Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 11-10-2005, 21:12
omega_red
 
Posts: n/a
The _CorExeMain function is indeed the main entrypoint of .NET runtime loader. However, things are a little more complicated. On Windows 2000, the Windows PE loader treated .NET exes just like normal ones regarding this import - you could put a BP there and it would stop. With XP though, the Windows PE loader handles .NET assemblies internally, and don't call/use that entry in import table.

Besides, like others said, .NET assemblies are just bytecode compiled to native instructions in runtime. So, you can't use x86 debuggers (well, you can, but you'd be tracing framework's compiler/runtime Use, for example, cordbg from .NET SDK (MSDN article)
Reply With Quote
  #2  
Old 11-11-2005, 14:56
vodu
 
Posts: n/a
You could not trace dot net file by OllyDbg or SoftICE. It is not a normal PE files. Indeed program runs in Virtual Machine of dot net core. It is clear by normal assembly debugger, you do not have any success to trace by OllyDbg. It has IL assembly langauge codes which run in a VM such as Java VM. If you want to trace a dot net program, the following link might be useful to you:

http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Olly pdk 1.08 ragdog General Discussion 4 01-05-2014 21:16
Any news on Olly? theCaller General Discussion 24 10-11-2012 15:02
try to open this with olly taos General Discussion 6 07-14-2005 07:58
Olly BPM apex General Discussion 1 02-25-2005 15:02


All times are GMT +8. The time now is 10:32.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )