View Single Post
  #43  
Old 09-04-2013, 17:44
Newbie_Cracker's Avatar
Newbie_Cracker Newbie_Cracker is offline
VIP
 
Join Date: Jan 2005
Posts: 227
Rept. Given: 72
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 49
Thanks Rcvd at 25 Times in 18 Posts
Newbie_Cracker Reputation: 26
Quote:
Originally Posted by Carbon View Post
@Newbie_Cracker
I don't get it. You need to find the OEP yourself?
In Scylla, like ImpRec, when you choose a process, the OEP is read from PE header and automatically is shown in OEP text box.

Imprec does the same for DLLs, but Scylla does not.

It seems that it reads the ImageBase and ImageSize from memory (I haven't debugged it to check), but it does not read the OEP from the disk/memory.
__________________
In memory of UnREal RCE...
Reply With Quote