2

As per this recent blog article one can set the PE loader to default to loading all sections. I even knew that. So setting the following setting in cfg\pe.cfg does the trick:

PE_LOAD_ALL_SECTIONS = YES

I often find myself needing to load at least the file header (sometimes in hindsight) but there is no explicit option for the file header on the load dialog:

Load new file dialog

Instead we have the "Load resources" checkbox, which -- if checked -- avoids having to do a full manual load, but seems to load both the resources (.rsrc "segment") and the file header (HEADER "segment").

List of segments

That also seems to be the effect of configuring PE_LOAD_ALL_SECTIONS = YES. Alas, if you set the configuration inside the cfg\pe.cfg, the "Load resources" checkbox doesn't get default-checked or so.

So my question is: are these two methods to load the file header and resources synonymous? If not, are they overlapping? What are the differences?

Experiment: trying all combinations on handle46.exe from SysInternals

Here's the outcome of the various settings on a PE file with IDA Pro 8.2.221215:

  1. PE_LOAD_ALL_SECTIONS = NO (default) and no changes on the load dialog:
    Just: PE_LOAD_ALL_SECTIONS = NO
  2. PE_LOAD_ALL_SECTIONS = NO (default) and "[✔] Load resources" on the load dialog:
    Load resources AND PE_LOAD_ALL_SECTIONS = NO
  3. PE_LOAD_ALL_SECTIONS = YES and no changes on the load dialog:
    Just: PE_LOAD_ALL_SECTIONS = YES
  4. PE_LOAD_ALL_SECTIONS = YES and "[✔] Load resources" on the load dialog:
    Load resources AND PE_LOAD_ALL_SECTIONS = YES

The odd outcome is 3., because it loads the .rsrc section although it hadn't been asked for it. That's also the reason why I asked this question in the first place.

Improve this question
3
  • I don't see 3 as an odd case. What you have is 2 different methods to change the behavior of IDA. Setting PE_LOAD_ALL_SECTIONS = YES in the config file does what it says, loads all sections (including .rsrc). Checking Load resources in the GUI also does what it says, ensures that .rsrc is loaded. These 2 configuration methods are independent of each other.
    – Mega Tonnage
    Jan 13 at 22:09
  • Just to clarify, these 2 methods only make changes when they are set to YES or checked. When they're set to NO or unchecked, they do nothing.
    – Mega Tonnage
    Jan 13 at 22:31
  • I guess they are indeed independent of each other. Thanks.
    – 0xC0000022L ♦
    Jan 14 at 10:37

1 Answer 1

Reset to default
2

I only get the HEADER segment when PE_LOAD_ALL_SECTIONS is set to YES in cfg\pe.cfg.

Checking Load Resources with PE_LOAD_ALL_SECTIONS = NO only adds the .rsrc segment for me (7.6 SP1).

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.