To find the address of a file entry point in Immunity Debugger.
note: images to follow :)
- Start the program
- Attach the program to Immunity Debugger
- Click on the letter
e
to open up theExecutable modules
window - Locate the file you are running
- Under the entry tab will be the address
- Copy the address,
right click
andcopy to clipboard
then selectentry
- Click on the letter
c
to take you back to theCPU
window - Click on the
forward arrow with the four dots
this will open up theEnter expression to follow
window - Paste in the address, and click
OK