I read pe program using a Pe Reader to view all sections, the .text section starts is "
What is in the pe program reader:
And is this what i see on the debugguer :
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
As you can see here,
0xFF is a “jump far indirect” opcode and this version of jump requires operand to be a memory address.
While using this type of jump, you cannot use register as an operand and hence the error message you see.
And I don’t think the snippet you provided contains the actual code - it rather looks like data, though OllyDbg still tries to disassemble it.
You will find the code at offset
0x1000 relative to the image base which will likely be
0x400000 in case of exe and
0x10000000 in case of dll.