1

I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem.

It is about an old Rockstar game, "Bully: The scholarship edition" (released 2007 - aka "Canis Canem Edit"). It however has issues to perform on Windows 10 anniversary edition OS that I have at this moment. That is expected since it's an old software. To resolve that, I tried many online solutions (compat mode, setting CPU affinity, ect), which didn't helped much.

So I decided to look into the code by using OllyDbg. The cause of the crash is pretty constant; an access violation. However, it is purely random. I am able to play a hour without problems, or experiencing a crash within 10 minutes. The program apparently tries to move data from address 0 to a register, which isn't allowed. The exception is always thrown at the same place, where the pointer call occurs.

Here is a screenshot from OllyDbg when debugging the program. (Sorry for small resolution, it's an old game, hence the resolution is set at 1280x960)

enter image description here

The exception is thrown at address 0088729D which has this instruction

MOV ECX, DWORD PTR DS:[EAX]

The EAX register is apparently empty (you can see that in the image). So I checked when information is moved to that register. It happens at the address (I've selected the line and added comment "moves empty address") 00887281. It contains the following instruction:

MOV EAX, DWORD PTR SS:[ESP+8]

As far I know, SS is the stack segment register and ESP extended stack pointer. The ESP register contains address 0019F3A0. With offset 8, the address is now 0019F3A8 (see selection in the right bottom box). It contains 00002000.

I'm now clueless after this point. I don't understand why the address during the call is zero and not that value. I expect that the EAX register would contain 00002000 after the instruction. However, this is not the case this time. The EAX register contains 00000000.

I believe that I'm interpreting this incorrectly. Can someone point me where my misinterpretation occurs or inform me how to check this problem more correctly?

Thank you.

PS: the reason for this is because I've played bully in my childhood and want to play again. Apparently, there are other users with the same problem, even after attempting the known solutions on the web. Perhaps if I find a solid solution for this, that I would be able to help others too.

  • 1
    From what I can tell, [ESP+8] is an argument to the function you are currently in. You should check higher up your callstack and see what's going on there. – mrexodia Nov 24 '16 at 18:02
  • There is a whole lot of context missing. Without knowing the nature of the routine and the program structure, it is really hard to give any advice. But you could try the crowbar approach: Insert a jump before the instruction which crashes, test eax and return (or skip the crashing instructions). Else, you can execute the 'normal' code. You should be able to find some unused bytes for that. Btw: 'call eax' hints a jumptable (switch-statement) – Nordwald Nov 25 '16 at 6:44
  • It hints a virtual method call (vtable), jump tables are pretty much always implemented as jmp dword ptr [regsizeof(void)+tableAddress] – mrexodia Nov 25 '16 at 17:06
  • @mrexodia Can you elaborate that? (Or put a link with info about that). Your comment has confused me. I know what virtual methods are but your conclusion is strange. I didn't interpret these instructions as a possible virtual method. Gotcha try the crowbar method to dig it further. – KarelG Nov 27 '16 at 11:19
  • 1
    @KarelG it uses ECX (generally the this pointer) and calls an from there somewhere. In normal code any call eax is usually a function pointer or virtual function call, not a switch table. – mrexodia Nov 27 '16 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.