View Single Post
  #5  
Old 03-27-2003, 18:02
kade
 
Posts: n/a
Ok, I switched over to Ollydbg and now it is getting interesting because I get the following warning :

---------------------
"Module 'StarVW' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breqdpoints!"
---------------------

Of course StarVW is the name of my target. If I click OK I get the following message box :

----------------------
Compressed code?

Quick statistical test of module 'StarVW' reports that its code section is either compressed, encrypted, or contains large amount of embedded data. Results of code analysis can be very unreliable or simply wrong. Do you want to continue analysis?

YES/NO
-----------------------

Does this mean that there is another file where the entry point resides?

Another stange thing I noticed is that the program makes a .tmp file in the temp directory and filemon shows that this file acts as a process, does this has anything to do with the encryption or compression?
Reply With Quote