grubx64.efi

info
MZ
PE
foremost
signature
hexdump
disasm
log
discuss
donate

filename	grubx64.efi
size	1116024 (0x110778)
md5	a62486b1639d335d4b5813e8088bb5ac

type	PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	4
TimeDateStamp	0x54a48e00
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x20e
Magic	0x20b
LinkerVersion	0.0
SizeOfCode	0x9c00
SizeOfInitializedData	0x105200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x400
BaseOfCode	0x400
ImageBase	0
SectionAlignment	0x200
FileAlignment	0x200
OperatingSystemVersion	0.0
ImageVersion	0.0
SubsystemVersion	0.0
Reserved1	0
SizeOfImage	0x110000
SizeOfHeaders	0x400
CheckSum	0x11f85a
Subsystem	0xa
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x10000
SizeOfHeapReserve	0x10000
SizeOfHeapCommit	0x10000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x400	0x9c00	0x9c00	R-X CODE
.data	0xa000	0xf000	0xf000	RW- IDATA
mods	0x19000	0xf6200	0xf6200	RW- IDATA
.reloc	0x10f200	0xe00	0xe00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0	0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0x110000	0x778
BASERELOC	0x10f200	0xe00
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority

serial: 01

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority
        Validity
            Not Before: Apr 12 11:39:08 2012 GMT
            Not After : Apr 11 11:39:08 2042 GMT
        Subject: C=GB, ST=Isle of Man, O=Canonical Ltd., OU=Secure Boot, CN=Canonical Ltd. Secure Boot Signing
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c9:5f:9b:62:8f:0b:b0:64:82:ac:be:c9:e2:62:
                    e3:4b:d2:9f:1e:8a:d5:61:1a:2b:5d:38:f4:b7:ce:
                    b9:9a:b8:43:b8:43:97:77:ab:4f:7f:0c:70:46:0b:
                    fc:7f:6d:c6:6d:ea:80:5e:01:d2:b7:66:1e:87:de:
                    0d:6d:d0:41:97:a8:a5:af:0c:63:4f:f7:7c:c2:52:
                    cc:a0:31:a9:bb:89:5d:99:1e:46:6f:55:73:b9:76:
                    69:ec:d7:c1:fc:21:d6:c6:07:e7:4f:bd:22:de:e4:
                    a8:5b:2d:db:95:34:19:97:d6:28:4b:21:4c:ca:bb:
                    1d:79:a6:17:7f:5a:f9:67:e6:5c:78:45:3d:10:6d:
                    b0:17:59:26:11:c5:57:e3:7f:4e:82:ba:f6:2c:4e:
                    c8:37:4d:ff:85:15:84:47:e0:ed:3b:7c:7f:bc:af:
                    e9:01:05:a7:0c:6f:c3:e9:8d:a3:ce:be:a6:e3:cd:
                    3c:b5:58:2c:9e:c2:03:1c:60:22:37:39:ff:41:02:
                    c1:29:a4:65:51:ff:33:34:aa:42:15:f9:95:78:fc:
                    2d:f5:da:8a:85:7c:82:9d:fb:37:2c:6b:a5:a8:df:
                    7c:55:0b:80:2e:3c:b0:63:e1:cd:38:48:89:e8:14:
                    06:0b:82:bc:fd:d4:07:68:1b:0f:3e:d9:15:dd:94:
                    11:1b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                Code Signing, 1.3.6.1.4.1.311.10.3.6
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                61:48:2A:A2:83:0D:0A:B2:AD:5A:F1:0B:72:50:DA:90:33:DD:CE:F0
            X509v3 Authority Key Identifier: 
                keyid:AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63

    Signature Algorithm: sha256WithRSAEncryption
         8f:8a:a1:06:1f:29:b7:0a:4a:d5:c5:fd:81:ab:25:ea:c0:7d:
         e2:fc:6a:96:a0:79:93:67:ee:05:0e:25:12:25:e4:5a:f6:aa:
         1a:f1:12:f3:05:8d:87:5e:f1:5a:5c:cb:8d:23:73:65:1d:15:
         b9:de:22:6b:d6:49:67:c9:a3:c6:d7:62:4e:5c:b5:f9:03:83:
         40:81:dc:87:9c:3c:3f:1c:0d:51:9f:94:65:0a:84:48:67:e4:
         a2:f8:a6:4a:f0:e7:cd:cd:bd:94:e3:09:d2:5d:2d:16:1b:05:
         15:0b:cb:44:b4:3e:61:42:22:c4:2a:5c:4e:c5:1d:a3:e2:e0:
         52:b2:eb:f4:8b:2b:dc:38:39:5d:fb:88:a1:56:65:5f:2b:4f:
         26:ff:06:78:10:12:eb:8c:5d:32:e3:c6:45:af:25:9b:a0:ff:
         8e:ef:47:09:a3:e9:8b:37:92:92:69:76:7e:34:3b:92:05:67:
         4e:b0:25:ed:bc:5e:5f:8f:b4:d6:ca:40:ff:e4:e2:31:23:0c:
         85:25:ae:0c:55:01:ec:e5:47:5e:df:5b:bc:14:33:e3:c6:f5:
         18:b6:d9:f7:dd:b3:b4:a1:31:d3:5a:5c:5d:7d:3e:bf:0a:e4:
         e4:e8:b4:59:7d:3b:b4:8c:a3:1b:b5:20:a3:b9:3e:84:6f:8c:
         21:00:c3:39

No certificates in

#<struct PEdump::WIN_CERTIFICATE dwLength=nil, wRevision=nil, wCertificateType=nil, data=nil>

pkcs7-signedData

SHA256: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA256

7e da 75 5c ea e3 34 0d 64 61 eb f6 ec 7b ba e4 |~.u\..4.da...{..| 7c 38 44 2b c1 01 ca d4 ad 60 f7 d4 15 47 07 fa ||8D+.....`...G..|

Certificate #2
- 2
  - 1
  - RSA-SHA256: nil
  - Issuer
    - C: GB
    - ST: Isle of Man
    - L: Douglas
    - O: Canonical Ltd.
    - CN: Canonical Ltd. Master Certificate Authority
  - 2012-04-12 11:39:08 UTC: 2042-04-11 11:39:08 UTC
  - Subject
    - C: GB
    - ST: Isle of Man
    - O: Canonical Ltd.
    - OU: Secure Boot
    - CN: Canonical Ltd. Secure Boot Signing
  - #5
    - rsaEncryption: nil
    - C9:5F:9B:62:8F:0B:B0:64:82:AC:BE:C9:E2:62:E3:4B:
      D2:9F:1E:8A:D5:61:1A:2B:5D:38:F4:B7:CE:B9:9A:B8:
      43:B8:43:97:77:AB:4F:7F:0C:70:46:0B:FC:7F:6D:C6:
      6D:EA:80:5E:01:D2:B7:66:1E:87:DE:0D:6D:D0:41:97:
      A8:A5:AF:0C:63:4F:F7:7C:C2:52:CC:A0:31:A9:BB:89:
      5D:99:1E:46:6F:55:73:B9:76:69:EC:D7:C1:FC:21:D6:
      C6:07:E7:4F:BD:22:DE:E4:A8:5B:2D:DB:95:34:19:97:
      D6:28:4B:21:4C:CA:BB:1D:79:A6:17:7F:5A:F9:67:E6:
      5C:78:45:3D:10:6D:B0:17:59:26:11:C5:57:E3:7F:4E:
      82:BA:F6:2C:4E:C8:37:4D:FF:85:15:84:47:E0:ED:3B:
      7C:7F:BC:AF:E9:01:05:A7:0C:6F:C3:E9:8D:A3:CE:BE:
      A6:E3:CD:3C:B5:58:2C:9E:C2:03:1C:60:22:37:39:FF:
      41:02:C1:29:A4:65:51:FF:33:34:AA:42:15:F9:95:78:
      FC:2D:F5:DA:8A:85:7C:82:9D:FB:37:2C:6B:A5:A8:DF:
      7C:55:0B:80:2E:3C:B0:63:E1:CD:38:48:89:E8:14:06:
      0B:82:BC:FD:D4:07:68:1B:0F:3E:D9:15:DD:94:11:1B: 0x010001
  - X509v3 extensions
    - basicConstraints
      - true
      - nil
    - extendedKeyUsage
      - codeSigning: 1.3.6.1.4.1.311.10.3.6
    - nsComment: OpenSSL Generated Certificate
    - subjectKeyIdentifier:
```
61 48 2a a2 83 0d 0a b2  ad 5a f1 0b 72 50 da 90  |aH*......Z..rP..|
33 dd ce f0                                       |3...            |
```
    - authorityKeyIdentifier:
```
ad 91 99 0b c2 2a b1 f5  17 04 8c 23 b6 65 5a 26  |.....*.....#.eZ&|
8e 34 5a 63                                       |.4Zc            |
```
- RSA-SHA256:
```
8f 8a a1 06 1f 29 b7 0a  4a d5 c5 fd 81 ab 25 ea  |.....)..J.....%.|
c0 7d e2 fc 6a 96 a0 79  93 67 ee 05 0e 25 12 25  |.}..j..y.g...%.%|
e4 5a f6 aa 1a f1 12 f3  05 8d 87 5e f1 5a 5c cb  |.Z.........^.Z\.|
8d 23 73 65 1d 15 b9 de  22 6b d6 49 67 c9 a3 c6  |.#se...."k.Ig...|
d7 62 4e 5c b5 f9 03 83  40 81 dc 87 9c 3c 3f 1c  |.bN\....@....aB".*\N.....R.|
eb f4 8b 2b dc 38 39 5d  fb 88 a1 56 65 5f 2b 4f  |...+.89]...Ve_+O|
26 ff 06 78 10 12 eb 8c  5d 32 e3 c6 45 af 25 9b  |&..x....]2..E.%.|
a0 ff 8e ef 47 09 a3 e9  8b 37 92 92 69 76 7e 34  |....G....7..iv~4|
3b 92 05 67 4e b0 25 ed  bc 5e 5f 8f b4 d6 ca 40  |;..gN.%..^_....@|
ff e4 e2 31 23 0c 85 25  ae 0c 55 01 ec e5 47 5e  |...1#..%..U...G^|
df 5b bc 14 33 e3 c6 f5  18 b6 d9 f7 dd b3 b4 a1  |.[..3...........|
31 d3 5a 5c 5d 7d 3e bf  0a e4 e4 e8 b4 59 7d 3b  |1.Z\]}>......Y};|
b4 8c a3 1b b5 20 a3 b9  3e 84 6f 8c 21 00 c3 39  |..... ..>.o.!..9|
```

unnamed
- #0
  - C: GB
  - ST: Isle of Man
  - L: Douglas
  - O: Canonical Ltd.
  - CN: Canonical Ltd. Master Certificate Authority
- 1
SHA256: nil
#2
- contentType: 1.3.6.1.4.1.311.2.1.4
- signingTime: 2019-03-21 22:58:14 UTC
- messageDigest:
```
00 b6 4b e8 47 51 04 99  f6 14 14 21 46 f9 bf 81  |..K.GQ.....!F...|
86 23 1d ab de f3 83 8a  dc c7 a4 e9 9d 46 a4 9d  |.#...........F..|
```
- SMIME-CAPS
  - AES-256-CBC
    - AES-192-CBC
    - AES-128-CBC
    - DES-EDE3-CBC
    - RC2-CBC: 0x80
    - RC2-CBC: 0x40
    - DES-CBC
    - RC2-CBC: 0x28

rsaEncryption:

42 d2 fe 7b 8a f4 ad 18  f0 f1 75 fc 17 5b 94 b8  |B..{......u..[..|
fe 07 75 37 65 c5 2f 90  7f b7 f4 ab 09 e5 24 4f  |..u7e./.......$O|
83 d4 86 4f 82 d0 be 06  cf 1d f1 6a ac ed be 00  |...O.......j....|
ec 0e ca 67 7e ba f7 32  19 3d 29 be 43 4d e9 10  |...g~..2.=).CM..|
f6 73 5d e5 f5 8f b1 8d  f4 5b a6 5a cc 62 04 74  |.s]......[.Z.b.t|
0b 50 26 d2 7e b4 6c e2  a7 90 91 87 5c 10 d6 4a  |.P&.~.l.....\..J|
19 46 20 37 35 3b 6c cd  2b 45 69 5f 92 11 56 09  |.F 75;l.+Ei_..V.|
68 48 46 76 8d 91 d4 c8  8b 0d 89 19 73 b7 13 42  |hHFv........s..B|
75 3c 93 7c 4f 45 e0 01  ca 79 79 19 6f 27 16 a5  |u<.|OE...yy.o'..|
b5 69 32 17 7d 0d b2 a4  24 90 ff c7 47 a9 f3 a3  |.i2.}...$...G...|
6d 58 6c e4 c9 7e a3 86  40 d2 85 e6 ce d1 80 bf  |mXl..~..@.......|
0e f1 ec 6f ea 34 9e 98  ef 95 e3 be aa 11 8a 5e  |...o.4.........^|
2b 42 62 24 c3 38 78 d7  4a 63 e6 85 c9 db d0 71  |+Bb$.8x.Jc.....q|
56 95 ee d6 39 f5 fb bd  5b 42 00 d4 db 4e c5 a6  |V...9...[B...N..|
98 06 69 1c c3 22 41 2a  23 76 cc 00 65 96 cd b6  |..i.."A*#v..e...|
19 92 49 c5 da e8 9b 00  e5 4a 11 0b c1 cb 0a 26  |..I......J.....&|

Cannot call to_der on

#<struct PEdump::WIN_CERTIFICATE dwLength=nil, wRevision=nil, wCertificateType=nil, data=nil>

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1110440	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::WIN_CERTIFICATE: too small length