| Objdump |
binaries/d5f74d1940bccc0f297e1c7846e5491f: file format efi-app-ia32
binaries/d5f74d1940bccc0f297e1c7846e5491f
architecture: i386, flags 0x0000010a:
EXEC_P, HAS_DEBUG, D_PAGED
start address 0x000000000047dc00
Characteristics 0x10f
relocations stripped
executable
line numbers stripped
symbols stripped
32 bit words
Time/Date Sun Sep 17 01:07:21 2006
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00084000
SizeOfHeaders 00000400
CheckSum 00000000
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000000
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000001000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010
The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 000000000006d04c 0000003c Import Directory [parts of .idata]
Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 000000000001c348 00000048 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000000000 00000000 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved
There is an import table in .data at 0x46d04c
The Import Tables (interpreted .data section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
0006d04c 00000000 00000000 00000000 0006d0ec 0006d000
DLL Name: kernel32.dll
0006d060 00000000 00000000 00000000 0006d0f9 0006d01c
DLL Name: user32.dll
0006d074 00000000 00000000 00000000 0006d104 0006d024
DLL Name: advapi32.dll
0006d088 00000000 00000000 00000000 0006d111 0006d02c
DLL Name: oleaut32.dll
0006d09c 00000000 00000000 00000000 0006d11e 0006d034
DLL Name: gdi32.dll
0006d0b0 00000000 00000000 00000000 0006d128 0006d03c
DLL Name: shell32.dll
0006d0c4 00000000 00000000 00000000 0006d134 0006d044
DLL Name: ws2_32.dll
0006d0d8 00000000 00000000 00000000 00000000 00000000
Sections:
Idx Name Size VMA LMA File off Algn
0 0000c400 0000000000401000 0000000000401000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE
1 00002200 0000000000417000 0000000000417000 0000c800 2**2
CONTENTS, ALLOC, LOAD, CODE
2 00001000 000000000041e000 000000000041e000 0000ea00 2**2
CONTENTS, ALLOC, LOAD, CODE
3 .data 00012200 000000000046d000 000000000046d000 0000fa00 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
SYMBOL TABLE:
no symbols |