|
|
#4
04-11-2004, 03:07
|
|||
|
|||
|
bart,
it is not a question of EP being or not inside the first section but of EP being inside a section that is not marked as being code. And as I already said, the application is not packed (it was initially packed with UPX). Can it be that UPX does not reset PE header to its original values when used to decompress a packed app??? Anyhow, what I still don't get is how sections that are both not marked as code and as executable (based on their section flags) and that are also not marked as code (based on PE header values) can still be executed as code without problems!! yaa Last edited by yaa; 04-11-2004 at 03:16. 
|
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Can I move Entry Point to the middle of the codz ? | netxman | General Discussion | 11 | 11-23-2005 08:51 |
| how to get the address of the entry point in an API | Warren | General Discussion | 6 | 08-30-2005 16:18 |
| Is it possable breakpoint on entry point of DLL | jadesk99 | General Discussion | 17 | 01-18-2004 12:08 |
| How to make sure this is really the Entry Point | merursinecury | General Discussion | 7 | 04-13-2003 08:20 |
Threaded Mode