© 2004 Microsoft Corporation. All rights reserved.

Figure 1 Section Names

Name
Description
.text
The default code section.
.data
The default read/write data section. Global variables typically go here.
.rdata
The default read-only data section. String literals and C++/COM vtables are examples of items put into .rdata.
.idata
The imports table. It has become common practice (either explicitly, or via linker default behavior) to merge the .idata section into another section, typically .rdata. By default, the linker only merges the .idata section into another section when creating a release mode executable.
.edata
The exports table. When creating an executable that exports APIs or data, the linker creates an .EXP file. The .EXP file contains an .edata section that's added into the final executable. Like the .idata section, the .edata section is often found merged into the .text or .rdata sections.
.rsrc
The resources. This section is read-only. However, it should not be named anything other than .rsrc, and should not be merged into other sections.
.bss
Uninitialized data. Rarely found in executables created with recent linkers. Instead, the VirtualSize of the executable's .data section is expanded to make enough room for uninitialized data.
.crt
Data added for supporting the C++ runtime (CRT). A good example is the function pointers that are used to call the constructors and destructors of static C++ objects. See the January 2001 Under The Hood column for details on this.
.tls
Data for supporting thread local storage variables declared with __declspec(thread). This includes the initial value of the data, as well as additional variables needed by the runtime.
.reloc
The base relocations in an executable. Base relocations are generally only needed for DLLs and not EXEs. In release mode, the linker doesn't emit base relocations for EXE files. Relocations can be removed when linking with the /FIXED switch.
.sdata
"Short" read/write data that can be addressed relative to the global pointer. Used for the IA-64 and other architectures that use a global pointer register. Regular-sized global variables on the IA-64 will go in this section.
.srdata
"Short" read-only data that can be addressed relative to the global pointer. Used on the IA-64 and other architectures that use a global pointer register.
.pdata
The exception table. Contains an array of IMAGE_RUNTIME_FUNCTION_ENTRY structures, which are CPU-specific. Pointed to by the IMAGE_DIRECTORY_ENTRY_EXCEPTION slot in the DataDirectory. Used for architectures with table-based exception handling, such as the IA-64. The only architecture that doesn't use table-based exception handling is the x86.
.debug$S
Codeview format symbols in the OBJ file. This is a stream of variable-length CodeView format symbol records.
.debug$T
Codeview format type records in the OBJ file. This is a stream of variable-length CodeView format type records.
.debug$P
Found in the OBJ file when using precompiled headers.
.drectve
Contains linker directives and is only found in OBJs. Directives are ASCII strings that could be passed on the linker command line. For instance:
  -defaultlib:LIBC
Directives are separated by a space character.
.didat
Delayload import data. Found in executables built in nonrelease mode. In release mode, the delayload data is merged into another section.
Figure 2 IMAGE_EXPORT_DIRECTORY Structure Members

Size
Member
Description
DWORD
Characteristics
Flags for the exports. Currently, none are defined.
DWORD
TimeDateStamp
The time/date that the exports were created. This field has the same definition as the IMAGE_NT_HEADERS.FileHeader. TimeDateStamp (number of seconds since 1/1/1970 GMT).
WORD
MajorVersion
The major version number of the exports. Not used, and set to 0.
WORD
MinorVersion
The minor version number of the exports. Not used, and set to 0.
DWORD
Name
A relative virtual address (RVA) to an ASCII string with the DLL name associated with these exports (for example, KERNEL32.DLL).
DWORD
Base
This field contains the starting ordinal value to be used for this executable's exports. Normally, this value is 1, but it's not required to be so. When looking up an export by ordinal, the value of this field is subtracted from the ordinal, with the result used as a zero-based index into the Export Address Table (EAT).
DWORD
NumberOfFunctions
The number of entries in the EAT. Note that some entries may be 0, indicating that no code/data is exported with that ordinal value.
DWORD
NumberOfNames
The number of entries in the Export Names Table (ENT). This value will always be less than or equal to the NumberOf-Functions field. It will be less when there are symbols exported by ordinal only. It can also be less if there are numeric gaps in the assigned ordinals. This field is also the size of the export ordinal table (below).
DWORD
AddressOfFunctions
The RVA of the EAT. The EAT is an array of RVAs. Each nonzero RVA in the array corresponds to an exported symbol.
DWORD
AddressOfNames
The RVA of the ENT. The ENT is an array of RVAs to ASCII strings. Each ASCII string corresponds to a symbol exported by name. This table is sorted so that the ASCII strings are in order. This allows the loader to do a binary search when looking for an exported symbol. The sorting of the names is binary (like the C++ RTL strcmp function provides), rather than a locale-specific alphabetic ordering.
DWORD
AddressOfNameOrdinals
The RVA of the export ordinal table. This table is an array of WORDs. This table maps an array index from the ENT into the corresponding export address table entry.
Figure 4 KERNEL32 Exports
exports table:
  Name:            KERNEL32.dll
  Characteristics: 00000000
  TimeDateStamp:   3B7DDFD8 -> Fri Aug 17 23:24:08 2001
  Version:         0.00
  Ordinal base:    00000001
  # of functions:  000003A0
  # of Names:      000003A0

  Entry Pt  Ordn  Name
  00012ADA     1  ActivateActCtx
  000082C2     2  AddAtomA
•••remainder of exports omitted
Figure 5 IMAGE_IMPORT_DESCRIPTOR Structure

Size
Member
Description
DWORD
OriginalFirstThunk
This field is badly named. It contains the RVA of the Import Name Table (INT). This is an array of IMAGE_THUNK_DATA structures. This field is set to 0 to indicate the end of the array of IMAGE_IMPORT_DESCRIPTORs.
DWORD
TimeDateStamp
This is 0 if this executable is not bound against the imported DLL. When binding in the old style (see the section on Binding), this field contains the time/date stamp (number of seconds since 1/1/1970 GMT) when the binding occurred. When binding in the new style, this field is set to -1.
DWORD
ForwarderChain
This is the Index of the first forwarded API. Set to -1 if no forwarders. Only used for old-style binding, which could not handle forwarded APIs efficiently.
DWORD
Name
The RVA of the ASCII string with the name of the imported DLL.
DWORD
FirstThunk
Contains the RVA of the Import Address Table (IAT). This is array of IMAGE_THUNK_DATA structures.
Figure 7 ImgDelayDescr Structure

Size
Member
Description
DWORD
grAttrs
The attributes for this structure. Currently, the only flag defined is dlattrRva (1), indicating that the address fields in the structure should be treated as RVAs, rather than virtual addresses.
RVA
rvaDLLName
An RVA to a string with the name of the imported DLL. This string is passed to LoadLibrary.
RVA
rvaHmod
An RVA to an HMODULE-sized memory location. When the Delayloaded DLL is brought into memory, its HMODULE is stored at this location.
RVA
rvaIAT
An RVA to the Import Address Table for this DLL. This is the same format as a regular IAT.
RVA
rvaINT
An RVA to the Import Name Table for this DLL. This is the same format as a regular INT.
RVA
rvaBoundIAT
An RVA of the optional bound IAT. An RVA to a bound copy of an Import Address Table for this DLL. This is the same format as a regular IAT. Currently, this copy of the IAT is not actually bound, but this feature may be added in future versions of the BIND program.
RVA
rvaUnloadIAT
An RVA of the optional copy of the original IAT. An RVA to an unbound copy of an Import Address Table for this DLL. This is the same format as a regular IAT. Currently always set to 0.
DWORD
dwTimeStamp
The date/time stamp of the delayload imported DLL. Normally set to 0.
Figure 8 Resources from ADVAPI32.DLL
Resources (RVA: 6B000)
ResDir (0) Entries:03 (Named:01, ID:02) TimeDate:00000000
    ———————————————————————————————
    ResDir (MOFDATA) Entries:01 (Named:01, ID:00) TimeDate:00000000
        ResDir (MOFRESOURCENAME) Entries:01 (Named:00, ID:01) TimeDate:00000000
            ID: 00000409  DataEntryOffs: 00000128
            DataRVA: 6B6F0  DataSize: 190F5  CodePage: 0
    ———————————————————————————————
    ResDir (STRING) Entries:01 (Named:00, ID:01) TimeDate:00000000
        ResDir (C36) Entries:01 (Named:00, ID:01) TimeDate:00000000
            ID: 00000409  DataEntryOffs: 00000138
            DataRVA: 6B1B0  DataSize: 0053C  CodePage: 0
    ———————————————————————————————
    ResDir (RCDATA) Entries:01 (Named:00, ID:01) TimeDate:00000000
        ResDir (66) Entries:01 (Named:00, ID:01) TimeDate:00000000
            ID: 00000409  DataEntryOffs: 00000148
            DataRVA: 85908  DataSize: 0005C  CodePage: 0
Figure 9 Fields of IMAGE_DEBUG_DIRECTORY

Size
Member
Description
DWORD
Characteristics
Unused and set to 0.
DWORD
TimeDateStamp
The time/date stamp of this debug information (number of seconds since 1/1/1970, GMT).
WORD
MajorVersion
The major version of this debug information. Unused.
WORD
MinorVersion
The minor version of this debug information. Unused.
DWORD
Type
The type of the debug information. The following types are the most commonly encountered:
IMAGE_DEBUG_TYPE_COFF
IMAGE_DEBUG_TYPE_CODEVIEW	// Including PDB files
IMAGE_DEBUG_TYPE_FPO		// Frame pointer omission
IMAGE_DEBUG_TYPE_MISC	// IMAGE_DEBUG_MISC
IMAGE_DEBUG_TYPE_OMAP_TO_SRC
IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
IMAGE_DEBUG_TYPE_BORLAND	// Borland format
DWORD
SizeOfData
The size of the debug data in this file. Doesn't count the size of external debug files such as .PDBs.
DWORD
AddressOfRawData
The RVA of the debug data, when mapped into memory. Set to 0 if the debug data isn't mapped in.
DWORD
PointerToRawData
The file offset of the debug data (not an RVA).
Figure 10 IMAGE_COR20_HEADER Structure

Type
Member
Description
DWORD
cb
Size of the header in bytes.
WORD
MajorRuntimeVersion
The minimum version of the runtime required to run this program. For the first release of .NET, this value is 2.
WORD
MinorRuntimeVersion
The minor portion of the version. Currently 0.
IMAGE_DATA_DIRECTORY
MetaData
The RVA to the metadata tables.
DWORD
Flags
Flag values containing attributes for this image. These values are currently defined as:
COMIMAGE_FLAGS_ILONLY // Image contains only IL code that
                      // is not required to run on a specific CPU.
COMIMAGE_FLAGS_32BITREQUIRED  // Only runs in 32-bit processes.
COMIMAGE_FLAGS_IL_LIBRARY
STRONGNAMESIGNED      // Image is signed with hash data
COMIMAGE_FLAGS_TRACKDEBUGDATA // Causes the JIT/runtime to
                              // keep debug information
                              // around for methods.

DWORD
EntryPointToken
Token for the MethodDef of the entry point for the image. The .NET runtime calls this method to begin managed execution in the file.
IMAGE_DATA_DIRECTORY
Resources
The RVA and size of the .NET resources.
IMAGE_DATA_DIRECTORY
StrongNameSignature
The RVA of the strong name hash data.
IMAGE_DATA_DIRECTORY
CodeManagerTable
The RVA of the code manager table. A code manager contains the code required to obtain the state of a running program (such as tracing the stack and track GC references).
IMAGE_DATA_DIRECTORY
VTableFixups
The RVA of an array of function pointers that need fixups. This is for support of unmanaged C++ vtables.
IMAGE_DATA_DIRECTORY
ExportAddressTableJumps
The RVA to an array of RVAs where export JMP thunks are written. These thunks allow managed methods to be exported so that unmanaged code can call them.
IMAGE_DATA_DIRECTORY
ManagedNativeHeader
For internal use of the .NET runtime in memory. Set to 0 in the executable.
Figure 11 IMAGE_TLS_DIRECTORY Structure

Size
Member
Description
DWORD
StartAddressOfRawData
The beginning address of a range of memory used to initialize a new thread's TLS data in memory.
DWORD
EndAddressOfRawData
The ending address of the range of memory used to initialize a new thread's TLS data in memory.
DWORD
AddressOfIndex
When the executable is brought into memory and a .tls section is present, the loader allocates a TLS handle via TlsAlloc. It stores the handle at the address given by this field. The runtime library uses this index to locate the thread local data.
DWORD
AddressOfCallBacks
Address of an array of PIMAGE_TLS_CALLBACK function pointers. When a thread is created or destroyed, each function in the list is called. The end of the list is indicated by a pointer-sized variable set to 0. In normal Visual C++ executables, this list is empty.
DWORD
SizeOfZeroFill
The size in bytes of the initialization data, beyond the initialized data delimited by the StartAddressOfRawData and EndAddressOfRawData fields. All per-thread data after this range is initialized to 0.
DWORD
Characteristics
Reserved. Currently set to 0.
Figure 12 Command-line Options

/A
Include everything in dump
/B
Show base relocations
/H
Include hex dump of sections
/I
Include Import Address Table thunk addresses
/L
Include line number information
/P
Include PDATA (runtime functions)
/R
Include detailed resources (stringtables and dialogs)
/S
Show symbol table