As per this recent blog article one can set the PE loader to default to loading all sections. I even knew that. So setting the following setting in
cfg\pe.cfg does the trick:
PE_LOAD_ALL_SECTIONS = YES
I often find myself needing to load at least the file header (sometimes in hindsight) but there is no explicit option for the file header on the load dialog:
Instead we have the "Load resources" checkbox, which -- if checked -- avoids having to do a full manual load, but seems to load both the resources (
.rsrc "segment") and the file header (
That also seems to be the effect of configuring
PE_LOAD_ALL_SECTIONS = YES. Alas, if you set the configuration inside the
cfg\pe.cfg, the "Load resources" checkbox doesn't get default-checked or so.
So my question is: are these two methods to load the file header and resources synonymous? If not, are they overlapping? What are the differences?
Experiment: trying all combinations on handle46.exe from SysInternals
Here's the outcome of the various settings on a PE file with IDA Pro 8.2.221215:
PE_LOAD_ALL_SECTIONS = NO(default) and no changes on the load dialog:
PE_LOAD_ALL_SECTIONS = NO(default) and "[✔] Load resources" on the load dialog:
PE_LOAD_ALL_SECTIONS = YESand no changes on the load dialog:
PE_LOAD_ALL_SECTIONS = YESand "[✔] Load resources" on the load dialog:
The odd outcome is 3., because it loads the
.rsrc section although it hadn't been asked for it. That's also the reason why I asked this question in the first place.