hello.map

2004-03-05_驱动病毒探索.rar探索驱动病毒的原理。

 Hello

 Timestamp is 3f654a5a (Mon Sep 15 13:12:58 2003)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 00000008H .idata$5                CODE
 0001:00000008 00000078H .rdata                  CODE
 0001:00000080 00000136H .text                   CODE
 0002:00000000 00000014H .idata$2                CODE
 0002:00000014 00000014H .idata$3                CODE
 0002:00000028 00000008H .idata$4                CODE
 0002:00000030 0000001eH .idata$6                CODE
 0003:00000000 00000058H .rsrc$01                DATA
 0003:00000060 00000368H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp_@IofCallDriver@8     00010260     wdm:NTOSKRNL.EXE
 0001:00000004       \177NTOSKRNL_NULL_THUNK_DATA 00010264     wdm:NTOSKRNL.EXE
 0001:00000080       _DriverEntry@8             000102e0 f   hello.obj
 0002:00000000       __IMPORT_DESCRIPTOR_NTOSKRNL 00010420     wdm:NTOSKRNL.EXE
 0002:00000014       __NULL_IMPORT_DESCRIPTOR   00010434     wdm:NTOSKRNL.EXE

 entry point at        0001:00000080

 Static symbols