Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: PE Section Name Descriptions SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
PE Section Name Descriptions

PE files (.exe, .dll, ...) have sections: a section with code, one with data, ... Each section has a name, and different compilers use different section names. Section names can help us identify the compiler and the type of PE file we are analyzing.

@Hexacorn compiled a list of section names with corresponding description, you can find the latest version here. I find this list so useful, that I included it (with permission) in my tool. pecheck is a Python tool to analyze PE files, based on Ero Carrera's pefile module. Use -o s (overview of sections) to see the sections, with name, size, entropy and description:

Didier Stevens
Microsoft MVP


417 Posts
ISC Handler
Congrats on the Microsoft MVP!

417 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!