dumpbin:命令行工具,可以输出PE信息。
下载地址:安装vs2022 IDE时自带。
基础用法:点击开始(桌面左下角的win图标) → 找到visual studio 2022文件夹 → 展开 → 点击Developer Command Prompt for vs 2022 → 输入如下指令:
dumpbin /headers "C:\Windows\System32\notepad.exe"
输出如下:
Microsoft (R) COFF/PE Dumper Version 14.42.34435.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file C:\Windows\System32\notepad.exe
PE signature found
File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
8664 machine (x64)
7 number of sections
6DF9F3AD time date stamp
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
22 characteristics
Executable
Application can handle large (>2GB) addresses
...