CODEWITHSUNDEEP
portable-executabledumpbin
grv grv
grv grv

Reputation: 1

Dumpbin file offsets for system binaries

So for system32 binaries, dumpbin will report:

...
        6178 entry point (0000000140006178)
...
SECTION HEADER #1
   .text name
    63E6 virtual size
    1000 virtual address (0000000140001000 to 00000001400073E5)
    6400 size of raw data
     400 file pointer to raw data (00000400 to 000067FF)

But the entry point at RVA 6178 maps to file offset 6178-1000+400 = 5578h (21,880), but the file opened in a hex editor only goes up to 4A00h (18,944).

Also, the file size is reported as 38,400 bytes by the shell.

So it seems that the .text section is encrypted or some other magic for system binaries. Anyone know what's going on?

Upvotes: 0

Views: 599

Answers (1)

mox
mox

Reputation: 6324

As far as I can see, the Entry point is not pointing to the .text section. This is not unusual for encrypted binaries. Using CFF Explorer or other tools like PeStudio, PE Explorer, etc, you might take a look at the mapping of the Entry Point and the pointed Section.

Upvotes: 0

Related Questions