Thread: Finding Correct EP
View Single Post
  #2  
Old 02-17-2011, 09:16
D-Jester's Avatar
D-Jester D-Jester is offline
VIP
  
Join Date: Nov 2003
Location: Ohio, USA
Posts: 269
Rept. Given: 39
Rept. Rcvd 61 Times in 41 Posts
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
D-Jester Reputation: 61
Heya RaptorX

Ok I'll break this down for ya.

First: 60A8EC is the correct EP for that executable.

Code:
00400128    ECA82000    DD 0020A8EC          ;  AddressOfEntryPoint = 20A8EC
00400134    00004000    DD 00400000          ; ImageBase = 400000
Second what you have done mistakenly is looked at the PE header of a loaded DLL, not the executable you are debugging. Which is why the EP of your dubugged target doesn't match the PE header of the DLL.

Code:
00340118    DF310600    DD 000631DF          ;  AddressOfEntryPoint = 631DF
00340124    0000417E    DD 7E410000          ; ImageBase = E410000
I can go into further detail if you need it, let me know.
__________________
Even as darkness envelops and consumes us, wrapping around our personal worlds like the hand that grips around our necks and suffocates us, we must realize that life really is beautiful and the shadows of despair will scurry away like the fleeting roaches before the light.
Reply With Quote