Why so many additional sections in the PE file after compiling by Dev C++?

问题

I wrote some simple code by C/C++ ,compiling by Dev C++(MinGW) in PE format on win10 .

I used the tool "Stud PE" to review the PE file structure of the compiled exe as follows:

As you can see,in addition to the normal file sections like .text ,.data , .bss ... , there are some other sections with the name like /4,/19,/31 ... .

How can I know what's the purpose of these sections ? for debugging?? (but why so many sections with strange name ?)

Is there any documentation or material to explain the purpose of theses sections,and how could I turn off generating these sections in Dev C++ ?

Thank you ~

回答1:

In PE executables, section names of the form /[n] reference offset [n] into the COFF string table for their names.

You can use gnu binutils' objdump -h to see the real names of these sections.

Generally the long named sections are ones added by gcc or clang for DWARF debug info, along with .eh_frame, which stores unwind information for each function.

There is no code in any of these sections, but their formats are documented (although DWARF is nontrivial to read).

Your output is likely to be something like this:

/Users/arty/dev/reactos/emacs-24.5/bin/addpm.exe:     file format pei-i386

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         000017b0  00401000  00401000  00000600  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE, DATA
  1 .data         00000010  00403000  00403000  00001e00  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  2 .rdata        00000b80  00404000  00404000  00002000  2**5
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  3 .eh_frame     00000150  00405000  00405000  00002c00  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  4 .bss          00000078  00406000  00406000  00000000  2**2
                  ALLOC
  5 .idata        000006f8  00407000  00407000  00002e00  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  6 .CRT          00000018  00408000  00408000  00003600  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  7 .tls          00000020  00409000  00409000  00003800  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  8 .debug_aranges 00000108  0040a000  0040a000  00003a00  2**0
                  CONTENTS, READONLY, DEBUGGING
  9 .debug_pubnames 00000388  0040b000  0040b000  00003c00  2**0
                  CONTENTS, READONLY, DEBUGGING
 10 .debug_pubtypes 00000469  0040c000  0040c000  00004000  2**0
                  CONTENTS, READONLY, DEBUGGING
 11 .debug_info   00004ea5  0040d000  0040d000  00004600  2**0
                  CONTENTS, READONLY, DEBUGGING
 12 .debug_abbrev 00000c0c  00412000  00412000  00009600  2**0
                  CONTENTS, READONLY, DEBUGGING
 13 .debug_line   00000be4  00413000  00413000  0000a400  2**0
                  CONTENTS, READONLY, DEBUGGING
 14 .debug_frame  000003c4  00414000  00414000  0000b000  2**2
                  CONTENTS, READONLY, DEBUGGING
 15 .debug_str    0000017e  00415000  00415000  0000b400  2**0
                  CONTENTS, READONLY, DEBUGGING
 16 .debug_loc    00001049  00416000  00416000  0000b600  2**0
                  CONTENTS, READONLY, DEBUGGING
 17 .debug_macro  0007c3c9  00418000  00418000  0000c800  2**0
                  CONTENTS, READONLY, DEBUGGING
 18 .debug_ranges 00000090  00495000  00495000  00088c00  2**0
                  CONTENTS, READONLY, DEBUGGING

来源：https://stackoverflow.com/questions/39543487/why-so-many-additional-sections-in-the-pe-file-after-compiling-by-dev-c

标签

c++

dev-c++

portable-executable