|
@RemedY
get hiewdemo, open it and load a exe file
in your windows parent, now press F4 decode,
now F8 and next F5, you will be at EntryPoint (OEP)
Every linker generates other bytes !
Example 55 8b and so on
or another linker 6a 70 and so on,
these bytes are the stolen bytes.
They were executed (sometimes emulated) after unpack
and before the jump to main exe file.
OK
(get packer demo, pack notepad, and see what's happening)
|