The sections of Portable Executable files are tagged with differents flags. Can someone explain the difference between IMAGE_SCN_MEM_EXECUTE (the section can be executed as code) and IMAGE_SCN_CNT_CODE (the section contains executable code)? Thanks.
IMAGE_SCN_MEM_EXECUTE is the one that is actually used by the PE loader to set up page permissions. IMAGE_SCN_CNT_CODE is not used, I guess it's just a descriptive flag.