1 | PE signature found
|
2 |
|
3 | File Type: EXECUTABLE IMAGE
|
4 |
|
5 | FILE HEADER VALUES
|
6 | 14C machine (x86)
|
7 | 3 number of sections
|
8 | 56431792 time date stamp Wed Nov 11 11:25:22 2015
|
9 | 0 file pointer to symbol table
|
10 | 0 number of symbols
|
11 | E0 size of optional header
|
12 | 102 characteristics
|
13 | Executable
|
14 | 32 bit word machine
|
15 |
|
16 | OPTIONAL HEADER VALUES
|
17 | 10B magic # (PE32)
|
18 | 11.00 linker version
|
19 | 2400 size of code
|
20 | 800 size of initialized data
|
21 | 0 size of uninitialized data
|
22 | 42FE entry point (004042FE)
|
23 | 2000 base of code
|
24 | 6000 base of data
|
25 | 400000 image base (00400000 to 00409FFF)
|
26 | 2000 section alignment
|
27 | 200 file alignment
|
28 | 4.00 operating system version
|
29 | 0.00 image version
|
30 | 6.00 subsystem version
|
31 | 0 Win32 version
|
32 | A000 size of image
|
33 | 200 size of headers
|
34 | 0 checksum
|
35 | 2 subsystem (Windows GUI)
|
36 | 8560 DLL characteristics
|
37 | High Entropy Virtual Addresses
|
38 | Dynamic base
|
39 | NX compatible
|
40 | No structured exception handler
|
41 | Terminal Server Aware
|
42 | 100000 size of stack reserve
|
43 | 1000 size of stack commit
|
44 | 100000 size of heap reserve
|
45 | 1000 size of heap commit
|
46 | 0 loader flags
|
47 | 10 number of directories
|
48 | 0 [ 0] RVA [size] of Export Directory
|
49 | 42A8 [ 53] RVA [size] of Import Directory
|
50 | 6000 [ 5E8] RVA [size] of Resource Directory
|
51 | 0 [ 0] RVA [size] of Exception Directory
|
52 | 0 [ 0] RVA [size] of Certificates Directory
|
53 | 8000 [ C] RVA [size] of Base Relocation Directory
|
54 | 4170 [ 1C] RVA [size] of Debug Directory
|
55 | 0 [ 0] RVA [size] of Architecture Directory
|
56 | 0 [ 0] RVA [size] of Global Pointer Directory
|
57 | 0 [ 0] RVA [size] of Thread Storage Directory
|
58 | 0 [ 0] RVA [size] of Load Configuration Directory
|
59 | 0 [ 0] RVA [size] of Bound Import Directory
|
60 | 2000 [ 8] RVA [size] of Import Address Table Directory
|
61 | 0 [ 0] RVA [size] of Delay Import Directory
|
62 | 2008 [ 48] RVA [size] of COM Descriptor Directory
|
63 | 0 [ 0] RVA [size] of Reserved Directory
|
64 |
|
65 |
|
66 | SECTION HEADER #1
|
67 | .text name
|
68 | 2304 virtual size
|
69 | 2000 virtual address (00402000 to 00404303)
|
70 | 2400 size of raw data
|
71 | 200 file pointer to raw data (00000200 to 000025FF)
|
72 | 0 file pointer to relocation table
|
73 | 0 file pointer to line numbers
|
74 | 0 number of relocations
|
75 | 0 number of line numbers
|
76 | 60000020 flags
|
77 | Code
|
78 | Execute Read
|
79 |
|
80 | Debug Directories
|
81 |
|
82 | Time Type Size RVA Pointer
|
83 | -------- ------ -------- -------- --------
|
84 | 56431792 cv 11C 0000418C 238C Format: RSDS, {36688253-6563-4
|
85 | 7A7-856B-0CD6F31C2612}, 1, c:\projekte\...
|
86 |
|
87 | SECTION HEADER #2
|
88 | .rsrc name
|
89 | 5E8 virtual size
|
90 | 6000 virtual address (00406000 to 004065E7)
|
91 | 600 size of raw data
|
92 | 2600 file pointer to raw data (00002600 to 00002BFF)
|
93 | 0 file pointer to relocation table
|
94 | 0 file pointer to line numbers
|
95 | 0 number of relocations
|
96 | 0 number of line numbers
|
97 | 40000040 flags
|
98 | Initialized Data
|
99 | Read Only
|
100 |
|
101 | SECTION HEADER #3
|
102 | .reloc name
|
103 | C virtual size
|
104 | 8000 virtual address (00408000 to 0040800B)
|
105 | 200 size of raw data
|
106 | 2C00 file pointer to raw data (00002C00 to 00002DFF)
|
107 | 0 file pointer to relocation table
|
108 | 0 file pointer to line numbers
|
109 | 0 number of relocations
|
110 | 0 number of line numbers
|
111 | 42000040 flags
|
112 | Initialized Data
|
113 | Discardable
|
114 | Read Only
|
115 |
|
116 | Summary
|
117 |
|
118 | 2000 .reloc
|
119 | 2000 .rsrc
|
120 | 4000 .text
|
