blabberer
February 16th, 2005, 23:50
hehe it has been documented already some where i even have a post about about this phenomena in this forum on some queer post 
i think i replied it in regard to 1bitshort's query
and lately this was again pointed out by 
nicolez brulez of armadillo (in his paper to honeynet scan of the month 33 
results ) he actually thought it will stop olly somehow loading the app 
but ollydbg loads the application and executes it without stopping 
on ep (the reason he states for his thinking is 
about modifiaction to LoaderFlags and Rva Entries in the pe-header 
but i beleieve they are not the only problems i have seen apps 
which dont have this modification but still execute the said application 

 probably there are more issues out there apart from these modification 
 
anyway to counter the above problem one can physically modify the 
entry point bytes 0xeb 0xfe (infinte jump)
and load the exe when it has completely loaded (ignore the warning about not valid blah blah ) 
press f12 and pause the application 
it will stop in the infinite jumps 

 modify the bytes back to original values 
and then you can find all of the string referances and import names all such s*** 
have fun