0

The entry point is set as 007112B0 in the header (shows up in IDA), but it always jumps me to 00B112B0 (which is inside a data segment that is basically empty). What's going on with the executable?

1
  • Nees more information please. Can you share the sample? – k0ng0 Sep 19 '15 at 5:30
1

If this is the sample You compiled - check Your compiler options and maybe Your source code to find the reason.

If this is something You have no source for - worth to start from Static analysis, begin with PE parsing.

Have a look on TLS entries: http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html

p.s. IDA IMHO is not the best choice to analyse PE, try PEstudio - https://www.winitor.com/

1

The value in the header (007112B0) is the Relative Virtual Address, which means that the ImageBase value (presumably 00400000) is added to it to convert to a Virtual Address (00B112B0). The VirtualAddress is the location from which the code will run.. If there is no code at the Virtual Address, then it might be that the EntryPoint value was not set correctly. Perhaps you meant to set it to 003112B0 (007112B0-ImageBase) instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.