|
- What are some nice command line ways to inspect DLL EXE details?
The Microsoft COFF Binary File Dumper (DUMPBIN EXE) Displays information about Common Object File Format (COFF) binary files You can use DUMPBIN to examine COFF object files, standard libraries of COFF objects, executable files, and dynamic-link libraries (DLLs)
- Understanding disassembly information from Visual Studios dumpbin and . . .
dumpbin is using what is known as Intel (dis)assembly syntax By default, objdump, being a GNU utility is using what is known as AT T (dis)assembly syntax If you want objdump to display output in Intel syntax, add -Mintel to your objdump command line –
- How to check if a binary is 32- or 64-bit on Windows?
Dumpbin exe method can solve the purpose probably Another alternative would be to use cygwin's file command However, I have not tested it on windows It works well on Linuxes Usage: file program_under_test exe EDIT: Just tested file exe on window works fine
- Dumpbin: Correlating thunk jumps in . reloc to disassembly
So i ran dumpbin RAWDATA:4 myDll dll and checked the dumpbin raw data dump and I think I understand So each contiguous series of bytes not separated by 0's (e g 2082, 2090, 20A2, 2074) represents imports from another DLL, and I would have to note the order of contiguous bytes to tell which specific DLL and import its' referring to?
- disassembly - Dumpbin show function names - Reverse Engineering Stack . . .
By default, DUMPBIN attempts to load PDB files for its target executables DUMPBIN uses this information to match addresses to symbol names If your source exe was compiled with MSVC, simply put pdb file in the same directory and use: dumpbin DISASM source exe The output will have symbol names applied - example disassembly fragment:
- windows - Batch disassembling DLL and EXE files? - Reverse Engineering . . .
The second applies dumpbin, which comes packaged with Visual Studio, on each found file name You can redirect the output into a file, or you can modify the above sequence to write the output of each disassembled file into a different output file You can also replace dumpbin with your favourite disassembler
- How to find the correct GUID in DLL to match its Pdb
From this question: Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software? and the answer from @chentiangemalc: You can also look for
- Calculate Function Call To Imported Function In Dumpbin Output
Dumpbin raw shows the following at the address 404270h 00404270: 76 4D 00 00 6C 4D 00 00 60 4D 00 00 52 4D 00 00 vM lM `M RM 0x4D76 corresponds to wcslen in CFF Explorer -> Import Directory -> MSVCRT dll -> wcslen OFTs and FTs (IAT) columns with a hint of "2E6"
|
|
|