1

Any time I try to crack a program I get this error in olly:

enter image description here

What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that doesn't help

  • Did you try passing the exception to the programm? e.g. Shift+ [F7], [F8], [F9]. The debugger is the first to be able to handle exceptions. – Nordwald Mar 17 '17 at 5:48
2

TL;DR: Without understanding what's causing the access violation, it is hard to tell how best to address it. You will need to investigate the exception handler and the cause first.

This status line means an Access Violation exception occurred and ollydbg caught that exception. It is not necessarily an error and could be part of normal behavior of the program. It is now up to you to decide how olly should handle that exception, but first lets discuss what can cause this exception.

Technically, this exception means the program tried accessing an invalid address. It could be that the address is not allocated or that the CPU tried executing code at an address whose permissions prevent execution, write to an address that can't be written to, etc. Generally, an access violation exception occurs when an attempt to access an address failed for one reason or another.

Now that we answered what is an access violation exception, let's discuss why it happens. An access violation usually happens when a bug is encountered, due to a programming error that made the CPU execute the wrong instructions or using the wrong data. However, security developers often use tricks related to access violation exceptions for their advantage, complicating the reverse engineering process or making the program harder to debug and modify.

Examples of the more common tricks include:

  1. Measuring the time between an exception being triggered until it's handled and normal execution is resumed. When in a debugger, the debugger will suspend the program, making that time difference significantly larger.
  2. Execute critical program parts within an exception handler which is slightly harder to debug, find and investigate.
  3. Trigger bugs in the debugger itself, making slight changes in behavior that could be critical to the program's execution.
  4. Increase the burden on the reverse engineer and complicate the dynamic reverse engineering process.
  5. Fail the program violently after an anti-debugging trick detected the program is being debugged.
  6. Normal operation and certain OS tricks might involve legitimately triggering (and handling) access violation exceptions.

Depending on why the exception was triggered, what is the exception handler code and what surrounds the exception triggering code, the way to handle that exception differs.

For example:

  1. If the exception triggering coded is surrounded with timing checks, you would want to add it to ollydbg's ignored exceptions so the debugger won't pause on those exceptions in future executions. Do that by pressing alt + o and selecting the "Exceptions" item under "Debugging".
  2. To understand if the exception handler has a crucial part in the program's behavior, you would probably want to hit Shift + F7 to step into the exception handling code and reverse engineer it.
  3. If the exception handler is only part of the program's normal operation, it might also be peacefully ignored by adding to ollydbg's ignored exceptions list or using shift + F7 , F8 or F9 to respectively step into, step over or run through the exception handler.
  4. If the access violation was triggered intentionally to terminate the program, you might be able to safely ignore it (shift + F9) and carry on with the rest of the program.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.