Specifically, is a .text
or .code
section always considered to contain code?
No.
And what is the relationship between the IMAGE_SCN_CNT_CODE
flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE
flag (0x20000000)
The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section are marked as executable in memory (via https://en.wikipedia.org/wiki/NX_bit).
can we consider a section with at least one of those two as definitely containing code?
Not always, no.
Generally, what is the criterion by which to decide whether a PE section contains code or not?
While the .text
/.code
sections will usually contain code, and a section with the IMAGE_SCN_MEM_EXECUTE
flag will usually contain code, the only real way to say that a section definitely contains code is if the CPU actually executes code in that section at runtime.