Layout of JIURL play Win2k address space: JIURL Home: http://jiurl.yeah.net Date: 2003-7-30
The layout of the address space, each process has 4G address space, where low 2G is the user address space, and the high 2G is the system address space. The layout of the user address space has its own user address space (low 2G), in the user address space, the process of environment variable, the process of the process, the heap (HEAP), the process loaded by the process, the process PEB, thread stack, thread teb, etc. I wrote a program called JIURLL2GLAYOUTSEE, and I can get a user address space layout of a specified process. Here is a user address space layout of a notepad obtained using Jiurll2gLayoutSee. Notepad.exe: // We can learn which user address spaces have been reserved through the process.
VADs: #define MEM_IMAGE 0x001 # define MEM_PRIVATE 0x800 # define PAGE_READONLY 0x010 # define PAGE_READWRITE 0x040 # define PAGE_WRITECOPY 0x050 # define PAGE_EXECUTE 0x020 # define PAGE_EXECUTE_READ 0x030 # define PAGE_EXECUTE_READWRITE 0x060 # define PAGE_EXECUTE_WRITECOPY 0x0700x00010000 - 0x00011000 Flags = 0xc400x00020000 - 0x00021000 Flags = 0xc400x00030000 - 0x00070000 Flags = 0x8400x00070000 - 0x00170000 Flags = 0x8400x00170000 - 0x00180000 Flags = 0x0400x00180000 - 0x00196000 Flags = 0x0100x001a0000 - 0x001cf000 Flags = 0x0100x001d0000 - 0x00211000 Flags = 0x0100x00220000 - 0x00224000 Flags = 0x0100x00230000 - 0x00271000 Flags = 0x0100x00280000 - 0x00348000 Flags = 0x0340x00350000 - 0x00393000 Flags = 0x0140x003a0000 - 0x006a0000 Flags = 0x0340x006a0000 - 0x006a1000 Flags = 0xc440x006b0000 - 0x006b1000 Flags = 0xc440x006c0000 - 0x006d0000 Flags = 0x8400x006d0000 - 0x006d2000 Flags = 0x0100x006e0000 - 0x006e1000 Flags = 0x0400x006f0000 - 0x00770000 Flags = 0x8400x00770000 - 0x00780000 Flags = 0x8400x00780000 - 0x 00b80000 Flags = 0x8400x00b90000 - 0x00b91000 Flags = 0xc440x00bb0000 - 0x00bc2000 Flags = 0xc440x00bd0000 - 0x00bd5000 Flags = 0xc440x00be0000 - 0x00be5000 Flags = 0x0100x00bf0000 - 0x00c30000 Flags = 0x8400x00d40000 - 0x00d5c000 Flags = 0x0710x00d60000 - 0x00d70000 Flags = 0x8400x00d70000 - 0x00dc3000 Flags = 0x0710x00dd0000 - 0x00de0000 Flags = 0x8400x00de0000 - 0x00f84000 Flags = 0x0400x01000000 - 0x01010000 Flags = 0x0710x01010000 - 0x011f0000 Flags = 0x0100x011f0000 - 0x01201000 Flags = 0x0100x01210000 - 0x01310000 Flags = 0x8400x10000000 - 0x10019000 Flags = 0x0710x6dd30000 - 0x6dd36000 Flags =
0x0710x75e00000 - 0x75e1a000 Flags = 0x0710x76af0000 - 0x76b2e000 Flags = 0x0710x77560000 - 0x777a0000 Flags = 0x0710x777c0000 - 0x777dd000 Flags = 0x0710x77990000 - 0x77a25000 Flags = 0x0710x77a30000 - 0x77b24000 Flags = 0x0710x77b30000 - 0x77bba000 Flags = 0x0710x77c50000 - 0x77c9a000 Flags = 0x0710x77ca0000 - 0x77d20000 Flags = 0x0710x77d20000 - 0x77d8f000 Flags = 0x0710x77d90000 - 0x77dea000 Flags = 0x0710x77df0000 - 0x77e54000 Flags = 0x0710x77e60000 - 0x77f35000 Flags = 0x0710x77f40000 - 0x77f7c000 Flags = 0x0710x77f80000 - 0x77ff9000 Flags = 0x0710x78000000 - 0x78046000 Flags = 0x0710x7f6f0000 - 0x7f7f0000 Flags = 0x0340x7ffa0000 - 0x7ffd3000 Flags = 0x0140x7ffdd000 - 0x7ffde000 Flags = 0xc640x7ffde000 - 0x7ffdf000 Flags = 0xc640x7ffdf000 - 0x7ffe0000 Flags = 0xc64 // layout of layout: // environment variable 0x00010000 - 0x00011000 environment // process parameters 0x00020000 - 0x00021000 processParameters // process heap 0x00070000 - 0x00170000 ProcessHeap 00x00170000 - 0x00270000 ProcessHeap 10x006c0000 - 0x007c0000 ProcessHeap 20x00770000 - 0x008 70000 ProcessHeap 30X00D60000 - 0x00E60000 ProcessHeap 40x00DD0000 - 0x00ed0000 ProcessHeap 5 // The module loaded by the process,
As well as the module contains sections 0x00d70000 - 0x00dc3000 upengine.dll0x00d71000 - 0x00d8b000 .text0x00d8b000 - 0x00da0000 .rdata0x00da0000 - 0x00db2000 .data0x00db2000 - 0x00db3000 .idata0x00db3000 - 0x00dbf000 .share_d0x00dbf000 - 0x00dc1000 .rsrc0x00dc1000 - 0x00dc3000 .reloc0x00d40000 - 0x00d5c000 unispim.ime0x00d41000 - 0x00d4e000 .text0x00d4e000 - 0x00d51000 .rdata0x00d51000 - 0x00d55000 .data0x00d55000 - 0x00d56000 .SharedD0x00d56000 - 0x00d5a000 .rsrc0x00d5a000 - 0x00d5c000 .reloc0x77ca0000 - 0x77d20000 CLBCATQ.DLL0x77ca1000 - 0x77d0f000 .text0x77d0f000 - 0x77d19000 .data0x77d19000 - 0x77d1b000 .rsrc0x77d1b000 - 0x77d20000 .reloc0x77990000 - 0x77a25000 OLEAUT32.DLL0x77991000 - 0x77a16000 .text0x77a16000 - 0x77a1d000 .data0x77a1d000 - 0x77a1e000 .rsrc0x77a1e000 - 0x77a25000 .reloc0x77a30000 - 0x77b24000 OLE32.DLL0x77a31000 - 0x77b08000 .text0x77b08000 - 0x77b11000 .orpc0x77b11000 - 0x77b17000 .data0x77b17000 - 0x77b19000 .rsrc0x77b19000 - 0x77b24000 .reloc0x6dd30000 - 0x6dd36000 INDICDLL.dll0x6dd31000 - 0x6dd33000 .text0x6dd33000 - 0x6dd34000 .data0x6dd34000 - 0x6dd35000 .rsrc0x6dd35000 - 0x6dd36000 .reloc0x10000000 - 0x10019000 NVDESK32.DLL0x10001000 - 0x1000f000 .text0x1000f000 - 0x10010000 .rdata0x10010000 - 0x10012000 .data0x10012000 - 0x10014000 .shared0x10014000 - 0x10015000 .notshar0x10015000 - 0x10017000 .rsrc0x10017000 - 0x10019000 .reloc0x75e00000 - 0x75e1a000 IMM32.DLL0x75e01000 - 0x75e13000 .text0x75e13000 - 0x75e14000 .data0x75e14000 - 0x75e19000 .rsrc0x75e19000 - 0x75e1a000 .reloc0x777c0000 - 0x777dd000 WINSPOOL.DRV0x777c1000 - 0x777d8000 .text0x777d8000 - 0x777db000 .data0x777db000 - 0x777dc000 .rsrc0x777dc000 - 0x777dd000 .reloc0x78000000 - 0x78046000 MSVCRT.
DLL0x78001000 - 0x78033000 .text0x78033000 - 0x7803b000 .rdata0x7803b000 - 0x78042000 .data0x78042000 - 0x78043000 .rsrc0x78043000 - 0x78046000 .reloc0x77560000 - 0x777a0000 SHELL32.DLL0x77561000 - 0x7767c000 .text0x7767c000 - 0x77680000 .data0x77680000 - 0x77791000 .rsrc0x77791000 - 0x777a0000 .reloc0x77b30000 - 0x77bba000 COMCTL32.DLL0x77b31000 - 0x77b96000. text0x77b96000 - 0x77b97000 .data0x77b97000 - 0x77bb6000 .rsrc0x77bb6000 - 0x77bba000 .reloc0x77d20000 - 0x77d8f000 RPCRT4.DLL0x77d21000 - 0x77d81000 .text0x77d81000 - 0x77d89000 .orpc0x77d89000 - 0x77d8a000 .data0x77d8a000 - 0x77d8b000 .rsrc0x77d8b000 - 0x77d8f000 .reloc0x77d90000 - 0x77dea000 ADVAPI32.DLL0x77d91000 - 0x77de1000 .text0x77de1000 - 0x77de4000. data0x77de4000 - 0x77de6000 .rsrc0x77de6000 - 0x77dea000 .reloc0x77df0000 - 0x77e54000 USER32.DLL0x77df1000 - 0x77e48000 .text0x77e48000 - 0x77e49000 .data0x77e49000 - 0x77e51000 .rsrc0x77e51000 - 0x77e54000 .reloc0x77e60000 - 0x77f35000 KERNEL32.DLL0x77e61000 - 0x77ebf000. text0x77ebf000 - 0x77ec1000 .data0x77ec1000 - 0x77f31000 .rsrc0x77f31000 - 0x77f35000 .reloc0x77f40000 - 0x77f7c000 GDI32.DLL0x77f41000 - 0x77f78000 .text0x77f78000 - 0x77f79000 .data0x77f79000 - 0x77f7a000 .rsrc0x77f7a000 - 0x77f7c000 .reloc0x77c50000 - 0x77c9a000 SHLWAPI.DLL0x77c51000 - 0x77c94000 .text0x77c94000 - 0x77c95000 .data0x77c95000 - 0x77c97000. rsrc0x77c97000 - 0x77c9a000 .reloc0x76af0000 - 0x76b2e000 comdlg32.dll0x76af1000 - 0x76b1b000 .text0x76b1b000 - 0x76b1f000 .data0x76b1f000 - 0x76b2b000 .rsrc0x76b2b000 - 0x76b2e000 .reloc0x77f80000 - 0x77ff9000 ntdll.
dll0x77f81000 - 0x77fc4000 .text0x77fc4000 - 0x77fc9000 ECODE0x77fc9000 - 0x77fcd000 PAGE0x77fcd000 - 0x77fd0000 .data0x77fd0000 - 0x77ff7000 .rsrc0x77ff7000 - 0x77ff9000 .reloc0x01000000 - 0x01010000 NOTEPAD.
EXE0x01001000 - 0x01008000 .text0x01008000 - 0x0100a000 .data0x0100a000 - 0x01010000 .rsrc // process PEB0x7ffdf000 - 0x7ffe0000 PEB // thread stack (Stack), and thread TEB0x0006a000 - 0x00070000 Stack Thread 0x1180x7ffde000 - 0x7ffdf000 TEB Thread 0x1180x00c2f000 - 0x00c30000 Stack Thread 0x2a80x7ffdd000 - 0x7ffde000 TEB Thread 0x2a8 system address space layout All processes in the system address space of the system address space, most of them. In the system address space, the system code, the page table of the current process, the page directory of the current process, the Working set of the current process, Paged Pool (can be exchanged out of physical memory system stack), NonPaged Pool (cannot be replaced out of physical memory The system heap, NonPagedPool has two parts, part of the lower part of the system address space, part of the height of the system address space), driver, etc. Let's take a look at my current system address space layout probably HAL.dll 0x80001000 - 0x80011220ntoskrnl.exe 0x80400000 - 0x80590900MmNonPagedPoolStart 8103e000win32k.sys 0xa0000000 - 0xa01a6000 current process's page table, page directory 0xc0000000 - 0xc03fffffMmSystemCacheStart c1000000MmSystemCacheEnd e0ffffffMmPagedPoolStart e1000000MmPagedPoolEnd e77fffffMmNonPagedSystemStart e7800000MmNonPagedPoolExpansionStart fcd6c000MmNonPagedPoolEnd ffbe0000 MmnonPagedPoolStart, MMSystemCacheStart, MMSystemcachend, MmpagedPoolStart, MmpageDpooled, MmnonPaultsystemStart, MmnonPageDpooled is global variables, using KD we can get the value of these global variables. kd> dd MmNonPagedPoolStart l 1dd MmNonPagedPoolStart l 18047e750 8103e000kd> dd MmSystemCacheStart l 1dd MmSystemCacheStart l 18046ac00 c1000000kd> dd MmSystemCacheEnd l 1dd MmSystemCacheEnd l 18047efd8 e0ffffffkd> dd MmPagedPoolStart l 1dd MmPagedPoolStart l 180471038 e1000000kd> dd MmPagedPoolEnd l 1dd MmPagedPoolEnd l 18047e738 e77fffffkd> dd MmNonPagedSystemStart l 1DD MMNONPAGEDSYSTEMSTART L 18047F62C E7800000KD> DD MMNONPAGEDPOOLEXPANSIONSTART L 1DD MMNONPAGEDPOEXPANSIONSTART L 18047E8DC FCD6C000KD & g
T; DD MMNONPAGEDPOOLEEND L 1DD MMNONPAGEDPOOLEND L 18046A85C FFBE0000 I wrote a program called JiurlsystemModulessee that can get information on the module loaded by the system address space. The modules loaded in the system address space include NtoskRNL.EXE, HAL.DLL, WIN32K.SYS, and drivers. // My current system address space to load modules, and each module in the section 0x80400000 - 0x80590900 ntoskrnl.exe0x804004c0 - 0x80466c69 .text0x80466c80 - 0x804677df POOLCODE0x80467800 - 0x80468a10 POOLMI0x80468a40 - 0x8046912c MISYSPTE0x80469140 - 0x80480ba4 .data0x80480bc0 - 0x8048c2f8 PAGELK0x8048c300 - 0x8052c481 PAGE0x8052c4c0 - 0x8053275f PAGEVRFY0x80532780 - 0x80535b39 PAGEKD0x80535b40 - 0x80538430 PAGEHYDR0x80538440 - 0x80538e4c PAGESPEC0x80538e80 - 0x80541f87 .edata0x80541fc0 - 0x80542cec PAGE0x80542d00 - 0x80543090 PAGEVRFY0x805430c0 - 0x805470e0 PAGEKD0x80547100 - 0x805471ac PAGELK0x805471c0 - 0x80569020 INIT0x80569040 - 0x80583dd0 .rsrc0x80583e00 - 0x805908c8 .reloc0x80001000 - 0x80011220 hal.dll0x80001340 - 0x80007835 .text0x80007840 - 0x80008fb0 .data0x80008fc0 - 0x8000a93b PAGELK0x8000a940 - 0x8000a998 PAGELK160x8000a9a0 - 0x8000cecc PAGE0x8000cee0 - 0x8000da93 .edata0x8000daa0 - 0x80010298 INIT0x800102a0 - 0x80010670 .rsrc0x80010680 - 0x80011204 .reloc0xf0810000 - 0xf0813000 BOOTVID.DLL0xf08102c0 - 0xf08118d4 .text0xf 08118e0 - 0xf081226c .data0xf0812280 - 0xf08123d8 .edata0xf08123e0 - 0xf0812514 INIT0xf0812520 - 0xf08128d0 .rsrc0xf08128e0 - 0xf0812a04 .reloc0xfcd43000 - 0xfcd6b000 ACPI.sys0xfcd43320 - 0xfcd59ac4 .text0xfcd59ae0 - 0xfcd5a3c0 .rdata0xfcd5a3c0 - 0xfcd5c6b4 .data0xfcd5c6c0 - 0xfcd66c74 PAGE0xfcd66c80 - 0xfcd67091 PAGE0xfcd670a0 - 0xfcd681e2 INIT0xfcd68200 - 0xfcd68a18 .rsrc0xfcd68a20 - 0xfcd6ab30.reloc0xf09c8000 - 0xf09c9000 wmilib.sys0xf09c82e0 - 0xf09c84cd .text0xf09c84e0 - 0xf09c8570 .rdata0xf09c8580 - 0xf09c89e3 Page0xf09c8a00 - 0
xf09c8a82 .edata0xf09c8aa0 - 0xf09c8b58 INIT0xf09c8b60 - 0xf09c8f30 .rsrc0xf09c8f40 - 0xf09c8f80 .reloc0xf0400000 - 0xf040f000 pci.sys0xf04002e0 - 0xf040346a .text0xf0403480 - 0xf0403868 .rdata0xf0403880 - 0xf0403e70 .data0xf0403e80 - 0xf040b891 PAGE0xf040b8a0 - 0xf040ca8a INIT0xf040caa0 - 0xf040db18 .rsrc0xf040db20 - 0xf040e33a .reloc0xf0410000 - 0xf041c000 isapnp.sys0xf04102e0 - 0xf0413ae2 .text0xf0413b00 - 0xf0413d88 .rdata0xf0413da0 - 0xf04140d4 .data0xf04140e0 - 0xf0419a64 PAGE0xf0419a80 - 0xf041a272 INIT0xf041a280 - 0xf041ad28 .rsrc0xf041ad40 - 0xf041b576 .reloc0xf09c9000 - 0xf09ca000 intelide.sys0xf09c92c0 - 0xf09c999a .text0xf09c99a0 - 0xf09c9a20 .rdata0xf09c9a20 - 0xf09c9a35 .data0xf09c9a40 - 0xf09c9ac0 INIT0xf09c9ac0 - 0xf09c9f00 .rsrc0xf09c9f00 - 0xf09c9f26 .reloc0xf0680000 - 0xf0686000 PCIIDEX.SYS0xf0680340 - 0xf06811d0 NONPAGE0xf06811e0 - 0xf06814e6 .text0xf0681500 - 0xf0681968 .rdata0xf0681980 - 0xf0681b60 .data0xf0681b60 - 0xf0684611 PAGE0xf0684620 - 0xf06846c4 .edata0xf 06846e0 - 0xf0684d24 INIT0xf0684d40 - 0xf0685110 .rsrc0xf0685120 - 0xf0685494 .reloc0xf0688000 - 0xf0690000 MountMgr.sys0xf06882c0 - 0xf06886e4 .text0xf0688700 - 0xf06888b0 .rdata0xf06888c0 - 0xf068e08d PAGE0xf068e0a0 - 0xf068e904 INIT0xf068e920 - 0xf068ecd8 .rsrc0xf068ece0 - 0xf068f176 .reloc0xfcd26000 - 0xfcd43000 ftdisk.sys0xfcd26300 - 0xfcd2751a .text0xfcd27520 - 0xfcd27c30 .rdata0xfcd27c40 - 0xfcd27c54 .data0xfcd27c60 - 0xfcd33237 PAGE0xfcd33240 - 0xfcd3efab PAGELK0xfcd3efc0 - 0xfcd3fce8 INIT0xfcd3fd00 - 0xfcd40fd8 .rsrc0xfcd40fe0 - 0xfcd420be .reloc0xf0900000 - 0xf0902000 Diskperf.sys0xf09002e0 - 0xf090099c .text0xf09009a0 - 0xf0900ab0 .rdata0xf0900ac0 - 0xf0900ad8 .data0xf0900ae0 - 0xf09012bf PAGE0xf09012c0 - 0xf09016e2 INIT0xf090170
0 - 0xf0901ac8 .rsrc0xf0901ae0 - 0xf0901bfc .reloc0xf0902000 - 0xf0904000 dmload.sys0xf09022c0 - 0xf0902de0 .text0xf0902de0 - 0xf0902ec0 .rdata0xf0902ec0 - 0xf0902ef8 .data0xf0902f00 - 0xf090314a INIT0xf0903160 - 0xf0903a90 .rsrc0xf0903aa0 - 0xf0903b7e .reloc0xfcd04000 - 0xfcd26000 dmio.sys0xfcd042c0 - 0xfcd1db9a .text0xfcd1dba0 - 0xfcd1de40 .rdata0xfcd1de40 - 0xfcd21978 .data0xfcd21980 - 0xfcd22416 INIT0xfcd22420 - 0xfcd23e58 .rsrc0xfcd23e60 - 0xfcd2521e .reloc0xf0814000 - 0xf0817000 PartMgr.sys0xf08142c0 - 0xf08144ea .text0xf0814500 - 0xf0814640 .rdata0xf0814640 - 0xf081602a PAGE0xf0816040 - 0xf0816582 INIT0xf08165a0 - 0xf0816958 .rsrc0xf0816960 - 0xf0816b6c .reloc0xfccef000 - 0xfcd04000 atapi.sys0xfccef360 - 0xfccf7e98. text0xfccf7ea0 - 0xfccf99eb NONPAGE0xfccf9a00 - 0xfccfa900 .rdata0xfccfa900 - 0xfccfb630 .data0xfccfb640 - 0xfccfc61f PAGESCAN0xfccfc620 - 0xfcd008c5 PAGE0xfcd008e0 - 0xfcd00b59 PAGE_ATA0xfcd00b60 - 0xfcd02b0e INIT0xfcd02b20 - 0xfcd02ed8 .rsrc0xfcd02ee0 - 0xfcd03ac6 .reloc0xf0690000 - 0xf0697000 disk.sys0xf06902e0 - 0xf0692290 .text0xf06922a0 - 0xf0692830 .rdata0xf0692840 - 0xf06928d8 .data0xf06928e0 - 0xf06950c7 PAGE0xf06950e0 - 0xf06961ee INIT0xf0696200 - 0xf06965b8 .rsrc0xf06965c0 - 0xf0696a1e .reloc0xf0420000 - 0xf0429000 CLASSPNP.SYS0xf0420300 - 0xf0423b56 .text0xf0423b60 - 0xf0423d8c .rdata0xf0423da0 - 0xf0423dc4 .data0xf0423de0 - 0xf042695f PAGE0xf0426960 - 0xf042709e .edata0xf04270a0 - 0xf04279ca INIT0xf04279e0 - 0xf0427da8 .rsrc0xf0427dc0 - 0xf042825c .reloc0xfccca000 - 0xfccef000 Fastfat.sys0xfccca2e0 - 0xfcccc3c1 .text0xfcccc3e0 - 0xfcccd29c .rdata0xfcccd2a0 - 0xfcccd660 .data0xfcccd660 - 0xfccea9d4 PAGE0xfccea9e0 - 0xfccec8ba INIT0xfccec8c0 - 0xfccecc88 .rsrc0xfccecca0 - 0xfccee038 .reloc0x
fccb9000 - 0xfccca000 KSecDD.sys0xfccb9360 - 0xfccbe98f .text0xfccbe9a0 - 0xfccbef7c .rdata0xfccbef80 - 0xfccc08a0 .data0xfccc08a0 - 0xfccc3cd0 PAGE0xfccc3ce0 - 0xfccc7420 PAGEMSG0xfccc7420 - 0xfccc7863 .edata0xfccc7880 - 0xfccc8880 PAGER32D0xfccc8880 - 0xfccc8eca INIT0xfccc8ee0 - 0xfccc92c8 .rsrc0xfccc92e0 - 0xfccc9b6e .reloc0xfcc90000 - 0xfccb9000 NDIS.sys0xfcc904a0 - 0xfcc9342e. text0xfcc93440 - 0xfcc93850 .rdata0xfcc93860 - 0xfcc93d90 .data0xfcc93da0 - 0xfcc99f74 PAGENPNP0xfcc99f80 - 0xfcc9f0b3 PAGENDSM0xfcc9f0c0 - 0xfcca7f10 PAGENDSI0xfcca7f20 - 0xfccaa475 PAGENDSP0xfccaa480 - 0xfccab3fc PAGENDSW0xfccab400 - 0xfccad828 PAGENDCO0xfccad840 - 0xfccaea97 PAGENDST0xfccaeaa0 - 0xfccb068e PAGENDSF0xfccb06a0 - 0xfccb1bbf PAGENDSE0xfccb1bc0 - 0xfccb2ba9 PAGENDSA0xfccb2bc0 - 0xfccb55f5 .edata0xfccb5600 - 0xfccb6190 PAGE0xfccb61a0 - 0xfccb76e6 INIT0xfccb7700 - 0xFCCB7AB8.RSRC0XFCCB7AC0 - 0XFCCB8E2C.Reloc0xf0430000 - 0xf0439000 ohci1394.sys0xf04302c0 - 0xf0436fa6.text0xf0436fc0 - 0xf043713 0 .rdata0xf0437140 - 0xf0437f9f PAGE0xf0437fa0 - 0xf043863c INIT0xf0438640 - 0xf0438a10 .rsrc0xf0438a20 - 0xf0438dfe .reloc0xf0440000 - 0xf044b000 1394BUS.SYS0xf0440300 - 0xf044526f .text0xf0445280 - 0xf04453c0 .rdata0xf04453c0 - 0xf0445400 .data0xf0445400 - 0xf04491c5 PAGE0xf04491e0 - 0xf0449238 .edata0xf0449240 - 0xf0449772 INIT0xf0449780 - 0xf0449b40 .rsrc0xf0449b40 - 0xf044a08a .reloc0xfcc7a000 - 0xfcc90000 Mup.sys0xfcc7a2e0 - 0xfcc7bc88 .text0xfcc7bca0 - 0xfcc7c1bc .rdata0xfcc7c1c0 - 0xfcc7dbcc .data0xfcc7dbe0 - 0xfcc8cdcc PAGE0xfcc8cde0 - 0xfcc8d9f2 INIT0xfcc8da00 - 0xfcc8ddc0 .rsrc0xfcc8ddc0 - 0xfcc8f130 .reloc0xf0698000 - 0xf069d000 agp440.sys0xf06982e0 - 0xf0699411 .text0xf0699420 - 0xf0699540 .rdata0xf0699540 - 0xf0699554 .data0xf
0699560 - 0xf069c422 PAGE0xf069c440 - 0xf069c7f6 INIT0xf069c800 - 0xf069cbb8 .rsrc0xf069cbc0 - 0xf069cf94 .reloc0xf0470000 - 0xf047d000 VIDEOPRT.SYS0xf0470340 - 0xf0471bb2 .text0xf0471bc0 - 0xf047224c .rdata0xf0472260 - 0xf04722b8 .data0xf04722c0 - 0xf04799cf PAGE0xf04799e0 - 0xf047a62b .edata0xf047a640 - 0xf047a7e8 PAGE_DAT0xf047a800 - 0xf047b854 INIT0xf047b860 - 0xf047bc20 .rsrc0xf047bc20 - 0xf047c3f4 .reloc0xf032a000 - 0xf03e0000 nv4_mini.sys0xf032a340 - 0xf0391472 .text0xf0391480 - 0xf0391fc9 _NVTEXT30xf0391fe0 - 0xf039304c .rdata0xf0393060 - 0xf03d5ee0 .data0xf03d5ee0 - 0xf03d996b PAGE0xf03d9980 - 0xf03dc46a PAGE0xf03dc480 - 0xf03dcc54 INIT0xf03dcc60 - 0xf03dd098 .rsrc0xf03dd0a0 - 0xf03df67a .reloc0xf06c0000 - 0xf06c7000 fdc.sys0xf06c02e0 - 0xf06c4972 .text0xf06c4980 - 0xf06c4b40 .rdata0xf06c4b40 - 0xf06c4c2a .data0xf06c4c40 - 0xf06c4d7d PAGE0xf06c4d80 - 0xf06c5c78 INIT0xf06c5c80 - 0xf06c6040 .rsrc0xf06c6040 - 0xf06c6530 .reloc0xf0480000 - 0xf0490000 serial.sys0xf0480320 - 0xf0482 555 .text0xf0482560 - 0xf0482700 .rdata0xf0482700 - 0xf04827f4 .data0xf0482800 - 0xf0486b66 PAGESRP00xf0486b80 - 0xf048a2e8 PAGESER0xf048a300 - 0xf048c7ba INIT0xf048c7c0 - 0xf048eaf8 .rsrc0xf048eb00 - 0xf048f2d4 .reloc0xf0878000 - 0xf087c000 serenum.sys0xf0878320 - 0xf0878af6 .text0xf0878b00 - 0xf0878c50 .rdata0xf0878c60 - 0xf0878c64 .data0xf0878c80 - 0xf0879e09 PAGE0xf0879e20 - 0xf087a9a5 PAGESENM0xf087a9c0 - 0xf087aeea INIT0xf087af00 - 0xf087b2c0 .rsrc0xf087b2c0 - 0xf087b492 .reloc0xf06d8000 - 0xf06df000 parport.sys0xf06d82e0 - 0xf06dc346 .text0xf06dc360 - 0xf06dc948 .rdata0xf06dc960 - 0xf06dcb40 .data0xf06dcb40 - 0xf06dcc5b PAGEPARW0xf06dcc60 - 0xf06dd368 INIT0xf06dd380 - 0xf06ddd00 .rsrc0xf06ddd00 - 0xf06de0dc .reloc0xf0490000 - 0xf049c
000 i8042prt.sys0xf0490300 - 0xf04928aa .text0xf04928c0 - 0xf04938f0 .rdata0xf0493900 - 0xf0493d08 .data0xf0493d20 - 0xf04973bd PAGE0xf04973c0 - 0xf04987da PAGEMOUC0xf04987e0 - 0xf049958c INIT0xf04995a0 - 0xf049b258 .rsrc0xf049b260 - 0xf049b970 .reloc0xf06e8000 - 0xf06ee000 mouclass.sys0xf06e82e0 - 0xf06e9b1a .text0xf06e9b20 - 0xf06e9cf0 .rdata0xf06e9d00 - 0xf06ea068 .data0xf06ea080 - 0xf06eb4a3 PAGE0xf06eb4c0 - 0xf06ec2ec INIT0xf06ec300 - 0xf06ecf50 .rsrc0xf06ecf60 - 0xf06ed3f4 .reloc0xf06f8000 - 0xf06fe000 kbdclass.sys0xf06f82e0 - 0xf06f9df2 .text0xf06f9e00 - 0xf06f9fe0 .rdata0xf06f9fe0 - 0xf06fa364 .data0xf06fa380 - 0xf06fbe3b PAGE0xf06fbe40 - 0xf06fccfa INIT0xf06fcd00 - 0xf06fd960 .rsrc0xf06fd960 - 0xf06fde92 .reloc0xf04a0000 - 0xf04ad000 Cdr4_2K.SYS0xf04a02c0 - 0xf04ab762 .text0xf04ab780 - 0xf04ab8e8 .rdata0xf04ab900 - 0xf04abdfc .data0xf04abe00 - 0xf04ac41e INIT0xf04ac420 - 0xf04ac780 .rsrc0xf04ac780 - 0xf04acccc .reloc0xf0710000 - 0xf0717000 cdrom.sys0xf0710360 - 0xf07147ec .tex t0xf0714800 - 0xf07149ec .rdata0xf0714a00 - 0xf0714a2c .data0xf0714a40 - 0xf071559b PAGE0xf07155a0 - 0xf07155d9 PAGEHIT20xf07155e0 - 0xf0715750 PAGEHITA0xf0715760 - 0xf0715962 PAGETOSH0xf0715980 - 0xf071628c INIT0xf07162a0 - 0xf0716660 .rsrc0xf0716660 - 0xf07169c4 .reloc0xf0720000 - 0xf0726000 Cdralw2k.SYS0xf07202c0 - 0xf0723e94 .text0xf0723ea0 - 0xf0724064 .rdata0xf0724080 - 0xf0724210 .data0xf0724220 - 0xf0724abe INIT0xf0724ac0 - 0xf0724e40 .rsrc0xf0724e40 - 0xf0725238 .reloc0xf0740000 - 0xf0745000 USBD.SYS0xf0740300 - 0xf074202e .text0xf0742040 - 0xf07421a0 .rdata0xf07421a0 - 0xf07423b1 .data0xf07423c0 - 0xf0743ee9 PAGE0xf0743f00 - 0xf07443aa .edata0xf07443c0 - 0xf07448d4 INIT0xf07448e0 - 0xf0744ca0 .rsrc0xf0744ca0 - 0xf0744f4a .reloc0xf
0730000 - 0xf0738000 uhcd.sys0xf07302e0 - 0xf0736014 .text0xf0736020 - 0xf07361a0 .rdata0xf07361a0 - 0xf0736208 .data0xf0736220 - 0xf0736eab PAGE0xf0736ec0 - 0xf073757a INIT0xf0737580 - 0xf0737950 .rsrc0xf0737960 - 0xf0737c70 .reloc0xf04b0000 - 0xf04be000 mf.sys0xf04b02e0 - 0xf04b14e8 .text0xf04b1500 - 0xf04b7b38 .rdata0xf04b7b40 - 0xf04b99a8 .data0xf04b99c0 - 0xf04bca07 PAGE0xf04bca20 - 0xf04bcf16 INIT0xf04bcf20 - 0xf04bd2d8 .rsrc0xf04bd2e0 - 0xf04bde4a .reloc0xf0758000 - 0xf075d000 RTL8139.SYS0xf0758400 - 0xf075b1af .text0xf075b200 - 0xf075b2fd .data0xf075b400 - 0xf075b7ce PAGE0xf075b800 - 0xf075bda0 INIT0xf075be00 - 0xf075c3a0 .rsrc0xf075c400 - 0xf075c668 .reloc0xf0888000 - 0xf088b000 fsvga.sys0xf08882c0 - 0xf0889ce4 .text0xf0889d00 - 0xf0889e2c .rdata0xf0889e40 - 0xf0889e88 .data0xf0889ea0 - 0xf088a694 INIT0xf088a6a0 - 0xf088adf0 .rsrc0xf088ae00 - 0xf088af3c .reloc0xf09d6000 - 0xf09d7000 audstub.sys0xf09d62c0 - 0xf09d6360 .rdata0xf09d6360 - 0xf09d64ed PAGE0xf09d6500 - 0xf09d6640 IN IT0xf09d6640 - 0xf09d69f0 .rsrc0xf09d6a00 - 0xf09d6a3c .reloc0xf04c0000 - 0xf04cd000 rasl2tp.sys0xf04c02c0 - 0xf04cafa7 .text0xf04cafc0 - 0xf04cb0fc .rdata0xf04cb100 - 0xf04cb2a0 .data0xf04cb2a0 - 0xf04cbc06 INIT0xf04cbc20 - 0xf04cc000 .rsrc0xf04cc000 - 0xf04cc55c .reloc0xf0890000 - 0xf0893000 ndistapi.sys0xf08902e0 - 0xf0891490 .text0xf08914a0 - 0xf089159c .rdata0xf08915a0 - 0xf08915f4 .data0xf0891600 - 0xf08916c0 .edata0xf08916c0 - 0xf0891be2 INIT0xf0891c00 - 0xf0891fe0 .rsrc0xf0891fe0 - 0xf089221c .reloc0xf0313000 - 0xf032a000 ndiswan.sys0xf03132c0 - 0xf0324893 .text0xf03248a0 - 0xf0325868 .rdata0xf0325880 - 0xf0326114 .data0xf0326120 - 0xf0327f22 INIT0xf0327f40 - 0xf0328330 .rsrc0xf0328340 - 0xf032916c .reloc0xf089c000 - 0xf08a0000 TDI .
SYS0xf089c300 - 0xf089e9ba .text0xf089e9c0 - 0xf089eb4e .rdata0xf089eb60 - 0xf089ec8c .data0xf089eca0 - 0xf089edbc PAGE0xf089edc0 - 0xf089f419 .edata0xf089f420 - 0xf089f94a INIT0xf089f960 - 0xf089fcf8 .rsrc0xf089fd00 - 0xf089ff28 .reloc0xf04d0000 - 0xf04dc000 raspptp.sys0xf04d02c0 - 0xf04da138 .text0xf04da140 - 0xf04da393 .rdata0xf04da3a0 - 0xf04da6b8 .data0xf04da6c0 - 0xf04dae4e INIT0xf04dae60 - 0xf04db230 .rsrc0xf04db240 - 0xf04db9d0 .reloc0xf0780000 - 0xf0785000 ptilink.sys0xf07802e0 - 0xf078352d .text0xf0783540 - 0xf0783670 .rdata0xf0783680 - 0xf078371c .data0xf0783720 - 0xf078383d .edata0xf0783840 - 0xf0783d10 INIT0xf0783d20 - 0xf0784120 .rsrc0xf0784120 - 0xf07843c4 .reloc0xf0790000 - 0xf0795000 raspti.sys0xf07902c0 - 0xf0792e40 .text0xf0792e40 - 0xf0792fd0 .rdata0xf0792fe0 - 0xf0793240 .data0xf0793240 - 0xf0793aa0 INIT0xf0793aa0 - 0xf0793e98 .rsrc0xf0793ea0 - 0xf07940ce .reloc0xf04e0000 - 0xf04ef000 parallel.sys0xf04e02e0 - 0xf04ebdb2 .text0xf04ebdc0 - 0xf04ec6b8 .rdata0xf04ec6c0 - 0xf04eced4 .data0xf04ecee0 - 0xf04ed04d PAGEPARW0xf04ed060 - 0xf04ed9cc INIT0xf04ed9e0 - 0xf04ee000 .rsrc0xf04ee000 - 0xf04ee998 .reloc0xf07a8000 - 0xf07b0000 RMSPPPOE.SYS0xf07a82c0 - 0xf07ae542 .text0xf07ae560 - 0xf07ae942 .rdata0xf07ae960 - 0xf07ae9e0 .data0xf07ae9e0 - 0xf07af21e INIT0xf07af220 - 0xf07af658 .rsrc0xf07af660 - 0xf07af938 .reloc0xf02cd000 - 0xf02eb000 ks. sys0xf02cd360 - 0xf02d3512 .text0xf02d3520 - 0xf02d3d39 .rdata0xf02d3d40 - 0xf02d3d6c .data0xf02d3d80 - 0xf02e5167 PAGE0xf02e5180 - 0xf02e6fa9 .edata0xf02e6fc0 - 0xf02e8054 PAGECONS0xf02e8060 - 0xf02e90b0 INIT0xf02e90c0 - 0xf02e94a8 .rsrc0xf02e94c0 - 0xf02eaa00 .reloc0xf09d7000 - 0xf09d8000 swenum.sys0xf09d72c0 - 0xf09d739e .text0xf09d73a0 - 0xf09d7445 .rdata0xf09d7460 -
0xf09d7684 PAGE0xf09d76a0 - 0xf09d78d2 INIT0xf09d78e0 - 0xf09d7d00 .rsrc0xf09d7d00 - 0xf09d7d76 .reloc0xf02b8000 - 0xf02cd000 update.sys0xf02b8320 - 0xf02b8524 .text0xf02b8540 - 0xf02b85ac .rdata0xf02b85c0 - 0xf02b85dc .data0xf02b85e0 - 0xf02b8e51 PAGE0xf02b8e60 - 0xf02cbe60 PAGELK0xf02cbe60 - 0xf02cc172 INIT0xf02cc180 - 0xf02cc7f0 .rsrc0xf02cc800 - 0xf02cc884 .reloc0xf07c0000 - 0xf07c5000 flpydisk .sys0xf07c02e0 - 0xf07c097a .text0xf07c0980 - 0xf07c0b1c .rdata0xf07c0b20 - 0xf07c0fb8 .data0xf07c0fc0 - 0xf07c3b83 PAGE0xf07c3ba0 - 0xf07c4374 INIT0xf07c4380 - 0xf07c4730 .rsrc0xf07c4740 - 0xf07c4a66 .reloc0xf0510000 - 0xf051a000 usbhub.sys0xf05102e0 - 0xf0513b1e .text0xf0513b20 - 0xf0513e2e .rdata0xf0513e40 - 0xf0513f78 .data0xf0513f80 - 0xf051883f PAGE0xf0518840 - 0xf0519080 INIT0xf0519080 - 0xf0519448 .rsrc0xf0519460 - 0xf0519b36 .reloc0xef206000 - 0xef22b000 portcls.sys0xef206320 - 0xef210515 .text0xef210520 - 0xef2131c0 .rdata0xef2131c0 - 0xef215ad8 .data0xef215ae0 - 0xef226f8b PAGE0xef 226fa0 - 0xef227642 .edata0xef227660 - 0xef2286cc INIT0xef2286e0 - 0xef228ad8 .rsrc0xef228ae0 - 0xef22a48c .reloc0xef22b000 - 0xef2b8000 adm8820.sys0xef22b320 - 0xef26f5b0 .text0xef26f5c0 - 0xef2723dc .rdata0xef2723e0 - 0xef2b3d48 .data0xef2b3d60 - 0xef2b3d64 .CRT0xef2b3d80 - 0xef2b4631 PAGE0xef2b4640 - 0xef2b4f90 INIT0xef2b4fa0 - 0xef2b5380 .rsrc0xef2b5380 - 0xef2b7938. reloc0xf08a4000 - 0xf08a7000 admjoy.sys0xf08a42c0 - 0xf08a47fd .text0xf08a4800 - 0xf08a4920 .rdata0xf08a4920 - 0xf08a5b92 PAGE0xf08a5ba0 - 0xf08a600c INIT0xf08a6020 - 0xf08a6420 .rsrc0xf08a6420 - 0xf08a65b4 .reloc0xf0520000 - 0xf052a000 NDProxy.SYS0xf05202c0 - 0xf0527d5c .text0xf0527d60 - 0xf0527ed0 .rdata0xf0527ee0 - 0xf05286e8 .data0xf0528700 - 0xf0529080 INIT0xf0529080 -
0xf0529428 .rsrc0xf0529440 - 0xf0529cca .reloc0xf0910000 - 0xf0912000 Fs_Rec.SYS0xf09102e0 - 0xf09102f2 .text0xf0910300 - 0xf0910416 .rdata0xf0910420 - 0xf0910474 .data0xf0910480 - 0xf091110b PAGE0xf0911120 - 0xf09116fe INIT0xf0911700 - 0xf0911ad0 .rsrc0xf0911ae0 - 0xf0911bb4 .reloc0xf09d8000 - 0xf09d9000 Null.SYS0xf09d82c0 - 0xf09d8350 .rdata0xf09d8360 - 0xf09d8447 PAGE0xf09d8460 - 0xf09d85f2 INIT0xf09d8600 - 0xf09d89a0 .rsrc0xf09d89a0 - 0xf09d89cc .reloc0xf09d9000 - 0xf09da000 Beep.SYS0xf09d9280 - 0xf09d96b8 .text0xf09d96c0 - 0xf09d97a0 .rdata0xf09d97a0 - 0xf09d9a76 INIT0xf09d9a80 - 0xf09d9e20 .rsrc0xf09d9e20 - 0xf09d9ece .reloc0xf08c0000 - 0xf08c4000 vga.sys0xf08c02e0 - 0xf08c03c0 .text0xf08c03c0 - 0xf08c0490 .rdata0xf08c04a0 - 0xf08c27ec PAGE0xf08c2800 - 0xf08c2c3a PAGE_DAT0xf08c2c40 - 0xf08c2ffc INIT0xf08c3000 - 0xf08c33b8 .rsrc0xf08c33c0 - 0xf08c3564 .reloc0xf09da000 - 0xf09db000 mnmdd.SYS0xf09da2e0 - 0xf09da2ec .text0xf09da300 - 0xf09da3a0 .rdata0xf09da3a0 - 0xf09da6c3 PAGE0xf09 da6e0 - 0xf09daa0c PAGE0xf09daa20 - 0xf09dab52 INIT0xf09dab60 - 0xf09daf28 .rsrc0xf09daf40 - 0xf09daf80 .reloc0xf07e8000 - 0xf07ee000 Msfs.SYS0xf07e82e0 - 0xf07e84a8 .text0xf07e84c0 - 0xf07e891c .rdata0xf07e8920 - 0xf07e8930 .data0xf07e8940 - 0xf07ec222 PAGE0xf07ec240 - 0xf07ec884 INIT0xf07ec8a0 - 0xf07ecc48 .rsrc0xf07ecc60 - 0xf07ed22a .reloc0xf0540000 - 0xf0549000 Npfs. SYS0xf05402e0 - 0xf0541c2a .text0xf0541c40 - 0xf05421f4 .rdata0xf0542200 - 0xf05422b4 .data0xf05422c0 - 0xf0547617 PAGE0xf0547620 - 0xf0548282 INIT0xf05482a0 - 0xf0548640 .rsrc0xf0548640 - 0xf0548f98 .reloc0xf091c000 - 0xf091e000 rasacd.sys0xf091c2e0 - 0xf091d0e0 .text0xf091d0e0 - 0xf091d1c0 .rdata0xf091d1c0 - 0xf091d2d4 .data0xf091d2e0 - 0xf091d3f7 PAGE0xf091d400 - 0xf091
d84a INIT0xf091d860 - 0xf091dc30 .rsrc0xf091dc40 - 0xf091de32 .reloc0xef15b000 - 0xef1a6000 tcpip.sys0xef15b340 - 0xef1934da .text0xef1934e0 - 0xef1939d4 .rdata0xef1939e0 - 0xef196950 .data0xef196960 - 0xef19a2d3 PAGE0xef19a2e0 - 0xef19d2ad PAGEIPMc0xef19d2c0 - 0xef19d580 .edata0xef19d580 - 0xef1a1f7a INIT0xef1a1f80 - 0xef1a2348 .rsrc0xef1a2360 - 0xef1a5844 .reloc0xf0550000 - 0xf0559000 msgpc.sys0xf05502e0 - 0xf0557104 .text0xf0557120 - 0xf05571d0 .rdata0xf05571e0 - 0xf05576d0 .data0xf05576e0 - 0xf055789d PAGE0xf05578a0 - 0xf0557c8e INIT0xf0557ca0 - 0xf0558068 .rsrc0xf0558080 - 0xf05586c4 .reloc0xf07f8000 - 0xf0800000 wanarp.sys0xf07f82e0 - 0xf07fcf5c .text0xf07fcf60 - 0xf07fd100 .rdata0xf07fd100 - 0xf07fd408 .data0xf07fd420 - 0xf07fe181 PAGE0xf07fe1a0 - 0xf07feb7c INIT0xf07feb80 - 0xf07fef60 .rsrc0xf07fef60 - 0xf07ff950 .reloc0xef136000 - 0xef15b000 netbt.sys0xef136320 - 0xef14e8b8 .text0xef14e8c0 - 0xef14eb5a .rdata0xef14eb60 - 0xef14f124 .data0xef14f140 - 0xef1568ac PAGE0xef1568c0 - 0xef156f2b PAGENBT0xef156f40 - 0xef15850c INIT0xef158520 - 0xef1588d8 .rsrc0xef1588e0 - 0xef15a4c4 .reloc0xf0560000 - 0xf0569000 netbios.sys0xf05602e0 - 0xf0563b94 .text0xf0563ba0 - 0xf0563d34 .rdata0xf0563d40 - 0xf0563ff4 .data0xf0564000 - 0xf0566d49 PAGE0xf0566d60 - 0xf0567646 INIT0xf0567660 - 0xf0567a28 .rsrc0xf0567a40 - 0xf056818c .reloc0xef078000 - 0xef096000 Siwvid.SYS0xef0782e0 - 0xef078387 _LTEXT0xef0783a0 - 0xef081172 .text0xef081180 - 0xef093878 .data0xef093880 - 0xef093888 _LDATA0xef0938a0 - 0xef093e7c INIT0xef093e80 - 0xef094248 .rsrc0xef094260 - 0xef095314 .reloc0xef056000 - 0xef078000 rdbss.sys0xef056300 - 0xef05cf8f .text0xef05cfa0 - 0xef05d706 .rdata0xef05d720 - 0xef05deb4 .data0xef05dec0 - 0xef073139 PAGE0xef073140 - 0xef0
73ec4 .edata0xef073ee0 - 0xef075e2e INIT0xef075e40 - 0xef076240 .rsrc0xef076240 - 0xef077394 .reloc0xeefe6000 - 0xef044000 mrxsmb.sys0xeefe63c0 - 0xeeffc707 .text0xeeffc720 - 0xeeffc983 SECUR0xeeffc9a0 - 0xeeffda17 .rdata0xeeffda20 - 0xef002f51 .data0xef002f60 - 0xef03b767 PAGE0xef03b780 - 0xef03cac0 PAGE4BRO0xef03cac0 - 0xef03cefc PAGE5NET0xef03cf00 - 0xef03cf33 .edata0xef03cf40 - 0xef03cf8c PAGE0xef03cfa0 - 0xef03f6a2 INIT0xef03f6c0 - 0xef03fa80 .rsrc0xef03fa80 - 0xef0431e0 .reloc0xa0000000 - 0xa01a6000 win32k.sysJiurlReadProcessMemory Failed0xecdd8000 - 0xecfae000 nv4_disp.dll0xecdd8320 - 0xecf2222a .text0xecf22240 - 0xecf484e4 .rdata0xecf48500 - 0xecf8fed8 .data0xecf8fee0 - 0xecf8fee8 .CRT0xecf8ff00 - 0xecf8ffba .edata0xecf8ffc0 - 0xecf90656 INIT0xecf90660 - 0xecf90ae0 .rsrc0xecf90ae0 - 0xecfada14 .reloc0xeba25000 - 0xeba3f000 afd.sys0xeba25320 - 0xeba26a5c .text0xeba26a60 - 0xeba27348 .rdata0xeba27360 - 0xeba278cc .data0xeba278e0 - 0xeba35fa5 PAGEAFD0xeba35fc0 - 0xeba3b8e1 PAGE0xe ba3b900 - 0xeba3d248 INIT0xeba3d260 - 0xeba3d630 .rsrc0xeba3d640 - 0xeba3e978 .reloc0xf0932000 - 0xf0934000 ParVdm.SYS0xf09322c0 - 0xf09327d4 .text0xf09327e0 - 0xf09328c8 .rdata0xf09328e0 - 0xf09328f4 .data0xf0932900 - 0xf093310a INIT0xf0933120 - 0xf0933778 .rsrc0xf0933780 - 0xf0933846 .reloc0xebb47000 - 0xebb4b000 Aspi32.SYS0xebb47240 - 0xebb49d2a .text0xebb49d40 - 0xebb49e94 .data0xebb49ea0 - 0xebb4a504 INIT0xebb4a520 - 0xebb4a894 .rsrc0xebb4a8a0 - 0xebb4ab7c .reloc0xf06f0000 - 0xf06f7000 cis1284.sys0xf06f0280 - 0xf06f57e0 .text0xf06f57e0 - 0xf06f6008 .data0xf06f6020 - 0xf06f6552 INIT0xf06f6560 - 0xf06f6920 .rsrc0xf06f6920 - 0xf06f6d1a .reloc0xeb9c2000 - 0xeb9d5000 wdmaud.sys0xeb9c2340 - 0xeb9c4522 .text0xeb9c4540 - 0xeb9c4838. RDATA0XEB9
