Penetration Testing Blog
.text
Section containing executable code.
.rdata
Globally accessible within the program for read-only data.
.data
Stores globally accessible data within the program.
.idata
Stores import function data, where relevant.
.edata
Stores export function data, where relevant.
.pdata
Stores exception handling data for x64 executables.
.rsrc
Stores program resources.
.reloc
Library file relocation information.
Immunity Debugger
IDA
GUnPacker
ImpREC
LordPE
MAP
OllyDB
PE Explorer
PeID
Process Hacker
Process Explorer
Strings
Procmon
Regshot
TCPView
UPX
Wireshark
Hash tool variant
Dependency Walker
Program dynamic link libraries (DLLs) can provide information about the functionality of a program. Here is a list and description of the most common Windows DLLs:
Kernel32.dll
Core functionality of access and modification of system memory, files and the hardware.
Advapi32.dll
Windows Service Manager and Registry access.
User32.dll
User interface components such as user controlled components, i.e. buttons and scroll bars.
Gdi32.dll
Graphics functionality.
Ntdll.dll
Windows kernel interface.
WSock32.dll and Ws2__32.dll
Network connectivity and related network functionality.
Wininet.dll
Application layer functions in networking, such as HTTP and FTP.