2

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window.

Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of the memory in the program (including the PE header)

For comparison: [CPU - main thread]

enter image description here [CPU - main thread, module ]

enter image description here

How do I switch between these two? When I press "view threads" it only shows me one executing thread, when I click it, it shows me the [CPU - main thread, module] which is not what I want.

Strange.

  • I suspect it shows "module XXX" when the EIP is in the range of the specified module, and just "main thread" otherwise. Try checking EIP value against the memory map. – Igor Skochinsky Apr 7 '17 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.