Why do PE sections have a name?

Index > Main > Why do PE sections have a name?

Author

Thread

ChrisLeslie

Joined: 04 Jun 2006
Posts: 50
Location: Australia

ChrisLeslie 23 Feb 2007, 03:35

Why is there a requirement to have a quoted text name for each PE section. I cannot find any reference to a function for the names, so why are they part of the assembler?

Chris

23 Feb 2007, 03:35

Chewy509

Joined: 19 Jun 2003
Posts: 297
Location: Bris-vegas, Australia

Chewy509 23 Feb 2007, 03:43

For the final linking stage before execution.

23 Feb 2007, 03:43

ChrisLeslie

Joined: 04 Jun 2006
Posts: 50
Location: Australia

ChrisLeslie 23 Feb 2007, 04:03

OK, but why do we have to give them a specific name? I can call them anything and it makes no difference to the outcome as far as I can tell.

Chris

23 Feb 2007, 04:03

Garthower

Joined: 21 Apr 2006
Posts: 158
Location: Ukraine

Garthower 23 Feb 2007, 07:22

Names for sections is easier good form of programming, no more. Any name of any section will not affect in any way working capacity of the program.

23 Feb 2007, 07:22

Raedwulf

Joined: 13 Jul 2005
Posts: 375
Location: United Kingdom

Raedwulf 23 Feb 2007, 09:34

We didn't design the PE format Smile

23 Feb 2007, 09:34

f0dder

Joined: 19 Feb 2004
Posts: 3174
Location: Denmark

f0dder 05 Aug 2007, 23:15

Sorry for reviving an old thread... but legend has it Smile

that some tools (or perhaps some windows versions?) required the resource section to be called .rsrc - I've seen compressors that renames all other sections but has options to keep .rsrc.

I've never stumbled upon the issue myself, so I don't know if it's just an urban legend or if there's some truth to it - but I've always stuck with .rsrc to be safe Smile

05 Aug 2007, 23:15

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4623
Location: Argentina

LocoDelAssembly 05 Aug 2007, 23:23

f0dder, even on Win95 OSR2 doing

Code:

align 4 ; Not optional at all
data resource
.
.
.
end data

Worked for me.

So, perhaps it is just to be suitable for some PE tools?

05 Aug 2007, 23:23

SFeLi

Joined: 03 Nov 2004
Posts: 138

SFeLi 05 Aug 2007, 23:34

LocoDelAssembly, “.rsrc” is required section name for version information.

05 Aug 2007, 23:34

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4623
Location: Argentina

LocoDelAssembly 06 Aug 2007, 00:08

SFeLi, you are right:

Code:

RESOURCE_SECTION equ 1

include 'win32ax.inc'

ret

match  =1, RESOURCE_SECTION{
section '.rsrc' resource readable}

match =0, RESOURCE_SECTION{
align 4
data resource}
  directory RT_VERSION, version

  resource version, 1, LANG_ENGLISH+SUBLANG_DEFAULT, vinfo

  versioninfo vinfo,VOS__WINDOWS32,VFT_APP,VFT2_UNKNOWN,\
                    LANG_ENGLISH+SUBLANG_DEFAULT,0,\
              'FileDescription','Description of program',\
              'LegalCopyright','Copyright et cetera',\
              'FileVersion','1.0',\
              'ProductVersion','1.0'
match =0, RESOURCE_SECTION{
end data}

With "RESOURCE_SECTION equ 1" Windows can display the version info while with "RESOURCE_SECTION equ 0" can't.

The myth is true! Very Happy

Thanks SFeLi

06 Aug 2007, 00:08

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 06 Aug 2007, 06:32

and try to change .rsrc to other name - work fine xp sp2+ )
The main thing - resourses seem to be in one whole section.

06 Aug 2007, 06:32

SFeLi

Joined: 03 Nov 2004
Posts: 138

SFeLi 06 Aug 2007, 13:43

Quote:

resourses seem to be in one whole section.

At the start of any section.

Ok, now the only thing that requires '.rsrc' is typelib handling code in OLEAUT32.DLL.

06 Aug 2007, 13:43

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum