|
Difference dumping @ OEP or runtime ?
I am wondering.. Why is is essential to dump an compressed DLL while locking it (eg jmp eip) at the OEP ?? I mean why not just let it finish loading and dump it while it is active in memory ? Does it get recompressed after finishing the init code or something ?
Just wondering... I dumped a (compressed) dll while locking it at the OEP, and I dumped the same dll while it was loaded by the host app. I saw no major differences...
|