HelloWorld_VS2008_IA32-signed.efi

info
MZ
PE
exports
foremost
signature
hexdump
disasmnew!
log
donate

filename	HelloWorld_VS2008_IA32-signed.efi
size	29624 (0x73b8)
md5	f02d7c60e45dcce0ac248780371694c1

type	MS-DOS executable
mimetype	application/octet-stream

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0
blocks_in_file	0
num_relocs	0
header_paragraphs	0
min_extra_paragraphs	0
max_extra_paragraphs	0
ss	0
sp	0
checksum	0
ip	0
cs	0
reloc_table_offset	0
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc8

DOS stub

00000000: 4d 5a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |MZ..............|
00000010: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000030: 00 00 00 00 00 00 00 00  00 00 00 00 c8 00 00 00  |................|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0: 00 00 00 00 00 00 00 00                           |........        |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x2000
SizeOfInitializedData	0x4000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	0.0
ImageVersion	0.0
SubsystemVersion	0.0
Reserved1	0
SizeOfImage	0x7000
SizeOfHeaders	0x1000
CheckSum	0x17209
Subsystem	0xa
DllCharacteristics	0
SizeOfStackReserve	0
SizeOfStackCommit	0
SizeOfHeapReserve	0
SizeOfHeapCommit	0
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x18d7	0x2000	R-X CODE
.rdata	0x3000	0x9a4	0x1000	R-- IDATA
.data	0x4000	0x68	0x1000	RW- IDATA
.edata	0x5000	0x52	0x1000	R-- IDATA
.reloc	0x6000	0x138	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x5000	0x52
IMPORT	0	0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0x7000	0x3b8
BASERELOC	0x6000	0x138
DEBUG	0x3000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

ord	entry_va	function_name
1	0x1000	InitializeDriver

module_name	HelloWorld.dll
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x502c
Functions(1)	0x5028
NameOrdinals(1)	0x5030

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /CN=TestRoot

serial: 74CE8EEAAC582590406C92A0DBF3AA52

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:ce:8e:ea:ac:58:25:90:40:6c:92:a0:db:f3:aa:52
    Signature Algorithm: md5WithRSAEncryption
        Issuer: CN=TestRoot
        Validity
            Not Before: Oct 26 20:07:28 2011 GMT
            Not After : Dec 31 23:59:59 2039 GMT
        Subject: CN=TestSub
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a2:19:1b:0b:ce:8b:3d:5d:4a:55:77:3e:a4:a1:
                    fe:17:82:41:56:46:95:e9:0b:26:77:b0:1f:8f:5c:
                    34:97:1c:be:70:3b:7c:e9:53:61:26:18:fb:ec:33:
                    d5:48:fc:d7:c6:21:50:51:35:7b:f3:62:2e:ff:d1:
                    a3:95:e9:9b:9d:05:87:ac:72:75:d3:f9:f5:e3:de:
                    6e:31:7f:f3:bd:92:1d:e2:1c:dd:cd:d9:05:aa:4f:
                    3f:10:9d:cb:c8:b2:79:49:eb:17:82:8b:1f:6f:d8:
                    a1:ca:b9:38:38:b5:64:26:7b:28:0a:fb:4b:6e:86:
                    5a:b1:6e:63:16:74:46:64:6d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.1: 
                0;..^.,.,w-f..9..1w...0.1.0...U....TestRoot..).o2.5\.M3*.....
    Signature Algorithm: md5WithRSAEncryption
         83:af:84:8e:0c:d6:ec:84:e0:f0:ed:92:12:dd:01:98:9e:22:
         c7:95:0b:4e:9c:74:59:3f:d2:4f:e2:49:d4:66:fa:e1:68:4f:
         a9:2b:a0:05:f1:b9:cf:3d:36:44:ab:3c:d0:da:d2:89:95:09:
         ca:9e:02:ce:22:60:cf:96:e6:81:56:b1:e5:02:4e:f3:62:c5:
         be:e2:85:81:90:e6:42:c4:59:fb:8b:ed:82:ae:2d:83:ec:9a:
         8c:a3:1f:a3:e1:ea:f7:b0:5f:e9:59:3d:7f:fe:fd:3e:ef:e0:
         9e:4c:31:3e:eb:d5:d8:90:20:78:48:f6:b6:fe:08:db:c8:d6:
         d2:af

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

e8 e6 54 46 7a bf 45 37 d9 1c c0 25 0e 9e 43 8b |..TFz.E7...%..C.| 65 55 45 d8 |eUE. |

2
- 74:CE:8E:EA:AC:58:25:90:40:6C:92:A0:DB:F3:AA:52
- RSA-MD5: nil
- CN: TestRoot
- 2011-10-26 20:07:28 UTC: 2039-12-31 23:59:59 UTC
- CN: TestSub
- #5
  - rsaEncryption: nil
  - A2:19:1B:0B:CE:8B:3D:5D:4A:55:77:3E:A4:A1:FE:17:
    82:41:56:46:95:E9:0B:26:77:B0:1F:8F:5C:34:97:1C:
    BE:70:3B:7C:E9:53:61:26:18:FB:EC:33:D5:48:FC:D7:
    C6:21:50:51:35:7B:F3:62:2E:FF:D1:A3:95:E9:9B:9D:
    05:87:AC:72:75:D3:F9:F5:E3:DE:6E:31:7F:F3:BD:92:
    1D:E2:1C:DD:CD:D9:05:AA:4F:3F:10:9D:CB:C8:B2:79:
    49:EB:17:82:8B:1F:6F:D8:A1:CA:B9:38:38:B5:64:26:
    7B:28:0A:FB:4B:6E:86:5A:B1:6E:63:16:74:46:64:6D: 0x010001
- 2.5.29.1
  - 5e f1 2c aa 2c 77 2d 66 06 c8 39 1e 1c 31 77 86 |^.,.,w-f..9..1w.|
    - CN: TestRoot
    - 29 bf 6f 32 da 35 5c a8 4d 33 2a 99 a8 f7 ce f4 |).o2.5\.M3*.....|

RSA-MD5:

83 af 84 8e 0c d6 ec 84  e0 f0 ed 92 12 dd 01 98  |................|
9e 22 c7 95 0b 4e 9c 74  59 3f d2 4f e2 49 d4 66  |."...N.tY?.O.I.f|
fa e1 68 4f a9 2b a0 05  f1 b9 cf 3d 36 44 ab 3c  |..hO.+.....=6D.<|
d0 da d2 89 95 09 ca 9e  02 ce 22 60 cf 96 e6 81  |.........."`....|
56 b1 e5 02 4e f3 62 c5  be e2 85 81 90 e6 42 c4  |V...N.b.......B.|
59 fb 8b ed 82 ae 2d 83  ec 9a 8c a3 1f a3 e1 ea  |Y.....-.........|
f7 b0 5f e9 59 3d 7f fe  fd 3e ef e0 9e 4c 31 3e  |.._.Y=...>...L1>|
eb d5 d8 90 20 78 48 f6  b6 fe 08 db c8 d6 d2 af  |.... xH.........|

#0
- CN: TestRoot
- 74:CE:8E:EA:AC:58:25:90:40:6C:92:A0:DB:F3:AA:52
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4

messageDigest:

ff 19 df eb ea 76 ff 8a  1e f0 a8 47 ce 22 1b 95  |.....v.....G."..|
35 a5 ff bd                                       |5...            |

rsaEncryption:

48 78 d4 f0 bb bb 42 90  39 45 bf 13 21 d0 d5 35  |Hx....B.9E..!..5|
9d 77 e2 09 34 c5 d8 04  23 70 c6 ab a0 49 c4 68  |.w..4...#p...I.h|
ee ab 5d 28 57 07 66 36  a0 e2 a7 97 32 ea e2 0b  |..](W.f6....2...|
26 e2 28 c8 14 f2 bf de  09 92 7c 64 81 f5 38 31  |&.(.......|d..81|
23 c1 3f 35 cd b3 26 09  99 dd cc 69 2c 5b 9c ce  |#.?5..&....i,[..|
51 b2 f9 78 42 76 bd 4f  21 00 c5 27 ac cb d8 e1  |Q..xBv.O!..'....|
78 20 5f 55 e9 7f 24 7c  e1 58 d6 33 0e f2 7f c3  |x _U..$|.X.3....|
2c 03 e9 4b 32 5a b7 61  df 39 df 4d 82 0a 33 58  |,..K2Z.a.9.M..3X|

show previews

offset	size	type	comment
0	28672	DLL	01/01/1970 00:00:00	#
7000	952	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK