PE加载器未加载哪些部分? [英] What sections are not loaded by the PE loader?

问题描述

PE加载程序是否全部加载了 not 的任何节?还是加载了节标题中指定的每个节?在ELF程序中，应加载的节头(称为程序头或段)是用PT_LOAD标记的节头.与PE程序中的内容类似吗?

Are any sections at all not loaded by the PE loader? Or are every section specified in the section headers loaded? In ELF programs, it's section headers (Called program headers, or segments) that are supposed to be loaded are those that are flagged with PT_LOAD. Is there anything similar to that in PE programs?

PS.我找到了标志IMAGE_SCN_MEM_DISCARDABLE.标有该标记的部分是否未加载?

PS. I found the flag IMAGE_SCN_MEM_DISCARDABLE. Are sections flagged with that not loaded?

推荐答案

当有重定位段可用，但PE映像不需要重定位时，加载程序不会加载重定位段.如果PE映像已经过数字签名，则其包含包含证书的部分.加载程序未加载此部分.此外，如果有调试部分可用，则加载程序也不会加载该调试段.

When a relocation section is available, but the PE image does not need to be relocated, the loader does not load the relocation section. If a PE image has been digitally signed, it has a section that contains the certificate. This section is not loaded by the loader. Additionally, if a debug section is available, this is also not loaded by the loader.

这篇关于PE加载器未加载哪些部分?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！