Quote:
Originally Posted by Carbon
@Newbie_Cracker
I don't get it. You need to find the OEP yourself?
|
In Scylla, like ImpRec, when you choose a process, the OEP is read from PE header and automatically is shown in OEP text box.
Imprec does the same for DLLs, but Scylla does not.
It seems that it reads the ImageBase and ImageSize from memory (I haven't debugged it to check), but it does not read the OEP from the disk/memory.