test.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	test.dll
size	45022 (0xafde)
md5	137695cf70b4438d1eee7954c2dd593d

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x10
TimeDateStamp	0x57746a99
PointerToSymbolTable	0x5c00
NumberOfSymbols	0x3bf
SizeOfOptionalHeader	0xf0
Characteristics	0x2026
Magic	0x20b
LinkerVersion	2.25
SizeOfCode	0x1e00
SizeOfInitializedData	0x3e00
SizeOfUninitializedData	0xa00
AddressOfEntryPoint	0x1400
BaseOfCode	0x1000
ImageBase	0x6bec0000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x12000
SizeOfHeaders	0x600
CheckSum	0xb947
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1c08	0x1e00	R-X CODE IDATA
.data	0x3000	0x58	0x200	RW- IDATA
.rdata	0x4000	0x6b0	0x800	R-- IDATA
.pdata	0x5000	0x234	0x400	R-- IDATA
.xdata	0x6000	0x1d4	0x200	R-- IDATA
.bss	0x7000	0x930	0	RW- UDATA
.edata	0x8000	0x74	0x200	R-- IDATA
.idata	0x9000	0x6c8	0x800	RW- IDATA
.CRT	0xa000	0x58	0x200	RW- IDATA
.tls	0xb000	0x68	0x200	RW- IDATA
.reloc	0xc000	0x48	0x200	R-- IDATA DISCARDABLE
/4	0xd000	0x50	0x200	R-- IDATA DISCARDABLE
/19	0xe000	0xe1c	0x1000	R-- IDATA DISCARDABLE
/31	0xf000	0x89	0x200	R-- IDATA DISCARDABLE
/45	0x10000	0x12d	0x200	R-- IDATA DISCARDABLE
/57	0x11000	0x48	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x8000	0x74
IMPORT	0x9000	0x6c8
RESOURCE	0	0
EXCEPTION	0x5000	0x234
SECURITY	0	0
BASERELOC	0xc000	0x48
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xb020	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x91d0	0x168
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x6becb000	0x6becb060	0x6bec75ac	0x6beca030	0	0

module_name	hint	function_name
KERNEL32.dll	216	DeleteCriticalSection
KERNEL32.dll	248	EnterCriticalSection
KERNEL32.dll	461	GetCurrentProcess
KERNEL32.dll	462	GetCurrentProcessId
KERNEL32.dll	466	GetCurrentThreadId
KERNEL32.dll	528	GetLastError
KERNEL32.dll	548	GetModuleHandleA
KERNEL32.dll	598	GetProcAddress
KERNEL32.dll	650	GetSystemTimeAsFileTime
KERNEL32.dll	677	GetTickCount
KERNEL32.dll	761	InitializeCriticalSection
KERNEL32.dll	843	LeaveCriticalSection
KERNEL32.dll	955	QueryPerformanceCounter
KERNEL32.dll	1025	RtlAddFunctionTable
KERNEL32.dll	1026	RtlCaptureContext
KERNEL32.dll	1033	RtlLookupFunctionEntry
KERNEL32.dll	1040	RtlVirtualUnwind
KERNEL32.dll	1183	SetUnhandledExceptionFilter
KERNEL32.dll	1196	Sleep
KERNEL32.dll	1210	TerminateProcess
KERNEL32.dll	1217	TlsGetValue
KERNEL32.dll	1230	UnhandledExceptionFilter
KERNEL32.dll	1260	VirtualProtect
KERNEL32.dll	1262	VirtualQuery
msvcrt.dll	78	__dllonexit
msvcrt.dll	83	__iob_func
msvcrt.dll	122	_amsg_exit
msvcrt.dll	330	_initterm
msvcrt.dll	439	_lock
msvcrt.dll	611	_onexit
msvcrt.dll	819	_unlock
msvcrt.dll	1030	abort
msvcrt.dll	1047	calloc
msvcrt.dll	1086	free
msvcrt.dll	1097	fwrite
msvcrt.dll	1145	malloc
msvcrt.dll	1153	memcpy
msvcrt.dll	1183	signal
msvcrt.dll	1204	strlen
msvcrt.dll	1207	strncmp
msvcrt.dll	1239	vfprintf
CS_API.dll	577	InitCsCameraIf

ord	entry_va	function_name
1	0x1500	CloseCamera
2	0x14d0	InitCamera
3	0x1520	SetCameraGain

module_name	test.dll
flags	0
timestamp	2016-06-30 00:40:57
version	0.0
ordinal_base	1
nFunctions	3
nNames	3
Names(3)	0x8034
Functions(3)	0x8028
NameOrdinals(3)	0x8040

show previews

offset	size	type	comment
0	45022	DLL	06/30/2016 00:40:57	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x75ac