basesrv.dll - ReactOS Base API Server DLL

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	basesrv.dll
size	45056 (0xb000)
md5	97b50ded5e250a602da427af856f6903

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
257	27027	5
1	0	66
259	27027	1
260	27027	8
256	27027	1
255	27027	1
258	27027	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5c0cca53
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.20
SizeOfCode	0x6000
SizeOfInitializedData	0x4c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3350
BaseOfCode	0x1000
BaseOfData	0x7000
ImageBase	0x7a890000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	5.1
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xe000
SizeOfHeaders	0x400
CheckSum	0x18c69
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x5f7a	0x6000	R-X CODE
.rdata	0x7000	0xa74	0xc00	R-- IDATA
.data	0x8000	0x3364	0x3400	RW- IDATA
.rsrc	0xc000	0x390	0x400	R-- IDATA
.reloc	0xd000	0x778	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x72f0	0xc0
IMPORT	0x73b0	0x3c
RESOURCE	0xc000	0x390
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xd000	0x778
DEBUG	0x7110	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x7000	0x110
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	816	0

module_name	hint	function_name
csrsrv.dll	3	CsrCreateProcess
csrsrv.dll	5	CsrCreateThread
csrsrv.dll	12	CsrDestroyProcess
csrsrv.dll	17	CsrLockProcessByClientId
csrsrv.dll	31	CsrUnlockProcess
csrsrv.dll	16	CsrImpersonateClient
csrsrv.dll	24	CsrRevertToSelf
csrsrv.dll	33	CsrValidateMessageBuffer
ntdll.dll	16	DbgPrint
ntdll.dll	1369	swprintf
ntdll.dll	447	RtlAllocateHeap
ntdll.dll	619	RtlFreeHeap
ntdll.dll	426	RtlAddAccessAllowedAce
ntdll.dll	445	RtlAllocateAndInitializeSid
ntdll.dll	499	RtlCreateAcl
ntdll.dll	509	RtlCreateSecurityDescriptor
ntdll.dll	621	RtlFreeSid
ntdll.dll	739	RtlLengthSid
ntdll.dll	829	RtlSetDaclSecurityDescriptor
ntdll.dll	476	RtlCompareUnicodeString
ntdll.dll	498	RtlCopyUnicodeString
ntdll.dll	623	RtlFreeUnicodeString
ntdll.dll	678	RtlInitUnicodeString
ntdll.dll	775	RtlPrefixUnicodeString
ntdll.dll	887	RtlUpcaseUnicodeString
ntdll.dll	532	RtlDeleteCriticalSection
ntdll.dll	571	RtlEnterCriticalSection
ntdll.dll	682	RtlInitializeCriticalSection
ntdll.dll	736	RtlLeaveCriticalSection
ntdll.dll	143	NtClose
ntdll.dll	171	NtCreateSymbolicLinkObject
ntdll.dll	231	NtMakePermanentObject
ntdll.dll	232	NtMakeTemporaryObject
ntdll.dll	256	NtOpenSymbolicLinkObject
ntdll.dll	302	NtQuerySymbolicLinkObject
ntdll.dll	1345	memcpy
ntdll.dll	1378	wcscat
ntdll.dll	1381	wcscpy
ntdll.dll	1386	wcsncpy
ntdll.dll	462	RtlAssert
ntdll.dll	514	RtlCreateUnicodeString
ntdll.dll	588	RtlExpandEnvironmentStrings_U
ntdll.dll	787	RtlQueryRegistryValues
ntdll.dll	152	NtCreateDirectoryObject
ntdll.dll	362	NtSetInformationObject
ntdll.dll	284	NtQueryInformationProcess
ntdll.dll	305	NtQuerySystemInformation
ntdll.dll	189	NtDuplicateObject
ntdll.dll	363	NtSetInformationProcess
ntdll.dll	94	LdrGetDllHandle
ntdll.dll	96	LdrGetProcedureAddress
ntdll.dll	1346	memmove
ntdll.dll	796	RtlReAllocateHeap
ntdll.dll	770	RtlOpenCurrentUser
ntdll.dll	153	NtCreateEvent
ntdll.dll	336	NtResetEvent
ntdll.dll	354	NtSetEvent
ntdll.dll	247	NtOpenKey
ntdll.dll	309	NtQueryValueKey
ntdll.dll	1347	memset
ntdll.dll	671	RtlInitAnsiString
ntdll.dll	251	NtOpenProcess
ntdll.dll	272	NtQueryDefaultLocale
ntdll.dll	99	LdrLoadDll
ntdll.dll	169	NtCreateSection
ntdll.dll	885	RtlUnwind

ord	entry_va	function_name
1	0x3460	BaseSetProcessCreateNotify
2	0x6a20	BaseSrvNlsLogon
3	0x6be0	BaseSrvNlsUpdateRegistryCache
4	0x33d0	ServerDllInitialization

module_name	basesrv.dll
flags	0
timestamp	2106-02-07 06:28:15
version	0.0
ordinal_base	1
nFunctions	4
nNames	4
Names(4)	0x7328
Functions(4)	0x7318
NameOrdinals(4)	0x7338

StringTable 040904b0

CompanyName	ReactOS Development Team
FileDescription	ReactOS Base API Server DLL
FileVersion	42.4.11-dev
InternalName	basesrv
LegalCopyright	Copyright 1998-2018 ReactOS Team
OriginalFilename	basesrv.dll
ProductName	ReactOS Operating System
ProductVersion	0.4.11-dev

VS_FIXEDFILEINFO

FileVersion	42.4.11.0
ProductVersion	0.4.11.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	45056	DLL	12/09/2018 07:54:59	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

basesrv.dll-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

basesrv.dll
-