pe-image.expected (1701B)
1 pe-image.exe: file format coff64-x86_64 2 3 architecture: x86_64, flags 0x00000102: 4 EXEC_P, D_PAGED 5 start address 0x0000000140001000 6 format: coff64, sections: 6, symbols: 0 7 8 subsystem: 3 (WINDOWS_CUI) 9 10 Sections: 11 Idx Name Size Align Flags 12 0 .text 00000008 2**0 CONTENTS,ALLOC,LOAD,READONLY,CODE 13 Characteristics: 0x60000020 14 1 .rdata 00000010 2**0 CONTENTS,ALLOC,LOAD,READONLY 15 Characteristics: 0x40000040 16 2 .idata 00000065 2**0 CONTENTS,ALLOC,LOAD,READONLY 17 Characteristics: 0x40000040 18 3 .data 00000008 2**0 CONTENTS,ALLOC,LOAD,DATA 19 Characteristics: 0xc0000040 20 4 .reloc 0000000c 2**0 CONTENTS,ALLOC,LOAD,READONLY,DISCARDABLE 21 Characteristics: 0x42000040 22 23 DYNAMIC SYMBOL TABLE: 24 0000000000000000 g n *UND* 0000000000000000 ExitProcess 25 26 27 pe-image.exe: PE32+ private headers 28 Magic: 0x20b (PE32+) 29 Machine: x86_64 30 ImageBase: 0x140000000 31 AddressOfEntryPoint: 0x1000 32 Subsystem: 3 (WINDOWS_CUI) 33 DllCharacteristics: 0x8160 34 35 Data Directories: 36 Idx Name RVA Size 37 1 IMPORT 0x00003000 0x00000028 38 5 BASERELOC 0x00005000 0x0000000c 39 12 IAT 0x00003038 0x00000010 40 41 The Import Tables: 42 DLL Name: KERNEL32.dll 43 Name: ExitProcess 44 45 DYNAMIC RELOCATION RECORDS 46 OFFSET TYPE VALUE 47 0000000140004000 X64_RELATIVE *ABS* 48