admin issue

[someone]

Im trying to learn--

Please, how do I find this line in OllyDbg?

According to the MSDN the PE header is 1000 Bytes and looks something like this:

typedef struct _IMAGE_FILE_HEADER {
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER,
*PIMAGE_FILE_HEADE

Source:

2

 

That file is in hex, and has file offset, you must calculate the virtual offset.

Virtual_Offset = (First_Address - Header) + File_Offset