1

I'm trying to disassemble ntdll.dll to look at some Native API libraries. I tried in both on OllyDBG (by using loaddll.exe) and using dumpbin with the /disasm option.

It seems like the output of both programs are very different. Firstly, the memory addresses don't match up, neither do the number of lines. Furthermore, the function calls are not the same.

Am I doing something wrong here? What am I actually seeing in both cases. I thought I was going to see identical code being presented on both parts.

Abundance
  • 1,963
  • 3
  • 24
  • 46

1 Answers1

1

You are comparing two different things, one is a live debugging (ollydbg) of the .text section of the program memory and the dissasembly of the static binary.

the .text section can change while the program is running so, you may get different results.

try comparing the dumpbin output with outputs from IDA PRO or some other static disassembly and probably will be the same.

Ollegn
  • 2,294
  • 2
  • 16
  • 22