View Single Post
  #8  
Old 04-12-2004, 11:56
archphase
 
Posts: n/a
OK, well like say our original EP was like 1010h which could be in our .text section, you'd also notice that OptionalHeader field .BaseOfCode would be 1000h or the RVA of .text in memory -- you can check this w/ .text Section Header field aswell..

Anyways if the file is packed and a new section is added like e.g: .foo at RVA 4000h and entrypoint is now 4010h in .foo and BaseOfCode is not updated then you get your info message from olly.
Reply With Quote