Search code examples
winapidisassemblyportable-executableollydbg

CPU registers state on the very start of the app. PE executables

Platform: Windows XP, average PE file
What defines CPU registers initial values on the very start of the application ? On the screenshot below OllyDbg stopped at the application entry point. But CPU registers already have some values(EDX == KiFastSystemCallReg?), PF/ZF==1, stack is not empty as well(SEH chain?).enter image description here

Does it mean that something was ran before we got to app entry point ? What is it ?

Solution

  • offsets pertain to x86 xp sp3 for other os lookup the CONTEXT structure in winnt.h / ntddk.h

    ctrl+g ->type ntdll.ZwContinue-> ok->F2-> restart the exe

    ollydbg will break at ZwContinue -> alt+f1 to open commandline plugin type follow [[esp+4]+b8] -> ok -> f2->f9 you will see a blank stack single step and see who fills the stack now

    ZwContinue takes 2 arguments first argument is a pointer to CONTEXT structure whose memeber eip is at 0xb8 from start of Structure this eip will be BaseProcessStartThunk this is the function responsible for filling the initial Structured Exception handler and calling the Module EntryPoint