Initial Register values

		Exetools > General > General Discussion
Initial Register values

06-10-2004, 10:34

ionescu007

Posts: n/a

On XP,

EAX should be 0, because it'll be the return value of one of the APIs that the PE Loader calls (NtSetInformation i think).

EBX will be the value at fs:30h, which is the program's PEB.

EDX should be KiFastSystemRet, usually, since the PE Loader API that got called ended up going through that call.

EDI/ESI should not be assumed to be anything valid.

Best regards,
Alex Ionescu
Relsoft Technologies
http://www.relsoft.net

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
need help register in www.aoreteam.com/vb	cxj98	General Discussion	2	09-14-2014 21:25
Hex values for jumps and thier functions please? VB?	CrAcKaHoLic	General Discussion	4	01-10-2004 02:54

All times are GMT +8. The time now is 02:09.