Created
September 8, 2022 12:45
-
-
Save pietroppeter/91e48ab5bb477cecd4201a6486451aac to your computer and use it in GitHub Desktop.
dll analysis in nim
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# compile with: nim c --app:lib -d:release add.nim | |
# examine with: peni info -a add.dll | |
# see https://forum.nim-lang.org/t/9446 | |
proc add*(num1, num2: int): int {.stdcall, exportc, dynlib.} = | |
num1 + num2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
add.dll: | |
File Name add.dll | |
File Size 147302 bytes | |
Compile Time 2022-09-08T12:35:44Z | |
Is DLL? true | |
Header PE32+ (x64) | |
Entrypoint 0x1290 | |
Sections .text .data .rdata /4 .pdata .xdata .bss .edata .idata .CRT .tls | |
.reloc /14 /29 /41 /55 /67 | |
Directories IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT | |
IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_BASERELOC | |
IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_IAT | |
File Entropy 5.877294780783449 | |
MD5 e1675a3ca66afbc80ccb0b8d6e498b55 | |
SHA1 065c359fdc20d33216621e2d9eca79a5f930e80e | |
SHA256 8b0dc4fe743b7f15fd92718eb0b5e4fbaaf695ba797376c507b04c23816fc449 | |
SSDEEP 3072:uTtYoKNDrR9SjdYd2DfCCRT3EvaJJJ655ZZoF+G7g:uhYoYB9SxT3EvaJJJ | |
655ZZoAG7g | |
Imphash Not implemented | |
Signature - | |
Dos Header | |
Magic Number 0x5a4d | |
Bytes in last page 144 | |
Pages in file 3 | |
Relocations 0 | |
Size of header in paragraphs 4 | |
Minimum extra paragraphs 0 | |
Maximum extra paragraphs 65535 | |
Initial (relative) SS value 0x0 | |
Initial SP value 0xb8 | |
Initial IP value 0x0 | |
Initial (relative) CS value 0x0 | |
Address of relocation table 0x40 | |
Overlay number 0x0 | |
OEM identifier 0x0 | |
OEM information 0x0 | |
PE header offset 0x80 | |
COFF/File header | |
Machine 0x8664 | |
Number of sections 17 | |
Date/time stamp 2022-09-08T12:35:44Z | |
Symbol Table offset 0x1aa00 | |
Number of symbols 1532 | |
Size of optional header 0xf0 | |
Characteristics 0x2026 | |
Characteristics names TODO | |
Optional/Image header | |
Magic number 0x20b | |
Linker major version 2 | |
Linker minor version 36 | |
Size of .text section 0x14a00 | |
Size of .data section 0x18c00 | |
Size of .bss section 0x11c00 | |
Entrypoint 0x1290 | |
Address of .text section 0x1000 | |
ImageBase 0x298b30000 | |
Alignment of sections 0x1000 | |
Alignment factor 0x200 | |
Major version of required OS 4 | |
Minor version of required OS 0 | |
Major version of image 0 | |
Minor version of image 0 | |
Major version of subsystem 5 | |
Minor version of subsystem 2 | |
Size of image 0x38000 | |
Size of headers 0x600 | |
Checksum 0x33d11 | |
Subsystem required 0x33d11 | |
Checksum 0x33d11 | |
DLL characteristics 0x160 | |
DLL characteristics names TODO | |
Size of stack to reserve 0x200000 | |
Size of stack to commit 0x1000 | |
Size of heap space to reserve 0x100000 | |
Size of heap space to commit 0x1000 | |
Sections | |
Section Name .text | |
Virtual Size 0x14888 | |
Size Of Raw Data 0x14a00 | |
Pointer To Raw Data 0x600 | |
Number Of Relocations 0 | |
Characteristics 0x60500060 | |
Characteristics Names contains executable code, contains initialized data, is | |
executable, is readable, | |
Sections | |
Section Name .data | |
Virtual Size 0x110 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x15000 | |
Number Of Relocations 0 | |
Characteristics 0xc0600040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .rdata | |
Virtual Size 0x15d0 | |
Size Of Raw Data 0x1600 | |
Pointer To Raw Data 0x15200 | |
Number Of Relocations 0 | |
Characteristics 0x40600040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name /4 | |
Virtual Size 0x4 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x16800 | |
Number Of Relocations 0 | |
Characteristics 0xc0300040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .pdata | |
Virtual Size 0xbac | |
Size Of Raw Data 0xc00 | |
Pointer To Raw Data 0x16a00 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .xdata | |
Virtual Size 0xbd0 | |
Size Of Raw Data 0xc00 | |
Pointer To Raw Data 0x17600 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .bss | |
Virtual Size 0x11b00 | |
Size Of Raw Data 0x0 | |
Pointer To Raw Data 0x0 | |
Number Of Relocations 0 | |
Characteristics 0xc0600080 | |
Characteristics Names contains uninitialized data, is readable, is writable, | |
Sections | |
Section Name .edata | |
Virtual Size 0x50 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18200 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .idata | |
Virtual Size 0x6d4 | |
Size Of Raw Data 0x800 | |
Pointer To Raw Data 0x18400 | |
Number Of Relocations 0 | |
Characteristics 0xc0300040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .CRT | |
Virtual Size 0x58 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18c00 | |
Number Of Relocations 0 | |
Characteristics 0xc0400040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .tls | |
Virtual Size 0x10 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18e00 | |
Number Of Relocations 0 | |
Characteristics 0xc0400040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .reloc | |
Virtual Size 0x68 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x19000 | |
Number Of Relocations 0 | |
Characteristics 0x42300040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /14 | |
Virtual Size 0x50 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x19200 | |
Number Of Relocations 0 | |
Characteristics 0x42500040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /29 | |
Virtual Size 0xe16 | |
Size Of Raw Data 0x1000 | |
Pointer To Raw Data 0x19400 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /41 | |
Virtual Size 0xaf | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a400 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /55 | |
Virtual Size 0xdd | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a600 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /67 | |
Virtual Size 0x77 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a800 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Directories | |
Directory Name Virtual Address Size | |
Export Table 0x2e000 80 | |
Import Table 0x2f000 1748 | |
Exception Table 0x1a000 2988 | |
Base Relocation Table 0x32000 104 | |
Thread Local Storage (TLS) 0x17660 40 | |
Import Address Table (IAT) 0x2f1cc 400 | |
Imported Functions | |
Library Function Hint | |
KERNEL32.dll DeleteCriticalSection 283 | |
KERNEL32.dll EnterCriticalSection 319 | |
KERNEL32.dll FreeLibrary 443 | |
KERNEL32.dll GetLastError 630 | |
KERNEL32.dll GetModuleHandleA 651 | |
KERNEL32.dll GetProcAddress 710 | |
KERNEL32.dll InitializeCriticalSection 892 | |
KERNEL32.dll IsDBCSLeadByteEx 919 | |
KERNEL32.dll LeaveCriticalSection 984 | |
KERNEL32.dll LoadLibraryA 988 | |
KERNEL32.dll MultiByteToWideChar 1036 | |
KERNEL32.dll Sleep 1410 | |
KERNEL32.dll TlsGetValue 1445 | |
KERNEL32.dll VirtualAlloc 1486 | |
KERNEL32.dll VirtualFree 1489 | |
KERNEL32.dll VirtualProtect 1492 | |
KERNEL32.dll VirtualQuery 1494 | |
KERNEL32.dll WideCharToMultiByte 1547 | |
msvcrt.dll ___lc_codepage_func 64 | |
msvcrt.dll ___mb_cur_max_func 67 | |
msvcrt.dll __iob_func 84 | |
msvcrt.dll _amsg_exit 124 | |
msvcrt.dll _errno 203 | |
msvcrt.dll _fileno 232 | |
msvcrt.dll _initterm 331 | |
msvcrt.dll _lock 443 | |
msvcrt.dll _setjmp 670 | |
msvcrt.dll _setmode 674 | |
msvcrt.dll _unlock 819 | |
msvcrt.dll abort 1038 | |
msvcrt.dll calloc 1055 | |
msvcrt.dll exit 1068 | |
msvcrt.dll fflush 1075 | |
msvcrt.dll fputc 1090 | |
msvcrt.dll free 1095 | |
msvcrt.dll fwrite 1109 | |
msvcrt.dll localeconv 1149 | |
msvcrt.dll longjmp 1155 | |
msvcrt.dll malloc 1156 | |
msvcrt.dll memcpy 1164 | |
msvcrt.dll realloc 1185 | |
msvcrt.dll signal 1196 | |
msvcrt.dll strerror 1217 | |
msvcrt.dll strlen 1219 | |
msvcrt.dll strncmp 1222 | |
msvcrt.dll vfprintf 1258 | |
msvcrt.dll wcslen 1283 | |
Exported Functions | |
Library Function Fwd Name Address Ordinal | |
add.dll NimMain 0xe2b0 1 | |
add.dll add 0xe240 2 | |
PS C:\Users\ppeterlongo\Documents\nimaglie> peni info -a add.dll > peni.out | |
PS C:\Users\ppeterlongo\Documents\nimaglie> peni info -a add.dll | |
add.dll: | |
File Name add.dll | |
File Size 147302 bytes | |
Compile Time 2022-09-08T12:35:44Z | |
Is DLL? true | |
Header PE32+ (x64) | |
Entrypoint 0x1290 | |
Sections .text .data .rdata /4 .pdata .xdata .bss .edata .idata .CRT .tls | |
.reloc /14 /29 /41 /55 /67 | |
Directories IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT | |
IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_BASERELOC | |
IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_IAT | |
File Entropy 5.877294780783449 | |
MD5 e1675a3ca66afbc80ccb0b8d6e498b55 | |
SHA1 065c359fdc20d33216621e2d9eca79a5f930e80e | |
SHA256 8b0dc4fe743b7f15fd92718eb0b5e4fbaaf695ba797376c507b04c23816fc449 | |
SSDEEP 3072:uTtYoKNDrR9SjdYd2DfCCRT3EvaJJJ655ZZoF+G7g:uhYoYB9SxT3EvaJJJ | |
655ZZoAG7g | |
Imphash Not implemented | |
Signature - | |
Dos Header | |
Magic Number 0x5a4d | |
Bytes in last page 144 | |
Pages in file 3 | |
Relocations 0 | |
Size of header in paragraphs 4 | |
Minimum extra paragraphs 0 | |
Maximum extra paragraphs 65535 | |
Initial (relative) SS value 0x0 | |
Initial SP value 0xb8 | |
Initial IP value 0x0 | |
Initial (relative) CS value 0x0 | |
Address of relocation table 0x40 | |
Overlay number 0x0 | |
OEM identifier 0x0 | |
OEM information 0x0 | |
PE header offset 0x80 | |
COFF/File header | |
Machine 0x8664 | |
Number of sections 17 | |
Date/time stamp 2022-09-08T12:35:44Z | |
Symbol Table offset 0x1aa00 | |
Number of symbols 1532 | |
Size of optional header 0xf0 | |
Characteristics 0x2026 | |
Characteristics names TODO | |
Optional/Image header | |
Magic number 0x20b | |
Linker major version 2 | |
Linker minor version 36 | |
Size of .text section 0x14a00 | |
Size of .data section 0x18c00 | |
Size of .bss section 0x11c00 | |
Entrypoint 0x1290 | |
Address of .text section 0x1000 | |
ImageBase 0x298b30000 | |
Alignment of sections 0x1000 | |
Alignment factor 0x200 | |
Major version of required OS 4 | |
Minor version of required OS 0 | |
Major version of image 0 | |
Minor version of image 0 | |
Major version of subsystem 5 | |
Minor version of subsystem 2 | |
Size of image 0x38000 | |
Size of headers 0x600 | |
Checksum 0x33d11 | |
Subsystem required 0x33d11 | |
Checksum 0x33d11 | |
DLL characteristics 0x160 | |
DLL characteristics names TODO | |
Size of stack to reserve 0x200000 | |
Size of stack to commit 0x1000 | |
Size of heap space to reserve 0x100000 | |
Size of heap space to commit 0x1000 | |
Sections | |
Section Name .text | |
Virtual Size 0x14888 | |
Size Of Raw Data 0x14a00 | |
Pointer To Raw Data 0x600 | |
Number Of Relocations 0 | |
Characteristics 0x60500060 | |
Characteristics Names contains executable code, contains initialized data, is | |
executable, is readable, | |
Sections | |
Section Name .data | |
Virtual Size 0x110 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x15000 | |
Number Of Relocations 0 | |
Characteristics 0xc0600040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .rdata | |
Virtual Size 0x15d0 | |
Size Of Raw Data 0x1600 | |
Pointer To Raw Data 0x15200 | |
Number Of Relocations 0 | |
Characteristics 0x40600040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name /4 | |
Virtual Size 0x4 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x16800 | |
Number Of Relocations 0 | |
Characteristics 0xc0300040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .pdata | |
Virtual Size 0xbac | |
Size Of Raw Data 0xc00 | |
Pointer To Raw Data 0x16a00 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .xdata | |
Virtual Size 0xbd0 | |
Size Of Raw Data 0xc00 | |
Pointer To Raw Data 0x17600 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .bss | |
Virtual Size 0x11b00 | |
Size Of Raw Data 0x0 | |
Pointer To Raw Data 0x0 | |
Number Of Relocations 0 | |
Characteristics 0xc0600080 | |
Characteristics Names contains uninitialized data, is readable, is writable, | |
Sections | |
Section Name .edata | |
Virtual Size 0x50 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18200 | |
Number Of Relocations 0 | |
Characteristics 0x40300040 | |
Characteristics Names contains initialized data, is readable, | |
Sections | |
Section Name .idata | |
Virtual Size 0x6d4 | |
Size Of Raw Data 0x800 | |
Pointer To Raw Data 0x18400 | |
Number Of Relocations 0 | |
Characteristics 0xc0300040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .CRT | |
Virtual Size 0x58 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18c00 | |
Number Of Relocations 0 | |
Characteristics 0xc0400040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .tls | |
Virtual Size 0x10 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x18e00 | |
Number Of Relocations 0 | |
Characteristics 0xc0400040 | |
Characteristics Names contains initialized data, is readable, is writable, | |
Sections | |
Section Name .reloc | |
Virtual Size 0x68 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x19000 | |
Number Of Relocations 0 | |
Characteristics 0x42300040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /14 | |
Virtual Size 0x50 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x19200 | |
Number Of Relocations 0 | |
Characteristics 0x42500040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /29 | |
Virtual Size 0xe16 | |
Size Of Raw Data 0x1000 | |
Pointer To Raw Data 0x19400 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /41 | |
Virtual Size 0xaf | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a400 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /55 | |
Virtual Size 0xdd | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a600 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Sections | |
Section Name /67 | |
Virtual Size 0x77 | |
Size Of Raw Data 0x200 | |
Pointer To Raw Data 0x1a800 | |
Number Of Relocations 0 | |
Characteristics 0x42100040 | |
Characteristics Names contains initialized data, can be discarded as needed, | |
is readable, | |
Directories | |
Directory Name Virtual Address Size | |
Export Table 0x2e000 80 | |
Import Table 0x2f000 1748 | |
Exception Table 0x1a000 2988 | |
Base Relocation Table 0x32000 104 | |
Thread Local Storage (TLS) 0x17660 40 | |
Import Address Table (IAT) 0x2f1cc 400 | |
Imported Functions | |
Library Function Hint | |
KERNEL32.dll DeleteCriticalSection 283 | |
KERNEL32.dll EnterCriticalSection 319 | |
KERNEL32.dll FreeLibrary 443 | |
KERNEL32.dll GetLastError 630 | |
KERNEL32.dll GetModuleHandleA 651 | |
KERNEL32.dll GetProcAddress 710 | |
KERNEL32.dll InitializeCriticalSection 892 | |
KERNEL32.dll IsDBCSLeadByteEx 919 | |
KERNEL32.dll LeaveCriticalSection 984 | |
KERNEL32.dll LoadLibraryA 988 | |
KERNEL32.dll MultiByteToWideChar 1036 | |
KERNEL32.dll Sleep 1410 | |
KERNEL32.dll TlsGetValue 1445 | |
KERNEL32.dll VirtualAlloc 1486 | |
KERNEL32.dll VirtualFree 1489 | |
KERNEL32.dll VirtualProtect 1492 | |
KERNEL32.dll VirtualQuery 1494 | |
KERNEL32.dll WideCharToMultiByte 1547 | |
msvcrt.dll ___lc_codepage_func 64 | |
msvcrt.dll ___mb_cur_max_func 67 | |
msvcrt.dll __iob_func 84 | |
msvcrt.dll _amsg_exit 124 | |
msvcrt.dll _errno 203 | |
msvcrt.dll _fileno 232 | |
msvcrt.dll _initterm 331 | |
msvcrt.dll _lock 443 | |
msvcrt.dll _setjmp 670 | |
msvcrt.dll _setmode 674 | |
msvcrt.dll _unlock 819 | |
msvcrt.dll abort 1038 | |
msvcrt.dll calloc 1055 | |
msvcrt.dll exit 1068 | |
msvcrt.dll fflush 1075 | |
msvcrt.dll fputc 1090 | |
msvcrt.dll free 1095 | |
msvcrt.dll fwrite 1109 | |
msvcrt.dll localeconv 1149 | |
msvcrt.dll longjmp 1155 | |
msvcrt.dll malloc 1156 | |
msvcrt.dll memcpy 1164 | |
msvcrt.dll memset 1166 | |
msvcrt.dll realloc 1185 | |
msvcrt.dll signal 1196 | |
msvcrt.dll strerror 1217 | |
msvcrt.dll strlen 1219 | |
msvcrt.dll strncmp 1222 | |
msvcrt.dll vfprintf 1258 | |
msvcrt.dll wcslen 1283 | |
Exported Functions | |
Library Function Fwd Name Address Ordinal | |
add.dll NimMain 0xe2b0 1 | |
add.dll add 0xe240 2 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment