Difference dumping @ OEP or runtime ? - Exetools

Exetools

		Exetools > General > General Discussion
Difference dumping @ OEP or runtime ?

Prev

Previous Post

Next Post

Next

#1

Old

08-30-2005, 14:59

wildmans

Posts: n/a

Difference dumping @ OEP or runtime ?

I am wondering.. Why is is essential to dump an compressed DLL while locking it (eg jmp eip) at the OEP ?? I mean why not just let it finish loading and dump it while it is active in memory ? Does it get recompressed after finishing the init code or something ?

Just wondering... I dumped a (compressed) dll while locking it at the OEP, and I dumped the same dll while it was loaded by the host app. I saw no major differences...

Reply With Quote

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
[Off Topic] Difference between ATX12V 2.0 and EPS12V power supply	Kerlingen	General Discussion	0	01-23-2005 02:36
runtime libs linked in to exe, IDA question.	Wannabe	General Discussion	7	08-02-2004 11:00
Compuware Difference DriverStudio and DrvierSuite	X-ten	General Discussion	5	02-27-2004 23:38

All times are GMT +8. The time now is 19:07.