1

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game will simply not work. It's gonna crash and there's no known solution so I thought about trying to debug it (I'm fairly new to debugger even though I've used IDA for a while). When I load the game in the debugger, I get an error from IDA saying:

"The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm not even sure if it's because of anti-debugging protections or if it's from the crash itself. I guess that it's the crash's fault because when I try to follow up through this error, IDA stops the process.

At this point I'm not sure what to do, hence why I've came to ask here. Thanks to everyone who takes their time to even try to help me!

Thank you all. Please ask if I missed something (as I said I'm fairly new to this haha), I'll answer really quick.

Image of the assembly when crashing:

Image of the assembly when crashing

Pseudocode of the function that gives the error.

3
  • could you please add the textual dump of the assembly in addition to the screenshot?
    – Igor Skochinsky
    Commented Jul 31, 2021 at 18:15
  • also, what is the value of eax?
    – Igor Skochinsky
    Commented Jul 31, 2021 at 18:16
  • hey, I'm really sorry for the time I took to answer. Here's a textual dump of the assembly: pastebin.com/ArHeTZra also EAX has 000006E8 as a value Commented Aug 1, 2021 at 1:28

2 Answers 2

2

I can't make comments yet, so will try to submit this as an answer, hopefully that helps:

You can try to pass that exception to the application and see if it is capable of dealing with it.

To do this you go to Debugger -> Debugger Options -> Edit exceptions... (button on the bottom of the Options dialog).

Then select your exception, RMC on it and choose Edit. Then uncheck Suspend Program option and check Pass to application checkbox.

1

It is crashing because [EAX+28h] does not refer to a valid readable memory location. EAX = 6E8h + 28h = 710h which is not referencing a valid location.

EAX is retrieved from memory location dword_19BA9E8, you will need to work out why that is not being populated with the correct value. Essentially the value at dword_19BA9E + 28h must reference a valid readable memory location to avoid the crash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.