2

I work with pe files analyzer sofwares like exeinfoPe and in section list part there are both .text and CODE section types that we can use them for example change .data name to .text or CODE or other section names. are these section typesthe same? what is difference between them?

7
  • Please see code segment and data segment. Sometimes, they can be the same. Jan 23, 2017 at 19:31
  • 1
    I believe you are talking about section names, not flags. There are some common section names, but they are not required. What count are in fact the flags (such as executable or writable).
    – Jester
    Jan 23, 2017 at 19:32
  • 2
    .code and .text segments are synonymous. Otherwise segments are usually not interchangeable. For example, those are read-only on many architectures. Jan 23, 2017 at 19:44
  • 1
    You've confused section names with section flags. CODE is a section flag and .text a section name. While the name of a section gives a pretty good clue what its used for, a section can be named anything and it's the section flags that determine what it can be used for.
    – Ross Ridge
    Jan 23, 2017 at 19:57
  • 1
    PE Explorer has mislead you. While CODE, specifically IMAGE_SCN_CNT_CODE, is a section flag that could, in combination with other flags, or absence of other flags, be considered to denote the type of a section, .text is just section name. By convention it has the flags IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ but sections with different names can also have this "type", and a section named .text can, at least in theory, have other flags. See the PECOFF spec for more details: msdn.microsoft.com/en-us/library/windows/desktop/…
    – Ross Ridge
    Jan 23, 2017 at 20:16

2 Answers 2

4

There is no functional difference between the .text and .code sections of a binary.

In almost all cases, they are completely synonymous (meaning that they refer to the same section), but even when they're not (e.g. due to the actual order of sections in the binary), they are semantically identical.

This is the section of the object file or address space that contains executable instructions ("code"), which are stored as plain text ("text"). It is almost always read-only, unlike the .data section.

Consult the documentation for your assembler, compiler, linker, or disassembler to see which name it prefers. The PE format uses .text.

0
0

There is no semantic difference between the .CODE and .TEXT sections. Just as in the MASM assembler, the instruction space address is named by .CODE section, and in other compilers is named by .CODE.

So when you assemble your code with MASM you will see .CODE section as well as .TEXT.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.