filenamewdmaud.drv
size172032 (0x2a000)
md5d205c24a9d069049fe2df2a1b38726a7
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1493072910
10158
1473072921
1313072919
146307291
1323072949
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4ce7ba26
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x23200
SizeOfInitializedData0x8e00
SizeOfUninitializedData0
AddressOfEntryPoint0x3c6b
BaseOfCode0x1000
BaseOfData0x26000
ImageBase0x41bc0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x30000
SizeOfHeaders0x400
CheckSum0x2d412
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x22ed70x23000R-X CODE
RT_CODE0x240000x1c0x200R-X CODE
.data0x250000x6e140x4c00RW- IDATA
RT_DATA0x2c0000x100x200RW- IDATA
.rsrc0x2d0000x5200x600R-- IDATA
.reloc0x2e0000x15dc0x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3ea40xb3
IMPORT0x231d80xc8
RESOURCE0x2d0000x520
EXCEPTION00
SECURITY00
BASERELOC0x2e0000x15dc
DEBUG0x23e780x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xa0b00x40
Bound_IAT0x2d00xd0
IAT0x10000x240
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19320
module_namehintordfunction_name
msvcrt.dll67_CIlog10
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll405_ftol2_sse
msvcrt.dll1262memset
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll1258memcpy
msvcrt.dll1007_wcsicmp
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll99_CxxThrowException
msvcrt.dll404_ftol2
msvcrt.dll1259memcpy_s
msvcrt.dll1261memmove_s
msvcrt.dll1190free
msvcrt.dll974_vsnwprintf
msvcrt.dll1246malloc
msvcrt.dll774_resetstkoflw
msvcrt.dll1371wcsncmp
msvcrt.dll1157calloc
msvcrt.dll271_beginthreadex
msvcrt.dll69_CIsin
msvcrt.dll71_CIsqrt
msvcrt.dll66_CIlog
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll345_except_handler4_common
msvcrt.dll257_amsg_exit
msvcrt.dll747_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1279realloc
msvcrt.dll342_errno
msvcrt.dll68_CIpow
msvcrt.dll764_purecall
KERNEL32.dll130CreateEventA
KERNEL32.dll221DeviceIoControl
KERNEL32.dll566GetOverlappedResult
KERNEL32.dll452GetCurrentThread
KERNEL32.dll904OutputDebugStringA
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll715HeapAlloc
KERNEL32.dll584GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll1346lstrcmpW
KERNEL32.dll944RaiseException
KERNEL32.dll1201SizeofResource
KERNEL32.dll851LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll334FindResourceW
KERNEL32.dll333FindResourceExW
KERNEL32.dll512GetLastError
KERNEL32.dll133CreateEventW
KERNEL32.dll82CloseHandle
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll1017ReleaseMutex
KERNEL32.dll1112SetEvent
KERNEL32.dll158CreateMutexW
KERNEL32.dll1134SetHandleInformation
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1038ResetEvent
KERNEL32.dll1272WaitForMultipleObjectsEx
KERNEL32.dll658GetTickCount
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll1176SetThreadPriority
KERNEL32.dll181CreateThread
KERNEL32.dll1358lstrlenW
KERNEL32.dll66CancelIo
KERNEL32.dll1202Sleep
KERNEL32.dll143CreateFileW
KERNEL32.dll959ReadFile
KERNEL32.dll1125SetFilePointerEx
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll935QueryPerformanceFrequency
KERNEL32.dll869MulDiv
KERNEL32.dll718HeapDestroy
KERNEL32.dll722HeapReAlloc
KERNEL32.dll724HeapSize
KERNEL32.dll674GetVersionExA
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll758TraceMessage
ADVAPI32.dll598RegGetValueW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll347GetTraceEnableFlags
ole32.dll376StringFromCLSID
ole32.dll16CoCreateInstance
ole32.dll63CoInitializeEx
ole32.dll108CoUninitialize
ole32.dll103CoTaskMemAlloc
ole32.dll104CoTaskMemFree
ole32.dll336PropVariantClear
USER32.dll506LoadStringW
USER32.dll773UnregisterClassA
WINMM.dll182waveOutPrepareHeader
WINMM.dll189waveOutWrite
WINMM.dll183waveOutReset
WINMM.dll180waveOutOpen
WINMM.dll168waveOutClose
WINMM.dll148timeGetTime
WINMM.dll2DriverCallback
WINMM.dll1DefDriverProc
WINMM.dll174waveOutGetNumDevs
WINMM.dll177waveOutGetPosition
WINMM.dll187waveOutSetVolume
WINMM.dll178waveOutGetVolume
WINMM.dll188waveOutUnprepareHeader
ksuser.dll2KsCreatePin
MMDevAPI.DLL14
MMDevAPI.DLL5
MMDevAPI.DLL3
MMDevAPI.DLL2
AVRT.dll1AvRevertMmThreadCharacteristics
AVRT.dll11AvSetMmThreadCharacteristicsA
AVRT.dllAvQuerySystemResponsiveness
AVRT.dll13AvSetMmThreadPriority
ordentry_vafunction_name
10x3feeDriverProc
20x817amidMessage
30x7f0cmodMessage
40x65c3widMessage
50x4ab6wodMessage
60x3f5cmxdMessage
module_nameWINMMDRV.dll
flags0
timestamp2010-11-20 10:27:04
version0.0
ordinal_base1
nFunctions6
nNames6
Names(6)0x3ee4
Functions(6)0x3ecc
NameOrdinals(6)0x3efc

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWinmm audio system driver
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamewdmaud.drv
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewdmaud.drv
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype9
offsetsizetypecomment
0172032DLL11/20/2010 12:08:06#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2d0