2

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window.

Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of the memory in the program (including the PE header)

For comparison: [CPU - main thread]

enter image description here [CPU - main thread, module ]

enter image description here

How do I switch between these two? When I press "view threads" it only shows me one executing thread, when I click it, it shows me the [CPU - main thread, module] which is not what I want.

Strange.

1
  • I suspect it shows "module XXX" when the EIP is in the range of the specified module, and just "main thread" otherwise. Try checking EIP value against the memory map.
    – Igor Skochinsky
    Commented Apr 7, 2017 at 12:25

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.