simple_dll.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	simple_dll.dll
size	122143 (0x1dd1f)
md5	05ef0a88a8df51264e3ab0f5bf7b23e9

type	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x55c9c9f9
PointerToSymbolTable	0x13e00
NumberOfSymbols	0x58f
SizeOfOptionalHeader	0xe0
Characteristics	0x2306
Magic	0x10b
LinkerVersion	2.23
SizeOfCode	0xb400
SizeOfInitializedData	0x13a00
SizeOfUninitializedData	0x200
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0xd000
ImageBase	0x685c0000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1b000
SizeOfHeaders	0x400
CheckSum	0x2a764
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xb384	0xb400	R-X CODE IDATA
.data	0xd000	0x4a44	0x4c00	RW- IDATA
.rdata	0x12000	0x20d0	0x2200	R-- IDATA
.bss	0x15000	0x68	0	RW- UDATA
.edata	0x16000	0x52	0x200	R-- IDATA
.idata	0x17000	0x4d0	0x600	RW- IDATA
.CRT	0x18000	0x18	0x200	RW- IDATA
.tls	0x19000	0x20	0x200	RW- IDATA
.reloc	0x1a000	0xb84	0xc00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x16000	0x52
IMPORT	0x17000	0x4d0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1a000	0xb84
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x19000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x17100	0xb0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x685d9019	0x685d901c	0x685d5010	0x685d8004	0	0

module_name	hint	function_name
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	169	CreateSemaphoreA
KERNEL32.dll	207	DeleteCriticalSection
KERNEL32.dll	236	EnterCriticalSection
KERNEL32.dll	451	GetCurrentThreadId
KERNEL32.dll	510	GetLastError
KERNEL32.dll	529	GetModuleHandleA
KERNEL32.dll	577	GetProcAddress
KERNEL32.dll	734	InitializeCriticalSection
KERNEL32.dll	743	InterlockedDecrement
KERNEL32.dll	747	InterlockedIncrement
KERNEL32.dll	814	LeaveCriticalSection
KERNEL32.dll	978	ReleaseSemaphore
KERNEL32.dll	1091	SetLastError
KERNEL32.dll	1152	Sleep
KERNEL32.dll	1171	TlsAlloc
KERNEL32.dll	1172	TlsFree
KERNEL32.dll	1173	TlsGetValue
KERNEL32.dll	1174	TlsSetValue
KERNEL32.dll	1213	VirtualProtect
KERNEL32.dll	1215	VirtualQuery
KERNEL32.dll	1223	WaitForSingleObject
msvcrt.dll	109	_write
msvcrt.dll	52	__dllonexit
msvcrt.dll	182	_errno
msvcrt.dll	266	_iob
msvcrt.dll	583	abort
msvcrt.dll	595	calloc
msvcrt.dll	610	fflush
msvcrt.dll	620	fputc
msvcrt.dll	621	fputs
msvcrt.dll	625	free
msvcrt.dll	633	fwrite
msvcrt.dll	676	malloc
msvcrt.dll	681	memcmp
msvcrt.dll	682	memcpy
msvcrt.dll	698	realloc
msvcrt.dll	709	sprintf
msvcrt.dll	715	strcmp
msvcrt.dll	721	strlen
msvcrt.dll	748	vfprintf

ord	entry_va	function_name
1	0x1259	CreateTestObject

module_name	simple_dll.dll
flags	0
timestamp	2015-08-11 10:10:01
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x1602c
Functions(1)	0x16028
NameOrdinals(1)	0x16030

show previews

offset	size	type	comment
0	81408	DLL	08/11/2015 10:10:01	#
15c1	15	HTM		#
13e00	40735	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x15010