Ggtcf

I am reviewing the Microsoft specification on Portable Executable files (EXE files). In particular, I am reviewing the .edata (export data) section. Here's what the specification says about the edata section:

The export data section, named .edata, contains information about
symbols that other images can access through dynamic linking. Exported
symbols are generally found in DLLs, but DLLs can also import symbols.

Can a non-DLL file have an edata section? Specifically, can a C program, after compiling and linking, result in an EXE file that contains an edata section? If yes, would you show a simple C program that, after compiling and linking, results in an EXE file that contains an edata section, please?

Any PE Image file may contain an export table, regardless of whether it is an EXE or DLL. However, the export tables are not necessarily contained within an .edata section. It is, for example, common to see export tables in the .rdata section instead.

To locate the export table, you should use the Export Table data directory, and not rely on the Section Table at all.

The following is an example C program that, when compiled, will produce an EXE with an export table. However, it might not be placed inside an .edata section (and the EXE might not have an .edata section at all).

#include <stdio.h>

__declspec(dllexport) void some_func(void)

 printf("Hellon");
 return;


int main()

 return 0;

When I compile this program using Visual Studio 2017 on my system, and run dumpbin /HEADERS /EXPORTS on the resulting EXE, I see the following:

...

SECTION HEADER #3
 .rdata name
 2A94 virtual size
 19000 virtual address (0000000140019000 to 000000014001BA93)
 2C00 size of raw data
 7E00 file pointer to raw data (00007E00 to 0000A9FF)
 0 file pointer to relocation table
 0 file pointer to line numbers
 0 number of relocations
 0 number of line numbers
40000040 flags
 Initialized Data
 Read Only

...


 Section contains the following exports for SampleApp.exe

 00000000 characteristics
 FFFFFFFF time date stamp
 0.00 version
 1 ordinal base
 1 number of functions
 1 number of names

 ordinal hint RVA name

 1 0 0001108C some_func = @ILT+135(some_func)

which confirms that the Export Table was put in the .rdata section in this case.