PE Loader Questions

Originally Posted by dila

1) Is it possible that a valid executable can have overlapping sections?
2) Is it possible for a single code instruction to overflow into another section?
3) Is it possible to have executable code between two sections, and if so, what memory characteristics are given to data in such a region?

Regards!

1. each PE section has more characteristics: the raw and rva fields and some sizes. raw is the offset of the section in the file and the rva - an offset in memory where the section will be copied. the loader doesn't check if the raw data overlaps, as I know till now. off course, there may be some checks in future windows versions.
2. possible, if you have the section already rounded. needs testing.
3. between 2 sections where? inside the file or in mem? to exist in mem, must be declared as a section, because the loader maps in mem only what it finds in sections header.