I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
Add a comment
|
1 Answer
As you can see here, 0xFF is a “jump far indirect” opcode and this version of jump requires operand to be a memory address.
While using this type of jump, you cannot use register as an operand and hence the error message you see.
And I don’t think the snippet you provided contains the actual code - it rather looks like data, though OllyDbg still tries to disassemble it.
You will find the code at offset 0x1000 relative to the image base which will likely be 0x400000 in case of exe and 0x10000000 in case of dll.
