It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping between these data blocks and certain COFF sections (even though it is somewhat customary, as with .rsrc). As a consequence the COFF sections and their names tend to be all over the place when an executable has been mangled by a packer, 'protector' or some such.

However, it seems that Windows determines location and size of the .pdata (array of RUNTIME_FUNCTION) via the .pdata COFF section header. Is that correct?

That would make this section unique in that even the most hare-brained 'protector' would have to emit accurate information under the correct name, or register that information dynamically...


No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].

Furthermore, the RUNTIME_FUNCTION structs don't need to be in "a separate COFF section".

  • 1
    Thanks, somehow I missed the Exception Table which used to be empty for x86 PEs. It seems that x64 use of this table was documented in v8 of the PE COFF specification; MSDN currently has version 8.3 for download (pecoff_v83.docx). Anyway, thanks again! I should have looked more closely at the header info. – DarthGizka Dec 20 '14 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.