Again to LaoNa

(3) EntryPoint RVA set to 0

Some packed files have their entry point RVA set to 0, which means they will start executing 'MZ...' which corresponds to 'dec ebx / pop edx ...'.

This is not an anti-debug trick in itself, but can be annoying if you want to break on the entry-point by using a software breakpoint.

If you create a suspended process, then set an INT3 at RVA 0, you will erase part of the magic MZ value ('M'). The magic was checked when the process was created, but it will get checked again by ntdll when the process is resumed (in the hope of reaching the entry-point). In that case, an INVALID_IMAGE_FORMAT exception will be raised.

If you create your own tracing or debugging tool, you will want to use hardware breakpoint to avoid this problem.

这个好玩

very good, very strong

Hi.yes.

good,is true.

I think:"http://bbs.pediy.com/showthread.php?t=51022"

think what?

I am translating it to Chinese

花了我整整一下午,终于完工了. 我只翻译完成,没有仔细检查, 如果有什么不妥的地方多多见谅.
英语水平好的就不用看了. 偶的水平也烂得很大专都没毕业

上传的附件：

• Windows Anti-Debug Reference.rar （22.07kb，216次下载）

咋的没人发表意见呢.看来都和我一样哦,喜欢沉默 通常我用别人东西也不发表什么哦

看英文版就够了,
不过也收藏了.
感谢耶稣,感谢佛祖,感谢angeljyt

well done.but...........no profession

I had saw this paper in the foums magazine  <hacker defender>,did the paper was ready translate by you????