copy and paste this google map to your website or blog!
Press copy button and paste into your blog or website.
(Please switch to 'HTML' mode when posting into your blog. Examples: WordPress Example, Blogger Example)
Input Form:Deal with this potential dealer,buyer,seller,supplier,manufacturer,exporter,importer
(Any information to deal,buy, sell, quote for products or service)
parsing a PE file to find the export table address using CFF explorer . . . Thanks for your comment, I tried CFF Explorer on another sample and it gives again the good offset for the export table address, it is my way to use the info giben by msdn which is wrong, I d'ont know exaclty where for the moment, I will search again these days
c - PE Format - IAT Questions - Stack Overflow Some useful programs: CFF Explorer, and a good hex editor My answer differs from the above in that it describes a way to manually perform what was described above within an executable still on the disk To get to the Relative Virtual Address (address at runtime, aka RVA) of the IAT: Start with the base address of the binary
How to find the file address of AddressOfEntryPoint I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0 I s
windows - How to check for DLL dependency? - Stack Overflow On your development machine, you can execute the program and run Sysinternals Process Explorer In the lower pane, it will show you the loaded DLLs and the current paths to them which is handy for a number of reasons
A newbies question about CFF explorer screen I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ? updated the question part , t
How to find start of . text section? - Reverse Engineering Stack Exchange But, how can i know it with CFF explorer? With CFF, i can know the virtual address of text section is 00011000 So when the program is loaded into memory, the start of the text section should be imagebase + 00011000 right? With ollydbg i can know its wrong The calculated address isnt the correct one, but the one shown in IDA is