If I do something like this:
dumpbin myexe.exe
I got output similar to:
Dump of file myexe.exe
File Type: EXECUTABLE IMAGE
Summary
21000 .data
1000 .gfids
3C9000 .rdata
4F000 .reloc
B4000 .rsrc
325000 .text
1000 .tls
Second column (.data, .gfids, .rdata...) represents section name. But what is first column? Section size?
This value is actually the aligned section size.
If you do dumpbin /headers myexe.exe
, you will get a more verbose output. For example, dumpbin C:\Windows\explorer.exe
on my system produces:
Dump of file c:\Windows\explorer.exe
File Type: EXECUTABLE IMAGE
Summary
4000 .data
1000 .didat
1000 .imrsiv
18000 .pdata
7B000 .rdata
6000 .reloc
1EA000 .rsrc
1C5000 .text
dumpbin /headers C:\Windows\explorer.exe
, contains the output for the .text
section as follows (... = lines omitted):
...
SECTION HEADER #1
.text name
1C4737 virtual size
1000 virtual address (0000000140001000 to 00000001401C5736)
1C4800 size of raw data
400 file pointer to raw data (00000400 to 001C4BFF)
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
Execute Read
...
It also gives 1000 section alignment
in the OPTIONAL HEADER VALUES
section.
As you can see, the size of the .text
section is actually 1C4737
, when aligned, it becomes 1C5000
, as reported in the /summary
(which is the default option for dumpbin).