1

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement:

MOV DWORD PTR DS:[EDI],EBX
I bypassed it by shift+F8 but it keeps giving access violation error multiple times. How can I proceed further in UnPacking Binary. Binary is working fine when executed without debugger.

  • maybe upload the binary somewhere? also try just run(F9) option and see if it runs in the debugger... – Sigtran Jun 7 '16 at 13:44
  • It is also crashing with F9 option. – Umer Jun 7 '16 at 14:57
  • Load the AnalyzeThis plugin also. Are you saying that you reached the OEP and dumped the program from memory using OllyDump plugin? – fpmurphy Jun 13 '16 at 3:33
1

Try to use newer version of ollydbg or x64dbg (a modern and open-source ollydbg-like) with anti-debug tricks plugins like a TitanHide or ScyllaHide to avoid detection by the packer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.