According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found that .rdata contains the IAT, load configuration table, and safe exception handler table. Can someone please clarify the purpose of .rdata and why what I find in there disagrees with both descriptions? Also, shouldn't the import information be in .idata?

I'm assuming different compilers and different versions of the same compiler treat the same sections differently. If that's the case, where can I get more information on this?


It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory.

The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers regarding the divergence between theory and practice can be found in another topic here on RE.

If you just want to extract/parse the information then you can ignore the section names completely; just use the info in the data directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.