Log in

View Full Version : How does Ollydbg determine if a file might be pack


1bitshort
July 6th, 2004, 20:54
When you open some packed files you might see a message like this:
Module 'target' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!

Ive always found it very interesting how OllyDbg is able to determine that. I know its a fairly simple and quick method, but the actual algorithm behind it makes me curious -- does anybody here know what might be happening? For example, does it look at the "BaseOfCode" and "BaseOfData" values, or the values of the VirtualOffset/RelativeOffset of each section, or the flags of each section, or what? If somebody can provide a "pseudo-algorithm" describing the procedure Id be very grateful.
Thankyou for your time

psyCK0
July 7th, 2004, 14:06
Just a guess:

section = GetSectionForAddress(eip);
if(section.characteristics != Characteristics.executable)
ShowMessage();

1bitshort
July 7th, 2004, 19:32
Thankyou! I know what you mean by section.characteristics, but what do you mean by executable.characteristics?

psyCK0
July 8th, 2004, 02:24
I meant:

if(section characteristics != exacutable)