Sorry for my bad english
No i don't mean the Original Entry Point
What i really mean is :
if goto the offset reported by procdump and PE-Explorer as Entry point, and changed it to 'CC' i.e. 'Int 3' .
is there *ANY* chance of that code not being the FIRST thing that is run..???
meaning could the PE Header report an entry point but the EXE starts from another one..???
|