Posted: Sun Jan 19, 2014 12:20 pm Post subject: Question about packed files
Recently started messing around with packers
and bumped into this packer that set the entry-point for the packed dll outside the dll boundaries.
I mean.. the packed dll size is 14,696 bytes (3968 in hex) and the it's entry-point is located at RVA: 0x01048C
plus, when i set a breakpoint at its EP, it won't even get there when execute.
Could it be hidden or something like that?
pretty new to this whole packing thing
even if it does
how could it be executed before the entry point?
isn't it the first place where the execution begins?
it's weird cuz when i debug it with ollydbg it says the entry point for the packed dll
but when opening with PE Explorer the entry point is set for the place after the unpacking process..
O_O ?!
even when i break with olly on every dll loading and stop on the entry point that PE Explorer wrote it break but the dll is already unpacked _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You cannot download files in this forum