Results 1 to 3 of 3

Thread: need advice regarding .net

  1. #1

    need advice regarding .net

    PE OEP:
    jmp _CorExeMain is never executed?

    if anybody have some interesting papers about net internals, please share
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002

  3. #3
    Registered User
    Join Date
    Dec 2005
    Blog Entries
    jmp _CorExeMain is only executed on 32 bit Vista and XP, and possibly Windows 7. For all 64 bit and WOW64 processes, if the loader detects a .NET data directory in the PE header, it automatically sets the EP to _CorExeMain. Thus the jump is never executed.

Similar Threads

  1. need some advice
    By peter klos in forum The Newbie Forum
    Replies: 13
    Last Post: May 7th, 2007, 13:09
  2. Need advice for some utility
    By roocoon in forum Off Topic
    Replies: 1
    Last Post: March 25th, 2007, 10:18
  3. Need advice...
    By Sauliux in forum The Newbie Forum
    Replies: 5
    Last Post: September 11th, 2004, 08:19
  4. Redirect IAT advice
    By Pepone in forum Malware Analysis and Unpacking Forum
    Replies: 0
    Last Post: May 2nd, 2004, 19:14
  5. give some advice
    By cooper in forum The Newbie Forum
    Replies: 3
    Last Post: November 29th, 2003, 14:21


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts