Windbg displays PE Information

Source: Internet
Author: User

! Dh command

Kd>! Dh 7c800000

File Type: DLL
FILE HEADER VALUES
14C machine (i386)
4 number of sections
4121457C time date stamp Tue Aug 17 07:38:36 2004

0 file pointer to symbol table
0 number of symbols
E0 size of optional header
210E characteristics
Executable
Line numbers stripped
Symbols stripped
32 bit word machine
DLL

OPTIONAL HEADER VALUES
10B magic #
7.10 linker version
81E00 size of code
95400 size of initialized data
0 size of uninitialized data
B436 address of entry point
1000 base of code
----- New -----
7c800000 image base
1000 section alignment
200 file alignment
3 subsystem (Windows CUI)
5.01 operating system version
5.01 image version
4.00 subsystem version
11C000 size of image
400 size of headers
1242EA checksum
00040000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
0 DLL characteristics
262C [6C7B] address [size] of Export Directory
802DC [28] address [size] of Import Directory
88000 [8D3FC] address [size] of Resource Directory
0 [0] address [size] of Exception Directory
0 [0] address [size] of Security Directory
116000 [5BD0] address [size] of Base Relocation Directory
82BC0 [38] address [size] of Debug Directory
0 [0] address [size] of Description Directory
0 [0] address [size] of Special Directory
0 [0] address [size] of Thread Storage Directory
4E080 [48] address [size] of Load Configuration Directory
280 [1C] address [size] of Bound Import Directory
1000 [620] address [size] of Import Address Table Directory
0 [0] address [size] of Delay Import Directory
0 [0] address [size] of COR20 Header Directory
0 [0] address [size] of Reserved Directory

Section header #1
. Text name
81C21 virtual size
1000 virtual address
81E00 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(No align specified)
Execute Read

Debug Directories (2)
Type Size Address Pointer
Can't read debug dir

Section header #2
. Data name
4180 virtual size
83000 virtual address
2400 size of raw data
82200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(No align specified)
Read Write

Section header #3
. Rsrc name
8D3FC virtual size
88000 virtual address
8D400 size of raw data
84600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(No align specified)
Read Only

Section header #4
. Reloc name
5BD0 virtual size
116000 virtual address
5C00 size of raw data
111A00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(No align specified)
Read Only

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.