![]() |
|
#1
|
|||
|
|||
|
Hello,
sorry for posting this (probably most stupid) question but not having been able to understand it alone ..... Anyway, I have an application that loaded with ollydbg makes it display the usual "Module xxxxxx has entry point outside code (as specified in the PE header). Maybe ....". Now, the application isn't packed .... but this is not the point, the point is why the message??? I mean, what does ollydbg display such a message??? I thought it was due to the entry point's section characteristics and in fact the section containing the EP does not have a CODE and a MEM_EXECUTE flag. Unfortunately changing its characteristics assigning both of them to it (going from C0000040 to E000020) has no sort of effect. What then maked ollydbg state that the entry point is outside code??? Also, I was wondering, in ollydbg's Memory Map what determines what is displayed in the "Contains" column??? I thought ollydbg analyzed all section's characteristics but by changing them with a tool such as LordPE or PETools does not cause any changes in what get displayed in that column!!! yaa |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Can I move Entry Point to the middle of the codz ? | netxman | General Discussion | 11 | 11-23-2005 08:51 |
| how to get the address of the entry point in an API | Warren | General Discussion | 6 | 08-30-2005 16:18 |
| Is it possable breakpoint on entry point of DLL | jadesk99 | General Discussion | 17 | 01-18-2004 12:08 |
| How to make sure this is really the Entry Point | merursinecury | General Discussion | 7 | 04-13-2003 08:20 |