.rdata 和 .idata 段之间有什么区别? [英] What's the difference between .rdata and .idata segments?

问题描述

我注意到在 IDA 中，我分析的 PE 文件不仅有 .rdata 部分，还有 .idata.有什么区别?

I noticed in IDA that the PE file which I analyze has not only the .rdata section but also .idata. What's the difference?

推荐答案

• .rdata 用于常量数据.它是 .data 段的只读版本.

  • .rdata is for const data. It is the read only version of the .data segment.

    .idata 保存导入目录(用于导出的 .edata).EXE 和 DLL 使用它来指定导入和导出的函数.请参阅 PE 格式规范 (http://msdn.microsoft.com/library/windows/hardware/gg463125) 了解详情.

    .idata holds the import directory (.edata for exports). It is used by EXE's and DLL's to designate the imported and exported functions. See the PE format specification (http://msdn.microsoft.com/library/windows/hardware/gg463125) for details.

    总结典型的段名称:

    .text: Code 
    .data: Initialized data
    .bss: Uninitialized data
    .rdata: Const/read-only (and initialized) data
    .edata: Export descriptors
    .idata: Import descriptors
    .reloc: Relocation table (for code instructions with absolute addressing when
              the module could not be loaded at its preferred base address)
    .rsrc: Resources (icon, bitmap, dialog, ...)
    .tls: __declspec(thread) data (Fails with dynamically loaded DLLs -> hard to find bugs)
    

    正如 Martin Rosenau 所提到的，段名称只是典型的.真正的段类型在段头中指定或由段中存储的数据的使用定义.

    As Martin Rosenau mentions, the segment names are only typical. The true segment type is specified in the segment header or is defined by usage of data stored in the segment.

    这篇关于.rdata 和 .idata 段之间有什么区别?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！