View Single Post
  #1  
Old 08-30-2005, 14:59
wildmans
 
Posts: n/a
Difference dumping @ OEP or runtime ?

I am wondering.. Why is is essential to dump an compressed DLL while locking it (eg jmp eip) at the OEP ?? I mean why not just let it finish loading and dump it while it is active in memory ? Does it get recompressed after finishing the init code or something ?

Just wondering... I dumped a (compressed) dll while locking it at the OEP, and I dumped the same dll while it was loaded by the host app. I saw no major differences...
Reply With Quote