tags:

views:

19

answers:

1

I opened cstrike.exe(for game Counter Strike) with ollydbg, but the disassembly code isn't complete,it starts at 01401000 and stops at 0140BFFF(I mean it should at least start from 00000000 to be complete, and I can't say for sure whether 0140BFFF is the exact end or just a stripped part)

01401000   . E8 05000000    CALL cstrike.0140100A
01401005   . E9 0A000000    JMP cstrike.01401014
0140100A   $ B9 90134101    MOV ECX,cstrike.01411390
...
0140BFFD     00             DB 00
0140BFFE     00             DB 00
0140BFFF     00             DB 00

How can I make OD show all the nitty-gritty details of the PE binary?

A: 

First, there is nothing at 00000000

Second, OD shows one memory region in disassembly window. Open memory window (alt+M) to see all memory regions. Or use ctrl-G to get to desired memory address.

Abyx
What is memory **region**?
Alan
Virtual memory is allocated by VirtualAlloc function ( http://msdn.microsoft.com/en-us/library/aa366887%28VS.85%29.aspx ). It allocates _regions_ of memory pages - some amount of memory pages following each other.
Abyx