Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Generally, what is the criterion by which to decide whether a PE section contains code or not?
Specifically, is a .text or .code section always considered to contain code? And what is the relationship between the IMAGE_SCN_CNT_CODE flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE flag (0x20000000) - can we consider a section with at least one of those two as definitely containing code?
Is there a hard static rule to recognize code sections?
Specifically, is a
.textor.codesection always considered to contain code?
No.
And what is the relationship between the
IMAGE_SCN_CNT_CODEflag (0x00000020) andIMAGE_SCN_MEM_EXECUTEflag (0x20000000)
The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section are marked as executable in memory (via https://en.wikipedia.org/wiki/NX_bit).
can we consider a section with at least one of those two as definitely containing code?
Not always, no.
Generally, what is the criterion by which to decide whether a PE section contains code or not?
While the .text/.code sections will usually contain code, and a section with the IMAGE_SCN_MEM_EXECUTE flag will usually contain code, the only real way to say that a section definitely contains code is if the CPU actually executes code in that section at runtime.
IMAGE_SCN_MEM_EXECUTE flag off on the only PE section which had it and the sample executable still runs with no problems. What am I missing here?