filenamesqlite3.exe
size507904 (0x7c000)
md5e68f67a5b2ce336689b299fa5d2fa5c1
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5199bb54
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.21
SizeOfCode0x6ca00
SizeOfInitializedData0x7bc00
SizeOfUninitializedData0x600
AddressOfEntryPoint0x126c
BaseOfCode0x1000
BaseOfData0x6e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x81000
SizeOfHeaders0x400
CheckSum0x897a1
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x6c9ac0x6ca00R-X CODE IDATA
.data0x6e0000x19e00x1a00RW- IDATA
.rdata0x700000xc56c0xc600R-- IDATA
.bss0x7d0000x4540RW- UDATA
.idata0x7e0000xd080xe00RW- IDATA
.CRT0x7f0000x180x200RW- IDATA
.tls0x800000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x7e0000xd08
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x800000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x7e2280x1ec
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4800190x48001c0x47d3c80x47f00400
module_namehintordfunction_name
KERNEL32.dll21AreFileApisANSI
KERNEL32.dll82CloseHandle
KERNEL32.dll135CreateFileA
KERNEL32.dll136CreateFileMappingA
KERNEL32.dll139CreateFileMappingW
KERNEL32.dll142CreateFileW
KERNEL32.dll157CreateMutexW
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll209DeleteFileA
KERNEL32.dll212DeleteFileW
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll341FlushFileBuffers
KERNEL32.dll347FormatMessageA
KERNEL32.dll348FormatMessageW
KERNEL32.dll352FreeLibrary
KERNEL32.dll446GetCurrentProcess
KERNEL32.dll447GetCurrentProcessId
KERNEL32.dll458GetDiskFreeSpaceA
KERNEL32.dll461GetDiskFreeSpaceW
KERNEL32.dll481GetFileAttributesA
KERNEL32.dll483GetFileAttributesExW
KERNEL32.dll486GetFileAttributesW
KERNEL32.dll492GetFileSize
KERNEL32.dll500GetFullPathNameA
KERNEL32.dll503GetFullPathNameW
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll582GetProcessHeap
KERNEL32.dll623GetSystemInfo
KERNEL32.dll627GetSystemTime
KERNEL32.dll629GetSystemTimeAsFileTime
KERNEL32.dll640GetTempPathA
KERNEL32.dll641GetTempPathW
KERNEL32.dll656GetTickCount
KERNEL32.dll671GetVersionExA
KERNEL32.dll711HeapAlloc
KERNEL32.dll713HeapCreate
KERNEL32.dll714HeapDestroy
KERNEL32.dll715HeapFree
KERNEL32.dll718HeapReAlloc
KERNEL32.dll720HeapSize
KERNEL32.dll723HeapValidate
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll817LoadLibraryA
KERNEL32.dll820LoadLibraryW
KERNEL32.dll829LocalFree
KERNEL32.dll839LockFile
KERNEL32.dll840LockFileEx
KERNEL32.dll844MapViewOfFile
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll892OutputDebugStringA
KERNEL32.dll893OutputDebugStringW
KERNEL32.dll922QueryPerformanceCounter
KERNEL32.dll947ReadFile
KERNEL32.dll1059SetEndOfFile
KERNEL32.dll1078SetFilePointer
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1163SystemTimeToFileTime
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1186UnlockFile
KERNEL32.dll1187UnlockFileEx
KERNEL32.dll1188UnmapViewOfFile
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
KERNEL32.dll1267WriteFile
msvcrt.dll55__getmainargs
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll114_access
msvcrt.dll137_assert
msvcrt.dll147_cexit
msvcrt.dll213_flsbuf
msvcrt.dll266_iob
msvcrt.dll267_isatty
msvcrt.dll268_isctype
msvcrt.dll383_onexit
msvcrt.dll391_pclose
msvcrt.dll392_pctype
msvcrt.dll395_popen
msvcrt.dll426_setmode
msvcrt.dll538_winmajor
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll592atoi
msvcrt.dll595calloc
msvcrt.dll604exit
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll672localtime
msvcrt.dll676malloc
msvcrt.dll681memcmp
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll689printf
msvcrt.dll691putchar
msvcrt.dll692puts
msvcrt.dll695qsort
msvcrt.dll698realloc
msvcrt.dll706signal
msvcrt.dll715strcmp
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll731strtol
msvcrt.dll742tolower
msvcrt.dll748vfprintf
offsetsizetypecomment
0507904EXE05/20/2013 05:57:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x7d3c8