Geek asks and answers

Windows startup context

As soon as Windows loads the executable into memory and transfers to the entry point, do the values ​​in the rehydres and the stack make sense? If so, where can I find more information about this?

+3
source share
2 answers

Officially, the registers at the entry point of the PE file do not have specific values. You should use the API, for example GetCommandLine, to get the necessary information. However, since the kernel function, which ultimately transfers control to the entry point, has not changed much from earlier times, some PE packers and malware have begun to rely on their own characteristics. Two more or less reliable registers:

  • EAX ( call eax )

  • EBX (PEB).

+6

5 Windows Internals Fifth Edition Windows, . Windows .

, , . , : Agner Fog

+1

More articles:


All Articles