objdump -x ./utils/osmo-arfcn.exe ./utils/osmo-arfcn.exe: file format pei-i386 ./utils/osmo-arfcn.exe architecture: i386, flags 0x00000102: EXEC_P, D_PAGED start address 0x00401000 Characteristics 0x32f relocations stripped executable line numbers stripped symbols stripped large address aware 32 bit words debugging information removed Time/Date Thu Feb 28 17:29:25 2013 Magic 010b (PE32) MajorLinkerVersion 2 MinorLinkerVersion 23 SizeOfCode 00003000 SizeOfInitializedData 00005200 SizeOfUninitializedData 00000200 AddressOfEntryPoint 00001000 BaseOfCode 00001000 BaseOfData 00004000 ImageBase 00400000 SectionAlignment 00001000 FileAlignment 00000200 MajorOSystemVersion 4 MinorOSystemVersion 0 MajorImageVersion 1 MinorImageVersion 0 MajorSubsystemVersion 4 MinorSubsystemVersion 0 Win32Version 00000000 SizeOfImage 00009000 SizeOfHeaders 00000400 CheckSum 00009e11 Subsystem 00000003 (Windows CUI) DllCharacteristics 00008000 SizeOfStackReserve 00200000 SizeOfStackCommit 00001000 SizeOfHeapReserve 00100000 SizeOfHeapCommit 00001000 LoaderFlags 00000000 NumberOfRvaAndSizes 00000010 The Data Directory Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)] Entry 1 00008000 000003d0 Import Directory [parts of .idata] Entry 2 00000000 00000000 Resource Directory [.rsrc] Entry 3 00000000 00000000 Exception Directory [.pdata] Entry 4 00000000 00000000 Security Directory Entry 5 00000000 00000000 Base Relocation Directory [.reloc] Entry 6 00000000 00000000 Debug Directory Entry 7 00000000 00000000 Description Directory Entry 8 00000000 00000000 Special Directory Entry 9 00000000 00000000 Thread Storage Directory [.tls] Entry a 00000000 00000000 Load Configuration Directory Entry b 00000000 00000000 Bound Import Directory Entry c 000080d0 00000094 Import Address Table Directory Entry d 00000000 00000000 Delay Import Directory Entry e 00000000 00000000 CLR Runtime Header Entry f 00000000 00000000 Reserved There is an import table in .idata at 0x408000 The Import Tables (interpreted .idata section contents) vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 00008000 0000803c 00000000 00000000 000083ac 000080d0 DLL Name: cygwin1.dll vma: Hint/Ord Member-Name Bound-To 8164 16 __assert_func 8174 32 __errno 8180 54 __getreent 8190 61 __main 819c 184 _dll_crt0@0 81ac 369 _impure_ptr 81bc 430 _lstat64 81c8 566 _stat64 81d4 735 calloc 81e0 763 chmod 81e8 836 cygwin_detach_dll 81fc 838 cygwin_internal 8210 859 dll_dllcrt0 8220 909 execv 8228 913 exit 8230 994 fprintf 823c 996 fputc 8244 1001 free 824c 1041 fwrite 8258 1061 getcwd 8264 1066 getenv 8270 1283 malloc 827c 1301 memcpy 8288 1521 realloc 8294 1523 realpath 82a0 1611 setenv 82ac 1623 setmode 82b8 1717 strcat 82c4 1720 strcmp 82d0 1722 strcpy 82dc 1725 strerror 82e8 1731 strlen 82f4 1847 vfprintf 00008014 000080c4 00000000 00000000 000083c0 00008158 DLL Name: KERNEL32.dll vma: Hint/Ord Member-Name Bound-To 8300 533 GetModuleHandleA 8314 581 GetProcAddress 00008028 00000000 00000000 00000000 00000000 00000000 Sections: Idx Name Size VMA LMA File off Algn 0 .text 00002fe8 00401000 00401000 00000400 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE, DATA 1 .data 00001b88 00404000 00404000 00003400 2**5 CONTENTS, ALLOC, LOAD, DATA 2 .eh_frame 00000004 00406000 00406000 00005000 2**2 CONTENTS, ALLOC, LOAD, DATA 3 .bss 00000110 00407000 00407000 00000000 2**5 ALLOC 4 .idata 000003d0 00408000 00408000 00005200 2**2 CONTENTS, ALLOC, LOAD, DATA SYMBOL TABLE: no symbols