Getting error code 487 (Attempt to access invalid address) for 64 bit application about examine

[manishshukla]

Never mind resolved the issue. The problem was due to address space layout randomization (ASLR) for calc.exe. The solution is to calculate the runtime process base address, then get the loaded images base address and add AddressOfEntryPoint to it. Tested it for 32 and 64 bit applications on Windows 7 64 bit.

[vtorri]

thank you for your interest.
btw, don't hesitate to propose patches. I have very few time these months.

notealso that there is the view tool in examine that should do something similar than dumpbin. It also display ASLR for exemple