I wanted to know which permissions each section of the following PE Sections have (windows):
.idata .rsrc .data .text .bss .rdata .edata
Thanks in advance, I couldn't found an answer using google. :)
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
You can find the official PE-format documentation here.
The section permissions are completely up to the programmer / compiler. You can parse the permissions out of the sections table. Please know that the permissions may be changed at runtime and also may be manipulated for smaller units of memory (pages!).
That being said, there is always some 'default' permissions set by the compiler if the programmer doesn't care about them explicitly:
For example, the
.text section is usually
READ + EXECUTE, while data sections are usually
READ + WRITE (+ PROTECTED). There is no magic here.
There is plenty of software available to look at the startup section permissions (basically everything parsing pe files).
You can use DUMPBIN for examining section permissions. If you run it with no other argument than executable name it shows sections in executable.
C:\> dumpbin ConsoleApplication1.exe Microsoft (R) COFF/PE Dumper Version 14.10.24930.0 Copyright (C) Microsoft Corporation. All rights reserved. Dump of file ConsoleApplication1.exe File Type: EXECUTABLE IMAGE Summary 1000 .data 1000 .rdata 1000 .reloc 1000 .rsrc 1000 .text
Then, check for specific section:
C:\> dumpbin /SECTION:.text ConsoleApplication1.exe Microsoft (R) COFF/PE Dumper Version 14.10.24930.0 Copyright (C) Microsoft Corporation. All rights reserved. Dump of file ConsoleApplication1.exe File Type: EXECUTABLE IMAGE SECTION HEADER #1 .text name C2F virtual size 1000 virtual address (00401000 to 00401C2E) E00 size of raw data 400 file pointer to raw data (00000400 to 000011FF) 0 file pointer to relocation table 0 file pointer to line numbers 0 number of relocations 0 number of line numbers 60000020 flags Code Execute Read <---- Summary 1000 .text
C:\Program Files\Microsoft Visual Studio 14.0>dumpbin c:\Windows\System32\calc.e xe /headers | grep SECTION -A 14 | grep -A 3 flags 60000020 flags Code Execute Read -- C0000040 flags Initialized Data Read Write -- 40000040 flags Initialized Data Read Only -- 42000040 flags Initialized Data Discardable Read Only C:\Program Files\Microsoft Visual Studio 14.0>