phln

info
MZ
PE
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	phln
size	3142 (0xc46)
md5	6b46484c227d8befa04c7a8f5a07399d

type	MS-DOS executable PE32 executable (DLL) (native) Intel 80386, for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0x4550
ss	0
sp	0x14c
checksum	2
ip	0x5656
cs	0x4f17
reloc_table_offset	0
overlay_number	0
reserved0	0x210200e000000000
oem_id	0x10b
oem_info	0xa
reserved2	0xa00
reserved3	0x200
reserved4	0
reserved5	0x1675
reserved6	0x1000
lfanew	0xc

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x4f175656
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0xa00
SizeOfInitializedData	0x200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1675
BaseOfCode	0x1000
BaseOfData	0xc
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x3000
SizeOfHeaders	0x200
CheckSum	0x7312
Subsystem	1
DllCharacteristics	0x540
SizeOfStackReserve	0
SizeOfStackCommit	0
SizeOfHeapReserve	0
SizeOfHeapCommit	0
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8e6	0xa00	R-X CODE
.reloc	0x2000	0x5c	0x46	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1040	0xfa
IMPORT	0x1778	0x28
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x2000	0x44
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x34
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
ntoskrnl.exe	184		FsRtlAllocatePool
ntoskrnl.exe	1392		ZwDeviceIoControlFile
ntoskrnl.exe	1376		ZwClose
ntoskrnl.exe	887		ObfDereferenceObject
ntoskrnl.exe	879		ObReferenceObjectByHandle
ntoskrnl.exe	387		IoFileObjectType
ntoskrnl.exe	1416		ZwOpenFile
ntoskrnl.exe	454		IoRegisterPlugPlayNotification
ntoskrnl.exe	357		IoCreateDriver
ntoskrnl.exe	87		ExFreePoolWithTag
ntoskrnl.exe	122		ExQueueWorkItem
ntoskrnl.exe	991		PsSetLoadImageNotifyRoutine

ord	entry_va	function_name
1	0x1661	KdD0Transition
2	0x166b	KdD3Transition
3	0x1722	KdDebuggerInitialize0
4	0x172e	KdDebuggerInitialize1
5	0x175e	KdReceivePacket
6	0x1748	KdRestore
7	0x173c	KdSave
8	0x1754	KdSendPacket

module_name	kdcom.dll
flags	0
timestamp	2012-01-18 23:31:34
version	0.0
ordinal_base	1
nFunctions	8
nNames	8
Names(8)	0x1088
Functions(8)	0x1068
NameOrdinals(8)	0x10a8

show previews

offset	size	type	comment
0	3142	DLL	01/18/2012 23:31:34	#
15c1	15	HTM		#

Scanning the drive for archives:
1 file, 3142 bytes (4 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid DOS stub size -52