0:000> lm
start end module name
00590000 005c0000 notepad (deferred)
0f2f0000 0f2f8000 DAVHLPR (deferred)
3f380000 3f389000 VERSION (deferred)
6cea0000 6cef1000 WINSPOOL (deferred)
73900000 73b0f000 COMCTL32 (deferred)
744e0000 744ea000 CRYPTBASE (deferred)
744f0000 7450e000 SspiCli (deferred)
74510000 7465e000 GDI32 (deferred)
74660000 746b8000 bcryptPrimitives (deferred)
0:000> !dh -f notepad
File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
14C machine (i386)
4 number of sections
559EA6FF time date stamp Fri Jul 10 00:53:19 2015
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
102 characteristics
Executable
32 bit word machine
OPTIONAL HEADER VALUES
10B magic #
9.00 linker version
A800 size of code
22400 size of initialized data
0 size of uninitialized data
31C9 address of entry point
1000 base of code
----- new -----
**00400000 image base**
1000 section alignment
200 file alignment
2 subsystem (Windows GUI)
6.01 operating system version
6.01 image version
6.01 subsystem version
30000 size of image
400 size of headers
385B1 checksum
00040000 size of stack reserve
00011000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
8140 DLL characteristics
Dynamic base
NX compatible
Terminal server aware
0 [ 0] address [size] of Export Directory
A0A0 [ 12C] address [size] of Import Directory
F000 [ 1F168] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
2F000 [ E38] address [size] of Base Relocation Directory
B69C [ 38] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
6D78 [ 40] address [size] of Load Configuration Directory
270 [ 128] address [size] of Bound Import Directory
1000 [ 404] address [size] of Import Address Table Directory
0 [ 0] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
0:000> dt -n (_IMAGE_DOS_HEADER)00400000
ntdll!_IMAGE_DOS_HEADER
+0x000 e_magic : 0x5a4d
+0x002 e_cblp : 0x90
+0x004 e_cp : 3
+0x006 e_crlc : 0
+0x008 e_cparhdr : 4
+0x00a e_minalloc : 0
+0x00c e_maxalloc : 0xffff
+0x00e e_ss : 0
+0x010 e_sp : 0xb8
+0x012 e_csum : 0
+0x014 e_ip : 0
+0x016 e_cs : 0
+0x018 e_lfarlc : 0x40
+0x01a e_ovno : 0
+0x01c e_res : [4] 0
+0x024 e_oemid : 0
+0x026 e_oeminfo : 0
+0x028 e_res2 : [10] 0
+0x03c e_lfanew : 0n216
0:000> dt -n (_IMAGE_NT_HEADERS)00400000+0n216
ntdll!_IMAGE_NT_HEADERS
+0x000 Signature : 0x4550
+0x004 FileHeader : _IMAGE_FILE_HEADER
+0x018 OptionalHeader : _IMAGE_OPTIONAL_HEADER
0:000> dx -r1 (*((ntdll!_IMAGE_FILE_HEADER *)0x4000dc))
(*((ntdll!_IMAGE_FILE_HEADER *)0x4000dc)) [Type: _IMAGE_FILE_HEADER]
[+0x000] Machine : 0x14c [Type: unsigned short]
[+0x002] NumberOfSections : 0x4 [Type: unsigned short]
[+0x004] TimeDateStamp : 0x559ea6ff [Type: unsigned long]
[+0x008] PointerToSymbolTable : 0x0 [Type: unsigned long]
[+0x00c] NumberOfSymbols : 0x0 [Type: unsigned long]
[+0x010] SizeOfOptionalHeader : 0xe0 [Type: unsigned short]
[+0x012] Characteristics : 0x102 [Type: unsigned short]
*0:000> dx -r1 (*((ntdll!_IMAGE_OPTIONAL_HEADER )0x4000f0))
(*((ntdll!_IMAGE_OPTIONAL_HEADER *)0x4000f0)) [Type: _IMAGE_OPTIONAL_HEADER]
[+0x000] Magic : 0x10b [Type: unsigned short]
[+0x002] MajorLinkerVersion : 0x9 [Type: unsigned char]
[+0x003] MinorLinkerVersion : 0x0 [Type: unsigned char]
[+0x004] SizeOfCode : 0xa800 [Type: unsigned long]
[+0x008] SizeOfInitializedData : 0x22400 [Type: unsigned long]
[+0x00c] SizeOfUninitializedData : 0x0 [Type: unsigned long]
[+0x010] AddressOfEntryPoint : 0x31c9 [Type: unsigned long]
[+0x014] BaseOfCode : 0x1000 [Type: unsigned long]
[+0x018] BaseOfData : 0xc000 [Type: unsigned long]
[+0x01c] ImageBase : 0x400000 [Type: unsigned long]
[+0x020] SectionAlignment : 0x1000 [Type: unsigned long]
[+0x024] FileAlignment : 0x200 [Type: unsigned long]
[+0x028] MajorOperatingSystemVersion : 0x6 [Type: unsigned short]
[+0x02a] MinorOperatingSystemVersion : 0x1 [Type: unsigned short]
[+0x02c] MajorImageVersion : 0x6 [Type: unsigned short]
[+0x02e] MinorImageVersion : 0x1 [Type: unsigned short]
[+0x030] MajorSubsystemVersion : 0x6 [Type: unsigned short]
[+0x032] MinorSubsystemVersion : 0x1 [Type: unsigned short]
[+0x034] Win32VersionValue : 0x0 [Type: unsigned long]
[+0x038] SizeOfImage : 0x30000 [Type: unsigned long]
[+0x03c] SizeOfHeaders : 0x400 [Type: unsigned long]
[+0x040] CheckSum : 0x385b1 [Type: unsigned long]
[+0x044] Subsystem : 0x2 [Type: unsigned short]
[+0x046] DllCharacteristics : 0x8140 [Type: unsigned short]
[+0x048] SizeOfStackReserve : 0x40000 [Type: unsigned long]
[+0x04c] SizeOfStackCommit : 0x11000 [Type: unsigned long]
[+0x050] SizeOfHeapReserve : 0x100000 [Type: unsigned long]
[+0x054] SizeOfHeapCommit : 0x1000 [Type: unsigned long]
[+0x058] LoaderFlags : 0x0 [Type: unsigned long]
[+0x05c] NumberOfRvaAndSizes : 0x10 [Type: unsigned long]
[+0x060] DataDirectory [Type: _IMAGE_DATA_DIRECTORY [16]]
0:000> dx -r2 (((ntdll!_IMAGE_DATA_DIRECTORY ()[16])0x400150))
(*((ntdll!_IMAGE_DATA_DIRECTORY (*)[16])0x400150)) [Type: _IMAGE_DATA_DIRECTORY [16]]
[0] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[1] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0xa0a0 [Type: unsigned long]
[+0x004] Size : 0x12c [Type: unsigned long]
[2] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0xf000 [Type: unsigned long]
[+0x004] Size : 0x1f168 [Type: unsigned long]
[3] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[4] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[5] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x2f000 [Type: unsigned long]
[+0x004] Size : 0xe38 [Type: unsigned long]
[6] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0xb69c [Type: unsigned long]
[+0x004] Size : 0x38 [Type: unsigned long]
[7] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[8] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[9] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[10] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x6d78 [Type: unsigned long]
[+0x004] Size : 0x40 [Type: unsigned long]
[11] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x270 [Type: unsigned long]
[+0x004] Size : 0x128 [Type: unsigned long]
[12] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x1000 [Type: unsigned long]
[+0x004] Size : 0x404 [Type: unsigned long]
[13] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[14] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]
[15] [Type: _IMAGE_DATA_DIRECTORY]
[+0x000] VirtualAddress : 0x0 [Type: unsigned long]
[+0x004] Size : 0x0 [Type: unsigned long]