im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i loaded the same program into ollydbg, the starting address is at 0x770B0D54. Another thing is i executed the program line by line, it somehow jump back to the entry point at 0x00043b33 and then go back to the address 0x770B0D54 later again. Can someone guide me on this？
It's a matter where you want to break. The address
0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before
main is executed and you want to step through that.
On the other hand
0x00043b33 is int user code and it's probably the address of the
main function so that is the real code of the application.