2

On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk.

notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk. I cannot find that function, by running dependency walker on notepad.exe.

How can kernel32.dll::BaseThreadInitThunk function be executed without importing it ?

Improve this question

1 Answer 1

Reset to default
2

It is just a coincidence. It happens sometimes that the value in a register be the address of some valid api which the application has nothing to do about. For reference see these images.

I have loaded OllyDbg2 in OllyDbg2. OllyDbg2 does not import kernel32.dll::BaseThreadInitThunk

In Windows 7 Ollydbg in Windows 7

In Windows XP Ollydbg in Windows XP

In Windows 7 on entrypoint the value of eax is the address of BaseThreadInitThunk. However on Windows XP the value of eax is 0.

Improve this answer
2
  • 1
    starting eax value may be meaningless. thank you.
    – greenfish
    Commented Jun 24, 2014 at 4:17
  • FYI, it can be used to help identify the host operating system. Not too useful in general, other than for potentially identifying emulators. code.google.com/p/corkami/wiki/InitialValues
    – Jason Geffner
    Commented Jun 24, 2014 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.