Structures contained in the .pdata section

I need to read the ".pdata" section of the x64 PE file.
I saw that the structures in the ".pdata" section are different from one platform to another. http://msdn.microsoft.com/en-us/library/aa448751.aspx
He also says the same thing in the PE specifications document.
But I do not understand what it is for ordinary windows (XP / Vista / Win7, etc.)

Anyone what it is?

+6
source share
1 answer

The .pdata section is an array of RUNTIME_FUNCTION . It gives you a range of code (the first two members) and RVA for the corresponding UNWIND_INFO .

From there, you get information such as an RVA exception handler, prolog size, etc.

+6
source

Source: https://habr.com/ru/post/911239/


All Articles