diff --git a/src/LibObjectFile.Tests/PE/PEReaderTests.cs b/src/LibObjectFile.Tests/PE/PEReaderTests.cs index 20363e9..84d06f8 100644 --- a/src/LibObjectFile.Tests/PE/PEReaderTests.cs +++ b/src/LibObjectFile.Tests/PE/PEReaderTests.cs @@ -7,8 +7,10 @@ using System.Linq; using System.Runtime.InteropServices; using System.Threading.Tasks; +using LibObjectFile.Diagnostics; using LibObjectFile.PE; using VerifyMSTest; +using VerifyTests; namespace LibObjectFile.Tests.PE; @@ -23,10 +25,28 @@ public partial class PEReaderTests public async Task TestPrinter(string name) { - var stream = File.OpenRead(Path.Combine(AppContext.BaseDirectory, "PE", name)); + + await using var stream = File.OpenRead(Path.Combine(AppContext.BaseDirectory, "PE", name)); var peImage = PEFile.Read(stream); - var text = new StringWriter(); - peImage.Print(text); - await Verifier.Verify(text).UseParameters(name); + var afterReadWriter = new StringWriter(); + peImage.Print(afterReadWriter); + + var afterReadText = afterReadWriter.ToString(); + + await Verifier.Verify(afterReadText).UseParameters(name); + + // Update the layout + var diagnostics = new DiagnosticBag(); + peImage.UpdateLayout(diagnostics); + + var afterUpdateWriter = new StringWriter(); + peImage.Print(afterUpdateWriter); + var afterUpdateText = afterUpdateWriter.ToString(); + + if (!string.Equals(afterReadText, afterUpdateText, StringComparison.Ordinal)) + { + TestContext.WriteLine("Error while verifying UpdateLayout"); + await Verifier.Verify(afterUpdateText).UseParameters(name).DisableRequireUniquePrefix(); + } } } \ No newline at end of file diff --git a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsole2Win64.exe.verified.txt b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsole2Win64.exe.verified.txt index a881069..1909d2c 100644 --- a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsole2Win64.exe.verified.txt +++ b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsole2Win64.exe.verified.txt @@ -83,99 +83,99 @@ Data Directories Sections [00] .text PESection Position = 0x00000400, Size = 0x00001A00, RVA = 0x00001000, VirtualSize = 0x000019E9, Characteristics = 0x60000020 (ContainsCode, MemExecute, MemRead) - Section Data [00] PEStreamSectionData Position = 0x00000400, Size = 0x00001A00, RVA = 0x00001000, VirtualSize = 0x00001A00 + [00] PEStreamSectionData Position = 0x00000400, Size = 0x000019E9, RVA = 0x00001000, VirtualSize = 0x000019E9 [01] .rdata PESection Position = 0x00001E00, Size = 0x00001A00, RVA = 0x00003000, VirtualSize = 0x0000183C, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEImportAddressTableDirectory Position = 0x00001E00, Size = 0x00000250, RVA = 0x00003000, VirtualSize = 0x00000250 - Section Data [00] PEImportAddressTable Position = 0x00001EC0, Size = 0x00000068, RVA = 0x00003000, VirtualSize = 0x00000068 - [0] PEImportHintName { Hint = 255, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z } (RVA = 0x42D6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x27E) - [1] PEImportHintName { Hint = 262, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z } (RVA = 0x4282, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x22A) - [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x4242, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x1EA) - [3] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x41FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x1A6) - [4] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x41C0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x168) - [5] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x417E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x126) - [6] PEImportHintName { Hint = 1121, Name = ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z } (RVA = 0x413A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0xE2) - [7] PEImportHintName { Hint = 1332, Name = ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z } (RVA = 0x40FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0xA6) - [8] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x40B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5E) - [9] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x4094, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3C) - [10] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x4318, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x2C0) - [11] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x4058, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x0) - - Section Data [01] PEImportAddressTable Position = 0x00001F60, Size = 0x00000010, RVA = 0x00003068, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x4346, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x2EE) - - Section Data [02] PEImportAddressTable Position = 0x00001F28, Size = 0x00000038, RVA = 0x00003078, VirtualSize = 0x00000038 - [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x47AC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x754) - [1] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x439C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x344) - [2] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x43BA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x362) - [3] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x436E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x316) - [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x4386, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x32E) - [5] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x435C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x304) - - Section Data [03] PEImportAddressTable Position = 0x00001FA0, Size = 0x00000098, RVA = 0x000030B0, VirtualSize = 0x00000098 - [0] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x44C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x46C) - [1] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4566, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x50E) - [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x454A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4F2) - [3] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x44A0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x448) - [4] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x448A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x432) - [5] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x447E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x426) - [6] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x445C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x404) - [7] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x443A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3E2) - [8] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x4420, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3C8) - [9] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x44D2, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x47A) - [10] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x43FC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3A4) - [11] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x43EA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x392) - [12] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4590, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x538) - [13] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x4498, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x440) - [14] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4582, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x52A) - [15] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x44B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x45E) - [16] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x44E6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x48E) - [17] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x44DC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x484) - - Section Data [04] PEImportAddressTable Position = 0x00001F90, Size = 0x00000010, RVA = 0x00003148, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x440C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3B4) - - Section Data [05] PEImportAddressTable Position = 0x00002038, Size = 0x00000018, RVA = 0x00003158, VirtualSize = 0x00000018 - [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x453A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4E2) - [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x44A8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x450) - - Section Data [06] PEImportAddressTable Position = 0x00001F80, Size = 0x00000010, RVA = 0x00003170, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x4514, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4BC) - - Section Data [07] PEImportAddressTable Position = 0x00001F70, Size = 0x00000010, RVA = 0x00003180, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x452A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4D2) - - Section Data [08] PEImportAddressTable Position = 0x00001E00, Size = 0x000000C0, RVA = 0x00003190, VirtualSize = 0x000000C0 - [0] PEImportHintName { Hint = 997, Name = LoadLibraryExA } (RVA = 0x482A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7D2) - [1] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4654, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5FC) - [2] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x466E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x616) - [3] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4682, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x62A) - [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x469E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x646) - [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x46BC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x664) - [6] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x46D0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x678) - [7] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x46E4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x68C) - [8] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x4700, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6A8) - [9] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x471A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6C2) - [10] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4730, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6D8) - [11] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4746, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6EE) - [12] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4760, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x708) - [13] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4776, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x71E) - [14] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x478A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x732) - [15] PEImportHintName { Hint = 1159, Name = RaiseException } (RVA = 0x47B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x75E) - [16] PEImportHintName { Hint = 637, Name = GetLastError } (RVA = 0x47C8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x770) - [17] PEImportHintName { Hint = 717, Name = GetProcAddress } (RVA = 0x4818, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7C0) - [18] PEImportHintName { Hint = 453, Name = FreeLibrary } (RVA = 0x480A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7B2) - [19] PEImportHintName { Hint = 1543, Name = VirtualQuery } (RVA = 0x47FA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7A2) - [20] PEImportHintName { Hint = 1541, Name = VirtualProtect } (RVA = 0x47E8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x790) - [21] PEImportHintName { Hint = 772, Name = GetSystemInfo } (RVA = 0x47D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x780) - [22] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4640, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5E8) - - - Section Data [01] PEStreamSectionData Position = 0x00002050, Size = 0x00000140, RVA = 0x00003250, VirtualSize = 0x00000140 - - Section Data [02] PELoadConfigDirectory64 Position = 0x00002190, Size = 0x00000140, RVA = 0x00003390, VirtualSize = 0x00000140 + [00] PEImportAddressTableDirectory Position = 0x00001E00, Size = 0x00000250, RVA = 0x00003000, VirtualSize = 0x00000250 + [00] PEImportAddressTable Position = 0x00001E00, Size = 0x000000C0, RVA = 0x00003000, VirtualSize = 0x000000C0 + [0] PEImportHintName { Hint = 997, Name = LoadLibraryExA } (RVA = 0x482A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7D2) + [1] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4654, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5FC) + [2] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x466E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x616) + [3] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4682, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x62A) + [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x469E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x646) + [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x46BC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x664) + [6] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x46D0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x678) + [7] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x46E4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x68C) + [8] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x4700, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6A8) + [9] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x471A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6C2) + [10] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4730, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6D8) + [11] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4746, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6EE) + [12] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4760, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x708) + [13] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4776, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x71E) + [14] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x478A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x732) + [15] PEImportHintName { Hint = 1159, Name = RaiseException } (RVA = 0x47B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x75E) + [16] PEImportHintName { Hint = 637, Name = GetLastError } (RVA = 0x47C8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x770) + [17] PEImportHintName { Hint = 717, Name = GetProcAddress } (RVA = 0x4818, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7C0) + [18] PEImportHintName { Hint = 453, Name = FreeLibrary } (RVA = 0x480A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7B2) + [19] PEImportHintName { Hint = 1543, Name = VirtualQuery } (RVA = 0x47FA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7A2) + [20] PEImportHintName { Hint = 1541, Name = VirtualProtect } (RVA = 0x47E8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x790) + [21] PEImportHintName { Hint = 772, Name = GetSystemInfo } (RVA = 0x47D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x780) + [22] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4640, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5E8) + + [01] PEImportAddressTable Position = 0x00001EC0, Size = 0x00000068, RVA = 0x000030C0, VirtualSize = 0x00000068 + [0] PEImportHintName { Hint = 255, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z } (RVA = 0x42D6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x27E) + [1] PEImportHintName { Hint = 262, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z } (RVA = 0x4282, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x22A) + [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x4242, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x1EA) + [3] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x41FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x1A6) + [4] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x41C0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x168) + [5] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x417E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x126) + [6] PEImportHintName { Hint = 1121, Name = ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z } (RVA = 0x413A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0xE2) + [7] PEImportHintName { Hint = 1332, Name = ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z } (RVA = 0x40FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0xA6) + [8] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x40B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5E) + [9] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x4094, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3C) + [10] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x4318, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x2C0) + [11] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x4058, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x0) + + [02] PEImportAddressTable Position = 0x00001F28, Size = 0x00000038, RVA = 0x00003128, VirtualSize = 0x00000038 + [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x47AC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x754) + [1] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x439C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x344) + [2] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x43BA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x362) + [3] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x436E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x316) + [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x4386, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x32E) + [5] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x435C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x304) + + [03] PEImportAddressTable Position = 0x00001F60, Size = 0x00000010, RVA = 0x00003160, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x4346, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x2EE) + + [04] PEImportAddressTable Position = 0x00001F70, Size = 0x00000010, RVA = 0x00003170, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x452A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4D2) + + [05] PEImportAddressTable Position = 0x00001F80, Size = 0x00000010, RVA = 0x00003180, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x4514, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4BC) + + [06] PEImportAddressTable Position = 0x00001F90, Size = 0x00000010, RVA = 0x00003190, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x440C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3B4) + + [07] PEImportAddressTable Position = 0x00001FA0, Size = 0x00000098, RVA = 0x000031A0, VirtualSize = 0x00000098 + [0] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x44C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x46C) + [1] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4566, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x50E) + [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x454A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4F2) + [3] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x44A0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x448) + [4] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x448A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x432) + [5] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x447E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x426) + [6] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x445C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x404) + [7] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x443A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3E2) + [8] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x4420, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3C8) + [9] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x44D2, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x47A) + [10] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x43FC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3A4) + [11] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x43EA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x392) + [12] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4590, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x538) + [13] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x4498, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x440) + [14] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4582, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x52A) + [15] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x44B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x45E) + [16] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x44E6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x48E) + [17] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x44DC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x484) + + [08] PEImportAddressTable Position = 0x00002038, Size = 0x00000018, RVA = 0x00003238, VirtualSize = 0x00000018 + [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x453A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4E2) + [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x44A8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x450) + + + [01] PEStreamSectionData Position = 0x00002050, Size = 0x00000140, RVA = 0x00003250, VirtualSize = 0x00000140 + + [02] PELoadConfigDirectory64 Position = 0x00002190, Size = 0x00000140, RVA = 0x00003390, VirtualSize = 0x00000140 Size = 0x140 TimeDateStamp = 0x0 MajorVersion = 0 @@ -230,414 +230,406 @@ Sections CastGuardOsDeterminedFailureMode = 0x140003278 GuardMemcpyFunctionPointer = 0x140003280 - Section Data [03] PEStreamSectionData Position = 0x000022D0, Size = 0x00000010, RVA = 0x000034D0, VirtualSize = 0x00000010 + [03] PEStreamSectionData Position = 0x000022D0, Size = 0x00000010, RVA = 0x000034D0, VirtualSize = 0x00000010 - Section Data [04] PEDebugDirectory Position = 0x000022E0, Size = 0x00000070, RVA = 0x000034E0, VirtualSize = 0x00000070 - [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x00003618 (PEDebugSectionDataRSDS[6] .rdata - [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x0000368C (PEDebugStreamSectionData[8] .rdata - [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x000036A0 (PEDebugStreamSectionData[9] .rdata + [04] PEDebugDirectory Position = 0x000022E0, Size = 0x00000070, RVA = 0x000034E0, VirtualSize = 0x00000070 + [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x00003618 (PEDebugSectionDataRSDS[6] -> .rdata) + [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x0000368C (PEDebugStreamSectionData[8] -> .rdata) + [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = RVA = 0x000036A0 (PEDebugStreamSectionData[9] -> .rdata) [3] Type = ILTCG, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2F, Data = null - Section Data [05] PEStreamSectionData Position = 0x00002350, Size = 0x000000C8, RVA = 0x00003550, VirtualSize = 0x000000C8 + [05] PEStreamSectionData Position = 0x00002350, Size = 0x000000C8, RVA = 0x00003550, VirtualSize = 0x000000C8 - Section Data [06] PEDebugSectionDataRSDS Position = 0x00002418, Size = 0x00000072, RVA = 0x00003618, VirtualSize = 0x00000072 + [06] PEDebugSectionDataRSDS Position = 0x00002418, Size = 0x00000072, RVA = 0x00003618, VirtualSize = 0x00000072 Debug Section Data (RSDS) Guid = ffed6f99-5708-452c-a889-ff343b6ce898 Age = 6 PdbPath = C:\code\LibObjectFile\src\native\Win64\NativeProjects\x64\Release\NativeConsole2Win64.pdb - Section Data [07] PEStreamSectionData Position = 0x0000248A, Size = 0x00000002, RVA = 0x0000368A, VirtualSize = 0x00000002 + [07] PEStreamSectionData Position = 0x0000248A, Size = 0x00000002, RVA = 0x0000368A, VirtualSize = 0x00000002 - Section Data [08] PEDebugStreamSectionData Position = 0x0000248C, Size = 0x00000014, RVA = 0x0000368C, VirtualSize = 0x00000014 + [08] PEDebugStreamSectionData Position = 0x0000248C, Size = 0x00000014, RVA = 0x0000368C, VirtualSize = 0x00000014 - Section Data [09] PEDebugStreamSectionData Position = 0x000024A0, Size = 0x000002FC, RVA = 0x000036A0, VirtualSize = 0x000002FC + [09] PEDebugStreamSectionData Position = 0x000024A0, Size = 0x000002FC, RVA = 0x000036A0, VirtualSize = 0x000002FC - Section Data [10] PEStreamSectionData Position = 0x0000279C, Size = 0x0000020C, RVA = 0x0000399C, VirtualSize = 0x0000020C + [10] PEStreamSectionData Position = 0x0000279C, Size = 0x0000020C, RVA = 0x0000399C, VirtualSize = 0x0000020C - Section Data [11] PEDelayImportDirectory Position = 0x000029A8, Size = 0x00000040, RVA = 0x00003BA8, VirtualSize = 0x00000040 + [11] PEDelayImportDirectory Position = 0x000029A8, Size = 0x00000040, RVA = 0x00003BA8, VirtualSize = 0x00000040 [0] DllName = NativeLibraryWin64.dll, RVA = 0x32E0 [0] Attributes = 1 - [0] DelayImportAddressTable RVA = 0x00005078 (PEBoundImportAddressTable64[1] .data - [0] DelayImportNameTable RVA = 0x00003BE8 (PEImportLookupTable[12] .rdata - [0] BoundImportAddressTable RVA = 0x00003C20 (PEBoundImportAddressTable64[14] .rdata + [0] DelayImportAddressTable RVA = 0x00005078 (PEBoundImportAddressTable64[1] -> .data) + [0] DelayImportNameTable RVA = 0x00003BE8 (PEImportLookupTable[12] -> .rdata) + [0] BoundImportAddressTable RVA = 0x00003C20 (PEBoundImportAddressTable64[14] -> .rdata) [0] UnloadDelayInformationTable null - Section Data [12] PEImportLookupTable Position = 0x000029E8, Size = 0x00000018, RVA = 0x00003BE8, VirtualSize = 0x00000018 + [12] PEImportLookupTable Position = 0x000029E8, Size = 0x00000018, RVA = 0x00003BE8, VirtualSize = 0x00000018 [0] PEImportHintName { Hint = 0, Name = AnotherFunction } (RVA = 0x3C0E, PEStreamSectionData { RVA = 0x3C00, VirtualSize = 0x20, Position = 0x2A00, Size = 0x20 }, Offset = 0xE) [1] PEImportHintName { Hint = 1, Name = HelloWorld } (RVA = 0x3C00, PEStreamSectionData { RVA = 0x3C00, VirtualSize = 0x20, Position = 0x2A00, Size = 0x20 }, Offset = 0x0) - Section Data [13] PEStreamSectionData Position = 0x00002A00, Size = 0x00000020, RVA = 0x00003C00, VirtualSize = 0x00000020 + [13] PEStreamSectionData Position = 0x00002A00, Size = 0x00000020, RVA = 0x00003C00, VirtualSize = 0x00000020 - Section Data [14] PEBoundImportAddressTable64 Position = 0x00002A20, Size = 0x00000018, RVA = 0x00003C20, VirtualSize = 0x00000018 + [14] PEBoundImportAddressTable64 Position = 0x00002A20, Size = 0x00000018, RVA = 0x00003C20, VirtualSize = 0x00000018 [0] VA = 0x0 [1] VA = 0x0 - Section Data [15] PEStreamSectionData Position = 0x00002A38, Size = 0x00000104, RVA = 0x00003C38, VirtualSize = 0x00000104 - - Section Data [16] PEImportDirectory Position = 0x00002B3C, Size = 0x000000C8, RVA = 0x00003D3C, VirtualSize = 0x000000C8 - [0] ImportDllNameLink = MSVCP140.dll (RVA = 0x4338, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x2E0) - [0] ImportAddressTable = RVA = 0x00003000 (PEImportAddressTable[0] - [0] ImportLookupTable = RVA = 0x00003EC8 (PEImportLookupTable[19] .rdata - - [1] ImportDllNameLink = VCRUNTIME140_1.dll (RVA = 0x43C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x36C) - [1] ImportAddressTable = RVA = 0x00003068 (PEImportAddressTable[1] - [1] ImportLookupTable = RVA = 0x00003F68 (PEImportLookupTable[21] .rdata - - [2] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x43D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x380) - [2] ImportAddressTable = RVA = 0x00003078 (PEImportAddressTable[2] - [2] ImportLookupTable = RVA = 0x00003F30 (PEImportLookupTable[20] .rdata - - [3] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x459C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x544) - [3] ImportAddressTable = RVA = 0x000030B0 (PEImportAddressTable[3] - [3] ImportLookupTable = RVA = 0x00003FA8 (PEImportLookupTable[25] .rdata - - [4] ImportDllNameLink = api-ms-win-crt-math-l1-1-0.dll (RVA = 0x45BE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x566) - [4] ImportAddressTable = RVA = 0x00003148 (PEImportAddressTable[4] - [4] ImportLookupTable = RVA = 0x00003F98 (PEImportLookupTable[24] .rdata - - [5] ImportDllNameLink = api-ms-win-crt-stdio-l1-1-0.dll (RVA = 0x45DE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x586) - [5] ImportAddressTable = RVA = 0x00003158 (PEImportAddressTable[5] - [5] ImportLookupTable = RVA = 0x00004040 (PEImportLookupTable[26] .rdata - - [6] ImportDllNameLink = api-ms-win-crt-locale-l1-1-0.dll (RVA = 0x45FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5A6) - [6] ImportAddressTable = RVA = 0x00003170 (PEImportAddressTable[6] - [6] ImportLookupTable = RVA = 0x00003F88 (PEImportLookupTable[23] .rdata - - [7] ImportDllNameLink = api-ms-win-crt-heap-l1-1-0.dll (RVA = 0x4620, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5C8) - [7] ImportAddressTable = RVA = 0x00003180 (PEImportAddressTable[7] - [7] ImportLookupTable = RVA = 0x00003F78 (PEImportLookupTable[22] .rdata - - [8] ImportDllNameLink = KERNEL32.dll (RVA = 0x479E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x746) - [8] ImportAddressTable = RVA = 0x00003190 (PEImportAddressTable[8] - [8] ImportLookupTable = RVA = 0x00003E08 (PEImportLookupTable[18] .rdata - - - Section Data [17] PEStreamSectionData Position = 0x00002C04, Size = 0x00000004, RVA = 0x00003E04, VirtualSize = 0x00000004 - - Section Data [18] PEImportLookupTable Position = 0x00002C08, Size = 0x000000C0, RVA = 0x00003E08, VirtualSize = 0x000000C0 - [0] PEImportHintName { Hint = 997, Name = LoadLibraryExA } (RVA = 0x482A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7D2) - [1] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4654, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5FC) - [2] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x466E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x616) - [3] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4682, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x62A) - [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x469E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x646) - [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x46BC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x664) - [6] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x46D0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x678) - [7] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x46E4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x68C) - [8] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x4700, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6A8) - [9] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x471A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6C2) - [10] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4730, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6D8) - [11] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4746, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x6EE) - [12] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4760, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x708) - [13] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4776, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x71E) - [14] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x478A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x732) - [15] PEImportHintName { Hint = 1159, Name = RaiseException } (RVA = 0x47B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x75E) - [16] PEImportHintName { Hint = 637, Name = GetLastError } (RVA = 0x47C8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x770) - [17] PEImportHintName { Hint = 717, Name = GetProcAddress } (RVA = 0x4818, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7C0) - [18] PEImportHintName { Hint = 453, Name = FreeLibrary } (RVA = 0x480A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7B2) - [19] PEImportHintName { Hint = 1543, Name = VirtualQuery } (RVA = 0x47FA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x7A2) - [20] PEImportHintName { Hint = 1541, Name = VirtualProtect } (RVA = 0x47E8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x790) - [21] PEImportHintName { Hint = 772, Name = GetSystemInfo } (RVA = 0x47D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x780) - [22] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4640, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5E8) - - Section Data [19] PEImportLookupTable Position = 0x00002CC8, Size = 0x00000068, RVA = 0x00003EC8, VirtualSize = 0x00000068 - [0] PEImportHintName { Hint = 255, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z } (RVA = 0x42D6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x27E) - [1] PEImportHintName { Hint = 262, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z } (RVA = 0x4282, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x22A) - [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x4242, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x1EA) - [3] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x41FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x1A6) - [4] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x41C0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x168) - [5] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x417E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x126) - [6] PEImportHintName { Hint = 1121, Name = ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z } (RVA = 0x413A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0xE2) - [7] PEImportHintName { Hint = 1332, Name = ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z } (RVA = 0x40FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0xA6) - [8] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x40B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x5E) - [9] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x4094, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3C) - [10] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x4318, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x2C0) - [11] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x4058, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x0) - - Section Data [20] PEImportLookupTable Position = 0x00002D30, Size = 0x00000038, RVA = 0x00003F30, VirtualSize = 0x00000038 - [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x47AC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x754) - [1] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x439C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x344) - [2] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x43BA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x362) - [3] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x436E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x316) - [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x4386, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x32E) - [5] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x435C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x304) - - Section Data [21] PEImportLookupTable Position = 0x00002D68, Size = 0x00000010, RVA = 0x00003F68, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x4346, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x2EE) - - Section Data [22] PEImportLookupTable Position = 0x00002D78, Size = 0x00000010, RVA = 0x00003F78, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x452A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4D2) - - Section Data [23] PEImportLookupTable Position = 0x00002D88, Size = 0x00000010, RVA = 0x00003F88, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x4514, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4BC) - - Section Data [24] PEImportLookupTable Position = 0x00002D98, Size = 0x00000010, RVA = 0x00003F98, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x440C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3B4) - - Section Data [25] PEImportLookupTable Position = 0x00002DA8, Size = 0x00000098, RVA = 0x00003FA8, VirtualSize = 0x00000098 - [0] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x44C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x46C) - [1] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4566, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x50E) - [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x454A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4F2) - [3] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x44A0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x448) - [4] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x448A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x432) - [5] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x447E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x426) - [6] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x445C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x404) - [7] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x443A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3E2) - [8] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x4420, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3C8) - [9] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x44D2, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x47A) - [10] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x43FC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x3A4) - [11] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x43EA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x392) - [12] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4590, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x538) - [13] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x4498, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x440) - [14] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4582, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x52A) - [15] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x44B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x45E) - [16] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x44E6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x48E) - [17] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x44DC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x484) - - Section Data [26] PEImportLookupTable Position = 0x00002E40, Size = 0x00000018, RVA = 0x00004040, VirtualSize = 0x00000018 - [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x453A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x4E2) - [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x44A8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x9A8, Position = 0x2E58, Size = 0x9A8 }, Offset = 0x450) - - Section Data [27] PEStreamSectionData Position = 0x00002E58, Size = 0x000009A8, RVA = 0x00004058, VirtualSize = 0x000009A8 + [15] PEStreamSectionData Position = 0x00002A38, Size = 0x00000104, RVA = 0x00003C38, VirtualSize = 0x00000104 + + [16] PEImportDirectory Position = 0x00002B3C, Size = 0x000000C8, RVA = 0x00003D3C, VirtualSize = 0x000000C8 + [0] ImportDllNameLink = MSVCP140.dll (RVA = 0x4338, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x2E0) + [0] ImportAddressTable = RVA = 0x000030C0 (PEImportAddressTable[1] -> PEImportAddressTableDirectory[0] -> .rdata) + [0] ImportLookupTable = RVA = 0x00003EC8 (PEImportLookupTable[19] -> .rdata) + + [1] ImportDllNameLink = VCRUNTIME140_1.dll (RVA = 0x43C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x36C) + [1] ImportAddressTable = RVA = 0x00003160 (PEImportAddressTable[3] -> PEImportAddressTableDirectory[0] -> .rdata) + [1] ImportLookupTable = RVA = 0x00003F68 (PEImportLookupTable[21] -> .rdata) + + [2] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x43D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x380) + [2] ImportAddressTable = RVA = 0x00003128 (PEImportAddressTable[2] -> PEImportAddressTableDirectory[0] -> .rdata) + [2] ImportLookupTable = RVA = 0x00003F30 (PEImportLookupTable[20] -> .rdata) + + [3] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x459C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x544) + [3] ImportAddressTable = RVA = 0x000031A0 (PEImportAddressTable[7] -> PEImportAddressTableDirectory[0] -> .rdata) + [3] ImportLookupTable = RVA = 0x00003FA8 (PEImportLookupTable[25] -> .rdata) + + [4] ImportDllNameLink = api-ms-win-crt-math-l1-1-0.dll (RVA = 0x45BE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x566) + [4] ImportAddressTable = RVA = 0x00003190 (PEImportAddressTable[6] -> PEImportAddressTableDirectory[0] -> .rdata) + [4] ImportLookupTable = RVA = 0x00003F98 (PEImportLookupTable[24] -> .rdata) + + [5] ImportDllNameLink = api-ms-win-crt-stdio-l1-1-0.dll (RVA = 0x45DE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x586) + [5] ImportAddressTable = RVA = 0x00003238 (PEImportAddressTable[8] -> PEImportAddressTableDirectory[0] -> .rdata) + [5] ImportLookupTable = RVA = 0x00004040 (PEImportLookupTable[26] -> .rdata) + + [6] ImportDllNameLink = api-ms-win-crt-locale-l1-1-0.dll (RVA = 0x45FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5A6) + [6] ImportAddressTable = RVA = 0x00003180 (PEImportAddressTable[5] -> PEImportAddressTableDirectory[0] -> .rdata) + [6] ImportLookupTable = RVA = 0x00003F88 (PEImportLookupTable[23] -> .rdata) + + [7] ImportDllNameLink = api-ms-win-crt-heap-l1-1-0.dll (RVA = 0x4620, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5C8) + [7] ImportAddressTable = RVA = 0x00003170 (PEImportAddressTable[4] -> PEImportAddressTableDirectory[0] -> .rdata) + [7] ImportLookupTable = RVA = 0x00003F78 (PEImportLookupTable[22] -> .rdata) + + [8] ImportDllNameLink = KERNEL32.dll (RVA = 0x479E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x746) + [8] ImportAddressTable = RVA = 0x00003000 (PEImportAddressTable[0] -> PEImportAddressTableDirectory[0] -> .rdata) + [8] ImportLookupTable = RVA = 0x00003E08 (PEImportLookupTable[18] -> .rdata) + + + [17] PEStreamSectionData Position = 0x00002C04, Size = 0x00000004, RVA = 0x00003E04, VirtualSize = 0x00000004 + + [18] PEImportLookupTable Position = 0x00002C08, Size = 0x000000C0, RVA = 0x00003E08, VirtualSize = 0x000000C0 + [0] PEImportHintName { Hint = 997, Name = LoadLibraryExA } (RVA = 0x482A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7D2) + [1] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4654, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5FC) + [2] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x466E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x616) + [3] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4682, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x62A) + [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x469E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x646) + [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x46BC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x664) + [6] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x46D0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x678) + [7] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x46E4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x68C) + [8] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x4700, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6A8) + [9] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x471A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6C2) + [10] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4730, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6D8) + [11] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4746, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x6EE) + [12] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4760, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x708) + [13] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4776, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x71E) + [14] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x478A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x732) + [15] PEImportHintName { Hint = 1159, Name = RaiseException } (RVA = 0x47B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x75E) + [16] PEImportHintName { Hint = 637, Name = GetLastError } (RVA = 0x47C8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x770) + [17] PEImportHintName { Hint = 717, Name = GetProcAddress } (RVA = 0x4818, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7C0) + [18] PEImportHintName { Hint = 453, Name = FreeLibrary } (RVA = 0x480A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7B2) + [19] PEImportHintName { Hint = 1543, Name = VirtualQuery } (RVA = 0x47FA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x7A2) + [20] PEImportHintName { Hint = 1541, Name = VirtualProtect } (RVA = 0x47E8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x790) + [21] PEImportHintName { Hint = 772, Name = GetSystemInfo } (RVA = 0x47D8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x780) + [22] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4640, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5E8) + + [19] PEImportLookupTable Position = 0x00002CC8, Size = 0x00000068, RVA = 0x00003EC8, VirtualSize = 0x00000068 + [0] PEImportHintName { Hint = 255, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z } (RVA = 0x42D6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x27E) + [1] PEImportHintName { Hint = 262, Name = ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z } (RVA = 0x4282, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x22A) + [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x4242, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x1EA) + [3] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x41FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x1A6) + [4] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x41C0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x168) + [5] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x417E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x126) + [6] PEImportHintName { Hint = 1121, Name = ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z } (RVA = 0x413A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0xE2) + [7] PEImportHintName { Hint = 1332, Name = ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z } (RVA = 0x40FE, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0xA6) + [8] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x40B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x5E) + [9] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x4094, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3C) + [10] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x4318, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x2C0) + [11] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x4058, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x0) + + [20] PEImportLookupTable Position = 0x00002D30, Size = 0x00000038, RVA = 0x00003F30, VirtualSize = 0x00000038 + [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x47AC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x754) + [1] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x439C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x344) + [2] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x43BA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x362) + [3] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x436E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x316) + [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x4386, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x32E) + [5] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x435C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x304) + + [21] PEImportLookupTable Position = 0x00002D68, Size = 0x00000010, RVA = 0x00003F68, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x4346, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x2EE) + + [22] PEImportLookupTable Position = 0x00002D78, Size = 0x00000010, RVA = 0x00003F78, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x452A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4D2) + + [23] PEImportLookupTable Position = 0x00002D88, Size = 0x00000010, RVA = 0x00003F88, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x4514, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4BC) + + [24] PEImportLookupTable Position = 0x00002D98, Size = 0x00000010, RVA = 0x00003F98, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x440C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3B4) + + [25] PEImportLookupTable Position = 0x00002DA8, Size = 0x00000098, RVA = 0x00003FA8, VirtualSize = 0x00000098 + [0] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x44C4, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x46C) + [1] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4566, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x50E) + [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x454A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4F2) + [3] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x44A0, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x448) + [4] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x448A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x432) + [5] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x447E, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x426) + [6] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x445C, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x404) + [7] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x443A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3E2) + [8] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x4420, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3C8) + [9] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x44D2, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x47A) + [10] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x43FC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x3A4) + [11] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x43EA, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x392) + [12] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4590, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x538) + [13] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x4498, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x440) + [14] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4582, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x52A) + [15] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x44B6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x45E) + [16] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x44E6, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x48E) + [17] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x44DC, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x484) + + [26] PEImportLookupTable Position = 0x00002E40, Size = 0x00000018, RVA = 0x00004040, VirtualSize = 0x00000018 + [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x453A, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x4E2) + [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x44A8, PEStreamSectionData { RVA = 0x4058, VirtualSize = 0x7E4, Position = 0x2E58, Size = 0x7E4 }, Offset = 0x450) + + [27] PEStreamSectionData Position = 0x00002E58, Size = 0x000007E4, RVA = 0x00004058, VirtualSize = 0x000007E4 [02] .data PESection Position = 0x00003800, Size = 0x00000200, RVA = 0x00005000, VirtualSize = 0x000006D0, Characteristics = 0xC0000040 (ContainsInitializedData, MemRead, MemWrite) - Section Data [00] PEStreamSectionData Position = 0x00003800, Size = 0x00000078, RVA = 0x00005000, VirtualSize = 0x00000078 + [00] PEStreamSectionData Position = 0x00003800, Size = 0x00000078, RVA = 0x00005000, VirtualSize = 0x00000078 - Section Data [01] PEBoundImportAddressTable64 Position = 0x00003878, Size = 0x00000018, RVA = 0x00005078, VirtualSize = 0x00000018 + [01] PEBoundImportAddressTable64 Position = 0x00003878, Size = 0x00000018, RVA = 0x00005078, VirtualSize = 0x00000018 [0] VA = 0x14000133E [1] VA = 0x140001332 - Section Data [02] PEStreamSectionData Position = 0x00003890, Size = 0x00000170, RVA = 0x00005090, VirtualSize = 0x00000170 + [02] PEStreamSectionData Position = 0x00003890, Size = 0x00000170, RVA = 0x00005090, VirtualSize = 0x00000170 [03] .pdata PESection Position = 0x00003A00, Size = 0x00000400, RVA = 0x00006000, VirtualSize = 0x00000210, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEExceptionDirectory Position = 0x00003A00, Size = 0x00000210, RVA = 0x00006000, VirtualSize = 0x00000210 - [0] Begin = RVA = 0x1000, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x0 - [0] End = RVA = 0x104B, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x4B + [00] PEExceptionDirectory Position = 0x00003A00, Size = 0x00000210, RVA = 0x00006000, VirtualSize = 0x00000210 + [0] Begin = RVA = 0x1000, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x0 + [0] End = RVA = 0x104B, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x4B [0] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [1] Begin = RVA = 0x1050, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x50 - [1] End = RVA = 0x108E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x8E + [1] Begin = RVA = 0x1050, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x50 + [1] End = RVA = 0x108E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x8E [1] UnwindInfoAddress = RVA = 0x39C8, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x2C - [2] Begin = RVA = 0x1090, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x90 - [2] End = RVA = 0x10B4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xB4 + [2] Begin = RVA = 0x1090, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x90 + [2] End = RVA = 0x10B4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xB4 [2] UnwindInfoAddress = RVA = 0x39EC, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x50 - [3] Begin = RVA = 0x10C0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xC0 - [3] End = RVA = 0x1272, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x272 + [3] Begin = RVA = 0x10C0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xC0 + [3] End = RVA = 0x1272, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x272 [3] UnwindInfoAddress = RVA = 0x3A04, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x68 - [4] Begin = RVA = 0x1280, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x280 - [4] End = RVA = 0x12B9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x2B9 + [4] Begin = RVA = 0x1280, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x280 + [4] End = RVA = 0x12B9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x2B9 [4] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [5] Begin = RVA = 0x12B9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x2B9 - [5] End = RVA = 0x1330, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x330 + [5] Begin = RVA = 0x12B9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x2B9 + [5] End = RVA = 0x1330, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x330 [5] UnwindInfoAddress = RVA = 0x3A64, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xC8 - [6] Begin = RVA = 0x1360, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x360 - [6] End = RVA = 0x137E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x37E + [6] Begin = RVA = 0x1360, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x360 + [6] End = RVA = 0x137E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x37E [6] UnwindInfoAddress = RVA = 0x3A70, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD4 - [7] Begin = RVA = 0x1380, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x380 - [7] End = RVA = 0x1436, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x436 + [7] Begin = RVA = 0x1380, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x380 + [7] End = RVA = 0x1436, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x436 [7] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [8] Begin = RVA = 0x1438, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x438 - [8] End = RVA = 0x1448, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x448 + [8] Begin = RVA = 0x1438, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x438 + [8] End = RVA = 0x1448, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x448 [8] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [9] Begin = RVA = 0x1448, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x448 - [9] End = RVA = 0x1461, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x461 + [9] Begin = RVA = 0x1448, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x448 + [9] End = RVA = 0x1461, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x461 [9] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [10] Begin = RVA = 0x1464, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x464 - [10] End = RVA = 0x15E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x5E0 + [10] Begin = RVA = 0x1464, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x464 + [10] End = RVA = 0x15E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x5E0 [10] UnwindInfoAddress = RVA = 0x3A7C, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xE0 - [11] Begin = RVA = 0x15E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x5E0 - [11] End = RVA = 0x15F2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x5F2 + [11] Begin = RVA = 0x15E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x5E0 + [11] End = RVA = 0x15F2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x5F2 [11] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [12] Begin = RVA = 0x15F4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x5F4 - [12] End = RVA = 0x1628, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x628 + [12] Begin = RVA = 0x15F4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x5F4 + [12] End = RVA = 0x1628, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x628 [12] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [13] Begin = RVA = 0x1628, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x628 - [13] End = RVA = 0x16FB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x6FB + [13] Begin = RVA = 0x1628, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x628 + [13] End = RVA = 0x16FB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x6FB [13] UnwindInfoAddress = RVA = 0x3ABC, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x120 - [14] Begin = RVA = 0x16FC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x6FC - [14] End = RVA = 0x176D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x76D + [14] Begin = RVA = 0x16FC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x6FC + [14] End = RVA = 0x176D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x76D [14] UnwindInfoAddress = RVA = 0x3AC4, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x128 - [15] Begin = RVA = 0x1770, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x770 - [15] End = RVA = 0x17A9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x7A9 + [15] Begin = RVA = 0x1770, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x770 + [15] End = RVA = 0x17A9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x7A9 [15] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [16] Begin = RVA = 0x17AC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x7AC - [16] End = RVA = 0x17E6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x7E6 + [16] Begin = RVA = 0x17AC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x7AC + [16] End = RVA = 0x17E6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x7E6 [16] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [17] Begin = RVA = 0x17E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x7E8 - [17] End = RVA = 0x1873, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x873 + [17] Begin = RVA = 0x17E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x7E8 + [17] End = RVA = 0x1873, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x873 [17] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [18] Begin = RVA = 0x1874, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x874 - [18] End = RVA = 0x190C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x90C + [18] Begin = RVA = 0x1874, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x874 + [18] End = RVA = 0x190C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x90C [18] UnwindInfoAddress = RVA = 0x3AD0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x134 - [19] Begin = RVA = 0x190C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x90C - [19] End = RVA = 0x1930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x930 + [19] Begin = RVA = 0x190C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x90C + [19] End = RVA = 0x1930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x930 [19] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [20] Begin = RVA = 0x1930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x930 - [20] End = RVA = 0x1959, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x959 + [20] Begin = RVA = 0x1930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x930 + [20] End = RVA = 0x1959, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x959 [20] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [21] Begin = RVA = 0x195C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x95C - [21] End = RVA = 0x1996, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x996 + [21] Begin = RVA = 0x195C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x95C + [21] End = RVA = 0x1996, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x996 [21] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [22] Begin = RVA = 0x1998, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x998 - [22] End = RVA = 0x19AF, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x9AF + [22] Begin = RVA = 0x1998, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x998 + [22] End = RVA = 0x19AF, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x9AF [22] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [23] Begin = RVA = 0x19B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x9B0 - [23] End = RVA = 0x1A5C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xA5C + [23] Begin = RVA = 0x19B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x9B0 + [23] End = RVA = 0x1A5C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xA5C [23] UnwindInfoAddress = RVA = 0x3AF8, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x15C - [24] Begin = RVA = 0x1A98, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xA98 - [24] End = RVA = 0x1AB3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xAB3 + [24] Begin = RVA = 0x1A98, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xA98 + [24] End = RVA = 0x1AB3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xAB3 [24] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [25] Begin = RVA = 0x1AD8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xAD8 - [25] End = RVA = 0x1C20, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xC20 + [25] Begin = RVA = 0x1AD8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xAD8 + [25] End = RVA = 0x1C20, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xC20 [25] UnwindInfoAddress = RVA = 0x3B04, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x168 - [26] Begin = RVA = 0x1C28, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xC28 - [26] End = RVA = 0x1C79, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xC79 + [26] Begin = RVA = 0x1C28, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xC28 + [26] End = RVA = 0x1C79, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xC79 [26] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [27] Begin = RVA = 0x1C8C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xC8C - [27] End = RVA = 0x1CE7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xCE7 + [27] Begin = RVA = 0x1C8C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xC8C + [27] End = RVA = 0x1CE7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xCE7 [27] UnwindInfoAddress = RVA = 0x3B14, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x178 - [28] Begin = RVA = 0x1CE8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xCE8 - [28] End = RVA = 0x1D24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xD24 + [28] Begin = RVA = 0x1CE8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xCE8 + [28] End = RVA = 0x1D24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xD24 [28] UnwindInfoAddress = RVA = 0x3B14, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x178 - [29] Begin = RVA = 0x1D24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xD24 - [29] End = RVA = 0x1D60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xD60 + [29] Begin = RVA = 0x1D24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xD24 + [29] End = RVA = 0x1D60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xD60 [29] UnwindInfoAddress = RVA = 0x3B14, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x178 - [30] Begin = RVA = 0x1D60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0xD60 - [30] End = RVA = 0x202A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x102A + [30] Begin = RVA = 0x1D60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0xD60 + [30] End = RVA = 0x202A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x102A [30] UnwindInfoAddress = RVA = 0x3B20, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x184 - [31] Begin = RVA = 0x20F0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x10F0 - [31] End = RVA = 0x21DB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x11DB + [31] Begin = RVA = 0x20F0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x10F0 + [31] End = RVA = 0x21DB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x11DB [31] UnwindInfoAddress = RVA = 0x3B94, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1F8 - [32] Begin = RVA = 0x21DC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x11DC - [32] End = RVA = 0x2296, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1296 + [32] Begin = RVA = 0x21DC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x11DC + [32] End = RVA = 0x2296, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1296 [32] UnwindInfoAddress = RVA = 0x39C0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x24 - [33] Begin = RVA = 0x2298, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1298 - [33] End = RVA = 0x2336, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1336 + [33] Begin = RVA = 0x2298, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1298 + [33] End = RVA = 0x2336, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1336 [33] UnwindInfoAddress = RVA = 0x3B14, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x178 - [34] Begin = RVA = 0x2338, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1338 - [34] End = RVA = 0x23D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x13D0 + [34] Begin = RVA = 0x2338, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1338 + [34] End = RVA = 0x23D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x13D0 [34] UnwindInfoAddress = RVA = 0x3B54, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1B8 - [35] Begin = RVA = 0x23D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x13D0 - [35] End = RVA = 0x246A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x146A + [35] Begin = RVA = 0x23D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x13D0 + [35] End = RVA = 0x246A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x146A [35] UnwindInfoAddress = RVA = 0x3B44, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1A8 - [36] Begin = RVA = 0x246C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x146C - [36] End = RVA = 0x2563, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1563 + [36] Begin = RVA = 0x246C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x146C + [36] End = RVA = 0x2563, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1563 [36] UnwindInfoAddress = RVA = 0x3B60, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1C4 - [37] Begin = RVA = 0x2564, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1564 - [37] End = RVA = 0x260D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x160D + [37] Begin = RVA = 0x2564, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1564 + [37] End = RVA = 0x260D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x160D [37] UnwindInfoAddress = RVA = 0x3A74, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xD8 - [38] Begin = RVA = 0x2610, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1610 - [38] End = RVA = 0x290C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x190C + [38] Begin = RVA = 0x2610, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1610 + [38] End = RVA = 0x290C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x190C [38] UnwindInfoAddress = RVA = 0x3B78, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1DC - [39] Begin = RVA = 0x2930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1930 - [39] End = RVA = 0x2932, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1932 + [39] Begin = RVA = 0x2930, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1930 + [39] End = RVA = 0x2932, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1932 [39] UnwindInfoAddress = RVA = 0x3B38, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x19C - [40] Begin = RVA = 0x2950, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1950 - [40] End = RVA = 0x2956, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1956 + [40] Begin = RVA = 0x2950, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1950 + [40] End = RVA = 0x2956, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1956 [40] UnwindInfoAddress = RVA = 0x3B40, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x1A4 - [41] Begin = RVA = 0x2978, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x1978 - [41] End = RVA = 0x29B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x19B3 + [41] Begin = RVA = 0x2978, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x1978 + [41] End = RVA = 0x29B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x19B3 [41] UnwindInfoAddress = RVA = 0x3A5C, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0xC0 - [42] Begin = RVA = 0x29B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x19B3 - [42] End = RVA = 0x29D1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x19D1 + [42] Begin = RVA = 0x29B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x19B3 + [42] End = RVA = 0x29D1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x19D1 [42] UnwindInfoAddress = RVA = 0x3AB4, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x118 - [43] Begin = RVA = 0x29D1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x19D1 - [43] End = RVA = 0x29E9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1A00, Position = 0x400, Size = 0x1A00 }, Offset = 0x19E9 + [43] Begin = RVA = 0x29D1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x19D1 + [43] End = RVA = 0x29E9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x19E9, Position = 0x400, Size = 0x19E9 }, Offset = 0x19E9 [43] UnwindInfoAddress = RVA = 0x3AF0, PEStreamSectionData { RVA = 0x399C, VirtualSize = 0x20C, Position = 0x279C, Size = 0x20C }, Offset = 0x154 - Section Data [01] PEStreamSectionData Position = 0x00003C10, Size = 0x000001F0, RVA = 0x00006210, VirtualSize = 0x000001F0 - [04] .rsrc PESection Position = 0x00003E00, Size = 0x00000200, RVA = 0x00007000, VirtualSize = 0x000001E0, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEResourceDirectory Position = 0x00003E00, Size = 0x000001E0, RVA = 0x00007000, VirtualSize = 0x000001E0 - > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + [00] PEResourceDirectory Position = 0x00003E00, Size = 0x000001E0, RVA = 0x00007000, VirtualSize = 0x000001E0 + > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} > PEResourceDirectoryEntry { Id = 0x18 (RT_MANIFEST), Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDirectoryEntry { Id = 0x1, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (381 bytes) } - Section Data [00] PEStreamSectionData Position = 0x00003FD8, Size = 0x00000008, RVA = 0x000071D8, VirtualSize = 0x00000008 - - - Section Data [01] PEStreamSectionData Position = 0x00003FE0, Size = 0x00000020, RVA = 0x000071E0, VirtualSize = 0x00000020 - - - [05] .reloc PESection Position = 0x00004000, Size = 0x00000200, RVA = 0x00008000, VirtualSize = 0x0000003C, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) - - Section Data [00] PEBaseRelocationDirectory Position = 0x00004000, Size = 0x0000003C, RVA = 0x00008000, VirtualSize = 0x0000003C - Block 0x3000 Relocations[20] - Dir64 Offset = 0x0250, RVA = 0x3250 (0x0000000140001A84), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0258, RVA = 0x3258 (0x0000000140001A84), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0260, RVA = 0x3260 (0x0000000140002930), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0268, RVA = 0x3268 (0x0000000140002950), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0270, RVA = 0x3270 (0x0000000140002950), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0280, RVA = 0x3280 (0x000000014000290C), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0290, RVA = 0x3290 (0x0000000140001448), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x02A8, RVA = 0x32A8 (0x0000000140001380), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x02B0, RVA = 0x32B0 (0x0000000140001438), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x02F8, RVA = 0x32F8 (0x00000001400050A0), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0300, RVA = 0x3300 (0x0000000140005140), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x03E8, RVA = 0x33E8 (0x0000000140005000), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0400, RVA = 0x3400 (0x0000000140003250), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0408, RVA = 0x3408 (0x0000000140003260), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0490, RVA = 0x3490 (0x0000000140003580), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x04A8, RVA = 0x34A8 (0x0000000140003258), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x04B0, RVA = 0x34B0 (0x0000000140003268), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x04B8, RVA = 0x34B8 (0x0000000140003270), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x04C0, RVA = 0x34C0 (0x0000000140003278), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x04C8, RVA = 0x34C8 (0x0000000140003280), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] .rdata } - Block 0x5000 Relocations[2] - Dir64 Offset = 0x0078, RVA = 0x5078 (0x000000014000133E), SectionData = { RVA = 0x00005078 (PEBoundImportAddressTable64[1] .data } - Dir64 Offset = 0x0080, RVA = 0x5080 (0x0000000140001332), SectionData = { RVA = 0x00005078 (PEBoundImportAddressTable64[1] .data } - Section Data [00] PEStreamSectionData Position = 0x0000402C, Size = 0x00000010, RVA = 0x0000802C, VirtualSize = 0x00000010 - - - Section Data [01] PEStreamSectionData Position = 0x0000403C, Size = 0x000001C4, RVA = 0x0000803C, VirtualSize = 0x000001C4 - + > PEResourceDirectoryEntry { Id = 0x1, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (381 bytes) } + [00] PEStreamSectionData Position = 0x00003FD8, Size = 0x00000008, RVA = 0x000071D8, VirtualSize = 0x00000008 + + + [05] .reloc PESection Position = 0x00004000, Size = 0x00000200, RVA = 0x00008000, VirtualSize = 0x0000003C, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) + + [00] PEBaseRelocationDirectory Position = 0x00004000, Size = 0x0000003C, RVA = 0x00008000, VirtualSize = 0x0000003C + Block 0x3000 Relocations[20] + [000] Dir64 Offset = 0x0250, RVA = 0x3250 (0x0000000140001A84), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [001] Dir64 Offset = 0x0258, RVA = 0x3258 (0x0000000140001A84), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [002] Dir64 Offset = 0x0260, RVA = 0x3260 (0x0000000140002930), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [003] Dir64 Offset = 0x0268, RVA = 0x3268 (0x0000000140002950), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [004] Dir64 Offset = 0x0270, RVA = 0x3270 (0x0000000140002950), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [005] Dir64 Offset = 0x0280, RVA = 0x3280 (0x000000014000290C), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [006] Dir64 Offset = 0x0290, RVA = 0x3290 (0x0000000140001448), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [007] Dir64 Offset = 0x02A8, RVA = 0x32A8 (0x0000000140001380), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [008] Dir64 Offset = 0x02B0, RVA = 0x32B0 (0x0000000140001438), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [009] Dir64 Offset = 0x02F8, RVA = 0x32F8 (0x00000001400050A0), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [010] Dir64 Offset = 0x0300, RVA = 0x3300 (0x0000000140005140), SectionData = { RVA = 0x00003250 (PEStreamSectionData[1] -> .rdata) } + [011] Dir64 Offset = 0x03E8, RVA = 0x33E8 (0x0000000140005000), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [012] Dir64 Offset = 0x0400, RVA = 0x3400 (0x0000000140003250), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [013] Dir64 Offset = 0x0408, RVA = 0x3408 (0x0000000140003260), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [014] Dir64 Offset = 0x0490, RVA = 0x3490 (0x0000000140003580), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [015] Dir64 Offset = 0x04A8, RVA = 0x34A8 (0x0000000140003258), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [016] Dir64 Offset = 0x04B0, RVA = 0x34B0 (0x0000000140003268), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [017] Dir64 Offset = 0x04B8, RVA = 0x34B8 (0x0000000140003270), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [018] Dir64 Offset = 0x04C0, RVA = 0x34C0 (0x0000000140003278), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + [019] Dir64 Offset = 0x04C8, RVA = 0x34C8 (0x0000000140003280), SectionData = { RVA = 0x00003390 (PELoadConfigDirectory64[2] -> .rdata) } + Block 0x5000 Relocations[2] + [000] Dir64 Offset = 0x0078, RVA = 0x5078 (0x000000014000133E), SectionData = { RVA = 0x00005078 (PEBoundImportAddressTable64[1] -> .data) } + [001] Dir64 Offset = 0x0080, RVA = 0x5080 (0x0000000140001332), SectionData = { RVA = 0x00005078 (PEBoundImportAddressTable64[1] -> .data) } + + diff --git a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsoleWin64.exe.verified.txt b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsoleWin64.exe.verified.txt index 7759071..9d7b758 100644 --- a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsoleWin64.exe.verified.txt +++ b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeConsoleWin64.exe.verified.txt @@ -83,87 +83,87 @@ Data Directories Sections [00] .text PESection Position = 0x00000400, Size = 0x00001200, RVA = 0x00001000, VirtualSize = 0x000010C9, Characteristics = 0x60000020 (ContainsCode, MemExecute, MemRead) - Section Data [00] PEStreamSectionData Position = 0x00000400, Size = 0x00001200, RVA = 0x00001000, VirtualSize = 0x00001200 + [00] PEStreamSectionData Position = 0x00000400, Size = 0x000010C9, RVA = 0x00001000, VirtualSize = 0x000010C9 [01] .rdata PESection Position = 0x00001600, Size = 0x00001400, RVA = 0x00003000, VirtualSize = 0x00001288, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEImportAddressTableDirectory Position = 0x00001600, Size = 0x000001F0, RVA = 0x00003000, VirtualSize = 0x000001F0 - Section Data [00] PEImportAddressTable Position = 0x00001680, Size = 0x00000048, RVA = 0x00003000, VirtualSize = 0x00000048 - [0] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x3C40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x0) - [1] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x3DA8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x168) - [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x3D68, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x128) - [3] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x3D20, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0xE0) - [4] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x3CDC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x9C) - [5] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x3C9E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5E) - [6] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x3C7C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3C) - [7] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x3DEA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1AA) - - Section Data [01] PEImportAddressTable Position = 0x00001700, Size = 0x00000010, RVA = 0x00003048, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x3E18, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1D8) - - Section Data [02] PEImportAddressTable Position = 0x000016C8, Size = 0x00000038, RVA = 0x00003058, VirtualSize = 0x00000038 - [0] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x3E40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x200) - [1] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x3E2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1EE) - [2] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x427E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x63E) - [3] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x3E6E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x22E) - [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x3E58, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x218) - [5] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x3E8C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x24C) - - Section Data [03] PEImportAddressTable Position = 0x00001740, Size = 0x00000098, RVA = 0x00003090, VirtualSize = 0x00000098 - [0] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4062, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x422) - [1] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4054, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x414) - [2] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4038, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3F8) - [3] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x401C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3DC) - [4] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x3FAE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x36E) - [5] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x3FA4, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x364) - [6] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x3F88, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x348) - [7] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x3EBC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x27C) - [8] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x3F72, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x332) - [9] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x3F6A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x32A) - [10] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x3F5C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x31C) - [11] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x3F50, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x310) - [12] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x3F2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2EE) - [13] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x3F0C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2CC) - [14] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x3EF2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2B2) - [15] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x3FB8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x378) - [16] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x3ECE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x28E) - [17] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x3F96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x356) - - Section Data [04] PEImportAddressTable Position = 0x00001730, Size = 0x00000010, RVA = 0x00003128, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x3EDE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x29E) - - Section Data [05] PEImportAddressTable Position = 0x000017D8, Size = 0x00000018, RVA = 0x00003138, VirtualSize = 0x00000018 - [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x400C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3CC) - [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x3F7A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x33A) - - Section Data [06] PEImportAddressTable Position = 0x00001720, Size = 0x00000010, RVA = 0x00003150, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x3FE6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3A6) - - Section Data [07] PEImportAddressTable Position = 0x00001710, Size = 0x00000010, RVA = 0x00003160, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x3FFC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3BC) - - Section Data [08] PEImportAddressTable Position = 0x00001600, Size = 0x00000080, RVA = 0x00003170, VirtualSize = 0x00000080 - [0] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4112, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x4D2) - [1] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x41D2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x592) - [2] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x41EC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5AC) - [3] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4202, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5C2) - [4] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4218, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5D8) - [5] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4232, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5F2) - [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4248, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x608) - [7] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x425C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x61C) - [8] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x41A2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x562) - [9] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x418E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x54E) - [10] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x4170, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x530) - [11] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4154, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x514) - [12] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x4140, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x500) - [13] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4126, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x4E6) - [14] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x41B6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x576) - + [00] PEImportAddressTableDirectory Position = 0x00001600, Size = 0x000001F0, RVA = 0x00003000, VirtualSize = 0x000001F0 + [00] PEImportAddressTable Position = 0x00001600, Size = 0x00000080, RVA = 0x00003000, VirtualSize = 0x00000080 + [0] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4112, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x4D2) + [1] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x41D2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x592) + [2] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x41EC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5AC) + [3] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4202, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5C2) + [4] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4218, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5D8) + [5] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4232, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5F2) + [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4248, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x608) + [7] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x425C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x61C) + [8] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x41A2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x562) + [9] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x418E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x54E) + [10] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x4170, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x530) + [11] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4154, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x514) + [12] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x4140, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x500) + [13] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4126, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x4E6) + [14] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x41B6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x576) + + [01] PEImportAddressTable Position = 0x00001680, Size = 0x00000048, RVA = 0x00003080, VirtualSize = 0x00000048 + [0] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x3C40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x0) + [1] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x3DA8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x168) + [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x3D68, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x128) + [3] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x3D20, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0xE0) + [4] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x3CDC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x9C) + [5] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x3C9E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5E) + [6] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x3C7C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3C) + [7] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x3DEA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1AA) + + [02] PEImportAddressTable Position = 0x000016C8, Size = 0x00000038, RVA = 0x000030C8, VirtualSize = 0x00000038 + [0] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x3E40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x200) + [1] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x3E2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1EE) + [2] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x427E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x63E) + [3] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x3E6E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x22E) + [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x3E58, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x218) + [5] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x3E8C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x24C) + + [03] PEImportAddressTable Position = 0x00001700, Size = 0x00000010, RVA = 0x00003100, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x3E18, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1D8) + + [04] PEImportAddressTable Position = 0x00001710, Size = 0x00000010, RVA = 0x00003110, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x3FFC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3BC) + + [05] PEImportAddressTable Position = 0x00001720, Size = 0x00000010, RVA = 0x00003120, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x3FE6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3A6) + + [06] PEImportAddressTable Position = 0x00001730, Size = 0x00000010, RVA = 0x00003130, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x3EDE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x29E) + + [07] PEImportAddressTable Position = 0x00001740, Size = 0x00000098, RVA = 0x00003140, VirtualSize = 0x00000098 + [0] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4062, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x422) + [1] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4054, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x414) + [2] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4038, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3F8) + [3] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x401C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3DC) + [4] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x3FAE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x36E) + [5] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x3FA4, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x364) + [6] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x3F88, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x348) + [7] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x3EBC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x27C) + [8] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x3F72, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x332) + [9] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x3F6A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x32A) + [10] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x3F5C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x31C) + [11] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x3F50, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x310) + [12] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x3F2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2EE) + [13] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x3F0C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2CC) + [14] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x3EF2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2B2) + [15] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x3FB8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x378) + [16] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x3ECE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x28E) + [17] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x3F96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x356) + + [08] PEImportAddressTable Position = 0x000017D8, Size = 0x00000018, RVA = 0x000031D8, VirtualSize = 0x00000018 + [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x400C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3CC) + [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x3F7A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x33A) + - Section Data [01] PEStreamSectionData Position = 0x000017F0, Size = 0x000000C0, RVA = 0x000031F0, VirtualSize = 0x000000C0 + [01] PEStreamSectionData Position = 0x000017F0, Size = 0x000000C0, RVA = 0x000031F0, VirtualSize = 0x000000C0 - Section Data [02] PELoadConfigDirectory64 Position = 0x000018B0, Size = 0x00000140, RVA = 0x000032B0, VirtualSize = 0x00000140 + [02] PELoadConfigDirectory64 Position = 0x000018B0, Size = 0x00000140, RVA = 0x000032B0, VirtualSize = 0x00000140 Size = 0x140 TimeDateStamp = 0x0 MajorVersion = 0 @@ -218,330 +218,322 @@ Sections CastGuardOsDeterminedFailureMode = 0x140003218 GuardMemcpyFunctionPointer = 0x140003220 - Section Data [03] PEDebugDirectory Position = 0x000019F0, Size = 0x00000070, RVA = 0x000033F0, VirtualSize = 0x00000070 - [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x000034DC (PEDebugSectionDataRSDS[5] .rdata - [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x00003550 (PEDebugStreamSectionData[7] .rdata - [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x00003564 (PEDebugStreamSectionData[8] .rdata + [03] PEDebugDirectory Position = 0x000019F0, Size = 0x00000070, RVA = 0x000033F0, VirtualSize = 0x00000070 + [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x000034DC (PEDebugSectionDataRSDS[5] -> .rdata) + [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x00003550 (PEDebugStreamSectionData[7] -> .rdata) + [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = RVA = 0x00003564 (PEDebugStreamSectionData[8] -> .rdata) [3] Type = ILTCG, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F11C3F, Data = null - Section Data [04] PEStreamSectionData Position = 0x00001A60, Size = 0x0000007C, RVA = 0x00003460, VirtualSize = 0x0000007C + [04] PEStreamSectionData Position = 0x00001A60, Size = 0x0000007C, RVA = 0x00003460, VirtualSize = 0x0000007C - Section Data [05] PEDebugSectionDataRSDS Position = 0x00001ADC, Size = 0x00000071, RVA = 0x000034DC, VirtualSize = 0x00000071 + [05] PEDebugSectionDataRSDS Position = 0x00001ADC, Size = 0x00000071, RVA = 0x000034DC, VirtualSize = 0x00000071 Debug Section Data (RSDS) Guid = a28d7ba2-048a-4315-9bbe-0edbca526f59 Age = 2 PdbPath = C:\code\LibObjectFile\src\native\Win64\NativeProjects\x64\Release\NativeConsoleWin64.pdb - Section Data [06] PEStreamSectionData Position = 0x00001B4D, Size = 0x00000003, RVA = 0x0000354D, VirtualSize = 0x00000003 + [06] PEStreamSectionData Position = 0x00001B4D, Size = 0x00000003, RVA = 0x0000354D, VirtualSize = 0x00000003 - Section Data [07] PEDebugStreamSectionData Position = 0x00001B50, Size = 0x00000014, RVA = 0x00003550, VirtualSize = 0x00000014 + [07] PEDebugStreamSectionData Position = 0x00001B50, Size = 0x00000014, RVA = 0x00003550, VirtualSize = 0x00000014 - Section Data [08] PEDebugStreamSectionData Position = 0x00001B64, Size = 0x00000284, RVA = 0x00003564, VirtualSize = 0x00000284 + [08] PEDebugStreamSectionData Position = 0x00001B64, Size = 0x00000284, RVA = 0x00003564, VirtualSize = 0x00000284 - Section Data [09] PEStreamSectionData Position = 0x00001DE8, Size = 0x0000019C, RVA = 0x000037E8, VirtualSize = 0x0000019C + [09] PEStreamSectionData Position = 0x00001DE8, Size = 0x0000019C, RVA = 0x000037E8, VirtualSize = 0x0000019C - Section Data [10] PEImportDirectory Position = 0x00001F84, Size = 0x000000C8, RVA = 0x00003984, VirtualSize = 0x000000C8 - [0] ImportDllNameLink = MSVCP140.dll (RVA = 0x3E0A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1CA) - [0] ImportAddressTable = RVA = 0x00003000 (PEImportAddressTable[0] - [0] ImportLookupTable = RVA = 0x00003AD0 (PEImportLookupTable[13] .rdata + [10] PEImportDirectory Position = 0x00001F84, Size = 0x000000C8, RVA = 0x00003984, VirtualSize = 0x000000C8 + [0] ImportDllNameLink = MSVCP140.dll (RVA = 0x3E0A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1CA) + [0] ImportAddressTable = RVA = 0x00003080 (PEImportAddressTable[1] -> PEImportAddressTableDirectory[0] -> .rdata) + [0] ImportLookupTable = RVA = 0x00003AD0 (PEImportLookupTable[13] -> .rdata) - [1] ImportDllNameLink = VCRUNTIME140_1.dll (RVA = 0x3E96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x256) - [1] ImportAddressTable = RVA = 0x00003048 (PEImportAddressTable[1] - [1] ImportLookupTable = RVA = 0x00003B50 (PEImportLookupTable[15] .rdata + [1] ImportDllNameLink = VCRUNTIME140_1.dll (RVA = 0x3E96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x256) + [1] ImportAddressTable = RVA = 0x00003100 (PEImportAddressTable[3] -> PEImportAddressTableDirectory[0] -> .rdata) + [1] ImportLookupTable = RVA = 0x00003B50 (PEImportLookupTable[15] -> .rdata) - [2] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x3EAA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x26A) - [2] ImportAddressTable = RVA = 0x00003058 (PEImportAddressTable[2] - [2] ImportLookupTable = RVA = 0x00003B18 (PEImportLookupTable[14] .rdata + [2] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x3EAA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x26A) + [2] ImportAddressTable = RVA = 0x000030C8 (PEImportAddressTable[2] -> PEImportAddressTableDirectory[0] -> .rdata) + [2] ImportLookupTable = RVA = 0x00003B18 (PEImportLookupTable[14] -> .rdata) - [3] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x406E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x42E) - [3] ImportAddressTable = RVA = 0x00003090 (PEImportAddressTable[3] - [3] ImportLookupTable = RVA = 0x00003B90 (PEImportLookupTable[19] .rdata + [3] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x406E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x42E) + [3] ImportAddressTable = RVA = 0x00003140 (PEImportAddressTable[7] -> PEImportAddressTableDirectory[0] -> .rdata) + [3] ImportLookupTable = RVA = 0x00003B90 (PEImportLookupTable[19] -> .rdata) - [4] ImportDllNameLink = api-ms-win-crt-math-l1-1-0.dll (RVA = 0x4090, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x450) - [4] ImportAddressTable = RVA = 0x00003128 (PEImportAddressTable[4] - [4] ImportLookupTable = RVA = 0x00003B80 (PEImportLookupTable[18] .rdata + [4] ImportDllNameLink = api-ms-win-crt-math-l1-1-0.dll (RVA = 0x4090, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x450) + [4] ImportAddressTable = RVA = 0x00003130 (PEImportAddressTable[6] -> PEImportAddressTableDirectory[0] -> .rdata) + [4] ImportLookupTable = RVA = 0x00003B80 (PEImportLookupTable[18] -> .rdata) - [5] ImportDllNameLink = api-ms-win-crt-stdio-l1-1-0.dll (RVA = 0x40B0, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x470) - [5] ImportAddressTable = RVA = 0x00003138 (PEImportAddressTable[5] - [5] ImportLookupTable = RVA = 0x00003C28 (PEImportLookupTable[20] .rdata + [5] ImportDllNameLink = api-ms-win-crt-stdio-l1-1-0.dll (RVA = 0x40B0, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x470) + [5] ImportAddressTable = RVA = 0x000031D8 (PEImportAddressTable[8] -> PEImportAddressTableDirectory[0] -> .rdata) + [5] ImportLookupTable = RVA = 0x00003C28 (PEImportLookupTable[20] -> .rdata) - [6] ImportDllNameLink = api-ms-win-crt-locale-l1-1-0.dll (RVA = 0x40D0, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x490) - [6] ImportAddressTable = RVA = 0x00003150 (PEImportAddressTable[6] - [6] ImportLookupTable = RVA = 0x00003B70 (PEImportLookupTable[17] .rdata + [6] ImportDllNameLink = api-ms-win-crt-locale-l1-1-0.dll (RVA = 0x40D0, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x490) + [6] ImportAddressTable = RVA = 0x00003120 (PEImportAddressTable[5] -> PEImportAddressTableDirectory[0] -> .rdata) + [6] ImportLookupTable = RVA = 0x00003B70 (PEImportLookupTable[17] -> .rdata) - [7] ImportDllNameLink = api-ms-win-crt-heap-l1-1-0.dll (RVA = 0x40F2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x4B2) - [7] ImportAddressTable = RVA = 0x00003160 (PEImportAddressTable[7] - [7] ImportLookupTable = RVA = 0x00003B60 (PEImportLookupTable[16] .rdata + [7] ImportDllNameLink = api-ms-win-crt-heap-l1-1-0.dll (RVA = 0x40F2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x4B2) + [7] ImportAddressTable = RVA = 0x00003110 (PEImportAddressTable[4] -> PEImportAddressTableDirectory[0] -> .rdata) + [7] ImportLookupTable = RVA = 0x00003B60 (PEImportLookupTable[16] -> .rdata) - [8] ImportDllNameLink = KERNEL32.dll (RVA = 0x4270, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x630) - [8] ImportAddressTable = RVA = 0x00003170 (PEImportAddressTable[8] - [8] ImportLookupTable = RVA = 0x00003A50 (PEImportLookupTable[12] .rdata + [8] ImportDllNameLink = KERNEL32.dll (RVA = 0x4270, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x630) + [8] ImportAddressTable = RVA = 0x00003000 (PEImportAddressTable[0] -> PEImportAddressTableDirectory[0] -> .rdata) + [8] ImportLookupTable = RVA = 0x00003A50 (PEImportLookupTable[12] -> .rdata) - Section Data [11] PEStreamSectionData Position = 0x0000204C, Size = 0x00000004, RVA = 0x00003A4C, VirtualSize = 0x00000004 + [11] PEStreamSectionData Position = 0x0000204C, Size = 0x00000004, RVA = 0x00003A4C, VirtualSize = 0x00000004 - Section Data [12] PEImportLookupTable Position = 0x00002050, Size = 0x00000080, RVA = 0x00003A50, VirtualSize = 0x00000080 - [0] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4112, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x4D2) - [1] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x41D2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x592) - [2] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x41EC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5AC) - [3] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4202, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5C2) - [4] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4218, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5D8) - [5] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4232, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5F2) - [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4248, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x608) - [7] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x425C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x61C) - [8] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x41A2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x562) - [9] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x418E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x54E) - [10] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x4170, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x530) - [11] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4154, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x514) - [12] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x4140, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x500) - [13] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4126, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x4E6) - [14] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x41B6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x576) + [12] PEImportLookupTable Position = 0x00002050, Size = 0x00000080, RVA = 0x00003A50, VirtualSize = 0x00000080 + [0] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x4112, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x4D2) + [1] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x41D2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x592) + [2] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x41EC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5AC) + [3] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x4202, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5C2) + [4] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x4218, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5D8) + [5] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x4232, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5F2) + [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x4248, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x608) + [7] PEImportHintName { Hint = 661, Name = GetModuleHandleW } (RVA = 0x425C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x61C) + [8] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x41A2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x562) + [9] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x418E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x54E) + [10] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x4170, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x530) + [11] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x4154, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x514) + [12] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x4140, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x500) + [13] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x4126, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x4E6) + [14] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x41B6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x576) - Section Data [13] PEImportLookupTable Position = 0x000020D0, Size = 0x00000048, RVA = 0x00003AD0, VirtualSize = 0x00000048 - [0] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x3C40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x0) - [1] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x3DA8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x168) - [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x3D68, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x128) - [3] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x3D20, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0xE0) - [4] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x3CDC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x9C) - [5] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x3C9E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x5E) - [6] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x3C7C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3C) - [7] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x3DEA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1AA) + [13] PEImportLookupTable Position = 0x000020D0, Size = 0x00000048, RVA = 0x00003AD0, VirtualSize = 0x00000048 + [0] PEImportHintName { Hint = 692, Name = ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A } (RVA = 0x3C40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x0) + [1] PEImportHintName { Hint = 1246, Name = ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z } (RVA = 0x3DA8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x168) + [2] PEImportHintName { Hint = 1221, Name = ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z } (RVA = 0x3D68, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x128) + [3] PEImportHintName { Hint = 1249, Name = ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z } (RVA = 0x3D20, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0xE0) + [4] PEImportHintName { Hint = 872, Name = ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ } (RVA = 0x3CDC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x9C) + [5] PEImportHintName { Hint = 580, Name = ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ } (RVA = 0x3C9E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x5E) + [6] PEImportHintName { Hint = 1310, Name = ?uncaught_exception@std@@YA_NXZ } (RVA = 0x3C7C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3C) + [7] PEImportHintName { Hint = 965, Name = ?good@ios_base@std@@QEBA_NXZ } (RVA = 0x3DEA, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1AA) - Section Data [14] PEImportLookupTable Position = 0x00002118, Size = 0x00000038, RVA = 0x00003B18, VirtualSize = 0x00000038 - [0] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x3E40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x200) - [1] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x3E2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1EE) - [2] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x427E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x63E) - [3] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x3E6E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x22E) - [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x3E58, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x218) - [5] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x3E8C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x24C) + [14] PEImportLookupTable Position = 0x00002118, Size = 0x00000038, RVA = 0x00003B18, VirtualSize = 0x00000038 + [0] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x3E40, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x200) + [1] PEImportHintName { Hint = 35, Name = __std_terminate } (RVA = 0x3E2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1EE) + [2] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x427E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x63E) + [3] PEImportHintName { Hint = 28, Name = __current_exception_context } (RVA = 0x3E6E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x22E) + [4] PEImportHintName { Hint = 27, Name = __current_exception } (RVA = 0x3E58, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x218) + [5] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x3E8C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x24C) - Section Data [15] PEImportLookupTable Position = 0x00002150, Size = 0x00000010, RVA = 0x00003B50, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x3E18, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x1D8) + [15] PEImportLookupTable Position = 0x00002150, Size = 0x00000010, RVA = 0x00003B50, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 0, Name = __CxxFrameHandler4 } (RVA = 0x3E18, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x1D8) - Section Data [16] PEImportLookupTable Position = 0x00002160, Size = 0x00000010, RVA = 0x00003B60, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x3FFC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3BC) + [16] PEImportLookupTable Position = 0x00002160, Size = 0x00000010, RVA = 0x00003B60, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 22, Name = _set_new_mode } (RVA = 0x3FFC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3BC) - Section Data [17] PEImportLookupTable Position = 0x00002170, Size = 0x00000010, RVA = 0x00003B70, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x3FE6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3A6) + [17] PEImportLookupTable Position = 0x00002170, Size = 0x00000010, RVA = 0x00003B70, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 8, Name = _configthreadlocale } (RVA = 0x3FE6, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3A6) - Section Data [18] PEImportLookupTable Position = 0x00002180, Size = 0x00000010, RVA = 0x00003B80, VirtualSize = 0x00000010 - [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x3EDE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x29E) + [18] PEImportLookupTable Position = 0x00002180, Size = 0x00000010, RVA = 0x00003B80, VirtualSize = 0x00000010 + [0] PEImportHintName { Hint = 9, Name = __setusermatherr } (RVA = 0x3EDE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x29E) - Section Data [19] PEImportLookupTable Position = 0x00002190, Size = 0x00000098, RVA = 0x00003B90, VirtualSize = 0x00000098 - [0] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4062, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x422) - [1] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4054, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x414) - [2] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4038, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3F8) - [3] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x401C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3DC) - [4] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x3FAE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x36E) - [5] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x3FA4, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x364) - [6] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x3F88, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x348) - [7] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x3EBC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x27C) - [8] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x3F72, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x332) - [9] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x3F6A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x32A) - [10] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x3F5C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x31C) - [11] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x3F50, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x310) - [12] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x3F2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2EE) - [13] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x3F0C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2CC) - [14] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x3EF2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x2B2) - [15] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x3FB8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x378) - [16] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x3ECE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x28E) - [17] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x3F96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x356) + [19] PEImportLookupTable Position = 0x00002190, Size = 0x00000098, RVA = 0x00003B90, VirtualSize = 0x00000098 + [0] PEImportHintName { Hint = 103, Name = terminate } (RVA = 0x4062, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x422) + [1] PEImportHintName { Hint = 30, Name = _crt_atexit } (RVA = 0x4054, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x414) + [2] PEImportHintName { Hint = 60, Name = _register_onexit_function } (RVA = 0x4038, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3F8) + [3] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x401C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3DC) + [4] PEImportHintName { Hint = 21, Name = _c_exit } (RVA = 0x3FAE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x36E) + [5] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x3FA4, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x364) + [6] PEImportHintName { Hint = 4, Name = __p___argc } (RVA = 0x3F88, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x348) + [7] PEImportHintName { Hint = 64, Name = _seh_filter_exe } (RVA = 0x3EBC, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x27C) + [8] PEImportHintName { Hint = 35, Name = _exit } (RVA = 0x3F72, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x332) + [9] PEImportHintName { Hint = 85, Name = exit } (RVA = 0x3F6A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x32A) + [10] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x3F5C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x31C) + [11] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x3F50, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x310) + [12] PEImportHintName { Hint = 40, Name = _get_initial_narrow_environment } (RVA = 0x3F2E, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2EE) + [13] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x3F0C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2CC) + [14] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x3EF2, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x2B2) + [15] PEImportHintName { Hint = 61, Name = _register_thread_local_exe_atexit_callback } (RVA = 0x3FB8, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x378) + [16] PEImportHintName { Hint = 66, Name = _set_app_type } (RVA = 0x3ECE, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x28E) + [17] PEImportHintName { Hint = 5, Name = __p___argv } (RVA = 0x3F96, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x356) - Section Data [20] PEImportLookupTable Position = 0x00002228, Size = 0x00000018, RVA = 0x00003C28, VirtualSize = 0x00000018 - [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x400C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x3CC) - [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x3F7A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x7C0, Position = 0x2240, Size = 0x7C0 }, Offset = 0x33A) + [20] PEImportLookupTable Position = 0x00002228, Size = 0x00000018, RVA = 0x00003C28, VirtualSize = 0x00000018 + [0] PEImportHintName { Hint = 1, Name = __p__commode } (RVA = 0x400C, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x3CC) + [1] PEImportHintName { Hint = 84, Name = _set_fmode } (RVA = 0x3F7A, PEStreamSectionData { RVA = 0x3C40, VirtualSize = 0x648, Position = 0x2240, Size = 0x648 }, Offset = 0x33A) - Section Data [21] PEStreamSectionData Position = 0x00002240, Size = 0x000007C0, RVA = 0x00003C40, VirtualSize = 0x000007C0 + [21] PEStreamSectionData Position = 0x00002240, Size = 0x00000648, RVA = 0x00003C40, VirtualSize = 0x00000648 [02] .data PESection Position = 0x00002A00, Size = 0x00000200, RVA = 0x00005000, VirtualSize = 0x00000680, Characteristics = 0xC0000040 (ContainsInitializedData, MemRead, MemWrite) - Section Data [00] PEStreamSectionData Position = 0x00002A00, Size = 0x00000200, RVA = 0x00005000, VirtualSize = 0x00000200 + [00] PEStreamSectionData Position = 0x00002A00, Size = 0x00000200, RVA = 0x00005000, VirtualSize = 0x00000200 [03] .pdata PESection Position = 0x00002C00, Size = 0x00000200, RVA = 0x00006000, VirtualSize = 0x00000198, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEExceptionDirectory Position = 0x00002C00, Size = 0x00000198, RVA = 0x00006000, VirtualSize = 0x00000198 - [0] Begin = RVA = 0x1000, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x0 - [0] End = RVA = 0x1017, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x17 + [00] PEExceptionDirectory Position = 0x00002C00, Size = 0x00000198, RVA = 0x00006000, VirtualSize = 0x00000198 + [0] Begin = RVA = 0x1000, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x0 + [0] End = RVA = 0x1017, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x17 [0] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [1] Begin = RVA = 0x1020, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x20 - [1] End = RVA = 0x11D2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1D2 + [1] Begin = RVA = 0x1020, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x20 + [1] End = RVA = 0x11D2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1D2 [1] UnwindInfoAddress = RVA = 0x3810, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x28 - [2] Begin = RVA = 0x11E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1E0 - [2] End = RVA = 0x121E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x21E + [2] Begin = RVA = 0x11E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1E0 + [2] End = RVA = 0x121E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x21E [2] UnwindInfoAddress = RVA = 0x3870, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x88 - [3] Begin = RVA = 0x1220, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x220 - [3] End = RVA = 0x1244, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x244 + [3] Begin = RVA = 0x1220, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x220 + [3] End = RVA = 0x1244, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x244 [3] UnwindInfoAddress = RVA = 0x3894, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xAC - [4] Begin = RVA = 0x1260, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x260 - [4] End = RVA = 0x127E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x27E + [4] Begin = RVA = 0x1260, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x260 + [4] End = RVA = 0x127E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x27E [4] UnwindInfoAddress = RVA = 0x38B0, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xC8 - [5] Begin = RVA = 0x1280, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x280 - [5] End = RVA = 0x1336, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x336 + [5] Begin = RVA = 0x1280, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x280 + [5] End = RVA = 0x1336, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x336 [5] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [6] Begin = RVA = 0x1338, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x338 - [6] End = RVA = 0x1348, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x348 + [6] Begin = RVA = 0x1338, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x338 + [6] End = RVA = 0x1348, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x348 [6] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [7] Begin = RVA = 0x1348, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x348 - [7] End = RVA = 0x1361, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x361 + [7] Begin = RVA = 0x1348, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x348 + [7] End = RVA = 0x1361, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x361 [7] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [8] Begin = RVA = 0x1364, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x364 - [8] End = RVA = 0x14E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x4E0 + [8] Begin = RVA = 0x1364, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x364 + [8] End = RVA = 0x14E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x4E0 [8] UnwindInfoAddress = RVA = 0x38BC, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xD4 - [9] Begin = RVA = 0x14E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x4E0 - [9] End = RVA = 0x14F2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x4F2 + [9] Begin = RVA = 0x14E0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x4E0 + [9] End = RVA = 0x14F2, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x4F2 [9] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [10] Begin = RVA = 0x14F4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x4F4 - [10] End = RVA = 0x1528, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x528 + [10] Begin = RVA = 0x14F4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x4F4 + [10] End = RVA = 0x1528, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x528 [10] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [11] Begin = RVA = 0x1528, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x528 - [11] End = RVA = 0x15FB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x5FB + [11] Begin = RVA = 0x1528, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x528 + [11] End = RVA = 0x15FB, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x5FB [11] UnwindInfoAddress = RVA = 0x38FC, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x114 - [12] Begin = RVA = 0x15FC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x5FC - [12] End = RVA = 0x166D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x66D + [12] Begin = RVA = 0x15FC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x5FC + [12] End = RVA = 0x166D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x66D [12] UnwindInfoAddress = RVA = 0x3904, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x11C - [13] Begin = RVA = 0x1670, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x670 - [13] End = RVA = 0x16A9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x6A9 + [13] Begin = RVA = 0x1670, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x670 + [13] End = RVA = 0x16A9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x6A9 [13] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [14] Begin = RVA = 0x16AC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x6AC - [14] End = RVA = 0x16E6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x6E6 + [14] Begin = RVA = 0x16AC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x6AC + [14] End = RVA = 0x16E6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x6E6 [14] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [15] Begin = RVA = 0x16E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x6E8 - [15] End = RVA = 0x1773, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x773 + [15] Begin = RVA = 0x16E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x6E8 + [15] End = RVA = 0x1773, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x773 [15] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [16] Begin = RVA = 0x1774, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x774 - [16] End = RVA = 0x180C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x80C + [16] Begin = RVA = 0x1774, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x774 + [16] End = RVA = 0x180C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x80C [16] UnwindInfoAddress = RVA = 0x3910, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x128 - [17] Begin = RVA = 0x180C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x80C - [17] End = RVA = 0x1830, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x830 + [17] Begin = RVA = 0x180C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x80C + [17] End = RVA = 0x1830, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x830 [17] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [18] Begin = RVA = 0x1830, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x830 - [18] End = RVA = 0x1859, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x859 + [18] Begin = RVA = 0x1830, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x830 + [18] End = RVA = 0x1859, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x859 [18] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [19] Begin = RVA = 0x185C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x85C - [19] End = RVA = 0x1896, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x896 + [19] Begin = RVA = 0x185C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x85C + [19] End = RVA = 0x1896, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x896 [19] UnwindInfoAddress = RVA = 0x38B4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0xCC - [20] Begin = RVA = 0x1898, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x898 - [20] End = RVA = 0x18AF, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x8AF + [20] Begin = RVA = 0x1898, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x898 + [20] End = RVA = 0x18AF, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x8AF [20] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [21] Begin = RVA = 0x18B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x8B0 - [21] End = RVA = 0x195C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x95C + [21] Begin = RVA = 0x18B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x8B0 + [21] End = RVA = 0x195C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x95C [21] UnwindInfoAddress = RVA = 0x3938, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x150 - [22] Begin = RVA = 0x1998, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x998 - [22] End = RVA = 0x19B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x9B3 + [22] Begin = RVA = 0x1998, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x998 + [22] End = RVA = 0x19B3, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x9B3 [22] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [23] Begin = RVA = 0x19D8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x9D8 - [23] End = RVA = 0x1B20, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xB20 + [23] Begin = RVA = 0x19D8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x9D8 + [23] End = RVA = 0x1B20, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xB20 [23] UnwindInfoAddress = RVA = 0x3944, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x15C - [24] Begin = RVA = 0x1B28, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xB28 - [24] End = RVA = 0x1B79, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xB79 + [24] Begin = RVA = 0x1B28, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xB28 + [24] End = RVA = 0x1B79, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xB79 [24] UnwindInfoAddress = RVA = 0x3808, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x20 - [25] Begin = RVA = 0x1B8C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xB8C - [25] End = RVA = 0x1BE7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xBE7 + [25] Begin = RVA = 0x1B8C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xB8C + [25] End = RVA = 0x1BE7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xBE7 [25] UnwindInfoAddress = RVA = 0x3954, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x16C - [26] Begin = RVA = 0x1BE8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xBE8 - [26] End = RVA = 0x1C24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xC24 + [26] Begin = RVA = 0x1BE8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xBE8 + [26] End = RVA = 0x1C24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xC24 [26] UnwindInfoAddress = RVA = 0x3954, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x16C - [27] Begin = RVA = 0x1C24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xC24 - [27] End = RVA = 0x1C60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xC60 + [27] Begin = RVA = 0x1C24, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xC24 + [27] End = RVA = 0x1C60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xC60 [27] UnwindInfoAddress = RVA = 0x3954, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x16C - [28] Begin = RVA = 0x1C60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xC60 - [28] End = RVA = 0x1F2A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0xF2A + [28] Begin = RVA = 0x1C60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xC60 + [28] End = RVA = 0x1F2A, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0xF2A [28] UnwindInfoAddress = RVA = 0x3960, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x178 - [29] Begin = RVA = 0x2010, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1010 - [29] End = RVA = 0x2012, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1012 + [29] Begin = RVA = 0x2010, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1010 + [29] End = RVA = 0x2012, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1012 [29] UnwindInfoAddress = RVA = 0x3978, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x190 - [30] Begin = RVA = 0x2030, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1030 - [30] End = RVA = 0x2036, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1036 + [30] Begin = RVA = 0x2030, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1030 + [30] End = RVA = 0x2036, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1036 [30] UnwindInfoAddress = RVA = 0x3980, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x198 - [31] Begin = RVA = 0x2058, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1058 - [31] End = RVA = 0x2093, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1093 + [31] Begin = RVA = 0x2058, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1058 + [31] End = RVA = 0x2093, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1093 [31] UnwindInfoAddress = RVA = 0x3868, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x80 - [32] Begin = RVA = 0x2093, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x1093 - [32] End = RVA = 0x20B1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x10B1 + [32] Begin = RVA = 0x2093, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x1093 + [32] End = RVA = 0x20B1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x10B1 [32] UnwindInfoAddress = RVA = 0x38F4, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x10C - [33] Begin = RVA = 0x20B1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x10B1 - [33] End = RVA = 0x20C9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1200, Position = 0x400, Size = 0x1200 }, Offset = 0x10C9 + [33] Begin = RVA = 0x20B1, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x10B1 + [33] End = RVA = 0x20C9, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x10C9, Position = 0x400, Size = 0x10C9 }, Offset = 0x10C9 [33] UnwindInfoAddress = RVA = 0x3930, PEStreamSectionData { RVA = 0x37E8, VirtualSize = 0x19C, Position = 0x1DE8, Size = 0x19C }, Offset = 0x148 - Section Data [01] PEStreamSectionData Position = 0x00002D98, Size = 0x00000068, RVA = 0x00006198, VirtualSize = 0x00000068 - [04] .rsrc PESection Position = 0x00002E00, Size = 0x00000200, RVA = 0x00007000, VirtualSize = 0x000001E0, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEResourceDirectory Position = 0x00002E00, Size = 0x000001E0, RVA = 0x00007000, VirtualSize = 0x000001E0 - > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + [00] PEResourceDirectory Position = 0x00002E00, Size = 0x000001E0, RVA = 0x00007000, VirtualSize = 0x000001E0 + > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} > PEResourceDirectoryEntry { Id = 0x18 (RT_MANIFEST), Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDirectoryEntry { Id = 0x1, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (381 bytes) } - Section Data [00] PEStreamSectionData Position = 0x00002FD8, Size = 0x00000008, RVA = 0x000071D8, VirtualSize = 0x00000008 - - - Section Data [01] PEStreamSectionData Position = 0x00002FE0, Size = 0x00000020, RVA = 0x000071E0, VirtualSize = 0x00000020 - - - [05] .reloc PESection Position = 0x00003000, Size = 0x00000200, RVA = 0x00008000, VirtualSize = 0x00000030, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) - - Section Data [00] PEBaseRelocationDirectory Position = 0x00003000, Size = 0x00000030, RVA = 0x00008000, VirtualSize = 0x00000030 - Block 0x3000 Relocations[20] - Dir64 Offset = 0x01F0, RVA = 0x31F0 (0x0000000140001984), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x01F8, RVA = 0x31F8 (0x0000000140001984), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0200, RVA = 0x3200 (0x0000000140002010), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0208, RVA = 0x3208 (0x0000000140002030), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0210, RVA = 0x3210 (0x0000000140002030), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0220, RVA = 0x3220 (0x0000000140001FEE), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0230, RVA = 0x3230 (0x0000000140001348), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0248, RVA = 0x3248 (0x0000000140001280), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0250, RVA = 0x3250 (0x0000000140001338), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0280, RVA = 0x3280 (0x0000000140005080), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0288, RVA = 0x3288 (0x0000000140005120), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0308, RVA = 0x3308 (0x0000000140005000), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0320, RVA = 0x3320 (0x00000001400031F0), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0328, RVA = 0x3328 (0x0000000140003200), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03B0, RVA = 0x33B0 (0x0000000140003480), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03C8, RVA = 0x33C8 (0x00000001400031F8), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03D0, RVA = 0x33D0 (0x0000000140003208), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03D8, RVA = 0x33D8 (0x0000000140003210), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03E0, RVA = 0x33E0 (0x0000000140003218), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x03E8, RVA = 0x33E8 (0x0000000140003220), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] .rdata } - Section Data [00] PEStreamSectionData Position = 0x00003028, Size = 0x00000008, RVA = 0x00008028, VirtualSize = 0x00000008 - - - Section Data [01] PEStreamSectionData Position = 0x00003030, Size = 0x000001D0, RVA = 0x00008030, VirtualSize = 0x000001D0 - + > PEResourceDirectoryEntry { Id = 0x1, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (381 bytes) } + [00] PEStreamSectionData Position = 0x00002FD8, Size = 0x00000008, RVA = 0x000071D8, VirtualSize = 0x00000008 + + + [05] .reloc PESection Position = 0x00003000, Size = 0x00000200, RVA = 0x00008000, VirtualSize = 0x00000030, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) + + [00] PEBaseRelocationDirectory Position = 0x00003000, Size = 0x00000030, RVA = 0x00008000, VirtualSize = 0x00000030 + Block 0x3000 Relocations[20] + [000] Dir64 Offset = 0x01F0, RVA = 0x31F0 (0x0000000140001984), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [001] Dir64 Offset = 0x01F8, RVA = 0x31F8 (0x0000000140001984), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [002] Dir64 Offset = 0x0200, RVA = 0x3200 (0x0000000140002010), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [003] Dir64 Offset = 0x0208, RVA = 0x3208 (0x0000000140002030), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [004] Dir64 Offset = 0x0210, RVA = 0x3210 (0x0000000140002030), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [005] Dir64 Offset = 0x0220, RVA = 0x3220 (0x0000000140001FEE), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [006] Dir64 Offset = 0x0230, RVA = 0x3230 (0x0000000140001348), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [007] Dir64 Offset = 0x0248, RVA = 0x3248 (0x0000000140001280), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [008] Dir64 Offset = 0x0250, RVA = 0x3250 (0x0000000140001338), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [009] Dir64 Offset = 0x0280, RVA = 0x3280 (0x0000000140005080), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [010] Dir64 Offset = 0x0288, RVA = 0x3288 (0x0000000140005120), SectionData = { RVA = 0x000031F0 (PEStreamSectionData[1] -> .rdata) } + [011] Dir64 Offset = 0x0308, RVA = 0x3308 (0x0000000140005000), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [012] Dir64 Offset = 0x0320, RVA = 0x3320 (0x00000001400031F0), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [013] Dir64 Offset = 0x0328, RVA = 0x3328 (0x0000000140003200), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [014] Dir64 Offset = 0x03B0, RVA = 0x33B0 (0x0000000140003480), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [015] Dir64 Offset = 0x03C8, RVA = 0x33C8 (0x00000001400031F8), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [016] Dir64 Offset = 0x03D0, RVA = 0x33D0 (0x0000000140003208), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [017] Dir64 Offset = 0x03D8, RVA = 0x33D8 (0x0000000140003210), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [018] Dir64 Offset = 0x03E0, RVA = 0x33E0 (0x0000000140003218), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + [019] Dir64 Offset = 0x03E8, RVA = 0x33E8 (0x0000000140003220), SectionData = { RVA = 0x000032B0 (PELoadConfigDirectory64[2] -> .rdata) } + + diff --git a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeLibraryWin64.dll.verified.txt b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeLibraryWin64.dll.verified.txt index 4bc60eb..369995c 100644 --- a/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeLibraryWin64.dll.verified.txt +++ b/src/LibObjectFile.Tests/Verified/PEReaderTests.TestPrinter_name=NativeLibraryWin64.dll.verified.txt @@ -83,48 +83,48 @@ Data Directories Sections [00] .text PESection Position = 0x00000400, Size = 0x00001000, RVA = 0x00001000, VirtualSize = 0x00000F18, Characteristics = 0x60000020 (ContainsCode, MemExecute, MemRead) - Section Data [00] PEStreamSectionData Position = 0x00000400, Size = 0x00001000, RVA = 0x00001000, VirtualSize = 0x00001000 + [00] PEStreamSectionData Position = 0x00000400, Size = 0x00000F18, RVA = 0x00001000, VirtualSize = 0x00000F18 [01] .rdata PESection Position = 0x00001400, Size = 0x00000E00, RVA = 0x00002000, VirtualSize = 0x00000C96, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEImportAddressTableDirectory Position = 0x00001400, Size = 0x000000E8, RVA = 0x00002000, VirtualSize = 0x000000E8 - Section Data [00] PEImportAddressTable Position = 0x00001478, Size = 0x00000028, RVA = 0x00002000, VirtualSize = 0x00000028 - [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x2C8C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x274) - [1] PEImportHintName { Hint = 37, Name = __std_type_info_destroy_list } (RVA = 0x2A30, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x18) - [2] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x2A18, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x0) - [3] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x2A50, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x38) - - Section Data [01] PEImportAddressTable Position = 0x000014A0, Size = 0x00000048, RVA = 0x00002028, VirtualSize = 0x00000048 - [0] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x2B08, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xF0) - [1] PEImportHintName { Hint = 34, Name = _execute_onexit_table } (RVA = 0x2AF0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xD8) - [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x2AD4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xBC) - [3] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x2AB2, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x9A) - [4] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x2A98, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x80) - [5] PEImportHintName { Hint = 63, Name = _seh_filter_dll } (RVA = 0x2A86, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x6E) - [6] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x2A78, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x60) - [7] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x2A6C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x54) - - Section Data [02] PEImportAddressTable Position = 0x00001400, Size = 0x00000078, RVA = 0x00002070, VirtualSize = 0x00000078 - [0] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x2C24, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x20C) - [1] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x2B62, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x14A) - [2] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x2B48, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x130) - [3] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x2B34, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x11C) - [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x2B92, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x17A) - [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x2BB0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x198) - [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x2C6A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x252) - [7] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x2C54, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x23C) - [8] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x2C3A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x222) - [9] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x2B76, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x15E) - [10] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x2C0E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1F6) - [11] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x2BF4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1DC) - [12] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x2BD8, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1C0) - [13] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x2BC4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1AC) - + [00] PEImportAddressTableDirectory Position = 0x00001400, Size = 0x000000E8, RVA = 0x00002000, VirtualSize = 0x000000E8 + [00] PEImportAddressTable Position = 0x00001400, Size = 0x00000078, RVA = 0x00002000, VirtualSize = 0x00000078 + [0] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x2C24, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x20C) + [1] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x2B62, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x14A) + [2] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x2B48, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x130) + [3] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x2B34, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x11C) + [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x2B92, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x17A) + [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x2BB0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x198) + [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x2C6A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x252) + [7] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x2C54, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x23C) + [8] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x2C3A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x222) + [9] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x2B76, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x15E) + [10] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x2C0E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1F6) + [11] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x2BF4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1DC) + [12] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x2BD8, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1C0) + [13] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x2BC4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1AC) + + [01] PEImportAddressTable Position = 0x00001478, Size = 0x00000028, RVA = 0x00002078, VirtualSize = 0x00000028 + [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x2C8C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x274) + [1] PEImportHintName { Hint = 37, Name = __std_type_info_destroy_list } (RVA = 0x2A30, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x18) + [2] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x2A18, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x0) + [3] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x2A50, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x38) + + [02] PEImportAddressTable Position = 0x000014A0, Size = 0x00000048, RVA = 0x000020A0, VirtualSize = 0x00000048 + [0] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x2B08, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xF0) + [1] PEImportHintName { Hint = 34, Name = _execute_onexit_table } (RVA = 0x2AF0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xD8) + [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x2AD4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xBC) + [3] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x2AB2, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x9A) + [4] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x2A98, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x80) + [5] PEImportHintName { Hint = 63, Name = _seh_filter_dll } (RVA = 0x2A86, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x6E) + [6] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x2A78, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x60) + [7] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x2A6C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x54) + - Section Data [01] PEStreamSectionData Position = 0x000014E8, Size = 0x000000A8, RVA = 0x000020E8, VirtualSize = 0x000000A8 + [01] PEStreamSectionData Position = 0x000014E8, Size = 0x000000A8, RVA = 0x000020E8, VirtualSize = 0x000000A8 - Section Data [02] PELoadConfigDirectory64 Position = 0x00001590, Size = 0x00000140, RVA = 0x00002190, VirtualSize = 0x00000140 + [02] PELoadConfigDirectory64 Position = 0x00001590, Size = 0x00000140, RVA = 0x00002190, VirtualSize = 0x00000140 Size = 0x140 TimeDateStamp = 0x0 MajorVersion = 0 @@ -179,290 +179,283 @@ Sections CastGuardOsDeterminedFailureMode = 0x180002110 GuardMemcpyFunctionPointer = 0x180002118 - Section Data [03] PEDebugDirectory Position = 0x000016D0, Size = 0x00000070, RVA = 0x000022D0, VirtualSize = 0x00000070 - [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x000023E4 (PEDebugSectionDataRSDS[5] .rdata - [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x00002458 (PEDebugStreamSectionData[7] .rdata - [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x0000246C (PEDebugStreamSectionData[8] .rdata + [03] PEDebugDirectory Position = 0x000016D0, Size = 0x00000070, RVA = 0x000022D0, VirtualSize = 0x00000070 + [0] Type = CodeView, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x000023E4 (PEDebugSectionDataRSDS[5] -> .rdata) + [1] Type = VCFeature, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x00002458 (PEDebugStreamSectionData[7] -> .rdata) + [2] Type = POGO, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = RVA = 0x0000246C (PEDebugStreamSectionData[8] -> .rdata) [3] Type = ILTCG, Characteristics = 0x0, Version = 0.0, TimeStamp = 0x66F19D2E, Data = null - Section Data [04] PEStreamSectionData Position = 0x00001740, Size = 0x000000A4, RVA = 0x00002340, VirtualSize = 0x000000A4 + [04] PEStreamSectionData Position = 0x00001740, Size = 0x000000A4, RVA = 0x00002340, VirtualSize = 0x000000A4 - Section Data [05] PEDebugSectionDataRSDS Position = 0x000017E4, Size = 0x00000071, RVA = 0x000023E4, VirtualSize = 0x00000071 + [05] PEDebugSectionDataRSDS Position = 0x000017E4, Size = 0x00000071, RVA = 0x000023E4, VirtualSize = 0x00000071 Debug Section Data (RSDS) Guid = 9e24e83e-5203-490d-b4fe-ac81f739897a Age = 2 PdbPath = C:\code\LibObjectFile\src\native\Win64\NativeProjects\x64\Release\NativeLibraryWin64.pdb - Section Data [06] PEStreamSectionData Position = 0x00001855, Size = 0x00000003, RVA = 0x00002455, VirtualSize = 0x00000003 + [06] PEStreamSectionData Position = 0x00001855, Size = 0x00000003, RVA = 0x00002455, VirtualSize = 0x00000003 - Section Data [07] PEDebugStreamSectionData Position = 0x00001858, Size = 0x00000014, RVA = 0x00002458, VirtualSize = 0x00000014 + [07] PEDebugStreamSectionData Position = 0x00001858, Size = 0x00000014, RVA = 0x00002458, VirtualSize = 0x00000014 - Section Data [08] PEDebugStreamSectionData Position = 0x0000186C, Size = 0x00000258, RVA = 0x0000246C, VirtualSize = 0x00000258 + [08] PEDebugStreamSectionData Position = 0x0000186C, Size = 0x00000258, RVA = 0x0000246C, VirtualSize = 0x00000258 - Section Data [09] PEStreamSectionData Position = 0x00001AC4, Size = 0x000001AC, RVA = 0x000026C4, VirtualSize = 0x000001AC + [09] PEStreamSectionData Position = 0x00001AC4, Size = 0x000001AC, RVA = 0x000026C4, VirtualSize = 0x000001AC - Section Data [10] PEExportDirectory Position = 0x00001C70, Size = 0x00000070, RVA = 0x00002870, VirtualSize = 0x00000070 + [10] PEExportDirectory Position = 0x00001C70, Size = 0x00000070, RVA = 0x00002870, VirtualSize = 0x00000070 TimeStamp = 02/07/2106 06:28:15 MajorVersion = 0 MinorVersion = 0 OrdinalBase = 0x1 NameLink = NativeLibraryWin64.dll (RVA = 0x28AC, PEStreamSectionData { RVA = 0x28AC, VirtualSize = 0x34, Position = 0x1CAC, Size = 0x34 }, Offset = 0x0) - ExportFunctionAddressTable = RVA = 0x00002898 (PEExportAddressTable[0] - ExportNameTable = RVA = 0x000028A0 (PEExportNameTable[1] - ExportOrdinalTable = RVA = 0x000028A8 (PEExportOrdinalTable[2] - Section Data [00] PEExportAddressTable Position = 0x00001C98, Size = 0x00000008, RVA = 0x00002898, VirtualSize = 0x00000008 - [0] Exported RVA = 0x1020 (RVA = 0x00001000 (PEStreamSectionData[0] .text) - [1] Exported RVA = 0x1010 (RVA = 0x00001000 (PEStreamSectionData[0] .text) - - Section Data [01] PEExportNameTable Position = 0x00001CA0, Size = 0x00000008, RVA = 0x000028A0, VirtualSize = 0x00000008 - [0] AnotherFunction (RVA = 0x28C3, PEStreamSectionData { RVA = 0x28AC, VirtualSize = 0x34, Position = 0x1CAC, Size = 0x34 }, Offset = 0x17) - [1] HelloWorld (RVA = 0x28D3, PEStreamSectionData { RVA = 0x28AC, VirtualSize = 0x34, Position = 0x1CAC, Size = 0x34 }, Offset = 0x27) - - Section Data [02] PEExportOrdinalTable Position = 0x00001CA8, Size = 0x00000004, RVA = 0x000028A8, VirtualSize = 0x00000004 - [0] Ordinal = 0 - [1] Ordinal = 1 - - Section Data [03] PEStreamSectionData Position = 0x00001CAC, Size = 0x00000034, RVA = 0x000028AC, VirtualSize = 0x00000034 - + ExportFunctionAddressTable = RVA = 0x00002898 (PEExportAddressTable[0] -> PEExportDirectory[10] -> .rdata) + ExportNameTable = RVA = 0x000028A0 (PEExportNameTable[1] -> PEExportDirectory[10] -> .rdata) + ExportOrdinalTable = RVA = 0x000028A8 (PEExportOrdinalTable[2] -> PEExportDirectory[10] -> .rdata) + [00] PEExportAddressTable Position = 0x00001C98, Size = 0x00000008, RVA = 0x00002898, VirtualSize = 0x00000008 + [0] Exported RVA = 0x1020 (RVA = 0x00001000 (PEStreamSectionData[0] -> .text)) + [1] Exported RVA = 0x1010 (RVA = 0x00001000 (PEStreamSectionData[0] -> .text)) + + [01] PEExportNameTable Position = 0x00001CA0, Size = 0x00000008, RVA = 0x000028A0, VirtualSize = 0x00000008 + [0] AnotherFunction (RVA = 0x28C3, PEStreamSectionData { RVA = 0x28AC, VirtualSize = 0x34, Position = 0x1CAC, Size = 0x34 }, Offset = 0x17) + [1] HelloWorld (RVA = 0x28D3, PEStreamSectionData { RVA = 0x28AC, VirtualSize = 0x34, Position = 0x1CAC, Size = 0x34 }, Offset = 0x27) + + [02] PEExportOrdinalTable Position = 0x00001CA8, Size = 0x00000004, RVA = 0x000028A8, VirtualSize = 0x00000004 + [0] Ordinal = 0 + [1] Ordinal = 1 + + [03] PEStreamSectionData Position = 0x00001CAC, Size = 0x00000034, RVA = 0x000028AC, VirtualSize = 0x00000034 + - Section Data [11] PEImportDirectory Position = 0x00001CE0, Size = 0x00000050, RVA = 0x000028E0, VirtualSize = 0x00000050 - [0] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x2A5A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x42) - [0] ImportAddressTable = RVA = 0x00002000 (PEImportAddressTable[0] - [0] ImportLookupTable = RVA = 0x000029A8 (PEImportLookupTable[13] .rdata + [11] PEImportDirectory Position = 0x00001CE0, Size = 0x00000050, RVA = 0x000028E0, VirtualSize = 0x00000050 + [0] ImportDllNameLink = VCRUNTIME140.dll (RVA = 0x2A5A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x42) + [0] ImportAddressTable = RVA = 0x00002078 (PEImportAddressTable[1] -> PEImportAddressTableDirectory[0] -> .rdata) + [0] ImportLookupTable = RVA = 0x000029A8 (PEImportLookupTable[13] -> .rdata) - [1] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x2B12, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xFA) - [1] ImportAddressTable = RVA = 0x00002028 (PEImportAddressTable[1] - [1] ImportLookupTable = RVA = 0x000029D0 (PEImportLookupTable[14] .rdata + [1] ImportDllNameLink = api-ms-win-crt-runtime-l1-1-0.dll (RVA = 0x2B12, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xFA) + [1] ImportAddressTable = RVA = 0x000020A0 (PEImportAddressTable[2] -> PEImportAddressTableDirectory[0] -> .rdata) + [1] ImportLookupTable = RVA = 0x000029D0 (PEImportLookupTable[14] -> .rdata) - [2] ImportDllNameLink = KERNEL32.dll (RVA = 0x2C7E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x266) - [2] ImportAddressTable = RVA = 0x00002070 (PEImportAddressTable[2] - [2] ImportLookupTable = RVA = 0x00002930 (PEImportLookupTable[12] .rdata + [2] ImportDllNameLink = KERNEL32.dll (RVA = 0x2C7E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x266) + [2] ImportAddressTable = RVA = 0x00002000 (PEImportAddressTable[0] -> PEImportAddressTableDirectory[0] -> .rdata) + [2] ImportLookupTable = RVA = 0x00002930 (PEImportLookupTable[12] -> .rdata) - Section Data [12] PEImportLookupTable Position = 0x00001D30, Size = 0x00000078, RVA = 0x00002930, VirtualSize = 0x00000078 - [0] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x2C24, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x20C) - [1] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x2B62, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x14A) - [2] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x2B48, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x130) - [3] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x2B34, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x11C) - [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x2B92, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x17A) - [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x2BB0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x198) - [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x2C6A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x252) - [7] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x2C54, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x23C) - [8] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x2C3A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x222) - [9] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x2B76, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x15E) - [10] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x2C0E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1F6) - [11] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x2BF4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1DC) - [12] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x2BD8, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1C0) - [13] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x2BC4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x1AC) + [12] PEImportLookupTable Position = 0x00001D30, Size = 0x00000078, RVA = 0x00002930, VirtualSize = 0x00000078 + [0] PEImportHintName { Hint = 567, Name = GetCurrentThreadId } (RVA = 0x2C24, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x20C) + [1] PEImportHintName { Hint = 1284, Name = RtlVirtualUnwind } (RVA = 0x2B62, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x14A) + [2] PEImportHintName { Hint = 1277, Name = RtlLookupFunctionEntry } (RVA = 0x2B48, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x130) + [3] PEImportHintName { Hint = 1269, Name = RtlCaptureContext } (RVA = 0x2B34, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x11C) + [4] PEImportHintName { Hint = 1444, Name = SetUnhandledExceptionFilter } (RVA = 0x2B92, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x17A) + [5] PEImportHintName { Hint = 562, Name = GetCurrentProcess } (RVA = 0x2BB0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x198) + [6] PEImportHintName { Hint = 928, Name = IsDebuggerPresent } (RVA = 0x2C6A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x252) + [7] PEImportHintName { Hint = 906, Name = InitializeSListHead } (RVA = 0x2C54, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x23C) + [8] PEImportHintName { Hint = 778, Name = GetSystemTimeAsFileTime } (RVA = 0x2C3A, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x222) + [9] PEImportHintName { Hint = 1510, Name = UnhandledExceptionFilter } (RVA = 0x2B76, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x15E) + [10] PEImportHintName { Hint = 563, Name = GetCurrentProcessId } (RVA = 0x2C0E, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1F6) + [11] PEImportHintName { Hint = 1136, Name = QueryPerformanceCounter } (RVA = 0x2BF4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1DC) + [12] PEImportHintName { Hint = 936, Name = IsProcessorFeaturePresent } (RVA = 0x2BD8, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1C0) + [13] PEImportHintName { Hint = 1476, Name = TerminateProcess } (RVA = 0x2BC4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x1AC) - Section Data [13] PEImportLookupTable Position = 0x00001DA8, Size = 0x00000028, RVA = 0x000029A8, VirtualSize = 0x00000028 - [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x2C8C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x274) - [1] PEImportHintName { Hint = 37, Name = __std_type_info_destroy_list } (RVA = 0x2A30, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x18) - [2] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x2A18, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x0) - [3] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x2A50, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x38) + [13] PEImportLookupTable Position = 0x00001DA8, Size = 0x00000028, RVA = 0x000029A8, VirtualSize = 0x00000028 + [0] PEImportHintName { Hint = 60, Name = memcpy } (RVA = 0x2C8C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x274) + [1] PEImportHintName { Hint = 37, Name = __std_type_info_destroy_list } (RVA = 0x2A30, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x18) + [2] PEImportHintName { Hint = 8, Name = __C_specific_handler } (RVA = 0x2A18, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x0) + [3] PEImportHintName { Hint = 62, Name = memset } (RVA = 0x2A50, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x38) - Section Data [14] PEImportLookupTable Position = 0x00001DD0, Size = 0x00000048, RVA = 0x000029D0, VirtualSize = 0x00000048 - [0] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x2B08, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xF0) - [1] PEImportHintName { Hint = 34, Name = _execute_onexit_table } (RVA = 0x2AF0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xD8) - [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x2AD4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0xBC) - [3] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x2AB2, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x9A) - [4] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x2A98, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x80) - [5] PEImportHintName { Hint = 63, Name = _seh_filter_dll } (RVA = 0x2A86, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x6E) - [6] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x2A78, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x60) - [7] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x2A6C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x3E8, Position = 0x1E18, Size = 0x3E8 }, Offset = 0x54) + [14] PEImportLookupTable Position = 0x00001DD0, Size = 0x00000048, RVA = 0x000029D0, VirtualSize = 0x00000048 + [0] PEImportHintName { Hint = 22, Name = _cexit } (RVA = 0x2B08, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xF0) + [1] PEImportHintName { Hint = 34, Name = _execute_onexit_table } (RVA = 0x2AF0, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xD8) + [2] PEImportHintName { Hint = 52, Name = _initialize_onexit_table } (RVA = 0x2AD4, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0xBC) + [3] PEImportHintName { Hint = 51, Name = _initialize_narrow_environment } (RVA = 0x2AB2, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x9A) + [4] PEImportHintName { Hint = 24, Name = _configure_narrow_argv } (RVA = 0x2A98, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x80) + [5] PEImportHintName { Hint = 63, Name = _seh_filter_dll } (RVA = 0x2A86, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x6E) + [6] PEImportHintName { Hint = 55, Name = _initterm_e } (RVA = 0x2A78, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x60) + [7] PEImportHintName { Hint = 54, Name = _initterm } (RVA = 0x2A6C, PEStreamSectionData { RVA = 0x2A18, VirtualSize = 0x27E, Position = 0x1E18, Size = 0x27E }, Offset = 0x54) - Section Data [15] PEStreamSectionData Position = 0x00001E18, Size = 0x000003E8, RVA = 0x00002A18, VirtualSize = 0x000003E8 + [15] PEStreamSectionData Position = 0x00001E18, Size = 0x0000027E, RVA = 0x00002A18, VirtualSize = 0x0000027E [02] .data PESection Position = 0x00002200, Size = 0x00000200, RVA = 0x00003000, VirtualSize = 0x00000680, Characteristics = 0xC0000040 (ContainsInitializedData, MemRead, MemWrite) - Section Data [00] PEStreamSectionData Position = 0x00002200, Size = 0x00000200, RVA = 0x00003000, VirtualSize = 0x00000200 + [00] PEStreamSectionData Position = 0x00002200, Size = 0x00000200, RVA = 0x00003000, VirtualSize = 0x00000200 [03] .pdata PESection Position = 0x00002400, Size = 0x00000200, RVA = 0x00004000, VirtualSize = 0x000001A4, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEExceptionDirectory Position = 0x00002400, Size = 0x000001A4, RVA = 0x00004000, VirtualSize = 0x000001A4 - [0] Begin = RVA = 0x1040, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x40 - [0] End = RVA = 0x105E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x5E + [00] PEExceptionDirectory Position = 0x00002400, Size = 0x000001A4, RVA = 0x00004000, VirtualSize = 0x000001A4 + [0] Begin = RVA = 0x1040, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x40 + [0] End = RVA = 0x105E, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x5E [0] UnwindInfoAddress = RVA = 0x26E8, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x24 - [1] Begin = RVA = 0x1060, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x60 - [1] End = RVA = 0x10B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xB0 + [1] Begin = RVA = 0x1060, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x60 + [1] End = RVA = 0x10B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xB0 [1] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [2] Begin = RVA = 0x10B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xB0 - [2] End = RVA = 0x11C6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x1C6 + [2] Begin = RVA = 0x10B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xB0 + [2] End = RVA = 0x11C6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x1C6 [2] UnwindInfoAddress = RVA = 0x26EC, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x28 - [3] Begin = RVA = 0x11C8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x1C8 - [3] End = RVA = 0x1248, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x248 + [3] Begin = RVA = 0x11C8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x1C8 + [3] End = RVA = 0x1248, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x248 [3] UnwindInfoAddress = RVA = 0x2730, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x6C - [4] Begin = RVA = 0x1248, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x248 - [4] End = RVA = 0x1370, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x370 + [4] Begin = RVA = 0x1248, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x248 + [4] End = RVA = 0x1370, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x370 [4] UnwindInfoAddress = RVA = 0x278C, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC8 - [5] Begin = RVA = 0x1370, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x370 - [5] End = RVA = 0x13AD, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x3AD + [5] Begin = RVA = 0x1370, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x370 + [5] End = RVA = 0x13AD, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x3AD [5] UnwindInfoAddress = RVA = 0x27BC, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xF8 - [6] Begin = RVA = 0x13B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x3B0 - [6] End = RVA = 0x13E4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x3E4 + [6] Begin = RVA = 0x13B0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x3B0 + [6] End = RVA = 0x13E4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x3E4 [6] UnwindInfoAddress = RVA = 0x27E0, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x11C - [7] Begin = RVA = 0x13E4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x3E4 - [7] End = RVA = 0x14B7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x4B7 + [7] Begin = RVA = 0x13E4, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x3E4 + [7] End = RVA = 0x14B7, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x4B7 [7] UnwindInfoAddress = RVA = 0x27CC, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x108 - [8] Begin = RVA = 0x14B8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x4B8 - [8] End = RVA = 0x1529, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x529 + [8] Begin = RVA = 0x14B8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x4B8 + [8] End = RVA = 0x1529, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x529 [8] UnwindInfoAddress = RVA = 0x27D4, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x110 - [9] Begin = RVA = 0x152C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x52C - [9] End = RVA = 0x15D8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x5D8 + [9] Begin = RVA = 0x152C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x52C + [9] End = RVA = 0x15D8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x5D8 [9] UnwindInfoAddress = RVA = 0x27E8, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x124 - [10] Begin = RVA = 0x1604, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x604 - [10] End = RVA = 0x161F, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x61F + [10] Begin = RVA = 0x1604, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x604 + [10] End = RVA = 0x161F, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x61F [10] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [11] Begin = RVA = 0x1620, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x620 - [11] End = RVA = 0x1659, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x659 + [11] Begin = RVA = 0x1620, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x620 + [11] End = RVA = 0x1659, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x659 [11] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [12] Begin = RVA = 0x165C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x65C - [12] End = RVA = 0x1690, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x690 + [12] Begin = RVA = 0x165C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x65C + [12] End = RVA = 0x1690, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x690 [12] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [13] Begin = RVA = 0x1690, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x690 - [13] End = RVA = 0x16A5, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6A5 + [13] Begin = RVA = 0x1690, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x690 + [13] End = RVA = 0x16A5, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6A5 [13] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [14] Begin = RVA = 0x16A8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6A8 - [14] End = RVA = 0x16D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6D0 + [14] Begin = RVA = 0x16A8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6A8 + [14] End = RVA = 0x16D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6D0 [14] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [15] Begin = RVA = 0x16D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6D0 - [15] End = RVA = 0x16E5, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6E5 + [15] Begin = RVA = 0x16D0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6D0 + [15] End = RVA = 0x16E5, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6E5 [15] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [16] Begin = RVA = 0x16E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x6E8 - [16] End = RVA = 0x1748, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x748 + [16] Begin = RVA = 0x16E8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x6E8 + [16] End = RVA = 0x1748, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x748 [16] UnwindInfoAddress = RVA = 0x281C, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x158 - [17] Begin = RVA = 0x1748, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x748 - [17] End = RVA = 0x1778, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x778 + [17] Begin = RVA = 0x1748, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x748 + [17] End = RVA = 0x1778, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x778 [17] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [18] Begin = RVA = 0x1778, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x778 - [18] End = RVA = 0x178C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x78C + [18] Begin = RVA = 0x1778, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x778 + [18] End = RVA = 0x178C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x78C [18] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [19] Begin = RVA = 0x178C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x78C - [19] End = RVA = 0x17C6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x7C6 + [19] Begin = RVA = 0x178C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x78C + [19] End = RVA = 0x17C6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x7C6 [19] UnwindInfoAddress = RVA = 0x2784, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xC0 - [20] Begin = RVA = 0x17C8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x7C8 - [20] End = RVA = 0x1853, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x853 + [20] Begin = RVA = 0x17C8, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x7C8 + [20] End = RVA = 0x1853, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x853 [20] UnwindInfoAddress = RVA = 0x27E0, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x11C - [21] Begin = RVA = 0x1854, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x854 - [21] End = RVA = 0x18EC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x8EC + [21] Begin = RVA = 0x1854, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x854 + [21] End = RVA = 0x18EC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x8EC [21] UnwindInfoAddress = RVA = 0x27F4, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x130 - [22] Begin = RVA = 0x18EC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x8EC - [22] End = RVA = 0x1910, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x910 + [22] Begin = RVA = 0x18EC, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x8EC + [22] End = RVA = 0x1910, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x910 [22] UnwindInfoAddress = RVA = 0x27E0, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x11C - [23] Begin = RVA = 0x1910, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x910 - [23] End = RVA = 0x1939, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x939 + [23] Begin = RVA = 0x1910, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x910 + [23] End = RVA = 0x1939, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x939 [23] UnwindInfoAddress = RVA = 0x27E0, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x11C - [24] Begin = RVA = 0x194C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0x94C - [24] End = RVA = 0x1A94, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xA94 + [24] Begin = RVA = 0x194C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0x94C + [24] End = RVA = 0x1A94, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xA94 [24] UnwindInfoAddress = RVA = 0x2830, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x16C - [25] Begin = RVA = 0x1A94, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xA94 - [25] End = RVA = 0x1AD0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xAD0 + [25] Begin = RVA = 0x1A94, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xA94 + [25] End = RVA = 0x1AD0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xAD0 [25] UnwindInfoAddress = RVA = 0x2840, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x17C - [26] Begin = RVA = 0x1AD0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xAD0 - [26] End = RVA = 0x1B0C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xB0C + [26] Begin = RVA = 0x1AD0, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xAD0 + [26] End = RVA = 0x1B0C, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xB0C [26] UnwindInfoAddress = RVA = 0x2840, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x17C - [27] Begin = RVA = 0x1B10, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xB10 - [27] End = RVA = 0x1DDA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xDDA + [27] Begin = RVA = 0x1B10, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xB10 + [27] End = RVA = 0x1DDA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xDDA [27] UnwindInfoAddress = RVA = 0x284C, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x188 - [28] Begin = RVA = 0x1E60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE60 - [28] End = RVA = 0x1E62, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE62 + [28] Begin = RVA = 0x1E60, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE60 + [28] End = RVA = 0x1E62, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE62 [28] UnwindInfoAddress = RVA = 0x2860, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x19C - [29] Begin = RVA = 0x1E80, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE80 - [29] End = RVA = 0x1E86, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE86 + [29] Begin = RVA = 0x1E80, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE80 + [29] End = RVA = 0x1E86, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE86 [29] UnwindInfoAddress = RVA = 0x2868, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x1A4 - [30] Begin = RVA = 0x1E86, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE86 - [30] End = RVA = 0x1E9D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE9D + [30] Begin = RVA = 0x1E86, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE86 + [30] End = RVA = 0x1E9D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE9D [30] UnwindInfoAddress = RVA = 0x2728, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x64 - [31] Begin = RVA = 0x1E9D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xE9D - [31] End = RVA = 0x1EB6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xEB6 + [31] Begin = RVA = 0x1E9D, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xE9D + [31] End = RVA = 0x1EB6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xEB6 [31] UnwindInfoAddress = RVA = 0x2728, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x64 - [32] Begin = RVA = 0x1EB6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xEB6 - [32] End = RVA = 0x1ECA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xECA + [32] Begin = RVA = 0x1EB6, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xEB6 + [32] End = RVA = 0x1ECA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xECA [32] UnwindInfoAddress = RVA = 0x2728, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x64 - [33] Begin = RVA = 0x1ECA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xECA - [33] End = RVA = 0x1F00, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xF00 + [33] Begin = RVA = 0x1ECA, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xECA + [33] End = RVA = 0x1F00, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xF00 [33] UnwindInfoAddress = RVA = 0x27B4, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0xF0 - [34] Begin = RVA = 0x1F00, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xF00 - [34] End = RVA = 0x1F18, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0x1000, Position = 0x400, Size = 0x1000 }, Offset = 0xF18 + [34] Begin = RVA = 0x1F00, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xF00 + [34] End = RVA = 0x1F18, PEStreamSectionData { RVA = 0x1000, VirtualSize = 0xF18, Position = 0x400, Size = 0xF18 }, Offset = 0xF18 [34] UnwindInfoAddress = RVA = 0x2814, PEStreamSectionData { RVA = 0x26C4, VirtualSize = 0x1AC, Position = 0x1AC4, Size = 0x1AC }, Offset = 0x150 - Section Data [01] PEStreamSectionData Position = 0x000025A4, Size = 0x0000005C, RVA = 0x000041A4, VirtualSize = 0x0000005C - [04] .rsrc PESection Position = 0x00002600, Size = 0x00000200, RVA = 0x00005000, VirtualSize = 0x000000F8, Characteristics = 0x40000040 (ContainsInitializedData, MemRead) - Section Data [00] PEResourceDirectory Position = 0x00002600, Size = 0x000000F8, RVA = 0x00005000, VirtualSize = 0x000000F8 - > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + [00] PEResourceDirectory Position = 0x00002600, Size = 0x000000F8, RVA = 0x00005000, VirtualSize = 0x000000F8 + > PEResourceDirectoryEntry { Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} > PEResourceDirectoryEntry { Id = 0x18 (RT_MANIFEST), Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDirectoryEntry { Id = 0x2, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} - > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (145 bytes) } - Section Data [00] PEStreamSectionData Position = 0x000026EC, Size = 0x0000000C, RVA = 0x000050EC, VirtualSize = 0x0000000C - - - Section Data [01] PEStreamSectionData Position = 0x000026F8, Size = 0x00000108, RVA = 0x000050F8, VirtualSize = 0x00000108 - - - [05] .reloc PESection Position = 0x00002800, Size = 0x00000200, RVA = 0x00006000, VirtualSize = 0x0000002C, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) - - Section Data [00] PEBaseRelocationDirectory Position = 0x00002800, Size = 0x0000002C, RVA = 0x00006000, VirtualSize = 0x0000002C - Block 0x2000 Relocations[17] - Dir64 Offset = 0x00E8, RVA = 0x20E8 (0x0000000180001B0C), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x00F0, RVA = 0x20F0 (0x0000000180001B0C), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x00F8, RVA = 0x20F8 (0x0000000180001E60), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0100, RVA = 0x2100 (0x0000000180001E80), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0108, RVA = 0x2108 (0x0000000180001E80), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0118, RVA = 0x2118 (0x0000000180001E3B), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0168, RVA = 0x2168 (0x0000000180003090), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x0170, RVA = 0x2170 (0x0000000180003130), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] .rdata } - Dir64 Offset = 0x01E8, RVA = 0x21E8 (0x0000000180003000), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0200, RVA = 0x2200 (0x00000001800020E8), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0208, RVA = 0x2208 (0x00000001800020F8), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x0290, RVA = 0x2290 (0x0000000180002380), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x02A8, RVA = 0x22A8 (0x00000001800020F0), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x02B0, RVA = 0x22B0 (0x0000000180002100), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x02B8, RVA = 0x22B8 (0x0000000180002108), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x02C0, RVA = 0x22C0 (0x0000000180002110), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Dir64 Offset = 0x02C8, RVA = 0x22C8 (0x0000000180002118), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] .rdata } - Section Data [00] PEStreamSectionData Position = 0x00002824, Size = 0x00000008, RVA = 0x00006024, VirtualSize = 0x00000008 - - - Section Data [01] PEStreamSectionData Position = 0x0000282C, Size = 0x000001D4, RVA = 0x0000602C, VirtualSize = 0x000001D4 - + > PEResourceDirectoryEntry { Id = 0x2, Entries[1] , TimeDateStamp = 01/01/1970 00:00:00, MajorVersion = 0, MinorVersion = 0} + > PEResourceDataEntry { Id = 0x409 (en-US), Data = Stream (145 bytes) } + [00] PEStreamSectionData Position = 0x000026EC, Size = 0x0000000C, RVA = 0x000050EC, VirtualSize = 0x0000000C + + + [05] .reloc PESection Position = 0x00002800, Size = 0x00000200, RVA = 0x00006000, VirtualSize = 0x0000002C, Characteristics = 0x42000040 (ContainsInitializedData, MemDiscardable, MemRead) + + [00] PEBaseRelocationDirectory Position = 0x00002800, Size = 0x0000002C, RVA = 0x00006000, VirtualSize = 0x0000002C + Block 0x2000 Relocations[18] + [000] Dir64 Offset = 0x00E8, RVA = 0x20E8 (0x0000000180001B0C), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [001] Dir64 Offset = 0x00F0, RVA = 0x20F0 (0x0000000180001B0C), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [002] Dir64 Offset = 0x00F8, RVA = 0x20F8 (0x0000000180001E60), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [003] Dir64 Offset = 0x0100, RVA = 0x2100 (0x0000000180001E80), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [004] Dir64 Offset = 0x0108, RVA = 0x2108 (0x0000000180001E80), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [005] Dir64 Offset = 0x0118, RVA = 0x2118 (0x0000000180001E3B), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [006] Dir64 Offset = 0x0168, RVA = 0x2168 (0x0000000180003090), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [007] Dir64 Offset = 0x0170, RVA = 0x2170 (0x0000000180003130), SectionData = { RVA = 0x000020E8 (PEStreamSectionData[1] -> .rdata) } + [008] Dir64 Offset = 0x01E8, RVA = 0x21E8 (0x0000000180003000), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [009] Dir64 Offset = 0x0200, RVA = 0x2200 (0x00000001800020E8), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [010] Dir64 Offset = 0x0208, RVA = 0x2208 (0x00000001800020F8), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [011] Dir64 Offset = 0x0290, RVA = 0x2290 (0x0000000180002380), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [012] Dir64 Offset = 0x02A8, RVA = 0x22A8 (0x00000001800020F0), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [013] Dir64 Offset = 0x02B0, RVA = 0x22B0 (0x0000000180002100), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [014] Dir64 Offset = 0x02B8, RVA = 0x22B8 (0x0000000180002108), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [015] Dir64 Offset = 0x02C0, RVA = 0x22C0 (0x0000000180002110), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [016] Dir64 Offset = 0x02C8, RVA = 0x22C8 (0x0000000180002118), SectionData = { RVA = 0x00002190 (PELoadConfigDirectory64[2] -> .rdata) } + [017] Absolute Zero padding + + diff --git a/src/LibObjectFile/Ar/ArArchiveFile.cs b/src/LibObjectFile/Ar/ArArchiveFile.cs index 2f9a004..dccaeba 100644 --- a/src/LibObjectFile/Ar/ArArchiveFile.cs +++ b/src/LibObjectFile/Ar/ArArchiveFile.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -325,7 +325,7 @@ public void Write(Stream stream) writer.Write(); } - public override void UpdateLayout(ArVisitorContext visitorContext) + public override void UpdateLayout(ArVisitorContext context) { } diff --git a/src/LibObjectFile/Diagnostics/DiagnosticId.cs b/src/LibObjectFile/Diagnostics/DiagnosticId.cs index 57fc0d2..df33aec 100644 --- a/src/LibObjectFile/Diagnostics/DiagnosticId.cs +++ b/src/LibObjectFile/Diagnostics/DiagnosticId.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -125,37 +125,12 @@ public enum DiagnosticId PE_ERR_InvalidSectionHeadersSize = 3007, PE_ERR_InvalidParent = 3008, PE_ERR_InvalidExtraData = 3009, - - // PE BaseRelocation - PE_ERR_BaseRelocationDirectoryInvalidEndOfStream = 3020, - PE_ERR_BaseRelocationDirectoryInvalidSection = 3021, - PE_ERR_BaseRelocationDirectoryInvalidSectionData = 3022, - PE_ERR_InvalidDataDirectorySection = 3023, - PE_ERR_BaseRelocationDirectoryInvalidVirtualAddress = 3024, - - // PE Import - PE_ERR_ImportDirectoryInvalidEndOfStream = 3040, - PE_ERR_ImportLookupTableInvalidEndOfStream = 3041, - PE_ERR_ImportLookupTableInvalidHintNameTableRVA = 3042, - PE_ERR_ImportLookupTableInvalidParent = 3043, - PE_ERR_ImportDirectoryInvalidImportAddressTableRVA = 3044, - PE_ERR_ImportDirectoryInvalidImportLookupTableRVA = 3045, - PE_ERR_ImportAddressTableNotFound = 3046, - PE_ERR_InvalidInternalState = 3047, - - // PE Export - PE_ERR_ExportAddressTableInvalidRVA = 3060, - PE_ERR_ExportDirectoryInvalidAddressOfNames = 3061, - PE_ERR_ExportDirectoryInvalidAddressOfFunctions = 3062, - PE_ERR_ExportDirectoryInvalidAddressOfNameOrdinals = 3063, - PE_ERR_ExportDirectoryInvalidName = 3064, - PE_ERR_ExportNameTableInvalidRVA = 3065, - - // PE Resource directory - PE_ERR_InvalidResourceDirectory = 3080, - PE_ERR_InvalidResourceDirectoryEntry = 3081, - PE_ERR_InvalidResourceDirectoryEntryRVAOffsetToData = 3082, - + PE_ERR_SectionSizeLargerThanVirtualSize = 3010, + PE_ERR_SectionRVALessThanPrevious = 3011, + PE_ERR_TooManySections = 3012, + PE_ERR_FileAlignmentNotPowerOfTwo = 3013, + PE_ERR_SectionAlignmentNotPowerOfTwo = 3014, + PE_ERR_SectionAlignmentLessThanFileAlignment = 315, // PE Exception directory PE_ERR_InvalidExceptionDirectory_Entries = 3100, @@ -165,12 +140,6 @@ public enum DiagnosticId // PE Certificate directory PE_ERR_InvalidCertificateEntry = 3200, - // PE TLS directory - PE_ERR_InvalidTlsStartAddressOfRawData = 3300, - PE_ERR_InvalidTlsEndAddressOfRawData = 3301, - PE_ERR_InvalidTlsAddressOfIndex = 3302, - PE_ERR_InvalidTlsAddressOfCallBacks = 3303, - // PE BoundImport directory PE_ERR_BoundImportDirectoryInvalidEndOfStream = 3400, PE_ERR_BoundImportDirectoryInvalidModuleName = 3401, @@ -193,4 +162,34 @@ public enum DiagnosticId PE_ERR_InvalidDebugDataRSDSSignature = 3603, PE_ERR_InvalidDebugDataRSDSPdbPath = 3604, PE_ERR_DebugDirectoryExtraData = 3605, + + // PE BaseRelocation + PE_ERR_BaseRelocationDirectoryInvalidEndOfStream = 3700, + PE_ERR_BaseRelocationDirectoryInvalidSection = 3701, + PE_ERR_BaseRelocationDirectoryInvalidSectionData = 3702, + PE_ERR_InvalidDataDirectorySection = 3703, + PE_ERR_BaseRelocationDirectoryInvalidVirtualAddress = 3704, + + // PE Import + PE_ERR_ImportDirectoryInvalidEndOfStream = 3800, + PE_ERR_ImportLookupTableInvalidEndOfStream = 3801, + PE_ERR_ImportLookupTableInvalidHintNameTableRVA = 3802, + PE_ERR_ImportLookupTableInvalidParent = 3803, + PE_ERR_ImportDirectoryInvalidImportAddressTableRVA = 3804, + PE_ERR_ImportDirectoryInvalidImportLookupTableRVA = 3805, + PE_ERR_ImportAddressTableNotFound = 3806, + PE_ERR_InvalidInternalState = 3807, + + // PE Export + PE_ERR_ExportAddressTableInvalidRVA = 3900, + PE_ERR_ExportDirectoryInvalidAddressOfNames = 3901, + PE_ERR_ExportDirectoryInvalidAddressOfFunctions = 3902, + PE_ERR_ExportDirectoryInvalidAddressOfNameOrdinals = 3903, + PE_ERR_ExportDirectoryInvalidName = 3904, + PE_ERR_ExportNameTableInvalidRVA = 3905, + + // PE Resource directory + PE_ERR_InvalidResourceDirectory = 4000, + PE_ERR_InvalidResourceDirectoryEntry = 4001, + PE_ERR_InvalidResourceDirectoryEntryRVAOffsetToData = 4002, } \ No newline at end of file diff --git a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocation.cs b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocation.cs index f2ab5b3..69001cd 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocation.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocation.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -14,6 +14,11 @@ namespace LibObjectFile.PE; [DebuggerDisplay("{ToString(),nq}")] public readonly record struct PEBaseRelocation(PEBaseRelocationType Type, PESectionData? Container, RVO RVO) : IPELink { + /// + /// Gets a value indicating whether the base relocation is zero padding. + /// + public bool IsZero => Type == PEBaseRelocationType.Absolute; + /// /// Reads the address from the section data. /// @@ -60,5 +65,5 @@ public ulong ReadAddress(PEFile file) } } - public override string ToString() => $"{Type} {this.ToDisplayTextWithRVA()}"; + public override string ToString() => Type == PEBaseRelocationType.Absolute ? $"{Type} Zero Padding" : $"{Type} {this.ToDisplayTextWithRVA()}"; } diff --git a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationBlock.cs b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationBlock.cs index bc4ef94..44072fb 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationBlock.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationBlock.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -53,7 +53,15 @@ internal unsafe uint CalculateSizeOf() return (uint)BlockBuffer.Length; } - return (uint)(Relocations.Count * sizeof(ushort)); + var count = Relocations.Count; + + // If we have an odd number of relocations, we need to add an extra 0x0 + if (count > 0 && (count & 1) != 0) + { + count++; + } + + return (uint)(count * sizeof(ushort)); } internal void ReadAndBind(PEImageReader reader) @@ -62,35 +70,33 @@ internal void ReadAndBind(PEImageReader reader) var relocSpan = MemoryMarshal.Cast(buffer.Span); - // Remove padding zeros at the end of the block - if (relocSpan.Length > 0 && relocSpan[^1].IsZero) - { - relocSpan = relocSpan.Slice(0, relocSpan.Length - 1); - } - var section = SectionLink.Container!; var blockBaseAddress = SectionLink.RVA(); // Iterate on all relocations - foreach (var relocation in relocSpan) + foreach (var rawReloc in relocSpan) { - if (relocation.IsZero) + PEBaseRelocation reloc; + if (rawReloc.IsZero) { - continue; + reloc = new PEBaseRelocation(); } + else + { + var va = blockBaseAddress + rawReloc.OffsetInBlockPart; - var va = blockBaseAddress + relocation.OffsetInBlockPart; + // Find the section data containing the virtual address + if (!section.TryFindSectionData(va, out var sectionData)) + { + reader.Diagnostics.Error(DiagnosticId.PE_ERR_BaseRelocationDirectoryInvalidVirtualAddress, $"Unable to find the section data containing the virtual address 0x{va:X4}"); + continue; + } - // Find the section data containing the virtual address - if (!section.TryFindSectionData(va, out var sectionData)) - { - reader.Diagnostics.Error(DiagnosticId.PE_ERR_BaseRelocationDirectoryInvalidVirtualAddress, $"Unable to find the section data containing the virtual address 0x{va:X4}"); - continue; - } + var offsetInSectionData = va - sectionData.RVA; + reloc = new PEBaseRelocation(rawReloc.Type, sectionData, offsetInSectionData); - var offsetInSectionData = va - sectionData.RVA; - var newRelocation = new PEBaseRelocation(relocation.Type, sectionData, offsetInSectionData); - Relocations.Add(newRelocation); + } + Relocations.Add(reloc); } // Clear the buffer, as we don't need it anymore diff --git a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationDirectory.cs b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationDirectory.cs index 19e66d3..29fcd97 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationDirectory.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEBaseRelocationDirectory.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -19,12 +19,12 @@ public PEBaseRelocationDirectory() : base(PEDataDirectoryKind.BaseRelocation) public List Blocks { get; } = new(); - protected override uint ComputeHeaderSize(PEVisitorContext context) + protected override unsafe uint ComputeHeaderSize(PEVisitorContext context) { var size = 0U; foreach (var block in Blocks) { - size += block.CalculateSizeOf(); + size += (uint)(block.CalculateSizeOf() + sizeof(ImageBaseRelocation)); } return size; diff --git a/src/LibObjectFile/PE/DataDirectory/PEDataDirectory.cs b/src/LibObjectFile/PE/DataDirectory/PEDataDirectory.cs index f8107ff..8f10e87 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEDataDirectory.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEDataDirectory.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -43,22 +43,22 @@ public sealed override void UpdateLayout(PELayoutContext context) // A directory could have a content in addition to the header // So we update the VirtualAddress of each content and update the layout - var position = Position; - foreach (var table in Content) + var position = Position + headerSize; + foreach (var subData in Content) { - table.RVA = va; + subData.RVA = va; // Update layout will update virtual address if (!context.UpdateSizeOnly) { - table.Position = position; + subData.Position = position; } - table.UpdateLayout(context); + subData.UpdateLayout(context); - va += (uint)table.Size; - size += table.Size; - position += table.Size; + va += (uint)subData.Size; + size += subData.Size; + position += subData.Size; } Size = size; diff --git a/src/LibObjectFile/PE/DataDirectory/PEDirectoryTable.cs b/src/LibObjectFile/PE/DataDirectory/PEDirectoryTable.cs index d352e3e..7bfc095 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEDirectoryTable.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEDirectoryTable.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -146,6 +146,21 @@ internal void Set(PEDataDirectoryKind kind, PEDataDirectory? directory) _count++; } } + + internal int CalculateNumberOfEntries() + { + int count = 0; + ReadOnlySpan span = _entries; + for(int i = 0; i < span.Length; i++) + { + if (_entries[i] is not null) + { + count = i + 1; + } + } + + return count; + } [InlineArray(15)] private struct InternalArray diff --git a/src/LibObjectFile/PE/DataDirectory/PEExportAddressTable.cs b/src/LibObjectFile/PE/DataDirectory/PEExportAddressTable.cs index 55e3d84..4b1e6a7 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEExportAddressTable.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEExportAddressTable.cs @@ -1,13 +1,17 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. using System; using System.Buffers; using System.Collections.Generic; +using System.ComponentModel; using System.Diagnostics; using System.Runtime.InteropServices; +using System.Security.Cryptography; +using System.Xml.Linq; using LibObjectFile.Diagnostics; +using static System.Collections.Specialized.BitVector32; namespace LibObjectFile.PE; @@ -49,24 +53,17 @@ public override unsafe void Read(PEImageReader reader) for (int i = 0; i < Values.Count; i++) { var rva = spanRva[i]; - if (!reader.File.TryFindContainerByRVA(rva, out var container)) + if (!reader.File.TryFindSection(rva, out var section)) { reader.Diagnostics.Error(DiagnosticId.PE_ERR_ExportAddressTableInvalidRVA, $"Unable to find the section data for RVA {rva}"); return; } - ObjectElement? parent = container; - while (parent != null && parent is not PESection) - { - parent = parent.Parent; - } - - Debug.Assert(parent is not null); - var section = (PESection)parent!; + var found = section.TryFindSectionData(rva, out var sectionData); if (section.Name == PESectionName.EData) { - var streamSectionData = container as PEStreamSectionData; + var streamSectionData = sectionData as PEStreamSectionData; if (streamSectionData is null) { reader.Diagnostics.Error(DiagnosticId.PE_ERR_ExportAddressTableInvalidRVA, $"Invalid forwarder RVA {rva} for Export Address Table"); @@ -74,11 +71,17 @@ public override unsafe void Read(PEImageReader reader) } Values[i] = new PEExportFunctionEntry(new PEAsciiStringLink(streamSectionData, rva - streamSectionData.RVA)); - } else { - Values[i] = new PEExportFunctionEntry(new PEFunctionAddressLink(container, rva - container.RVA)); + if (found) + { + Values[i] = new PEExportFunctionEntry(new PEFunctionAddressLink(sectionData, rva - sectionData!.RVA)); + } + else + { + Values[i] = new PEExportFunctionEntry(new PEFunctionAddressLink(section, rva - section.RVA)); + } } } } diff --git a/src/LibObjectFile/PE/DataDirectory/PEExportDirectory.cs b/src/LibObjectFile/PE/DataDirectory/PEExportDirectory.cs index 60597d2..22d4579 100644 --- a/src/LibObjectFile/PE/DataDirectory/PEExportDirectory.cs +++ b/src/LibObjectFile/PE/DataDirectory/PEExportDirectory.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. diff --git a/src/LibObjectFile/PE/ImageDosHeader.cs b/src/LibObjectFile/PE/ImageDosHeader.cs index 42b0072..a8f297d 100644 --- a/src/LibObjectFile/PE/ImageDosHeader.cs +++ b/src/LibObjectFile/PE/ImageDosHeader.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -106,5 +106,5 @@ public unsafe struct ImageDosHeader /// /// File address of new exe header. (Original DOS field is `e_lfanew`) /// - public int FileAddressPEHeader; + public uint FileAddressPEHeader; } \ No newline at end of file diff --git a/src/LibObjectFile/PE/PEFile.Read.cs b/src/LibObjectFile/PE/PEFile.Read.cs index 288eb9f..b6f873c 100644 --- a/src/LibObjectFile/PE/PEFile.Read.cs +++ b/src/LibObjectFile/PE/PEFile.Read.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -93,6 +93,7 @@ public override void Read(PEImageReader reader) _dosStub = []; } + read = (int)reader.Position; // Read any DOS stub extra data (e.g Rich) if (DosHeader.FileAddressPEHeader > read) { @@ -100,7 +101,10 @@ public override void Read(PEImageReader reader) } // Read the PE signature - reader.Stream.Seek(DosHeader.FileAddressPEHeader, SeekOrigin.Begin); + if (reader.Position != DosHeader.FileAddressPEHeader) + { + reader.Position = DosHeader.FileAddressPEHeader; + } var signature = default(ImagePESignature); read = reader.Read(MemoryMarshal.AsBytes(MemoryMarshal.CreateSpan(ref signature, 1))); @@ -208,7 +212,7 @@ public override void Read(PEImageReader reader) } } - private void ReadSectionsAndDirectories(PEImageReader reader, ReadOnlySpan headers) + private void ReadSectionsAndDirectories(PEImageReader reader, ReadOnlySpan sectionHeaders) { _sections.Clear(); @@ -216,21 +220,23 @@ private void ReadSectionsAndDirectories(PEImageReader reader, ReadOnlySpan 0) + if (sectionHeaders.Length > 0) { - positionFirstSection = headers[0].PointerToRawData; + positionFirstSection = sectionHeaders[0].PointerToRawData; } uint positionAfterLastSection = positionFirstSection; // Create sections - foreach (var section in headers) + foreach (var section in sectionHeaders) { // We don't validate the name var peSection = new PESection( new PESectionName(section.NameAsString, false), section.RVA, section.VirtualSize) { Position = section.PointerToRawData, - Size = section.SizeOfRawData, + // Use the exact size of the section on disk if virtual size is smaller + // as these are considered as padding between sections + Size = section.VirtualSize < section.SizeOfRawData ? section.VirtualSize : section.SizeOfRawData, Characteristics = section.Characteristics, }; @@ -402,15 +408,16 @@ private void ReadSectionsAndDirectories(PEImageReader reader, ReadOnlySpan(); - listOrderedByPosition.AddRange(dataParts.UnsafeList); - listOrderedByPosition.Sort((a, b) => a.Position.CompareTo(b.Position)); + var listOrderedByPosition = dataParts.UnsafeList; + + listOrderedByPosition.Sort((a, b) => a.Position.CompareTo(b.Position)); + for (var i = 0; i < listOrderedByPosition.Count; i++) + { + var data = listOrderedByPosition[i]; + data.Index = i; + } for (var i = 0; i < listOrderedByPosition.Count; i++) { var data = listOrderedByPosition[i]; @@ -480,10 +492,12 @@ private static void FillSectionDataWithMissingStreams(PEImageReader imageReader, var sectionData = new PEStreamSectionData(imageReader.ReadAsStream(size)) { Position = currentPosition, + Parent = container, }; - dataParts.Insert(data.Index, sectionData); + listOrderedByPosition.Insert(i, sectionData); currentPosition = data.Position; + i++; } else if (currentPosition > data.Position) { @@ -501,27 +515,36 @@ private static void FillSectionDataWithMissingStreams(PEImageReader imageReader, var sectionData = new PEStreamSectionData(imageReader.ReadAsStream(size)) { Position = currentPosition, + Parent = container, }; - dataParts.Add(sectionData); + listOrderedByPosition.Add(sectionData); } else if (currentPosition > startPosition + totalSize) { imageReader.Diagnostics.Error(DiagnosticId.PE_ERR_InvalidInternalState, $"Invalid section data position {currentPosition} > {startPosition + totalSize} in {container}"); } + + // Make sure to update the indices after inserting the missing streams + for (var i = 0; i < listOrderedByPosition.Count; i++) + { + var data = listOrderedByPosition[i]; + data.Index = i; + } } - private static void FillExtraDataWithMissingStreams(PEImageReader imageReader, ObjectList list, ulong extraPosition, ulong extraTotalSize) + private static void FillExtraDataWithMissingStreams(PEImageReader imageReader, PEObjectBase parent, ObjectList list, ulong extraPosition, ulong extraTotalSize) { var currentPosition = extraPosition; imageReader.Position = extraPosition; // We are working on position, while the list is ordered by VirtualAddress - list.UnsafeList.Sort((a, b) => a.Position.CompareTo(b.Position)); + var listOrderedByPosition = list.UnsafeList; + listOrderedByPosition.Sort((a, b) => a.Position.CompareTo(b.Position)); - for (var i = 0; i < list.Count; i++) + for (var i = 0; i < listOrderedByPosition.Count; i++) { - var data = list[i]; + var data = listOrderedByPosition[i]; if (currentPosition < data.Position) { var size = data.Position - currentPosition; @@ -530,11 +553,12 @@ private static void FillExtraDataWithMissingStreams(PEImageReader imageReader, O var sectionData = new PEStreamExtraData(imageReader.ReadAsStream(size)) { Position = currentPosition, - Size = size, + Parent = parent, }; - list.Insert(data.Index, sectionData); + listOrderedByPosition.Insert(i, sectionData); currentPosition = data.Position; + i++; } else if (currentPosition > data.Position) { @@ -552,17 +576,24 @@ private static void FillExtraDataWithMissingStreams(PEImageReader imageReader, O var sectionData = new PEStreamExtraData(imageReader.ReadAsStream(size)) { Position = currentPosition, - Size = size, + Parent = parent, }; - list.Add(sectionData); + listOrderedByPosition.Add(sectionData); } else if (currentPosition > extraPosition + extraTotalSize) { imageReader.Diagnostics.Error(DiagnosticId.PE_ERR_InvalidInternalState, $"Invalid extra data position {currentPosition} > {extraPosition + extraTotalSize}"); } + + // Make sure to update the indices after inserting the missing streams + for (var i = 0; i < listOrderedByPosition.Count; i++) + { + var data = listOrderedByPosition[i]; + data.Index = i; + } } - + private static void FillDirectoryWithStreams(PEImageReader imageReader, PEDataDirectory directory) { FillSectionDataWithMissingStreams(imageReader, directory, directory.Content, directory.Position + directory.HeaderSize, directory.Size - directory.HeaderSize); diff --git a/src/LibObjectFile/PE/PEFile.cs b/src/LibObjectFile/PE/PEFile.cs index 94bb9e3..9b8f247 100644 --- a/src/LibObjectFile/PE/PEFile.cs +++ b/src/LibObjectFile/PE/PEFile.cs @@ -6,11 +6,15 @@ using System.Collections.Generic; using System.Diagnostics.CodeAnalysis; using System.IO; +using System.Numerics; using System.Reflection.PortableExecutable; using System.Runtime.CompilerServices; using System.Runtime.InteropServices; using System.Text; using LibObjectFile.Collections; +using LibObjectFile.Diagnostics; +using LibObjectFile.PE.Internal; +using LibObjectFile.Utils; namespace LibObjectFile.PE; @@ -250,8 +254,141 @@ public bool TryFindByVA(VA64 va, [NotNullWhen(true)] out PEObject? result, out R return false; } - public override void UpdateLayout(PELayoutContext layoutContext) + /// + /// Updates the layout of this PE file. + /// + /// The diagnostics to output errors. + public void UpdateLayout(DiagnosticBag diagnostics) { + var context = new PELayoutContext(this, diagnostics); + UpdateLayout(context); + } + + /// + public override unsafe void UpdateLayout(PELayoutContext context) + { + var position = 0U; + + // Update DOS header + position += (uint)sizeof(ImageDosHeader); + position += (uint)_dosStub.Length; + position += (uint)(_dosStubExtra?.Length ?? 0U); + + // Update optional header + position = AlignHelper.AlignUp(position, 8); // PE header is aligned on 8 bytes + + // Update offset to PE header + DosHeader.FileAddressPEHeader = position; + + position += sizeof(ImagePESignature); // PE00 header + + // COFF header + position += (uint)sizeof(ImageCoffHeader); + + // TODO: update other DosHeader fields + + position += (uint)(IsPE32 ? sizeof(RawImageOptionalHeader32) : sizeof(RawImageOptionalHeader64)); + + // Update directories + position += (uint)(Directories.CalculateNumberOfEntries() * sizeof(ImageDataDirectory)); + + // TODO: Additional optional header size? + + // Data before sections + foreach (var extraData in ExtraDataBeforeSections) + { + extraData.Position = position; + extraData.UpdateLayout(context); + var dataSize = (uint)extraData.Size; + position += dataSize; + } + + if (_sections.Count > 96) + { + context.Diagnostics.Error(DiagnosticId.PE_ERR_TooManySections, $"Too many sections {_sections.Count} (max 96)"); + } + + + // Update COFF header + CoffHeader.NumberOfSections = (ushort)_sections.Count; + CoffHeader.PointerToSymbolTable = 0; + CoffHeader.NumberOfSymbols = 0; + + OptionalHeader.SizeOfCode = 0; + OptionalHeader.SizeOfInitializedData = 0; + OptionalHeader.SizeOfUninitializedData = 0; + + if (!BitOperations.IsPow2(OptionalHeader.FileAlignment) || OptionalHeader.FileAlignment == 0) + { + context.Diagnostics.Error(DiagnosticId.PE_ERR_FileAlignmentNotPowerOfTwo, $"File alignment {OptionalHeader.FileAlignment} is not a power of two"); + return; + } + + if (!BitOperations.IsPow2(OptionalHeader.SectionAlignment) || OptionalHeader.SectionAlignment == 0) + { + context.Diagnostics.Error(DiagnosticId.PE_ERR_SectionAlignmentNotPowerOfTwo, $"Section alignment {OptionalHeader.SectionAlignment} is not a power of two"); + return; + } + + // Ensure that SectionAlignment is greater or equal to FileAlignment + if (OptionalHeader.SectionAlignment < OptionalHeader.FileAlignment) + { + context.Diagnostics.Error(DiagnosticId.PE_ERR_SectionAlignmentLessThanFileAlignment, $"Section alignment {OptionalHeader.SectionAlignment} is less than file alignment {OptionalHeader.FileAlignment}"); + return; + + } + + // Ensure that SectionAlignment is a multiple of FileAlignment + position = AlignHelper.AlignUp(position, OptionalHeader.FileAlignment); + OptionalHeader.SizeOfHeaders = position; + + // Update sections + RVA previousEndOfRVA = 0U; + foreach (var section in _sections) + { + section.Position = position; + section.UpdateLayout(context); + if (section.RVA < previousEndOfRVA) + { + context.Diagnostics.Error(DiagnosticId.PE_ERR_SectionRVALessThanPrevious, $"Section {section.Name} RVA {section.RVA} is less than the previous section end RVA {previousEndOfRVA}"); + } + + var sectionSize = (uint)section.Size; + position += sectionSize; + + var virtualSizeDiskAligned = AlignHelper.AlignUp(section.VirtualSize, OptionalHeader.FileAlignment); + + if ((section.Characteristics & SectionCharacteristics.ContainsCode) != 0) + { + OptionalHeader.SizeOfCode += virtualSizeDiskAligned; + } + else if ((section.Characteristics & SectionCharacteristics.ContainsInitializedData) != 0) + { + OptionalHeader.SizeOfInitializedData += virtualSizeDiskAligned; + } + else if ((section.Characteristics & SectionCharacteristics.ContainsUninitializedData) != 0) + { + OptionalHeader.SizeOfUninitializedData += virtualSizeDiskAligned; + } + + // Update the end of the RVA + previousEndOfRVA = section.RVA + AlignHelper.AlignUp(section.VirtualSize, OptionalHeader.SectionAlignment); + } + + // Update the (virtual) size of the image + OptionalHeader.SizeOfImage = previousEndOfRVA; + + // Data after sections + foreach (var extraData in ExtraDataAfterSections) + { + extraData.Position = position; + extraData.UpdateLayout(context); + var dataSize = (uint)extraData.Size; + position += dataSize; + } + + // Update the size of the file + Size = position; } protected override bool PrintMembers(StringBuilder builder) diff --git a/src/LibObjectFile/PE/PEPrinter.cs b/src/LibObjectFile/PE/PEPrinter.cs index 5b38b00..0436d5c 100644 --- a/src/LibObjectFile/PE/PEPrinter.cs +++ b/src/LibObjectFile/PE/PEPrinter.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -172,7 +172,7 @@ private static void PrintSections(PEFile file, ref TextWriterIndenter writer) private static void PrintSectionData(PEFile file, PESectionData data, ref TextWriterIndenter writer) { - writer.WriteLine($"Section Data [{data.Index:00}] {PEDescribe(data)}"); + writer.WriteLine($"[{data.Index:00}] {PEDescribe(data)}"); writer.Indent(); switch (data) { @@ -259,13 +259,11 @@ private static void PrintSectionData(PEFile file, PESectionData data, ref TextWr break; } - if (data is PEDataDirectory directory) + if (data is PEDataDirectory directory && directory.Content.Count > 0) { foreach (var content in directory.Content) { - writer.Indent(); PrintSectionData(file, content, ref writer); - writer.Unindent(); } } @@ -293,20 +291,26 @@ private static void Print(PEBaseRelocationDirectory data, ref TextWriterIndenter writer.WriteLine($"Block {pageRVA} Relocations[{block.Relocations.Count}]"); writer.Indent(); - foreach (var reloc in block.Relocations) + for (var i = 0; i < block.Relocations.Count; i++) { + var reloc = block.Relocations[i]; var relocRVA = reloc.RVA(); var offsetInPage = relocRVA - pageRVA; if (reloc.Type == PEBaseRelocationType.Dir64) { - writer.WriteLine($"{reloc.Type,6} Offset = 0x{offsetInPage:X4}, RVA = {relocRVA} (0x{reloc.ReadAddress(peFile):X16}), SectionData = {{ {PELink(reloc.Container)} }}"); + writer.WriteLine($"[{i:000}] {reloc.Type} Offset = 0x{offsetInPage:X4}, RVA = {relocRVA} (0x{reloc.ReadAddress(peFile):X16}), SectionData = {{ {PELink(reloc.Container)} }}"); + } + else if (reloc.Type == PEBaseRelocationType.Absolute) + { + writer.WriteLine($"[{i:000}] {reloc.Type} Zero padding"); } else { - writer.WriteLine($"{reloc.Type,6} Offset = 0x{offsetInPage:X4}, RVA = {relocRVA}, SectionData = {{ {PELink(reloc.Container)} }}"); + writer.WriteLine($"[{i:000}] {reloc.Type} Offset = 0x{offsetInPage:X4}, RVA = {relocRVA}, SectionData = {{ {PELink(reloc.Container)} }}"); } } + writer.Unindent(); } } @@ -533,7 +537,9 @@ private static void Print(PELoadConfigDirectory64 data, ref TextWriterIndenter w private static void Print(PEResourceDirectory data, ref TextWriterIndenter writer) { + writer.Indent(); Print(data.Root, ref writer); + writer.Unindent(); } private static void Print(PEResourceEntry data, ref TextWriterIndenter writer) @@ -548,10 +554,9 @@ private static void Print(PEResourceEntry data, ref TextWriterIndenter writer) writer.Indent(); foreach (var entry in dir.Entries) { - writer.Indent(); Print(entry, ref writer); - writer.Unindent(); } + writer.Unindent(); break; default: throw new ArgumentOutOfRangeException(nameof(data)); @@ -687,7 +692,7 @@ private static string PELink(PEObjectBase? peObjectBase) { if (peObjectBase is PEObject peObject) { - return $"RVA = 0x{peObject.RVA.Value:X8} ({peObject.GetType().Name}[{peObject.Index}]{PEParent((PEObjectBase?)peObject.Parent)}"; + return $"RVA = 0x{peObject.RVA.Value:X8} ({peObject.GetType().Name}[{peObject.Index}]{PEParent((PEObjectBase?)peObject.Parent)})"; } else if (peObjectBase is not null) { @@ -702,7 +707,16 @@ static string PEParent(PEObjectBase? obj) { if (obj is PESection section) { - return $" {section.Name}"; + return $" -> {section.Name}"; + } + else if (obj is PESectionData sectionData) + { + return $" -> {sectionData.GetType().Name}[{sectionData.Index}]{PEParent((PEObjectBase?)sectionData.Parent)}"; + } + + if (obj is not null) + { + return $" -> {obj.GetType().Name}"; } return ""; diff --git a/src/LibObjectFile/PE/PESection.cs b/src/LibObjectFile/PE/PESection.cs index ffc483d..1be9ee5 100644 --- a/src/LibObjectFile/PE/PESection.cs +++ b/src/LibObjectFile/PE/PESection.cs @@ -1,4 +1,4 @@ -// Copyright (c) Alexandre Mutel. All rights reserved. +// Copyright (c) Alexandre Mutel. All rights reserved. // This file is licensed under the BSD-Clause 2 license. // See the license.txt file in the project root for more information. @@ -10,6 +10,8 @@ using System.Runtime.InteropServices; using System.Text; using LibObjectFile.Collections; +using LibObjectFile.Diagnostics; +using LibObjectFile.Utils; namespace LibObjectFile.PE; @@ -69,20 +71,39 @@ public bool TryFindSectionData(RVA virtualAddress, [NotNullWhen(true)] out PESec /// public override void UpdateLayout(PELayoutContext context) { + var peFile = context.File; + + var sectionAlignment = peFile.OptionalHeader.SectionAlignment; + var fileAlignment = peFile.OptionalHeader.FileAlignment; + var va = RVA; var position = Position; + var size = 0U; foreach (var data in Content) { data.RVA = va; + if (!context.UpdateSizeOnly) { data.Position = position; } data.UpdateLayout(context); - va += (uint)data.Size; - position += data.Size; + + var dataSize = (uint)data.Size; + va += dataSize; + position += dataSize; + size += dataSize; } + + // The size of a section is the size of the content aligned on the file alignment + Size = (Characteristics & SectionCharacteristics.ContainsUninitializedData) == 0 ? AlignHelper.AlignUp(size, fileAlignment) : (ulong)0; + + //if (Size > VirtualSize) + //{ + // // Log diagnostics error + // context.Diagnostics.Error(DiagnosticId.PE_ERR_SectionSizeLargerThanVirtualSize, $"Section {Name} size {Size} is greater than the virtual size {VirtualSize}"); + //} } public override void Read(PEImageReader reader)