On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk.notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk.I cannot find that function, by running dependency walker on notepad.exe.How can kernel32.dll::BaseThreadInitThunk function be executed without importing it ?
kernel32.BaseThreadInitThunk without IAT
windows;dll;iat
It is just a coincidence. It happens sometimes that the value in a register be the address of some valid api which the application has nothing to do about. For reference see these images.I have loaded OllyDbg2 in OllyDbg2. OllyDbg2 does not import kernel32.dll::BaseThreadInitThunkOllydbg in Windows 7Ollydbg in Windows XPIn Windows 7 on entrypoint the value of eax is the address of BaseThreadInitThunk. However on Windows XP the value of eax is 0.