Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #2  
Old 02-17-2011, 09:16
D-Jester's Avatar
D-Jester D-Jester is offline
VIP
 
Join Date: Nov 2003
Location: Ohio, USA
Posts: 269
Rept. Given: 39
Rept. Rcvd 61 Times in 41 Posts
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
D-Jester Reputation: 61
Heya RaptorX

Ok I'll break this down for ya.

First: 60A8EC is the correct EP for that executable.

Code:
00400128    ECA82000    DD 0020A8EC          ;  AddressOfEntryPoint = 20A8EC
00400134    00004000    DD 00400000          ; ImageBase = 400000
Second what you have done mistakenly is looked at the PE header of a loaded DLL, not the executable you are debugging. Which is why the EP of your dubugged target doesn't match the PE header of the DLL.

Code:
00340118    DF310600    DD 000631DF          ;  AddressOfEntryPoint = 631DF
00340124    0000417E    DD 7E410000          ; ImageBase = E410000
I can go into further detail if you need it, let me know.
__________________
Even as darkness envelops and consumes us, wrapping around our personal worlds like the hand that grips around our necks and suffocates us, we must realize that life really is beautiful and the shadows of despair will scurry away like the fleeting roaches before the light.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Finding which packer has been used rcer General Discussion 16 11-03-2019 01:56
Finding API Address britedream General Discussion 5 10-05-2006 21:28


All times are GMT +8. The time now is 20:42.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )