im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i loaded the same program into ollydbg, the starting address is at 0x770B0D54. Another thing is i executed the program line by line, it somehow jump back to the entry point at 0x00043b33 and then go back to the address 0x770B0D54 later again. Can someone guide me on this？
1 Answer
It's a matter where you want to break. The address 0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before main is executed and you want to step through that.
On the other hand 0x00043b33 is int user code and it's probably the address of the main function so that is the real code of the application.
In OllyDbg you can control the initial breakpoint in Options->Debugging, Startup and exit
answered Oct 28, 2019 at 15:15