gets.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	gets.exe
size	128131 (0x1f483)
md5	6778b44fb3b00447e94b99a41f32c07b

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xf
TimeDateStamp	0x57164e48
PointerToSymbolTable	0x16e00
NumberOfSymbols	0x646
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	2.23
SizeOfCode	0x2400
SizeOfInitializedData	0x3800
SizeOfUninitializedData	0x600
AddressOfEntryPoint	0x1500
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x21000
SizeOfHeaders	0x400
CheckSum	0x2ae47
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2264	0x2400	R-X CODE IDATA
.data	0x4000	0xa8	0x200	RW- IDATA
.rdata	0x5000	0x538	0x600	R-- IDATA
.bss	0x6000	0x410	0	RW- UDATA
.idata	0x7000	0x7ac	0x800	RW- IDATA
.CRT	0x8000	0x34	0x200	RW- IDATA
.tls	0x9000	0x20	0x200	RW- IDATA
/4	0xa000	0x398	0x400	R-- IDATA DISCARDABLE
/19	0xb000	0xbffa	0xc000	R-- IDATA DISCARDABLE
/31	0x17000	0x2008	0x2200	R-- IDATA DISCARDABLE
/45	0x1a000	0x1f18	0x2000	R-- IDATA DISCARDABLE
/57	0x1c000	0xa24	0xc00	R-- IDATA DISCARDABLE
/70	0x1d000	0x2dc	0x400	R-- IDATA DISCARDABLE
/81	0x1e000	0x175e	0x1800	R-- IDATA DISCARDABLE
/92	0x20000	0x318	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x7000	0x7ac
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x9000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x7154	0x118
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x409018	0x40901c	0x406030	0x408020	0	0

module_name	hint	function_name
KERNEL32.dll	83	CloseHandle
KERNEL32.dll	132	CreateEventA
KERNEL32.dll	183	CreateThread
KERNEL32.dll	212	DeleteCriticalSection
KERNEL32.dll	234	DuplicateHandle
KERNEL32.dll	239	EnterCriticalSection
KERNEL32.dll	452	GetCurrentProcess
KERNEL32.dll	453	GetCurrentProcessId
KERNEL32.dll	456	GetCurrentThread
KERNEL32.dll	457	GetCurrentThreadId
KERNEL32.dll	515	GetLastError
KERNEL32.dll	612	GetStartupInfoA
KERNEL32.dll	635	GetSystemTimeAsFileTime
KERNEL32.dll	649	GetThreadContext
KERNEL32.dll	663	GetTickCount
KERNEL32.dll	747	InitializeCriticalSection
KERNEL32.dll	754	InterlockedCompareExchange
KERNEL32.dll	756	InterlockedExchange
KERNEL32.dll	806	LeaveCriticalSection
KERNEL32.dll	915	QueryPerformanceCounter
KERNEL32.dll	982	ResumeThread
KERNEL32.dll	1117	SetThreadPriority
KERNEL32.dll	1127	SetUnhandledExceptionFilter
KERNEL32.dll	1138	SignalObjectAndWait
KERNEL32.dll	1140	Sleep
KERNEL32.dll	1148	SuspendThread
KERNEL32.dll	1154	TerminateProcess
KERNEL32.dll	1161	TlsGetValue
KERNEL32.dll	1174	UnhandledExceptionFilter
KERNEL32.dll	1206	VirtualProtect
KERNEL32.dll	1209	VirtualQuery
KERNEL32.dll	1218	WaitForSingleObject
msvcrt.dll	55	__dllonexit
msvcrt.dll	58	__getmainargs
msvcrt.dll	59	__initenv
msvcrt.dll	68	__lconv_init
msvcrt.dll	104	__set_app_type
msvcrt.dll	107	__setusermatherr
msvcrt.dll	122	_acmdln
msvcrt.dll	144	_amsg_exit
msvcrt.dll	161	_cexit
msvcrt.dll	200	_close
msvcrt.dll	221	_errno
msvcrt.dll	273	_fmode
msvcrt.dll	349	_initterm
msvcrt.dll	353	_iob
msvcrt.dll	458	_lock
msvcrt.dll	625	_onexit
msvcrt.dll	627	_open
msvcrt.dll	838	_unlock
msvcrt.dll	1007	_write
msvcrt.dll	1054	abort
msvcrt.dll	1067	calloc
msvcrt.dll	1078	exit
msvcrt.dll	1094	fprintf
msvcrt.dll	1101	free
msvcrt.dll	1112	fwrite
msvcrt.dll	1119	gets
msvcrt.dll	1159	malloc
msvcrt.dll	1167	memcpy
msvcrt.dll	1170	memset
msvcrt.dll	1174	perror
msvcrt.dll	1175	printf
msvcrt.dll	1195	signal
msvcrt.dll	1215	strlen
msvcrt.dll	1218	strncmp
msvcrt.dll	1236	system
msvcrt.dll	1251	vfprintf

show previews

offset	size	type	comment
0	93696	EXE	04/19/2016 15:27:04	#
15c1	15	HTM		#
16e00	34435	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x6030