Skip to content

Instantly share code, notes, and snippets.

@pietroppeter
Created September 8, 2022 12:45
Show Gist options
  • Save pietroppeter/91e48ab5bb477cecd4201a6486451aac to your computer and use it in GitHub Desktop.
Save pietroppeter/91e48ab5bb477cecd4201a6486451aac to your computer and use it in GitHub Desktop.
dll analysis in nim
# compile with: nim c --app:lib -d:release add.nim
# examine with: peni info -a add.dll
# see https://forum.nim-lang.org/t/9446
proc add*(num1, num2: int): int {.stdcall, exportc, dynlib.} =
num1 + num2
add.dll:
File Name add.dll
File Size 147302 bytes
Compile Time 2022-09-08T12:35:44Z
Is DLL? true
Header PE32+ (x64)
Entrypoint 0x1290
Sections .text .data .rdata /4 .pdata .xdata .bss .edata .idata .CRT .tls
.reloc /14 /29 /41 /55 /67
Directories IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT
IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_BASERELOC
IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_IAT
File Entropy 5.877294780783449
MD5 e1675a3ca66afbc80ccb0b8d6e498b55
SHA1 065c359fdc20d33216621e2d9eca79a5f930e80e
SHA256 8b0dc4fe743b7f15fd92718eb0b5e4fbaaf695ba797376c507b04c23816fc449
SSDEEP 3072:uTtYoKNDrR9SjdYd2DfCCRT3EvaJJJ655ZZoF+G7g:uhYoYB9SxT3EvaJJJ
655ZZoAG7g
Imphash Not implemented
Signature -
Dos Header
Magic Number 0x5a4d
Bytes in last page 144
Pages in file 3
Relocations 0
Size of header in paragraphs 4
Minimum extra paragraphs 0
Maximum extra paragraphs 65535
Initial (relative) SS value 0x0
Initial SP value 0xb8
Initial IP value 0x0
Initial (relative) CS value 0x0
Address of relocation table 0x40
Overlay number 0x0
OEM identifier 0x0
OEM information 0x0
PE header offset 0x80
COFF/File header
Machine 0x8664
Number of sections 17
Date/time stamp 2022-09-08T12:35:44Z
Symbol Table offset 0x1aa00
Number of symbols 1532
Size of optional header 0xf0
Characteristics 0x2026
Characteristics names TODO
Optional/Image header
Magic number 0x20b
Linker major version 2
Linker minor version 36
Size of .text section 0x14a00
Size of .data section 0x18c00
Size of .bss section 0x11c00
Entrypoint 0x1290
Address of .text section 0x1000
ImageBase 0x298b30000
Alignment of sections 0x1000
Alignment factor 0x200
Major version of required OS 4
Minor version of required OS 0
Major version of image 0
Minor version of image 0
Major version of subsystem 5
Minor version of subsystem 2
Size of image 0x38000
Size of headers 0x600
Checksum 0x33d11
Subsystem required 0x33d11
Checksum 0x33d11
DLL characteristics 0x160
DLL characteristics names TODO
Size of stack to reserve 0x200000
Size of stack to commit 0x1000
Size of heap space to reserve 0x100000
Size of heap space to commit 0x1000
Sections
Section Name .text
Virtual Size 0x14888
Size Of Raw Data 0x14a00
Pointer To Raw Data 0x600
Number Of Relocations 0
Characteristics 0x60500060
Characteristics Names contains executable code, contains initialized data, is
executable, is readable,
Sections
Section Name .data
Virtual Size 0x110
Size Of Raw Data 0x200
Pointer To Raw Data 0x15000
Number Of Relocations 0
Characteristics 0xc0600040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .rdata
Virtual Size 0x15d0
Size Of Raw Data 0x1600
Pointer To Raw Data 0x15200
Number Of Relocations 0
Characteristics 0x40600040
Characteristics Names contains initialized data, is readable,
Sections
Section Name /4
Virtual Size 0x4
Size Of Raw Data 0x200
Pointer To Raw Data 0x16800
Number Of Relocations 0
Characteristics 0xc0300040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .pdata
Virtual Size 0xbac
Size Of Raw Data 0xc00
Pointer To Raw Data 0x16a00
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .xdata
Virtual Size 0xbd0
Size Of Raw Data 0xc00
Pointer To Raw Data 0x17600
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .bss
Virtual Size 0x11b00
Size Of Raw Data 0x0
Pointer To Raw Data 0x0
Number Of Relocations 0
Characteristics 0xc0600080
Characteristics Names contains uninitialized data, is readable, is writable,
Sections
Section Name .edata
Virtual Size 0x50
Size Of Raw Data 0x200
Pointer To Raw Data 0x18200
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .idata
Virtual Size 0x6d4
Size Of Raw Data 0x800
Pointer To Raw Data 0x18400
Number Of Relocations 0
Characteristics 0xc0300040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .CRT
Virtual Size 0x58
Size Of Raw Data 0x200
Pointer To Raw Data 0x18c00
Number Of Relocations 0
Characteristics 0xc0400040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .tls
Virtual Size 0x10
Size Of Raw Data 0x200
Pointer To Raw Data 0x18e00
Number Of Relocations 0
Characteristics 0xc0400040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .reloc
Virtual Size 0x68
Size Of Raw Data 0x200
Pointer To Raw Data 0x19000
Number Of Relocations 0
Characteristics 0x42300040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /14
Virtual Size 0x50
Size Of Raw Data 0x200
Pointer To Raw Data 0x19200
Number Of Relocations 0
Characteristics 0x42500040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /29
Virtual Size 0xe16
Size Of Raw Data 0x1000
Pointer To Raw Data 0x19400
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /41
Virtual Size 0xaf
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a400
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /55
Virtual Size 0xdd
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a600
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /67
Virtual Size 0x77
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a800
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Directories
Directory Name Virtual Address Size
Export Table 0x2e000 80
Import Table 0x2f000 1748
Exception Table 0x1a000 2988
Base Relocation Table 0x32000 104
Thread Local Storage (TLS) 0x17660 40
Import Address Table (IAT) 0x2f1cc 400
Imported Functions
Library Function Hint
KERNEL32.dll DeleteCriticalSection 283
KERNEL32.dll EnterCriticalSection 319
KERNEL32.dll FreeLibrary 443
KERNEL32.dll GetLastError 630
KERNEL32.dll GetModuleHandleA 651
KERNEL32.dll GetProcAddress 710
KERNEL32.dll InitializeCriticalSection 892
KERNEL32.dll IsDBCSLeadByteEx 919
KERNEL32.dll LeaveCriticalSection 984
KERNEL32.dll LoadLibraryA 988
KERNEL32.dll MultiByteToWideChar 1036
KERNEL32.dll Sleep 1410
KERNEL32.dll TlsGetValue 1445
KERNEL32.dll VirtualAlloc 1486
KERNEL32.dll VirtualFree 1489
KERNEL32.dll VirtualProtect 1492
KERNEL32.dll VirtualQuery 1494
KERNEL32.dll WideCharToMultiByte 1547
msvcrt.dll ___lc_codepage_func 64
msvcrt.dll ___mb_cur_max_func 67
msvcrt.dll __iob_func 84
msvcrt.dll _amsg_exit 124
msvcrt.dll _errno 203
msvcrt.dll _fileno 232
msvcrt.dll _initterm 331
msvcrt.dll _lock 443
msvcrt.dll _setjmp 670
msvcrt.dll _setmode 674
msvcrt.dll _unlock 819
msvcrt.dll abort 1038
msvcrt.dll calloc 1055
msvcrt.dll exit 1068
msvcrt.dll fflush 1075
msvcrt.dll fputc 1090
msvcrt.dll free 1095
msvcrt.dll fwrite 1109
msvcrt.dll localeconv 1149
msvcrt.dll longjmp 1155
msvcrt.dll malloc 1156
msvcrt.dll memcpy 1164
msvcrt.dll realloc 1185
msvcrt.dll signal 1196
msvcrt.dll strerror 1217
msvcrt.dll strlen 1219
msvcrt.dll strncmp 1222
msvcrt.dll vfprintf 1258
msvcrt.dll wcslen 1283
Exported Functions
Library Function Fwd Name Address Ordinal
add.dll NimMain 0xe2b0 1
add.dll add 0xe240 2
PS C:\Users\ppeterlongo\Documents\nimaglie> peni info -a add.dll > peni.out
PS C:\Users\ppeterlongo\Documents\nimaglie> peni info -a add.dll
add.dll:
File Name add.dll
File Size 147302 bytes
Compile Time 2022-09-08T12:35:44Z
Is DLL? true
Header PE32+ (x64)
Entrypoint 0x1290
Sections .text .data .rdata /4 .pdata .xdata .bss .edata .idata .CRT .tls
.reloc /14 /29 /41 /55 /67
Directories IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT
IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_BASERELOC
IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_IAT
File Entropy 5.877294780783449
MD5 e1675a3ca66afbc80ccb0b8d6e498b55
SHA1 065c359fdc20d33216621e2d9eca79a5f930e80e
SHA256 8b0dc4fe743b7f15fd92718eb0b5e4fbaaf695ba797376c507b04c23816fc449
SSDEEP 3072:uTtYoKNDrR9SjdYd2DfCCRT3EvaJJJ655ZZoF+G7g:uhYoYB9SxT3EvaJJJ
655ZZoAG7g
Imphash Not implemented
Signature -
Dos Header
Magic Number 0x5a4d
Bytes in last page 144
Pages in file 3
Relocations 0
Size of header in paragraphs 4
Minimum extra paragraphs 0
Maximum extra paragraphs 65535
Initial (relative) SS value 0x0
Initial SP value 0xb8
Initial IP value 0x0
Initial (relative) CS value 0x0
Address of relocation table 0x40
Overlay number 0x0
OEM identifier 0x0
OEM information 0x0
PE header offset 0x80
COFF/File header
Machine 0x8664
Number of sections 17
Date/time stamp 2022-09-08T12:35:44Z
Symbol Table offset 0x1aa00
Number of symbols 1532
Size of optional header 0xf0
Characteristics 0x2026
Characteristics names TODO
Optional/Image header
Magic number 0x20b
Linker major version 2
Linker minor version 36
Size of .text section 0x14a00
Size of .data section 0x18c00
Size of .bss section 0x11c00
Entrypoint 0x1290
Address of .text section 0x1000
ImageBase 0x298b30000
Alignment of sections 0x1000
Alignment factor 0x200
Major version of required OS 4
Minor version of required OS 0
Major version of image 0
Minor version of image 0
Major version of subsystem 5
Minor version of subsystem 2
Size of image 0x38000
Size of headers 0x600
Checksum 0x33d11
Subsystem required 0x33d11
Checksum 0x33d11
DLL characteristics 0x160
DLL characteristics names TODO
Size of stack to reserve 0x200000
Size of stack to commit 0x1000
Size of heap space to reserve 0x100000
Size of heap space to commit 0x1000
Sections
Section Name .text
Virtual Size 0x14888
Size Of Raw Data 0x14a00
Pointer To Raw Data 0x600
Number Of Relocations 0
Characteristics 0x60500060
Characteristics Names contains executable code, contains initialized data, is
executable, is readable,
Sections
Section Name .data
Virtual Size 0x110
Size Of Raw Data 0x200
Pointer To Raw Data 0x15000
Number Of Relocations 0
Characteristics 0xc0600040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .rdata
Virtual Size 0x15d0
Size Of Raw Data 0x1600
Pointer To Raw Data 0x15200
Number Of Relocations 0
Characteristics 0x40600040
Characteristics Names contains initialized data, is readable,
Sections
Section Name /4
Virtual Size 0x4
Size Of Raw Data 0x200
Pointer To Raw Data 0x16800
Number Of Relocations 0
Characteristics 0xc0300040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .pdata
Virtual Size 0xbac
Size Of Raw Data 0xc00
Pointer To Raw Data 0x16a00
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .xdata
Virtual Size 0xbd0
Size Of Raw Data 0xc00
Pointer To Raw Data 0x17600
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .bss
Virtual Size 0x11b00
Size Of Raw Data 0x0
Pointer To Raw Data 0x0
Number Of Relocations 0
Characteristics 0xc0600080
Characteristics Names contains uninitialized data, is readable, is writable,
Sections
Section Name .edata
Virtual Size 0x50
Size Of Raw Data 0x200
Pointer To Raw Data 0x18200
Number Of Relocations 0
Characteristics 0x40300040
Characteristics Names contains initialized data, is readable,
Sections
Section Name .idata
Virtual Size 0x6d4
Size Of Raw Data 0x800
Pointer To Raw Data 0x18400
Number Of Relocations 0
Characteristics 0xc0300040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .CRT
Virtual Size 0x58
Size Of Raw Data 0x200
Pointer To Raw Data 0x18c00
Number Of Relocations 0
Characteristics 0xc0400040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .tls
Virtual Size 0x10
Size Of Raw Data 0x200
Pointer To Raw Data 0x18e00
Number Of Relocations 0
Characteristics 0xc0400040
Characteristics Names contains initialized data, is readable, is writable,
Sections
Section Name .reloc
Virtual Size 0x68
Size Of Raw Data 0x200
Pointer To Raw Data 0x19000
Number Of Relocations 0
Characteristics 0x42300040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /14
Virtual Size 0x50
Size Of Raw Data 0x200
Pointer To Raw Data 0x19200
Number Of Relocations 0
Characteristics 0x42500040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /29
Virtual Size 0xe16
Size Of Raw Data 0x1000
Pointer To Raw Data 0x19400
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /41
Virtual Size 0xaf
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a400
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /55
Virtual Size 0xdd
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a600
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Sections
Section Name /67
Virtual Size 0x77
Size Of Raw Data 0x200
Pointer To Raw Data 0x1a800
Number Of Relocations 0
Characteristics 0x42100040
Characteristics Names contains initialized data, can be discarded as needed,
is readable,
Directories
Directory Name Virtual Address Size
Export Table 0x2e000 80
Import Table 0x2f000 1748
Exception Table 0x1a000 2988
Base Relocation Table 0x32000 104
Thread Local Storage (TLS) 0x17660 40
Import Address Table (IAT) 0x2f1cc 400
Imported Functions
Library Function Hint
KERNEL32.dll DeleteCriticalSection 283
KERNEL32.dll EnterCriticalSection 319
KERNEL32.dll FreeLibrary 443
KERNEL32.dll GetLastError 630
KERNEL32.dll GetModuleHandleA 651
KERNEL32.dll GetProcAddress 710
KERNEL32.dll InitializeCriticalSection 892
KERNEL32.dll IsDBCSLeadByteEx 919
KERNEL32.dll LeaveCriticalSection 984
KERNEL32.dll LoadLibraryA 988
KERNEL32.dll MultiByteToWideChar 1036
KERNEL32.dll Sleep 1410
KERNEL32.dll TlsGetValue 1445
KERNEL32.dll VirtualAlloc 1486
KERNEL32.dll VirtualFree 1489
KERNEL32.dll VirtualProtect 1492
KERNEL32.dll VirtualQuery 1494
KERNEL32.dll WideCharToMultiByte 1547
msvcrt.dll ___lc_codepage_func 64
msvcrt.dll ___mb_cur_max_func 67
msvcrt.dll __iob_func 84
msvcrt.dll _amsg_exit 124
msvcrt.dll _errno 203
msvcrt.dll _fileno 232
msvcrt.dll _initterm 331
msvcrt.dll _lock 443
msvcrt.dll _setjmp 670
msvcrt.dll _setmode 674
msvcrt.dll _unlock 819
msvcrt.dll abort 1038
msvcrt.dll calloc 1055
msvcrt.dll exit 1068
msvcrt.dll fflush 1075
msvcrt.dll fputc 1090
msvcrt.dll free 1095
msvcrt.dll fwrite 1109
msvcrt.dll localeconv 1149
msvcrt.dll longjmp 1155
msvcrt.dll malloc 1156
msvcrt.dll memcpy 1164
msvcrt.dll memset 1166
msvcrt.dll realloc 1185
msvcrt.dll signal 1196
msvcrt.dll strerror 1217
msvcrt.dll strlen 1219
msvcrt.dll strncmp 1222
msvcrt.dll vfprintf 1258
msvcrt.dll wcslen 1283
Exported Functions
Library Function Fwd Name Address Ordinal
add.dll NimMain 0xe2b0 1
add.dll add 0xe240 2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment