3

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error.

I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code:

procedure TForm1.SpeedButton1Click(Sender: TObject);
var somevalue : string;
begin
    somevalue := 'this is a value';
    showmessage(somevalue);
end;

So I attached it in olly and searched for the string "this is a value" and reached this point:

MOV EDX, 0045212C

the address 0x45212C contains my string, so I decide to put another value in an empty address (I choose 00400400).

The problem is that when I change the code to

MOV EDX, 400400

I get the following error:

Access violation when writing to [004003F8]

Which contains the following assembly line:

LOCK INC DWORD PTR DS:[EDX-8]

What does this error mean and how can I fix it?

Improve this question

1 Answer 1

Reset to default
5

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, or because the address is unallocated.

I'ts crusial to note that the address, 0x004003F8 is eight bytes before your chosen address (0x00400400). I guess the access violation happened because that address is unallocated.

The best guess given the information you provided is that although the textual string starts at that specific address, it is only part of the bigger in-memory structure that begins before the actual text.

This is actually quite common, and correct for all managed/object oriented programming languages. and is indeed the cause for Delphi's string objects, as described here including memory representation specifics.

The line in which you get an access viloation is also of some interesting capacity and could be unclear to the uneducated reverser.

LOCK INC DWORD PTR DS:[EDX-8]

And here's the instruction's parts described one by one:

  1. LOCK is an instruction prefix that modifies the instruction following it, which is assumed to be preforming a read/modify/write operation. It guarantees the instruction following it is atomic, and prevents race conditions with other instructions modifying the same memory address.

  2. INC has a single operand (either a register or a memory address) and increases it by one.

  3. DWORD marks the provided operand points to a double-word value (that is, 4 bytes).

  4. DS: tells the address is in the data segment. This became quite redundant in 32 and 64 bit architectures so you can normally just ignore it.

  5. [EDX-8] is the actual operand, and represents "the address 8 bytes before the value currently in EDX.

Improve this answer
1
  • And note that the [edx-8] accesses the field that, in the description, is called reference count. As lock is used to make an instruction multithreading-safe, this makes sense as the string reference count is incremented whenever a new reference to the string gets created. To answer your question about how to fix it: copy your string to 4000040C, and copy the 12 bytes in front of the original string to 40000400. Don't forget to adjust the string length at 40000008.
    – Guntram Blohm
    Sep 26, 2016 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.