Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 02-11-2004, 16:09
least
 
Posts: n/a
Hi,
when you are in IDA, look on the bottom of the window, you'll see there some info; for me the fourth is the offset that you need to find in winhex. Also when you'll use HIEW or BIEW, you can turn on relative adresses, which will be the same as IDA uses in the disassembly.
Concerning the PeID, it identifies mainly commercial or well known protections; when it says nothing, then the program can still be protected. The best way how to find if there is any protection is to make it trigger to see how it works. Do you suppose that there is CRC check? Try to change something unimportant (like char in the This program doesn't run in DOS NAG in PE header, or some nulls at the end of code section) and see whats going on. And so no. Also pay attention to strings you can find in it. Remember, gain as much knowledge on your adversary as you can before you start messing with him
Regards,
least
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
two questions for admin TomaHawk General Discussion 8 04-01-2014 00:51
Humor and a few questions. Innocent General Discussion 6 08-10-2004 02:51
Armadillo questions? ManSun General Discussion 20 05-12-2004 17:46
2 questions (IDA / Windows 2k/2k3) skyper General Discussion 8 04-22-2004 08:44
some unpacking questions gnasher General Discussion 2 01-03-2004 20:44


All times are GMT +8. The time now is 13:43.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )