In the Portable Executable format, there is a directory named IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG. Can someone provide a URL with a good explanation of this directory and its real usage? Why do some apps use this feature?
+1
A:
It seems originally it was used for some rarely-used features (e.g. LockPrefixTable, I've only seen it in kernel32.dll). These days you generally only see it used for the /safeseh feature (SEHandlerTable/SEHandlerCount).
Igor Skochinsky
2010-10-13 13:26:12
Notepad.exe, mspaint.exe and many others contain the IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG directory! Both PeStudio and CFF Explorer show the existence of this directory. It seems like this directory has an new usage.
marc ochsenmeier
2010-10-14 11:13:46
As I said, it's used for SafeSEH these days.
Igor Skochinsky
2010-10-14 13:16:40