rdpcfgex.dll - Remote Desktop Session Host Server Connection Configuration Extension for the RDP protocol

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	rdpcfgex.dll
size	8704 (0x2200)
md5	03a88560ef6b5f746a9ac5ba1c0a36c7

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
149	30729	1
1	0	26
147	30729	9
146	30729	1
131	30729	12
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce7a163
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x1400
SizeOfInitializedData	0xc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1b4f
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x50000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x6000
SizeOfHeaders	0x400
CheckSum	0x916b
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1358	0x1400	R-X CODE
.data	0x3000	0x358	0x200	RW- IDATA
.rsrc	0x4000	0x5a0	0x600	R-- IDATA
.reloc	0x5000	0x17a	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x21f0	0x168
IMPORT	0x1f54	0x64
RESOURCE	0x4000	0x5a0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x5000	0x124
DEBUG	0x1080	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1338	0x40
Bound_IAT	0x270	0x58
IAT	0x1000	0x68
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MUI	#1	200	0
VERSION	#1	1060	0

module_name	hint	ord	function_name
ntdll.dll	1918		memset
ntdll.dll		1
msvcrt.dll	345		_except_handler4_common
msvcrt.dll	257		_amsg_exit
msvcrt.dll	469		_initterm
msvcrt.dll	1190		free
msvcrt.dll	1246		malloc
msvcrt.dll	106		_XcptFilter
KERNEL32.dll	748		InterlockedExchange
KERNEL32.dll	1202		Sleep
KERNEL32.dll	1188		SetUnhandledExceptionFilter
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	632		GetSystemTimeAsFileTime
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	658		GetTickCount
KERNEL32.dll	934		QueryPerformanceCounter
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	222		DisableThreadLibraryCalls
USER32.dll	506		LoadStringW

ord	entry_va	function_name
1	0x1555	ExGetCfgVersionInfo
2	0x157a	ExtEncryptionLevels
3	0x1410	ExtEnd
4	0x1594	ExtGetCapabilities
5	0x1486	ExtGetEncryptionLevelAndDescrEx
6	0x1430	ExtGetEncryptionLevelDescr
7	0x1658	ExtGetSecurityLayerDescrString
8	0x15da	ExtGetSecurityLayerName
9	0x15b7	ExtSecurityLayers
10	0x13ee	ExtStart

module_name	RDPCFGEX.dll
flags	0
timestamp	2010-11-20 08:25:04
version	0.0
ordinal_base	1
nFunctions	10
nNames	10
Names(10)	0x2240
Functions(10)	0x2218
NameOrdinals(10)	0x2268

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Remote Desktop Session Host Server Connection Configuration Extension for the RDP protocol
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	RDPCFGEX
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	RDPCFGEX.DLL
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0x40004

show previews

offset	size	type	comment
0	8704	DLL	11/20/2010 10:22:27	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x270

rdpcfgex.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

rdpcfgex.dll
-