Search code examples
exe

EXE header information (.reloc & .rsrc meaning )

If you do dumpbin /header it will give you all 7 section data dumps. .data .idata .rdata .reloc .rsrc .text .textbss

Among this .rsrc and .idata are both content initialized data. These sections are read-only. Then what is the difference between these two? What is the purpose of the .reloc section?

Solution

  • The .rdata section represents read-only data, such as literal strings, constants, and debug directory information.

    The .rsrc section contains resource information for a module. It begins with a resource directory structure like most other sections, but this section's data is further structured into a resource tree. The IMAGE_RESOURCE_DIRECTORY, shown below, forms the root and nodes of the tree.

    source for EXE Format description : http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html

    you can find more information here: http://msdn.microsoft.com/en-us/library/ms809762.aspx