0

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":

What is in the pe program reader:

PE READER PROGRAM

And is this what i see on the debugguer :

DEBUGGER

1

As you can see here, 0xFF is a “jump far indirect” opcode and this version of jump requires operand to be a memory address.

While using this type of jump, you cannot use register as an operand and hence the error message you see.

And I don’t think the snippet you provided contains the actual code - it rather looks like data, though OllyDbg still tries to disassemble it.

You will find the code at offset 0x1000 relative to the image base which will likely be 0x400000 in case of exe and 0x10000000 in case of dll.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.