> For the complete documentation index, see [llms.txt](https://docs.hyperdbg.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hyperdbg.org/commands/meta-commands/.pe.md). # .pe (parse PE file) ### Command > .pe ### Syntax > .pe \[header] \[FilePath (string)] > > .pe \[section] \[SectionName (string)] \[FilePath (string)] ### Description Parses Portable Executable (PE) files and dump sections. ### Parameters **\[header]** The action for this command is showing headers. **\[section]** The action for this command is showing a special section. **\[SectionName (string)]** The name of the section to be dumped. **\[FilePath (string)]** The file path of the PE file. ### Examples If you want to see the headers of a PE located at `c:\reverse files\myfile.exe`. ```c HyperDbg> .pe header "C:\reverse files\myfile.exe" Valid Dos Exe File ------------------ Dumping DOS Header Info.... --------------------------- Magic number : MZ Bytes on last page of file : 0x90 Pages in file : 0x3 Relocation : 0 Size of header in paragraphs : 0x4 Minimum extra paragraphs needed : 0 Maximum extra paragraphs needed : 0xffff Initial (relative) SS value : 0 Initial SP value : 0xb8 Checksum : 0 Initial IP value : 0 Initial (relative) CS value : 0 File address of relocation table : 0x40 Overlay number : 0 OEM identifier : 0 OEM information(e_oemid specific) : 0 RVA address of PE header : 0x118 =============================================================================== =============================================================================== RICH HEADER =============================================================================== Entries: 15 Build ID Prod ID Use Count --------------------------------------- 0x00008179 0x00000105 189 0x00008179 0x00000103 10 0x00008987 0x000000FD 3 0x00008987 0x00000104 19 0x00008987 0x00000103 12 0x00008987 0x00000105 111 0x00008179 0x00000104 34 0x00008179 0x00000106 1 0x00008179 0x00000101 39 0x00000000 0x00000001 633 0x00008995 0x00000109 305 0x00008995 0x00000100 1 0x00008995 0x000000FF 1 0x00000000 0x00000097 26 0x00008995 0x00000102 1 ==============Rich Header End ================== Valid PE64 file ------------- Dumping COFF/PE Header Info.... -------------------------------- Signature : PE Machine Architecture : AMD x64 Characteristics : Executable Image, Application can address > 2GB, Time Stamp : Fri Mar 20 00:45:24 2026 No.sections(size) : 7 No.entries in symbol table : 0 Size of optional header : 240 Raw machine value : 0x8664 Pointer to symbol table : 0 Raw characteristics value : 0x22 Dumping PE Optional Header Info.... ----------------------------------- Info of optional Header ----------------------- Address of Entry Point : 0x3e03a0 Raw optional header magic : 0x20b Entrypoint file offset : 0x3df7a0 Base Address of the Image : 0x140000000 SubSystem type : Windows GUI Given file is a : PE32+(64) File Alignment : 0x200 Size of Image : 0x805000 Size of Headers : 0x400 Optional header checksum : 0x8032f2 Computed PE checksum : 0x8032f2 (matches) Raw DLL characteristics value : 0x8160 DLL characteristics flags : High Entropy VA, Dynamic Base, NX Compatible, Terminal Server Aware Size of code segment(.text) : 4405248 Base address of code segment(RVA) : 0x1000 Size of Initialized data : 3982336 Section Alignment : 0x1000 Major Linker Version : 14 Minor Linker Version : 44 Data directories ---------------- Number of RVA and sizes : 16 [ 0] Export Table RVA 0x53ec80, size 0x108, mapped file offset 0x53d880 [ 1] Import Table RVA 0x53ed88, size 0x190, mapped file offset 0x53d988 [ 2] Resource Table RVA 0x579000, size 0x284480, mapped file offset 0x571800 [ 3] Exception Table RVA 0x558000, size 0x1f1f4, mapped file offset 0x552400 [ 4] Certificate Table file offset 0x7fc200, size 0x2880, valid bounds, mapped file offset 0x7fc200 [ 5] Base Relocation Table RVA 0x7fe000, size 0x633c, mapped file offset 0x7f5e00 [ 6] Debug RVA 0x4e6740, size 0x1c, mapped file offset 0x4e5340 [ 7] Architecture RVA 0, size 0, empty [ 8] Global Ptr RVA 0, size 0, empty [ 9] TLS Table RVA 0x4e6900, size 0x28, mapped file offset 0x4e5500 [10] Load Config Table RVA 0x4e6600, size 0x140, mapped file offset 0x4e5200 [11] Bound Import RVA 0, size 0, empty [12] Import Address Table RVA 0x435000, size 0x1328, mapped file offset 0x433c00 [13] Delay Import Descriptor RVA 0, size 0, empty [14] CLR Runtime Header RVA 0, size 0, empty [15] Reserved RVA 0, size 0, empty Certificate table ----------------- [0] file offset 0x7fc200 length 0x2880 revision 0x200 type 0x2 Certificate entry count : 1 Base relocations ---------------- [0] page RVA 0x436000 block size 0x18c entries 194 [1] page RVA 0x437000 block size 0x20 entries 12 ... Relocation block count : 97 Relocation entry count : 12314 Relocation type count : 0 = 42 Relocation type count : 10 = 12272 Info, printed relocation blocks : 0x20 Bound imports ------------- Bound import directory : empty Resources --------- Resource directory count : 2496 Resource entry count : 4981 Resource declared data entries : 2486 Resource mapped data entries : 2486 Resource invalid entry count : 0 Resource named root types : 0 Resource declared data bytes : 0x265010 Resource mapped data bytes : 0x265010 Resource type count : cursor (1) = 1 Resource type count : bitmap (2) = 1 Resource type count : icon (3) = 1 Resource type count : menu (4) = 1 Resource type count : dialog (5) = 1 Resource type count : group cursor (12) = 1 Resource type count : group icon (14) = 1 Resource type count : version (16) = 1 Resource type count : manifest (24) = 1 Exceptions ---------- Runtime function count : 10623 [0] begin 0x1000 end 0x108d unwind 0x4f5450 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0 [1] begin 0x10a0 end 0x1127 unwind 0x4f5868 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0 [2] begin 0x1130 end 0x11b8 unwind 0x4f58b4 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0 ... Info, printed exception entries : 32 Delay imports ------------- Delay import directory : empty CLR runtime ----------- CLR runtime header : empty TLS --- Start address of raw data VA : 0x1404f52f8 End address of raw data VA : 0x1404f5300 Address of index VA : 0x1405547fc Address of callbacks VA : 0x140436558 Size of zero fill : 0 Characteristics : 0x300000 Debug ----- [0] characteristics 0 time date stamp 0x69bc8a94 major 0 minor 0 type 13 size 0x42c address 0x4f4e80 raw 0x4f3a80 Payload bounds : valid Load config ----------- Size : 0x140 Time date stamp : 0 Major version : 0 Minor version : 0 Global flags clear : 0 Global flags set : 0 Critical section timeout : 0 Process heap flags : 0 Security cookie : 0x1405432c0 SE handler table : 0 SE handler count : 0 Guard CF check pointer : 0x140436328 Guard CF dispatch pointer : 0x140436338 Guard CF function table : 0 Guard CF function count : 0 Guard flags : 0x100 Guard flag names : CF instrumented Guard address-taken IAT table : 0 Guard address-taken IAT count : 0 Guard long jump target table : 0 Guard long jump target count : 0 Dynamic value reloc table : 0 CHPE metadata pointer : 0 Guard RF failure routine : 0 Guard RF failure routine ptr : 0 Dynamic value reloc offset : 0 Dynamic value reloc section : 0 Guard RF verify stack ptr : 0 Hot patch table offset : 0 Enclave config pointer : 0 Volatile metadata pointer : 0x1404f447c Guard EH continuation table : 0 Guard EH continuation count : 0 Guard XFG check pointer : 0x140436330 Guard XFG dispatch pointer : 0x140436340 Guard XFG table dispatch ptr : 0x140436348 CastGuard failure mode : 0x140436350 Guard memcpy pointer : 0x140436358 Imports ------- [0] DLL name COMCTL32.dll [0] hint 0x5a name ImageList_DragShowNolock thunk RVA 0x4350a8 [1] hint 0x66 name ImageList_GetImageInfo thunk RVA 0x4350b0 [2] hint 0x57 name ImageList_DragEnter thunk RVA 0x4350b8 [3] hint 0x59 name ImageList_DragMove thunk RVA 0x4350c0 ... [1] DLL name SHLWAPI.dll [0] hint 0x59 name PathGetDriveNumberW thunk RVA 0x435a88 [1] hint 0x69 name PathIsRelativeW thunk RVA 0x435a90 [2] hint 0x3d name PathCombineW thunk RVA 0x435a98 ... [2] DLL name SHELL32.dll [0] hint 0x2a name DragQueryFileW thunk RVA 0x435a20 [1] hint 0x26 name DragFinish thunk RVA 0x435a28 [2] hint 0x1af name ShellExecuteExW thunk RVA 0x435a30 ... [3] DLL name dbghelp.dll [0] hint 0x16 name ImageNtHeader thunk RVA 0x436298 [4] DLL name VERSION.dll [0] hint 0x7 name GetFileVersionInfoSizeW thunk RVA 0x436258 [1] hint 0x8 name GetFileVersionInfoW thunk RVA 0x436260 [2] hint 0x10 name VerQueryValueW thunk RVA 0x436268 [5] DLL name CRYPT32.dll [0] hint 0xae name CryptMsgClose thunk RVA 0x435180 [1] hint 0x46 name CertGetCertificateContextProperty thunk RVA 0x435188 ... [6] DLL name WINTRUST.dll [0] hint 0x92 name WinVerifyTrust thunk RVA 0x436288 [7] DLL name SensApi.dll [0] hint 0x1 name IsDestinationReachableW thunk RVA 0x435b10 [1] hint 0x2 name IsNetworkAlive thunk RVA 0x435b18 [8] DLL name WININET.dll [0] hint 0x9f name InternetCrackUrlW thunk RVA 0x436278 [9] DLL name UxTheme.dll [0] hint 0x17 name EndBufferedAnimation thunk RVA 0x4361d8 [1] hint 0x51 name SetWindowTheme thunk RVA 0x4361e0 ... [10] DLL name dwmapi.dll [0] hint 0xa name DwmGetColorizationColor thunk RVA 0x4362a8 [1] hint 0x1b name DwmSetWindowAttribute thunk RVA 0x4362b0 [11] DLL name KERNEL32.dll [0] hint 0x31a name GetSystemTimeAsFileTime thunk RVA 0x435418 [1] hint 0x24c name GetDateFormatW thunk RVA 0x435420 ... [12] DLL name USER32.dll [0] hint 0x29c name MonitorFromRect thunk RVA 0x435b28 [1] hint 0x6c name CreateDialogParamW thunk RVA 0x435b30 ... [17] DLL name OLEAUT32.dll [0] ordinal 6 thunk RVA 0x435a08 [1] ordinal 4 thunk RVA 0x435a10 [18] DLL name IMM32.dll [0] hint 0x72 name ImmSetCandidateWindow thunk RVA 0x4353c8 [1] hint 0x76 name ImmSetCompositionStringW thunk RVA 0x4353d0 ... Exports ------- DLL name : notepad++.exe Ordinal base : 1 Address table count : 8 Name pointer count : 8 [0] ordinal 1 name CreateLexer RVA 0x2cdde0 [1] ordinal 2 name GetLexerCount RVA 0x2cdd10 [2] ordinal 3 name GetLexerFactory RVA 0x2cddb0 [3] ordinal 4 name GetLexerName RVA 0x2cdd30 [4] ordinal 5 name GetLibraryPropertyNames RVA 0x2ce020 [5] ordinal 6 name GetNameSpace RVA 0x2ce030 [6] ordinal 7 name LexerNameFromID RVA 0x2cdfd0 [7] ordinal 8 name SetLibraryProperty RVA 0x3440 Dumping Sections Header Info.... -------------------------------- Section Info (1 of 7) --------------------- Section Header name : .text ActualSize of code or data : 0x4336cc Virtual Address(RVA) : 0x1000 Size of raw data (rounded to FA) : 0x433800 Pointer to Raw Data : 0x400 Raw data bounds : valid Raw data entropy : 6.4635 Raw data FNV-1a64 : 0xc8423699a1bf52d4 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains executable code, Readable, Section Info (2 of 7) --------------------- Section Header name : .rdata ActualSize of code or data : 0x10dcb8 Virtual Address(RVA) : 0x435000 Size of raw data (rounded to FA) : 0x10de00 Pointer to Raw Data : 0x433c00 Raw data bounds : valid Raw data entropy : 5.6967 Raw data FNV-1a64 : 0xc85a9aedccb357bf Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Section Info (3 of 7) --------------------- Section Header name : .data ActualSize of code or data : 0x146fc Virtual Address(RVA) : 0x543000 Size of raw data (rounded to FA) : 0x10a00 Pointer to Raw Data : 0x541a00 Raw data bounds : valid Raw data entropy : 3.8285 Raw data FNV-1a64 : 0xa31da6a0167f3806 Warning : virtual size is larger than raw data Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Writable, Section Info (4 of 7) --------------------- Section Header name : .pdata ActualSize of code or data : 0x1f1f4 Virtual Address(RVA) : 0x558000 Size of raw data (rounded to FA) : 0x1f200 Pointer to Raw Data : 0x552400 Raw data bounds : valid Raw data entropy : 6.3830 Raw data FNV-1a64 : 0x272cb405f81bf335 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Section Info (5 of 7) --------------------- Section Header name : .fptable ActualSize of code or data : 0x100 Virtual Address(RVA) : 0x578000 Size of raw data (rounded to FA) : 0x200 Pointer to Raw Data : 0x571600 Raw data bounds : valid Raw data entropy : 0.0000 Raw data FNV-1a64 : 0x7da144b97d054b25 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Writable, Section Info (6 of 7) --------------------- Section Header name : .rsrc ActualSize of code or data : 0x284480 Virtual Address(RVA) : 0x579000 Size of raw data (rounded to FA) : 0x284600 Pointer to Raw Data : 0x571800 Raw data bounds : valid Raw data entropy : 7.5338 Raw data FNV-1a64 : 0xfd8a5bdb97251d09 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Section Info (7 of 7) --------------------- Section Header name : .reloc ActualSize of code or data : 0x633c Virtual Address(RVA) : 0x7fe000 Size of raw data (rounded to FA) : 0x6400 Pointer to Raw Data : 0x7f5e00 Raw data bounds : valid Raw data entropy : 5.4602 Raw data FNV-1a64 : 0x83c79c484f898f36 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Overlay and warnings -------------------- Overlay offset : 0x7fc200 Overlay size : 0x2880 Info : overlay includes certificate data; not necessarily suspicious =============================================================================== ``` If you want to see the header + dump of the `.text` section of the PE file. ```c HyperDbg> .pe section .rdata "C:\reverse files\myfile.exe" Valid Dos Exe File ------------------ Dumping DOS Header Info.... --------------------------- Magic number : MZ Bytes on last page of file : 0x90 Pages in file : 0x3 Relocation : 0 Size of header in paragraphs : 0x4 Minimum extra paragraphs needed : 0 Maximum extra paragraphs needed : 0xffff Initial (relative) SS value : 0 Initial SP value : 0xb8 Checksum : 0 Initial IP value : 0 Initial (relative) CS value : 0 File address of relocation table : 0x40 Overlay number : 0 OEM identifier : 0 OEM information(e_oemid specific) : 0 RVA address of PE header : 0x108 =============================================================================== =============================================================================== RICH HEADER =============================================================================== Entries: 12 Build ID Prod ID Use Count --------------------------------------- 0x00008179 0x00000105 173 0x00008179 0x00000104 14 0x00008179 0x00000103 8 0x00008987 0x00000103 10 0x00008987 0x00000104 16 0x00008987 0x00000105 81 0x00008179 0x00000101 2 0x0000899B 0x00000101 3 0x00000000 0x00000001 108 0x0000899B 0x00000109 1 0x0000899B 0x000000FF 1 0x0000899B 0x00000102 1 ==============Rich Header End ================== Valid PE64 file ------------- Dumping COFF/PE Header Info.... -------------------------------- Signature : PE Machine Architecture : AMD x64 Characteristics : Executable Image, Application can address > 2GB, Time Stamp : Tue Jun 2 17:50:10 2026 No.sections(size) : 7 No.entries in symbol table : 0 Size of optional header : 240 Raw machine value : 0x8664 Pointer to symbol table : 0 Raw characteristics value : 0x22 Dumping PE Optional Header Info.... ----------------------------------- Info of optional Header ----------------------- Address of Entry Point : 0x9c40 Raw optional header magic : 0x20b Entrypoint file offset : 0x9040 Base Address of the Image : 0x140000000 SubSystem type : Windows CLI Given file is a : PE32+(64) File Alignment : 0x200 Size of Image : 0x8f000 Size of Headers : 0x400 Optional header checksum : 0 Computed PE checksum : 0x906c6 (differs) Raw DLL characteristics value : 0x8160 DLL characteristics flags : High Entropy VA, Dynamic Base, NX Compatible, Terminal Server Aware Size of code segment(.text) : 398848 Base address of code segment(RVA) : 0x1000 Size of Initialized data : 167936 Section Alignment : 0x1000 Major Linker Version : 14 Minor Linker Version : 44 Data directories ---------------- Number of RVA and sizes : 16 [ 0] Export Table RVA 0, size 0, empty [ 1] Import Table RVA 0x828ac, size 0x3c, mapped file offset 0x812ac [ 2] Resource Table RVA 0x8d000, size 0x1e0, mapped file offset 0x88200 [ 3] Exception Table RVA 0x87000, size 0x4d34, mapped file offset 0x83200 [ 4] Certificate Table file offset 0, size 0, empty [ 5] Base Relocation Table RVA 0x8e000, size 0x9f0, mapped file offset 0x88400 [ 6] Debug RVA 0x7eaf0, size 0x70, mapped file offset 0x7d4f0 [ 7] Architecture RVA 0, size 0, empty [ 8] Global Ptr RVA 0, size 0, empty [ 9] TLS Table RVA 0, size 0, empty [10] Load Config Table RVA 0x7e9b0, size 0x140, mapped file offset 0x7d3b0 [11] Bound Import RVA 0, size 0, empty [12] Import Address Table RVA 0x63000, size 0x308, mapped file offset 0x61a00 [13] Delay Import Descriptor RVA 0, size 0, empty [14] CLR Runtime Header RVA 0, size 0, empty [15] Reserved RVA 0, size 0, empty Certificate table ----------------- Certificate table : empty Base relocations ---------------- [0] page RVA 0x63000 block size 0x1e4 entries 238 [1] page RVA 0x64000 block size 0x3c entries 26 [2] page RVA 0x67000 block size 0xfc entries 122 [3] page RVA 0x68000 block size 0x18 entries 8 ... Relocation block count : 18 Relocation entry count : 1200 Relocation type count : 0 = 9 Relocation type count : 10 = 1191 Bound imports ------------- Bound import directory : empty Resources --------- Resource directory count : 3 Resource entry count : 3 Resource declared data entries : 1 Resource mapped data entries : 1 Resource invalid entry count : 0 Resource named root types : 0 Resource declared data bytes : 0x17d Resource mapped data bytes : 0x17d Resource type count : manifest (24) = 1 Exceptions ---------- Runtime function count : 1647 [0] begin 0x1000 end 0x1022 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0 [1] begin 0x1030 end 0x1048 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0 [2] begin 0x1050 end 0x1068 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0 [3] begin 0x1070 end 0x1088 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0 ... Info, printed exception entries : 32 Delay imports ------------- Delay import directory : empty CLR runtime ----------- CLR runtime header : empty TLS --- TLS directory : empty Debug ----- [0] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 2 size 0x6c address 0x7fd54 raw 0x7e754 Payload bounds : valid CodeView RSDS GUID : fa280af0-3b09-4abd-9808-f1374a252ad7 CodeView age : 4 CodeView PDB path : C:\Users\sina\Desktop\HyperDbg\HyperDbg\hyperdbg\build\bin\release\hyperdbg-cli.pdb [1] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 12 size 0x14 address 0x7fdc0 raw 0x7e7c0 Payload bounds : valid [2] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 13 size 0x398 address 0x7fdd4 raw 0x7e7d4 Payload bounds : valid [3] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 14 size 0 address 0 raw 0 Load config ----------- Size : 0x140 Time date stamp : 0 Major version : 0 Minor version : 0 Global flags clear : 0 Global flags set : 0 Critical section timeout : 0 Process heap flags : 0 Security cookie : 0x140084040 SE handler table : 0 SE handler count : 0 Guard CF check pointer : 0x140063308 Guard CF dispatch pointer : 0x140063318 Guard CF function table : 0 Guard CF function count : 0 Guard flags : 0x100 Guard flag names : CF instrumented Guard address-taken IAT table : 0 Guard address-taken IAT count : 0 Guard long jump target table : 0 Guard long jump target count : 0 Dynamic value reloc table : 0 CHPE metadata pointer : 0 Guard RF failure routine : 0 Guard RF failure routine ptr : 0 Dynamic value reloc offset : 0 Dynamic value reloc section : 0 Guard RF verify stack ptr : 0 Hot patch table offset : 0 Enclave config pointer : 0 Volatile metadata pointer : 0x14007fc34 Guard EH continuation table : 0 Guard EH continuation count : 0 Guard XFG check pointer : 0x140063310 Guard XFG dispatch pointer : 0x140063320 Guard XFG table dispatch ptr : 0x140063328 CastGuard failure mode : 0x140063330 Guard memcpy pointer : 0x140063338 Imports ------- [0] DLL name libhyperdbg.dll [0] hint 0xb name hyperdbg_u_continue_previous_command thunk RVA 0x632d8 [1] hint 0x4 name hyperdbg_u_check_multiline_command thunk RVA 0x632e0 [2] hint 0x2b name hyperdbg_u_show_signature thunk RVA 0x632e8 [3] hint 0x21 name hyperdbg_u_run_command thunk RVA 0x632f0 [4] hint 0x23 name hyperdbg_u_script_read_file_and_execute_commandline thunk RVA 0x632f8 [1] DLL name KERNEL32.dll [0] hint 0x2a4 name GetModuleHandleExW thunk RVA 0x63000 [1] hint 0xe6 name CreateFileW thunk RVA 0x63008 [2] hint 0x593 name SetStdHandle thunk RVA 0x63010 [3] hint 0x55a name SetEnvironmentVariableW thunk RVA 0x63018 [4] hint 0x1d3 name FreeEnvironmentStringsW thunk RVA 0x63020 ... Exports ------- Export directory : empty Dumping Sections Header Info.... -------------------------------- Section Info (1 of 7) --------------------- Section Header name : .text ActualSize of code or data : 0x61576 Virtual Address(RVA) : 0x1000 Size of raw data (rounded to FA) : 0x61600 Pointer to Raw Data : 0x400 Raw data bounds : valid Raw data entropy : 5.7032 Raw data FNV-1a64 : 0x52e943d1c070be2b Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains executable code, Readable, Section Info (2 of 7) --------------------- Section Header name : .rdata ActualSize of code or data : 0x20346 Virtual Address(RVA) : 0x63000 Size of raw data (rounded to FA) : 0x20400 Pointer to Raw Data : 0x61a00 Raw data bounds : valid Raw data entropy : 4.6294 Raw data FNV-1a64 : 0x713d846dd8017611 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, 140063000: |24 30 08 00 | 00 00 00 00 | 2c 33 08 00 | 00 00 00 00 $0......,3...... 140063010: | 1c 33 08 00 | 00 00 00 00 | 02 33 08 00 | 00 00 00 00 .3.......3...... ... 140063050: | 0e 2d 08 00 | 00 00 00 00 | 2c 2d 08 00 | 00 00 00 00 .-......,-...... 140063060: | 44 2d 08 00 | 00 00 00 00 | 54 2d 08 00 | 00 00 00 00 D-......T-...... 140063070: | 64 2d 08 00 | 00 00 00 00 | 7a 2d 08 00 | 00 00 00 00 d-......z-...... ... 1400630b0: | 00 2e 08 00 | 00 00 00 00 | 1c 2e 08 00 | 00 00 00 00 ................ 1400630c0: | 3a 2e 08 00 | 00 00 00 00 | 4e 2e 08 00 | 00 00 00 00 :.......N....... 1400630d0: | 62 2e 08 00 | 00 00 00 00 | 7e 2e 08 00 | 00 00 00 00 b.......~....... ... 1400832f0: | 76 69 72 6f | 6e 6d 65 6e | 74 53 74 72 | 69 6e 67 73 vironmentStrings 140083300: | 57 00 5a 05 | 53 65 74 45 | 6e 76 69 72 | 6f 6e 6d 65 W.Z.SetEnvironme ... 140083330: | 65 61 74 65 | 46 69 6c 65 | 57 00 16 05 | 52 74 6c 55 eateFileW...RtlU 140083340: | 6e 77 69 6e | 64 00 00 00 | 00 00 00 00 | 00 00 00 00 nwind........... 140083350: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 140083360: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 140083370: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 140083380: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 140083390: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833a0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833b0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833c0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833d0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833e0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ 1400833f0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................ Section Info (3 of 7) --------------------- Section Header name : .data ActualSize of code or data : 0x2fd0 Virtual Address(RVA) : 0x84000 Size of raw data (rounded to FA) : 0x1400 Pointer to Raw Data : 0x81e00 Raw data bounds : valid Raw data entropy : 2.6692 Raw data FNV-1a64 : 0x4add5d1c4b513b48 Warning : virtual size is larger than raw data Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Writable, Section Info (4 of 7) --------------------- Section Header name : .pdata ActualSize of code or data : 0x4d34 Virtual Address(RVA) : 0x87000 Size of raw data (rounded to FA) : 0x4e00 Pointer to Raw Data : 0x83200 Raw data bounds : valid Raw data entropy : 5.3377 Raw data FNV-1a64 : 0x35dd9b50c5bce8c9 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Section Info (5 of 7) --------------------- Section Header name : .fptable ActualSize of code or data : 0x100 Virtual Address(RVA) : 0x8c000 Size of raw data (rounded to FA) : 0x200 Pointer to Raw Data : 0x88000 Raw data bounds : valid Raw data entropy : 0.0000 Raw data FNV-1a64 : 0x7da144b97d054b25 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Writable, Section Info (6 of 7) --------------------- Section Header name : .rsrc ActualSize of code or data : 0x1e0 Virtual Address(RVA) : 0x8d000 Size of raw data (rounded to FA) : 0x200 Pointer to Raw Data : 0x88200 Raw data bounds : valid Raw data entropy : 4.7177 Raw data FNV-1a64 : 0xb721756e709199f1 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Section Info (7 of 7) --------------------- Section Header name : .reloc ActualSize of code or data : 0x9f0 Virtual Address(RVA) : 0x8e000 Size of raw data (rounded to FA) : 0xa00 Pointer to Raw Data : 0x88400 Raw data bounds : valid Raw data entropy : 5.4259 Raw data FNV-1a64 : 0xa5557b54c7f04571 Pointer to Relocations : 0 Pointer to Line numbers : 0 Number of relocations : 0 Number of line numbers : 0 Characteristics : Contains initialized data, Readable, Overlay and warnings -------------------- Overlay : none =============================================================================== ``` ### IOCTL None ### Remarks Starting with HyperDbg **v0.19**, the output of this command has been significantly improved adding richer DOS/NT/COFF/optional-header output, section bounds checking, data directory reporting, import/export parsing, TLS/debug/PDB/load-config metadata, overlay reporting, malformed metadata warnings as well as many other PE-related headers and details. This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command. ### Requirements None ### Related None