adplus-dvertising
frame-decoration

Question

What is a file-backed section object?

a.

A section object created for the purpose of sharing data between two processes or between applications and the kernel

b.

A section object attached to a physical file on the hard drive

c.

A section object used to load executable images

d.

A section object used for temporary storage of information

Posted under Reverse Engineering

Answer: (b).A section object attached to a physical file on the hard drive Explanation:A file-backed section object is attached to a physical file on the hard drive. This means that when it is first mapped, it will contain the contents of the file to which it is attached. If it is writable, any changes made to the data while the object is mapped into memory will be written back into the file. A file-backed section object is a convenient way of accessing a file, because instead of using cumbersome APIs such as ReadFile and WriteFile, a program can just directly access the data in memory using a pointer. The system uses file-backed section objects for a variety of purposes, including the loading of executable images.

Engage with the Community - Add Your Comment

Confused About the Answer? Ask for Details Here.

Know the Explanation? Add it Here.

Q. What is a file-backed section object?