PE .rdata section contents

Question

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found that .rdata contains the IAT, load configuration table, and safe exception handler table. Can someone please clarify the purpose of .rdata and why what I find in there disagrees with both descriptions? Also, shouldn't the import information be in .idata?

I'm assuming different compilers and different versions of the same compiler treat the same sections differently. If that's the case, where can I get more information on this?

Answer 1

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory.

The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers regarding the divergence between theory and practice can be found in another topic here on RE.

If you just want to extract/parse the information then you can ignore the section names completely; just use the info in the data directory.

Answer 2

Okay so basically, it's convenient to have as few sections as possible because each section must start on a new physical page, so you could waste a few KiB of physical memory here and there. Also, it takes up more kernel memory with more subsection objects required and more subsections to set up means more code to execute so the load time will be marginally longer. The import table must be in a read only section but doesn't need to be in a section of its own because it's accessed using a pointer in the PE header. It needs to be read only because otherwise the user code could modify the IAT and hijack calls to gadgets in the code or injected dlls. As for the loader, it needs to modify the IAT itself. This means it momentarily needs to change the PTEs from read only to COW, write to it which causes new physical pages to be allocated as read/write, and once its done, write protect those allocated pages and hence the PTEs. Similarly, .pdata is sometimes its own section, but it does not need to be and can be included in any read only section, so long as the exception directory RVA is in the optional PE header.