PDA

View Full Version : need advice regarding .net


sn0w
August 11th, 2013, 13:47
PE OEP:
jmp _CorExeMain is never executed?

if anybody have some interesting papers about net internals, please share

disavowed
August 13th, 2013, 15:37
http://www.ntcore.com/files/netint_native.htm

rendari
August 13th, 2013, 16:05
jmp _CorExeMain is only executed on 32 bit Vista and XP, and possibly Windows 7. For all 64 bit and WOW64 processes, if the loader detects a .NET data directory in the PE header, it automatically sets the EP to _CorExeMain. Thus the jump is never executed.