Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a file that among other sections has:
code.text.bssAnd this file was not crafted manually, so I suspect.
The question is what could be the meaning of code and .text sections? As far as I know, executable code is located in .text section, so why compiler would add the other one?
If you need more information for answer I'll try to provide as much as I can.
In general .code and .text sections are synonymous. Both of those section contain executable code. Whereas, .data section contains non-executable data.
.bss segment is usually added due to optimization. The size of .bss is usually really small since it is designated to hold uninitialized data. In comparison, .data segment is designated to hold global/static variables and data structures.
Second code segment was most likely added manually.
Now, it is impossible to answer why the binary has two sections of code just by looking at the names. I think it is obviously unusual. I can state one thing for sure, you have two sections for a reason. However, you gonna have to fig in to figure out what the reason is.
First thing I would do is try to confirm segment permissions and CLASS. True code segment will have Read and Execute permissions. You can use lots of different tools to verify it. For instance, if you were to use IDA, it is done with Segments Subview, which could be accessed with Shift + F7. You might get lucky and spot the fake right from the get go.
You can create arbitrary sections, with any name you wish in a PE file.
.text and code sections ring a bell, perhaps this is a packed executable? I cannot remember which packer, however.
.code section. All my analysis was concentrated on the .text section.
Section names .text and .bss are default names used by Microsoft's VC++ compiler. While CODE is used by Borland's compiler, code is not.
As such, it would seem as though this PE file was created with Microsoft VC++ and the code section was added manually by the PE file's author. However, section names can be modified to be any value up to 8 characters (and are ignored by the Windows loader), so take this with a grain of salt.
Using #pragma data_seg(.xxxxx) one can create a separate section and it is possible for the name to be .code, as section names are just names and are alterable.
Section names don't mean anything to the PE loader and you can set them manually or change them using hex editors. So the only real way of knowing the section's real properties is by checking IMAGE_SECTION_HEADER's Characteristics field. Use a PE dumping utility like dumpbin and check to see if the section is marked as executable.
