2

I have a file that among other sections has:

  • code
  • .text
  • .bss

And this file was not crafted manually, so I suspect.

The question is what could be the meaning of code and .text sections? As far as I know, executable code is located in .text section, so why compiler would add the other one?

If you need more information for answer I'll try to provide as much as I can.

perror
  • 19,083
  • 29
  • 87
  • 150
PhoeniX
  • 3,052
  • 16
  • 30

5 Answers5

6

In general .code and .text sections are synonymous. Both of those section contain executable code. Whereas, .data section contains non-executable data.

.bss segment is usually added due to optimization. The size of .bss is usually really small since it is designated to hold uninitialized data. In comparison, .data segment is designated to hold global/static variables and data structures.

Second code segment was most likely added manually.

Now, it is impossible to answer why the binary has two sections of code just by looking at the names. I think it is obviously unusual. I can state one thing for sure, you have two sections for a reason. However, you gonna have to fig in to figure out what the reason is.

First thing I would do is try to confirm segment permissions and CLASS. True code segment will have Read and Execute permissions. You can use lots of different tools to verify it. For instance, if you were to use IDA, it is done with Segments Subview, which could be accessed with Shift + F7. You might get lucky and spot the fake right from the get go.

PSS
  • 3,088
  • 1
  • 21
  • 35
2

Section names .text and .bss are default names used by Microsoft's VC++ compiler. While CODE is used by Borland's compiler, code is not.

As such, it would seem as though this PE file was created with Microsoft VC++ and the code section was added manually by the PE file's author. However, section names can be modified to be any value up to 8 characters (and are ignored by the Windows loader), so take this with a grain of salt.

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • "Firstly, the linker names the sections, not the compiler." This is simply not true. Where do you think the linker gets the names from? – Jonathon Reinhart Jun 28 '13 at 05:20
  • Well, technically, the compiler suggest names for the sections. But, indeed, this is up to the linker to create the sections and name it. I do think that Jason is right. – perror Jun 28 '13 at 07:54
  • You're correct; I've edit my post above. Thanks for spotting the error ;) – Jason Geffner Jun 28 '13 at 12:58
2

You can create arbitrary sections, with any name you wish in a PE file.

.text and code sections ring a bell, perhaps this is a packed executable? I cannot remember which packer, however.

Jonathon Reinhart
  • 565
  • 3
  • 10
  • No, it is a plain file. – PhoeniX Jun 28 '13 at 13:09
  • @ph0sec How do you know? Packed executables still look and run like their native formats (PE), but there is code embedded inside to unpack the obfuscated hidden code. – Jonathon Reinhart Jun 28 '13 at 22:19
  • I saw it in packed executables too – Cream Cracker Jun 29 '13 at 04:11
  • Yes, you are both right. It's just in that particular case, I've already unpacked it and removed all layers of obfuscation. I did not get to the code that is placed in .code section. All my analysis was concentrated on the .text section. – PhoeniX Jun 29 '13 at 19:06
1

Using #pragma data_seg(.xxxxx) one can create a separate section and it is possible for the name to be .code, as section names are just names and are alterable.

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
blabb
  • 1,346
  • 9
  • 11
1

Section names don't mean anything to the PE loader and you can set them manually or change them using hex editors. So the only real way of knowing the section's real properties is by checking IMAGE_SECTION_HEADER's Characteristics field. Use a PE dumping utility like dumpbin and check to see if the section is marked as executable.

shebaw
  • 685
  • 6
  • 13