5

I was recently working with the Microsoft documentation about the PE and COFF specifications.

Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of stuff a section contains. However, the section characteristics flag is often the same for several different sections, and as I have read, the section name can be of arbitrary value, so it is not a big help too.

Actually, I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set.

But how could I, for example, recognize the resource directory? It only has IMAGE_SCN_CNT_INITIALIZED_DATA or IMAGE_SCN_MEM_READ set, and many other sections have the same flag.

Do I have to evaluate with some made-up and typical section names (RSRC or .rsrc for this example)? It will mean that I may get tricked out by custom section names. Do I even have to try-and-error analyzation of section data to get a more definite result of what the section contains?

Or is there a flag somewhere in the PE headers I skipped, helping me out in this case?

Improve this question

1 Answer 1

Reset to default
5

I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set.

The presence of this flag doesn't "definitely" mean that that section contains code, and the absence of this flag doesn't "definitely" mean that that section doesn't contain code:

  • A PE file can have that flag on a non-code (data) section and still run fine (though this is not advisable from a security perspective).
  • A PE file can have that flag missing from an actual code section, assuming that the operating system does not have DEP enabled and/or other code changes the memory protection of that section at runtime to make it executable.

But how could I, for example, recognize the resource directory?

The only reliable way to find the resource directory is via the IMAGE_DIRECTORY_ENTRY_RESOURCE entry in the PE file's IMAGE_DATA_DIRECTORY.

Improve this answer
1
  • Yeah, getting misleaded by "wrong" or badly set flags on purpose would also trick me out, but then at least I can say that I relied on the characteristic flags. I see that there are also data directories for import and export tables. That can help me further already, parsing the contents of those sections. If the result is still wrong, I just won't parse the section.
    – Ray
    Feb 28, 2015 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.