Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ELF) and it seems to be the case.

I suppose the compiler/linker can be configured to chose a different name. In which cases would one want to change it? Are there known examples (CPU arch, compiler, etc.) where there is no .text section? What are other frequently used names? Can user code be put in other sections than the .text section?

Or is the name .text required to be a valid PE / ELF and thus always chosen? The ELF specification for example mentions the name .text several times, so does the PE specification.

  • 3
    Delphi 7 linker sets the name of code section to CODE – morsisko Nov 24 '20 at 17:27

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom names (UPX00 etc.) or even garbage.

AFAIK the only section name that is somewhat enforced is .rsrc - I think Explorer may not show the file icon if resources section is renamed.

  • And it’s not impossible to have more than one code section. – David Nov 25 '20 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.