![]() |
|
|
|
#1
|
|||
|
|||
|
The _CorExeMain function is indeed the main entrypoint of .NET runtime loader. However, things are a little more complicated. On Windows 2000, the Windows PE loader treated .NET exes just like normal ones regarding this import - you could put a BP there and it would stop. With XP though, the Windows PE loader handles .NET assemblies internally, and don't call/use that entry in import table.
Besides, like others said, .NET assemblies are just bytecode compiled to native instructions in runtime. So, you can't use x86 debuggers (well, you can, but you'd be tracing framework's compiler/runtime Use, for example, cordbg from .NET SDK (MSDN article)
|
|
#2
|
|||
|
|||
|
You could not trace dot net file by OllyDbg or SoftICE. It is not a normal PE files. Indeed program runs in Virtual Machine of dot net core. It is clear by normal assembly debugger, you do not have any success to trace by OllyDbg. It has IL assembly langauge codes which run in a VM such as Java VM. If you want to trace a dot net program, the following link might be useful to you:
http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html
|
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Olly pdk 1.08 | ragdog | General Discussion | 4 | 01-05-2014 21:16 |
| Any news on Olly? | theCaller | General Discussion | 24 | 10-11-2012 15:02 |
| try to open this with olly | taos | General Discussion | 6 | 07-14-2005 07:58 |
| Olly BPM | apex | General Discussion | 1 | 02-25-2005 15:02 |