“未映射数据”中有什么？ PE 的一部分？
有人知道吗？
在我看来， PE 的大部分空间都被 Unmapped Data 占用，在大多数情况下都是这种情况吗？
Anyone knows?
It seems to me most space of PE is taken up by Unmapped Data , is this the case in most occasions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，大多数情况并非如此。
尽管可以有，但最后一部分之后不应有任何数据。如果存在，则该数据不会加载到内存中，因此可执行文件可能在运行时对其自己的文件映像执行一些可疑操作。
No that is not the case in most situations.
There should be no data past the last section, though there can be. If there is, it will be data that is not loaded into memory and hence the executable might be doing something fishy with its own fileimage at runtime.
通常会有一些未映射的数据，特别是在包含未初始化数据的.bss部分，但大多数PE都会映射到某些东西。例如，如果 .text 部分包含未映射的数据，则这是一个明显的迹象，表明您正在查看一个奇怪的二进制文件，该二进制文件可能已被防御性加壳工具混淆。
你的问题让我想知道你在用什么来查看二进制文件。我会推荐 OllyDbg 或 Ida Pro。程序的大部分地址空间将被取消映射，但 PE 加载到的内存不会被取消映射。
There is often some unmapped data, particularly in the .bss section which contains uninitialized data, but most of the PE will mapped to something. If, for example, the .text section contains unmapped data, it's a clear sign that you're looking at a weird binary that's probably been obfuscated by a defensive packer tool.
Your question makes me wonder what you're looking at the binary with. I would recommend OllyDbg or Ida Pro. Most of the program's address space will be unmapped, but not the memory that the PE loads into.