问题
Are any sections at all not loaded by the PE loader? Or are every section specified in the section headers loaded? In ELF programs, it's section headers (Called program headers, or segments) that are supposed to be loaded are those that are flagged with PT_LOAD. Is there anything similar to that in PE programs?
PS. I found the flag IMAGE_SCN_MEM_DISCARDABLE. Are sections flagged with that not loaded?
回答1:
When a relocation section is available, but the PE image does not need to be relocated, the loader does not load the relocation section. If a PE image has been digitally signed, it has a section that contains the certificate. This section is not loaded by the loader. Additionally, if a debug section is available, this is also not loaded by the loader.
回答2:
Well, DOS Stub is not a Section!
As a general rule, some parts of the PE file can be read, but not mapped in memory (like relocations). And some parts are not mapped at all. Debugging information at the end of the file, is an instance of such a situation.
Usually the data placed at the end of the file -past any parts in the file (that are willing to be mapped)- are not mapped in memory.
来源：https://stackoverflow.com/questions/8954446/what-sections-are-not-loaded-by-the-pe-loader