teimaninja
February 16th, 2010, 06:48
just joined the forum...
i want to know the inner details of PE file (hands on way), for example a file that can be found in every win OS ntdll.dll (in the system32 directory).
how can i find those (specific in ntdll.dll and i guess it would be correct for every PE file) details:
Number of sections and name of each section.
"Magic number" (in hex and in ASCII).
Address of entry point.
Size of code.
Size of initialized data.
Size of the optional header.
Size of relocation table.
Base of code.
Base of data.
Number of exported "symbols" (in decimal).
Name and entry point of export symbol with ordinal 27.
i want to know the inner details of PE file (hands on way), for example a file that can be found in every win OS ntdll.dll (in the system32 directory).
how can i find those (specific in ntdll.dll and i guess it would be correct for every PE file) details:
Number of sections and name of each section.
"Magic number" (in hex and in ASCII).
Address of entry point.
Size of code.
Size of initialized data.
Size of the optional header.
Size of relocation table.
Base of code.
Base of data.
Number of exported "symbols" (in decimal).
Name and entry point of export symbol with ordinal 27.