hello.pedump

来自「windows下汇编语言 学习汇编语言好助手」· PEDUMP 代码 · 共 113 行

Dump of file HELLO.EXE

File Header
  Machine:                      014C (i386)
  Number of Sections:           0004
  TimeDateStamp:                B85C2775
  PointerToSymbolTable:         00000000
  NumberOfSymbols:              00000000
  SizeOfOptionalHeader:         00E0
  Characteristics:              818E
    EXECUTABLE_IMAGE
    LINE_NUMS_STRIPPED
    LOCAL_SYMS_STRIPPED
    BYTES_REVERSED_LO
    32BIT_MACHINE
    BYTES_REVERSED_HI

Optional Header
  Magic                         010B
  linker version                2.25
  size of code                  200
  size of initialized data      600
  size of uninitialized data    0
  entrypoint RVA                1000
  base of code                  1000
  base of data                  2000
  image base                    400000
  section align                 1000
  file align                    200
  required OS version           1.00
  image version                 0.00
  subsystem version             3.10
  Reserved1                     0
  size of image                 5000
  size of headers               400
  checksum                      0
  Subsystem                     0002 (Windows GUI)
  stack reserve size            100000
  stack commit size             2000
  heap reserve size             100000
  heap commit size              1000
  RVAs & sizes                  10

Data Directory
  EXPORT       rva: 00000000  size: 00000000
  IMPORT       rva: 00003000  size: 00000090
  RESOURCE     rva: 00000000  size: 00000000
  EXCEPTION    rva: 00000000  size: 00000000
  SECURITY     rva: 00000000  size: 00000000
  BASERELOC    rva: 00004000  size: 00000014
  DEBUG        rva: 00000000  size: 00000000
  COPYRIGHT    rva: 00000000  size: 00000000
  GLOBALPTR    rva: 00000000  size: 00000000
  TLS          rva: 00000000  size: 00000000
  LOAD_CONFIG  rva: 00000000  size: 00000000
  BOUND_IMPORT rva: 00000000  size: 00000000
  IAT          rva: 00000000  size: 00000000
  unused       rva: 00000000  size: 00000000
  unused       rva: 00000000  size: 00000000
  unused       rva: 00000000  size: 00000000

Section Table
  01 CODE      VirtSize: 00001000  VirtAddr:  00001000
    raw data offs:   00000600  raw data size: 00000200
    relocation offs: 00000000  relocations:   00000000
    line # offs:     00000000  line #'s:      00000000
    characteristics: 60000020
      CODE  MEM_EXECUTE  MEM_READ

  02 DATA      VirtSize: 00001000  VirtAddr:  00002000
    raw data offs:   00000800  raw data size: 00000200
    relocation offs: 00000000  relocations:   00000000
    line # offs:     00000000  line #'s:      00000000
    characteristics: C0000040
      INITIALIZED_DATA  MEM_READ  MEM_WRITE

  03 .idata    VirtSize: 00001000  VirtAddr:  00003000
    raw data offs:   00000A00  raw data size: 00000200
    relocation offs: 00000000  relocations:   00000000
    line # offs:     00000000  line #'s:      00000000
    characteristics: C0000040
      INITIALIZED_DATA  MEM_READ  MEM_WRITE

  04 .reloc    VirtSize: 00001000  VirtAddr:  00004000
    raw data offs:   00000C00  raw data size: 00000200
    relocation offs: 00000000  relocations:   00000000
    line # offs:     00000000  line #'s:      00000000
    characteristics: 50000040
      INITIALIZED_DATA  MEM_SHARED  MEM_READ




Imports Table:
  USER32.dll
  Hint/Name Table: 0000303C
  TimeDateStamp:   00000000
  ForwarderChain:  00000000
  First thunk RVA: 0000304C
  Ordn  Name
     0  MessageBoxA

  KERNEL32.dll
  Hint/Name Table: 00003044
  TimeDateStamp:   00000000
  ForwarderChain:  00000000
  First thunk RVA: 00003054
  Ordn  Name
     0  ExitProcess