2

On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk.

notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk. I cannot find that function, by running dependency walker on notepad.exe.

How can kernel32.dll::BaseThreadInitThunk function be executed without importing it ?

2

It is just a coincidence. It happens sometimes that the value in a register be the address of some valid api which the application has nothing to do about. For reference see these images.

I have loaded OllyDbg2 in OllyDbg2. OllyDbg2 does not import kernel32.dll::BaseThreadInitThunk

In Windows 7 Ollydbg in Windows 7

In Windows XP Ollydbg in Windows XP

In Windows 7 on entrypoint the value of eax is the address of BaseThreadInitThunk. However on Windows XP the value of eax is 0.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.