Dumpbin 输出，什么意思？

Question

If I do something like this:

dumpbin myexe.exe

I got output similar to:

Dump of file myexe.exe

File Type: EXECUTABLE IMAGE

Summary

   21000 .data
    1000 .gfids
  3C9000 .rdata
   4F000 .reloc
   B4000 .rsrc
  325000 .text
    1000 .tls

Second column (.data, .gfids, .rdata...) represents section name. But what is first column? Section size?

Answer 1

This value is actually the aligned section size.

If you do dumpbin /headers myexe.exe , you will get a more verbose output. For example, dumpbin C:\\Windows\\explorer.exe on my system produces:

Dump of file c:\Windows\explorer.exe

File Type: EXECUTABLE IMAGE

Summary

    4000 .data
    1000 .didat
    1000 .imrsiv
   18000 .pdata
   7B000 .rdata
    6000 .reloc
  1EA000 .rsrc
  1C5000 .text

dumpbin /headers C:\\Windows\\explorer.exe , contains the output for the .text section as follows (... = lines omitted):

...
SECTION HEADER #1
   .text name
  1C4737 virtual size
    1000 virtual address (0000000140001000 to 00000001401C5736)
  1C4800 size of raw data
     400 file pointer to raw data (00000400 to 001C4BFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read
...

It also gives 1000 section alignment in the OPTIONAL HEADER VALUES section.

As you can see, the size of the .text section is actually 1C4737 , when aligned, it becomes 1C5000 , as reported in the /summary (which is the default option for dumpbin).