zlib.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	zlib.dll
size	37408 (0x9220)
md5	4758c1b39190eb30bc9a597e208d6937

type	PE32 executable (DLL) (Windows CE) ARM, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000080:

PE Header

Signature	PE
Machine	0x1c0
NumberOfSections	3
TimeDateStamp	0x4e94f9d8
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2123
Magic	0x10b
LinkerVersion	6.1
SizeOfCode	0x8a00
SizeOfInitializedData	0x6fc
SizeOfUninitializedData	0
AddressOfEntryPoint	0x948c
BaseOfCode	0x1000
BaseOfData	0xa000
ImageBase	0x40110000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xd000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	9
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8a00	0x8a00	R-X CODE
.data	0xa000	0x4dc	0x200	RW- IDATA
.pdata	0xb000	0x220	0x220	R-- IDATA

Data Directory

type	va	size
EXPORT	0x9840	0x1c0
IMPORT	0x97d4	0x28
RESOURCE	0	0
EXCEPTION	0xb000	0x220
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
COREDLL.dll		1044
COREDLL.dll		1047
COREDLL.dll		1346
COREDLL.dll		1018
COREDLL.dll		1645
COREDLL.dll		87
COREDLL.dll		2696
COREDLL.dll		1876
COREDLL.dll		1232
COREDLL.dll		544

ord	entry_va	function_name
1	0x30e4	adler32
2	0x3308	crc32
3	0x34b8	deflate
4	0x3868	deflateEnd
5	0x490c	deflateInit2_
6	0x4b8c	deflateInit_
7	0x47e4	deflateReset
8	0x32e4	get_crc_table
9	0x4df4	inflate
10	0x4c34	inflateEnd
11	0x4ca0	inflateInit2_
12	0x4dd8	inflateInit_
13	0x4bcc	inflateReset
14	0x5358	inflateSetDictionary
15	0x5400	inflateSync
16	0x54fc	inflateSyncPoint
17	0x553c	uncompress
18	0x55e0	zlibVersion

module_name	ZLIB.dll
flags	0
timestamp	2011-10-12 02:22:13
version	0.0
ordinal_base	1
nFunctions	18
nNames	18
Names(18)	0x98b0
Functions(18)	0x9868
NameOrdinals(18)	0x98f8

show previews

offset	size	type	comment
0	37408	DLL	10/12/2011 02:22:16	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK