hello.map

2004-03-05_驱动病毒探索.rar探索驱动病毒的原理。

 Hello

 Timestamp is 3f6407c3 (Sun Sep 14 14:16:35 2003)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 00000010H .idata$5                CODE
 0001:00000010 00000070H .rdata                  CODE
 0001:00000080 00000097H .text                   CODE
 0002:00000000 00000318H .data                   DATA
 0003:00000000 00000014H .idata$2                CODE
 0003:00000014 00000014H .idata$3                CODE
 0003:00000028 00000010H .idata$4                CODE
 0003:00000038 00000034H .idata$6                CODE
 0004:00000000 00000058H .rsrc$01                DATA
 0004:00000060 00000368H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp__ZwSetValueKey@24    00010280     wdm:NTOSKRNL.EXE
 0001:00000004       __imp__ZwOpenKey@12        00010284     wdm:NTOSKRNL.EXE
 0001:00000008       __imp__ZwClose@4           00010288     wdm:NTOSKRNL.EXE
 0001:0000000c       \177NTOSKRNL_NULL_THUNK_DATA 0001028c     wdm:NTOSKRNL.EXE
 0001:00000080       _DriverEntry@8             00010300 f   hello.obj
 0001:00000110       _DriverUnload@4            00010390 f   hello.obj
 0002:00000000       _RegRunKeyName             000103a0     hello.obj
 0002:00000100       _RegKeyValueName           000104a0     hello.obj
 0002:00000200       _RegKeyValue               000105a0     hello.obj
 0002:00000300       _RegPath                   000106a0     hello.obj
 0002:00000308       _ValueName                 000106a8     hello.obj
 0002:00000310       _Value                     000106b0     hello.obj
 0003:00000000       __IMPORT_DESCRIPTOR_NTOSKRNL 000106c0     wdm:NTOSKRNL.EXE
 0003:00000014       __NULL_IMPORT_DESCRIPTOR   000106d4     wdm:NTOSKRNL.EXE

 entry point at        0001:00000080

 Static symbols