0

I wanted to know which permissions each section of the following PE Sections have (windows):

.idata
.rsrc
.data
.text
.bss
.rdata
.edata

Thanks in advance, I couldn't found an answer using google. :)

1
2

You can find the official PE-format documentation here.

The section permissions are completely up to the programmer / compiler. You can parse the permissions out of the sections table. Please know that the permissions may be changed at runtime and also may be manipulated for smaller units of memory (pages!).

That being said, there is always some 'default' permissions set by the compiler if the programmer doesn't care about them explicitly:

For example, the .text section is usually READ + EXECUTE, while data sections are usually READ + WRITE (+ PROTECTED). There is no magic here.

There is plenty of software available to look at the startup section permissions (basically everything parsing pe files).

2
  • So by that I can understand everything i asked except .rsrc, which I dont know if I can call data. What do you think? – Sagi Maymon Mar 21 '17 at 11:52
  • the .rsrc section contains all ressources compiled into the binary (icons etc.). Since Windows allows updating resources, I assume they are frequently flagged READ + WRITE – Nordwald Mar 21 '17 at 12:04
3

You can use DUMPBIN for examining section permissions. If you run it with no other argument than executable name it shows sections in executable.

C:\> dumpbin ConsoleApplication1.exe
Microsoft (R) COFF/PE Dumper Version 14.10.24930.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file ConsoleApplication1.exe

File Type: EXECUTABLE IMAGE

  Summary

    1000 .data
    1000 .rdata
    1000 .reloc
    1000 .rsrc
    1000 .text

Then, check for specific section:

C:\> dumpbin /SECTION:.text ConsoleApplication1.exe
Microsoft (R) COFF/PE Dumper Version 14.10.24930.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file ConsoleApplication1.exe

File Type: EXECUTABLE IMAGE

SECTION HEADER #1
   .text name
     C2F virtual size
    1000 virtual address (00401000 to 00401C2E)
     E00 size of raw data
     400 file pointer to raw data (00000400 to 000011FF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read <----

  Summary

        1000 .text
1
C:\Program Files\Microsoft Visual Studio 14.0>dumpbin c:\Windows\System32\calc.e
xe /headers | grep SECTION -A 14 |  grep -A 3 flags
60000020 flags
         Code
         Execute Read

--
C0000040 flags
         Initialized Data
         Read Write

--
40000040 flags
         Initialized Data
         Read Only

--
42000040 flags
         Initialized Data
         Discardable
         Read Only

C:\Program Files\Microsoft Visual Studio 14.0>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.