1

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i loaded the same program into ollydbg, the starting address is at 0x770B0D54. Another thing is i executed the program line by line, it somehow jump back to the entry point at 0x00043b33 and then go back to the address 0x770B0D54 later again. Can someone guide me on this?

1 Answer 1

1

It's a matter where you want to break. The address 0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before main is executed and you want to step through that.

On the other hand 0x00043b33 is int user code and it's probably the address of the main function so that is the real code of the application.

In OllyDbg you can control the initial breakpoint in Options->Debugging, Startup and exit enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.