hello.map

2004-03-05_驱动病毒探索.rar探索驱动病毒的原理。

 Hello

 Timestamp is 3f6585b2 (Mon Sep 15 17:26:10 2003)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 00000014H .idata$5                CODE
 0001:00000014 0000007cH .rdata                  CODE
 0001:00000090 00000207H .text                   CODE
 0002:00000000 00000318H .data                   DATA
 0003:00000000 00000014H .idata$2                CODE
 0003:00000014 00000014H .idata$3                CODE
 0003:00000028 00000014H .idata$4                CODE
 0003:0000003c 00000044H .idata$6                CODE
 0004:00000000 00000058H .rsrc$01                DATA
 0004:00000060 00000368H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp__ZwClose@4           00010280     wdm:NTOSKRNL.EXE
 0001:00000004       __imp__ZwSetValueKey@24    00010284     wdm:NTOSKRNL.EXE
 0001:00000008       __imp__ZwOpenKey@12        00010288     wdm:NTOSKRNL.EXE
 0001:0000000c       __imp__ZwCreateFile@44     0001028c     wdm:NTOSKRNL.EXE
 0001:00000010       \177NTOSKRNL_NULL_THUNK_DATA 00010290     wdm:NTOSKRNL.EXE
 0001:0000013a       _DriverEntry@8             000103ba f   hello.obj
 0001:00000290       _DriverUnload@4            00010510 f   hello.obj
 0002:00000000       _RegRunKeyName             00010520     hello.obj
 0002:00000100       _RegKeyValueName           00010620     hello.obj
 0002:00000200       _RegKeyValue               00010720     hello.obj
 0002:00000300       _RegPath                   00010820     hello.obj
 0002:00000308       _ValueName                 00010828     hello.obj
 0002:00000310       _Value                     00010830     hello.obj
 0003:00000000       __IMPORT_DESCRIPTOR_NTOSKRNL 00010840     wdm:NTOSKRNL.EXE
 0003:00000014       __NULL_IMPORT_DESCRIPTOR   00010854     wdm:NTOSKRNL.EXE

 entry point at        0001:0000013a

 Static symbols