I have used Puppy (PPEE) which is a tool similar to PE Studio for initial static analysis of a PE binary. PPEE identifies a string "Root CA" which appears at what it says is 0x0007C523, however as shown in my attached screenshot, when I open a hex editor, it does not appear at that offset. Note that both the hex editor and PPEE are staticly analyzing the file, so no runtime stuff like ASLR or PIE should have an effect here. Also, this is in fact an ASCII string, not unicode.

enter image description here

  • 2
    You are not looking at the same offset. 7C40 vs 7C523. They are order of magnitude different. – Paweł Łukasik Feb 6 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.