> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/malware/data-directories.md).

# Data directories

The `IMAGE_DATA_DIRECTORY` structure contains two members. A *VirtualAddress,* which points to the start of a particular data directory structure; and a Size, which is the size of that data directory. These data directories contain information needed by the Windows loader, for example, the import directory contains details of the modules (DLLs) that PE requires to function.

### Sections

The PE sections contain the actual data and executable code of the program. These typically include: 

* **.text** - the executables code of the program 
* **.data** - initialised data.
* **.bss** - uninitialised data.
* **.rdata** - read-only data.
* **.rsrc** - resources used by the program such as icons.

\
Each section is appended to the a header that describes it. A section header contains a:

* **Name** - the name of the section. This field is limited to 8-bytes.
* **VirtualSize** - the total size of the section when loaded into memory. 
* **VirtualAddress** - the memory address of the section when loaded into memory. The value is an offset relative to the image's base address. 
* **SizeOfRawData** - the size of the section as it is stored on disk. This size may be different to its virtual size, e.g. if it's padded. 
* **Characteristics** - a set of flags that describe the characteristics of the section. One such characteristics is the final memory permissions that this section memory should be (e.g. R, RW, RX, etc.)