata and why what I find in there disagrees with both descriptions? Also, shouldn't the import information be in .idata?

I'm assuming different compilers and different versions of the same compiler treat the same sections differently. If that's the case, where can I get more information on this?