Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Are any sections at all not loaded by the PE loader? Or are every section specified in the section headers loaded? In ELF programs, it’s section headers (Called program headers, or segments) that are supposed to be loaded are those that are flagged with PT_LOAD. Is there anything similar to that in PE programs?
PS. I found the flag IMAGE_SCN_MEM_DISCARDABLE. Are sections flagged with that not loaded?
When a relocation section is available, but the PE image does not need to be relocated, the loader does not load the relocation section. If a PE image has been digitally signed, it has a section that contains the certificate. This section is not loaded by the loader. Additionally, if a debug section is available, this is also not loaded by the loader.