3

It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping between these data blocks and certain COFF sections (even though it is somewhat customary, as with .rsrc). As a consequence the COFF sections and their names tend to be all over the place when an executable has been mangled by a packer, 'protector' or some such.

However, it seems that Windows determines location and size of the .pdata (array of RUNTIME_FUNCTION) via the .pdata COFF section header. Is that correct?

That would make this section unique in that even the most hare-brained 'protector' would have to emit accurate information under the correct name, or register that information dynamically...

Improve this question

1 Answer 1

Reset to default
6

No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].

Furthermore, the RUNTIME_FUNCTION structs don't need to be in "a separate COFF section".

Improve this answer
1
  • 1
    Thanks, somehow I missed the Exception Table which used to be empty for x86 PEs. It seems that x64 use of this table was documented in v8 of the PE COFF specification; MSDN currently has version 8.3 for download (pecoff_v83.docx). Anyway, thanks again! I should have looked more closely at the header info.
    – DarthGizka
    Commented Dec 20, 2014 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.