Search code examples
assemblyheaderbyteportable-executablesections

Is there really a limit to sections name in PE binaries?

One awesome article about PE format states the following:

Name. Each section header has a name field up to eight characters long, for which the first character must be a period.

But I am aware of a few examples that violates this, starting with .gnu_debuglink section inside binaries, that have detached debug symbols in DWARF format. Also DWARF's .debug_arranges, .debug_info and others violates this. (For comparison, PDB's "detached" section name is just .debug.)

So I wonder if this article is just outdated/incomplete, or maybe it's a Windows-specific guideline, or there never was any limit to section names length?

Also I would be glad if someone points to me any book about PE/COFF binaries (ELF would be great as well), more comprehensive than online articles, if it even exists. Or about system programming in general — the information about this topic is very scarce or outdated by 20+ years. :)

Solution

  • There is a "long section names" feature in COFF to support section names that don't fit in the section name field.

    For a long section name, the normal section name field contains a name that looks like /4, in general a / followed by some decimal number as ASCII string. The number it encodes is an offset in the symbol table, so at PointerToSymbolTable (from the file header) plus that offset.