I'm trying to analyze a piece of code, I'm confused about the following line:
CALL fct.00402589
Then after that, I come across a block beginning with RETN.(See below)
Here are a couple of lines of that code-block:
RETN
NOP
PUSH EBP
MOV EBP,ESP
LEA ESP, DWORD PTR SS:[ESP-0X2D0]
PUSH ESP
CALL ntdll.RtCaptureContext
......
......
INT 3
NOP
So as I said, after the call I am in the line RETN. But when I want to go further(click on the "step over"-button of ollydbg) then it jumps back to the next line after the call-instruction. In the line before the last instruction "NOP", there is the instruction INT 3.
I have figured out that in some cases, especially as anti-debugging technique, the program inserts the opcode 0xCC of INT 3 to confuse the debugger. The debugger thinks that it is a breakpoint because normally, the debugger uses OxCC to set breakpoints.
So, I change the debugging options of ollydbg (Options -> Debugging Options -> Exceptions and then click the INT 3 breaks-Box). From now on, the debugger does not trap the exception, it passes the exception to the program.
When I start the program again, and come to the call-instruction, then the following appears(again i copy some lines):
JMP DWORD PTR DS: [<%crtdll._GetMainArgs>]
NOP
NOP
ADD BYTE PTR DS:[EAX], AL
ADD BYTE PTR DS:[EAX], AL
JMP DWORD PTR DS: [<%crtdll._strcmpi>]
NOP
NOP
ADD BYTE PTR DS:[EAX], AL
ADD BYTE PTR DS:[EAX], AL
JMP DWORD PTR DS: [<%crtdll._atoi>]
NOP
NOP
ADD BYTE PTR DS:[EAX], AL
ADD BYTE PTR DS:[EAX], AL
JMP DWORD PTR DS: [<%crtdll._exit>]
NOP
NOP
ADD BYTE PTR DS:[EAX], AL
ADD BYTE PTR DS:[EAX], AL
JMP DWORD PTR DS: [<%crtdll._memcpy>]
NOP
NOP
----
And so on, has anyone a clue? Or can someone explain me what is going on here?
int3
,call
andretn
? Thecall
andretn
just about anybody can explain you, but the question is unclear.