visual-c++execoffdumpbin

Dumpbin output ,meaning?


If I do something like this:

dumpbin myexe.exe

I got output similar to:

Dump of file myexe.exe

File Type: EXECUTABLE IMAGE

Summary

      21000 .data
       1000 .gfids
     3C9000 .rdata
      4F000 .reloc
      B4000 .rsrc
     325000 .text
       1000 .tls

Second column (.data, .gfids, .rdata...) represents section name. But what is first column? Section size?


Solution

  • This value is actually the aligned section size.

    If you do dumpbin /headers myexe.exe, you will get a more verbose output. For example, dumpbin C:\Windows\explorer.exe on my system produces:

    Dump of file c:\Windows\explorer.exe
    
    File Type: EXECUTABLE IMAGE
    
    Summary
    
        4000 .data
        1000 .didat
        1000 .imrsiv
       18000 .pdata
       7B000 .rdata
        6000 .reloc
      1EA000 .rsrc
      1C5000 .text
    

    dumpbin /headers C:\Windows\explorer.exe, contains the output for the .text section as follows (... = lines omitted):

    ...
    SECTION HEADER #1
       .text name
      1C4737 virtual size
        1000 virtual address (0000000140001000 to 00000001401C5736)
      1C4800 size of raw data
         400 file pointer to raw data (00000400 to 001C4BFF)
           0 file pointer to relocation table
           0 file pointer to line numbers
           0 number of relocations
           0 number of line numbers
    60000020 flags
             Code
             Execute Read
    ...
    

    It also gives 1000 section alignment in the OPTIONAL HEADER VALUES section.

    As you can see, the size of the .text section is actually 1C4737, when aligned, it becomes 1C5000, as reported in the /summary (which is the default option for dumpbin).