| Objdump |
binaries/84dd05b2688de0215d29b8ec3d5f135a: file format efi-app-ia32
binaries/84dd05b2688de0215d29b8ec3d5f135a
architecture: i386, flags 0x0000010a:
EXEC_P, HAS_DEBUG, D_PAGED
start address 0x00000000004cafea
Characteristics 0x818f
relocations stripped
executable
line numbers stripped
symbols stripped
little endian
32 bit words
big endian
Time/Date Sun Oct 22 06:13:17 2006
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 0010f000
SizeOfHeaders 00000400
CheckSum 0004b546
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000000
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000004000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010
The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 00000000000cab00 000001e0 Import Directory [parts of .idata]
Entry 2 00000000000c9000 00001988 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 00000000000ae000 0000a292 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 00000000000ad018 0000000b Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 00000000000cb8f0 00000018 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000000000 00000000 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved
There is an import table in .nsp1 at 0x4cab00
The Import Tables (interpreted .nsp1 section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
000cab00 00000000 00000000 00000000 000cace0 000caa34
DLL Name: KERNEL32.DLL
000cab14 00000000 00000000 00000000 000caced 000caa50
DLL Name: MSACM32.DLL
000cab28 00000000 00000000 00000000 000cacf9 000caa58
DLL Name: WININET.DLL
000cab3c 00000000 00000000 00000000 000cad05 000caa60
DLL Name: OLEAUT32.DLL
000cab50 00000000 00000000 00000000 000cad12 000caa68
DLL Name: SHELL32.DLL
000cab64 00000000 00000000 00000000 000cad1e 000caa70
DLL Name: ADVAPI32.DLL
000cab78 00000000 00000000 00000000 000cad2b 000caa78
DLL Name: KERNEL32.DLL
000cab8c 00000000 00000000 00000000 000cad38 000caa80
DLL Name: KERNEL32.DLL
000caba0 00000000 00000000 00000000 000cad45 000caa88
DLL Name: WS2_32.DLL
000cabb4 00000000 00000000 00000000 000cad50 000caa90
DLL Name: ADVAPI32.DLL
000cabc8 00000000 00000000 00000000 000cad5d 000caa98
DLL Name: USER32.DLL
000cabdc 00000000 00000000 00000000 000cad68 000caaa0
DLL Name: VERSION.DLL
000cabf0 00000000 00000000 00000000 000cad74 000caaa8
DLL Name: KERNEL32.DLL
000cac04 00000000 00000000 00000000 000cad81 000caab0
DLL Name: WSOCK32.DLL
000cac18 00000000 00000000 00000000 000cad8d 000caab8
DLL Name: AVICAP32.DLL
000cac2c 00000000 00000000 00000000 000cad9a 000caac0
DLL Name: ADVAPI32.DLL
000cac40 00000000 00000000 00000000 000cada7 000caac8
DLL Name: ADVAPI32.DLL
000cac54 00000000 00000000 00000000 000cadb4 000caad0
DLL Name: MPR.DLL
000cac68 00000000 00000000 00000000 000cadbc 000caad8
DLL Name: GDI32.DLL
000cac7c 00000000 00000000 00000000 000cadc6 000caae0
DLL Name: OLEAUT32.DLL
000cac90 00000000 00000000 00000000 000cadd3 000caae8
DLL Name: WINMM.DLL
000caca4 00000000 00000000 00000000 000caddd 000caaf0
DLL Name: USER32.DLL
000cacb8 00000000 00000000 00000000 000cade8 000caaf8
DLL Name: COMCTL32.DLL
000caccc 00000000 00000000 00000000 00000000 00000000
Sections:
Idx Name Size VMA LMA File off Algn
0 .nsp0 00000000 0000000000401000 0000000000401000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA, SHARED
1 .nsp1 00043bbf 00000000004c9000 00000000004c9000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
2 .nsp2 00000000 000000000050d000 000000000050d000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
SYMBOL TABLE:
no symbols |