1

I am trying to analyze a game with OllyDbg. However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with NOPs, I soon encounter another instruction that happens to attempt the same dumb write. Without being debugged by OllyDbg the game runs smoothly. What I am missing? Why does it fail like that in OllyDbg?

I am running Win7 x64, the game is in x86.

Here is the first instruction that does it and the registers.

0048B65C   . F3:A5          REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]

EAX 00002000
ECX 00000800
EDX 00002000
EBX 02A700CC
ESP 0018F878
EBP 00002000
ESI 05A72034
EDI 00000000
EIP 0048B65C heroes4.0048B65C
C 0  ES 002B 32bit 0(FFFFFFFF)
P 1  CS 0023 32bit 0(FFFFFFFF)
A 1  SS 002B 32bit 0(FFFFFFFF)
Z 0  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 1  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00210316 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty -??? FFFF 00000000 00000000
ST1 empty -NAN FFFF FFFFFFFF FFFFFFFF
ST2 empty -??? FFFF 07E007E0 07E007E0
ST3 empty -1.0000000000000000000
ST4 empty 48000.000000000000000
ST5 empty 0.7071067690849304199
ST6 empty 0.2113374471664428711
ST7 empty 0.0
               3 2 1 0      E S P U O Z D I
FST 0130  Cond 0 0 0 1  Err 0 0 1 1 0 0 0 0  (LT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
  • Google for "anti debug techniques ollydbg". There's a plethora of things that could be happening in your game, and it isn't really possible to enumerate and explain them here. – Guntram Blohm supports Monica Nov 28 '15 at 10:58
  • See Step 5 @ stackoverflow.com/a/8002754 – Jason Geffner Nov 28 '15 at 14:53
  • Can i epxect an antidebugging defense from a commercial game from 2003? Is that what is really going on? Isnt it just some bug in OllyDbg? – Stanislaw T Nov 29 '15 at 7:04
  • It seems the issue was I was running OllyDbg 1.10. I am running smoothly on 2.01 now. – Stanislaw T Nov 29 '15 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.