Dumpbin display. net pe File Format

Let's write a simple. Net console application.
> Dumpbin-All consoleapplication1.exe> C: \ B .txt
> Notepad c: \ B .txt

After removing the binary code, we get the following structure and result:
Dump of file consoleapplication1.exe
PE signature found
File Type: executable Image

File header values
14C machine (x86)
3 Number of sections
47216963 time date stamp Fri Oct 26 12:13:23 2007
0 file pointer to symbol table
0 Number of symbols
E0 size of optional Header
10E Characteristics
Executable
Line numbers stripped
Symbols stripped
32 bit word Machine

Optional header values
10b magic # (pe32)
8.00 linker version
1000 size of code
2000 size of initialized data
0 size of uninitialized data
27be entry point (004027be)
2000 base of code
4000 base of data
400000 Image Base (00400000 to 00407fff)
2000 section alignment
1000 file alignment
4.00 operating system version
0.00 image version
4.00 subsystem version
0 Win32 version
8000 size of Image
1000 size of headers
0 checksum
3 subsystem (Windows Cui)
400 DLL Characteristics
No structured exception handler
100000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 loader flags
10 number of directories
0 [0] RVA [size] of export directory
2770 [4B] RVA [size] of import directory
4000 [390] RVA [size] of Resource Directory
0 [0] RVA [size] of exception directory
0 [0] RVA [size] of certificates directory
6000 [c] RVA [size] of base relocation directory
26ec [1C] RVA [size] of DEBUG directory
0 [0] RVA [size] of architecture directory
0 [0] RVA [size] of global pointer directory
0 [0] RVA [size] of thread storage directory
0 [0] RVA [size] of load configuration directory
0 [0] RVA [size] of bound import directory
2000 [8] RVA [size] of import Address Table directory
0 [0] RVA [size] of delay import directory
2008 [48] RVA [size] of COM descriptor directory
0 [0] RVA [size] of reserved directory

Section header #1
. Text name
7c4 virtual size
2000 virtual address (00402000 to 004027c3)
1000 size of raw data
1000 file pointer to raw data (00001000 to 1_1fff)
0 file pointer to relocation table
0 file pointer to line numbers
0 Number of relocations
0 Number of line numbers
60000020 flags
Code
Execute read

 

Debug Directories

Time type size RVA pointer
--------------------------------------
47216963 CV 65 00002708 1708 format: RSDs, {5ad83dc1-5587-401a-ade6-2de784e28c8c}, 4,

G: \ projects \ testwinapp \ consoleapplication1 \ OBJ \ debug \ consoleapplication1.pdb

CLR header:

48 CB
2.05 runtime version
20a4 [648] RVA [size] of metadata directory
1 flags
6000001 entry point token
0 [0] RVA [size] of Resources Directory
0 [0] RVA [size] of strongnamesignature directory
0 [0] RVA [size] of codemanagertable directory
0 [0] RVA [size] of vtablefixups directory
0 [0] RVA [size] of exportaddresstablejumps directory
0 [0] RVA [size] of managednativeheader directory

Section contains the following imports:

Mscoree. dll
402000 import Address Table
402798 Import Name table
0 time date stamp
0 index of first forwarder reference

0 _ corexemain

Section header #2
. Rsrc name
390 virtual size
4000 virtual address (00404000 to 0040438f)
1000 size of raw data
2000 file pointer to raw data (00002000 to 00002fff)
0 file pointer to relocation table
0 file pointer to line numbers
0 Number of relocations
0 Number of line numbers
40000040 flags
Initialized data
Read Only

 

Section header #3
. Reloc name
C virtual size
6000 virtual address (00406000 to 0040600b)
1000 size of raw data
3000 file pointer to raw data (00003000 to ipv3fff)
0 file pointer to relocation table
0 file pointer to line numbers
0 Number of relocations
0 Number of line numbers
42000040 flags
Initialized data
Discardable
Read Only

Raw data #3
Base relocations #3
2000 RVA, C sizeofblock
7c0 high low 00402000
0 ABS

Summary

2000. reloc
2000. rsrc
2000. Text


When some important parts are marked, no analysis is performed, because I do not understand the meaning of each line ..

The PE File Format modified by. Net contains some special things. Pay special attention to the CLR header.