I was recently working with the Microsoft documentation about the PE and COFF specifications.
Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of stuff a section contains. However, the section characteristics flag is often the same for several different sections, and as I have read, the section name can be of arbitrary value, so it is not a big help too.
Actually, I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE
flag is set, as other sections should not have this flag set.
But how could I, for example, recognize the resource directory? It only has IMAGE_SCN_CNT_INITIALIZED_DATA
or IMAGE_SCN_MEM_READ
set, and many other sections have the same flag.
Do I have to evaluate with some made-up and typical section names (RSRC
or .rsrc
for this example)? It will mean that I may get tricked out by custom section names. Do I even have to try-and-error analyzation of section data to get a more definite result of what the section contains?
Or is there a flag somewhere in the PE headers I skipped, helping me out in this case?