filenamePhysicalMemoryOperation zouxianyu_PhysicalMemoryReadWrite_HackTool_GameHack.sys
size10240 (0x2800)
md59d4eba99e495698df29676ee710560b9
typePE32+ executable (native) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
257289003
1019
259289005
260289008
260299171
258299171

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x6040f885
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.29
SizeOfCode0x1800
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x6000
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0xf641
Subsystem1
DllCharacteristics0x4160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x12070x1400R-X CODE
.rdata0x30000x5340x600R-- IDATA
.data0x40000xb00x200RW- IDATA
.pdata0x50000x15c0x200R-- IDATA
INIT0x60000x2be0x400R-X CODE DISCARDABLE
.reloc0x70000x200x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x605c0x28
RESOURCE00
EXCEPTION0x50000x15c
SECURITY00
BASERELOC0x70000x20
DEBUG0x30f00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x31300x138
Bound_IAT00
IAT0x30000xa0
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
ntoskrnl.exe2231RtlInitUnicodeString
ntoskrnl.exe93DbgPrint
ntoskrnl.exe1161KeGetCurrentIrql
ntoskrnl.exe1219KeLowerIrql
ntoskrnl.exe1364KfRaiseIrql
ntoskrnl.exe1060IofCompleteRequest
ntoskrnl.exe763IoCreateDevice
ntoskrnl.exe775IoCreateSymbolicLink
ntoskrnl.exe788IoDeleteDevice
ntoskrnl.exe790IoDeleteSymbolicLink
ntoskrnl.exe1687ObfDereferenceObject
ntoskrnl.exe2771ZwClose
ntoskrnl.exe2861ZwOpenSection
ntoskrnl.exe2839ZwMapViewOfSection
ntoskrnl.exe2985ZwUnmapViewOfSection
ntoskrnl.exe1443MmGetPhysicalAddress
ntoskrnl.exe1411MmAllocateNonCachedMemory
ntoskrnl.exe1436MmFreeNonCachedMemory
ntoskrnl.exe1913PsLookupProcessByProcessId
offsetsizetypecomment
15c115HTM#
15d04656BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK