| Figure 1 Commonly Encountered Sections | |
| .text | Machine code instructions. |
| .data | Initialized data. |
| .rdata | Read only data. OLE GUIDs are stored here, among other things. |
| .rsrc | Resources. Produced by the resource compiler, and placed into RES files. Linker copies it to the executable. |
| .reloc | Base relocations. Produced by the linker. Not found in OBJs. |
| .edata | The exported function table. Created by the linker and placed in an EXP file. Linker copies it to the executable. |
| .idata | Imported function table in an executable file. |
| .idata$XXX | Portions of an imported function table. The librarian creates these sections in an import library. The linker combines them into the final .idata section in the executable. |
| .CRT | Tables of initialization and shutdown pointers in the executable that are used by the Microsoft C++ runtime library. |
| .CRT$XXX | Initialization and shutdown pointers in OBJs, prior to the linker combining them in the executable. |
| .bss | Uninitialized data. |
| .drectve | OBJ file section containing linker directives. Not copied to executable. |
| .debug$XXX | COFF symbol table information in an OBJ file. |
Figure 3 An Imports Table
1121 public symbols
EA14 _ActivateKeyboardLayout@8
...
Archive member name at EA14: USER32.dll/
...
SECTION HEADER #2
.text name
RAW DATA #2
00000000 FF 25 00 00 00 00 .%....
...
SECTION HEADER #4
.idata$5 name
RAW DATA #4
00000000 00 00 00 00 ....
...
SECTION HEADER #5
.idata$4 name
RAW DATA #5
00000000 00 00 00 00 ....
...
SECTION HEADER #6
.idata$6 name
RAW DATA #6
00000000 00 00 41 63 74 69 76 61 | 74 65 4B 65 79 62 6F 61 ..Activa|teKeyboa
00000010 72 64 4C 61 79 6F 75 74 | 00 00 rdLayout|..
...
COFF SYMBOL TABLE
...
003 00000000 SECT2 notype () External | _ActivateKeyboardLayout@8