0

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address:

DD address1
DD address2
DD myfunction
DD adress4
.. AND SO ON

Where addressN are other function. Thinking that it was the routine that bother me I just fill with NOPs DD myfunction, but after restarting the process (and loosing the NOPS) Olly show me.

DD address1
DD address2
POP ESP
INC EBP
...others instruction like the one above
DD address4
DD address5
... so on

And, when I hit F9 it just return to the DD myfunction shape ... I cannot understand what's going on, hope you can help me.

  • err, you cant edit a dword table of addresses with nops you would have to patch the function itself.. try using the cleanup plugin in olly and start again, you've most likely corrupted something.. – evlncrn8 Sep 21 '14 at 17:16
  • After restarting the process the instruction return to normality. My question is about the behavior of the DD instruction,about the fact that it seems performing a jmp to myfunction but Ollydbg detect it as "DD myfunction" – Azazel Sep 21 '14 at 17:29
  • dd = dword .. its a jump table, there will be some code most likely near by like.. mov register, offset start of table then some cmps and jmps to the table using an index or a simple jmp [eax*4 + offset start of table] or similar code.. to make it clearer the dd is NOT an instruction, mnemonic or similar, it is simply declaring that the value there is a dword which is an address of a function, it will never be executed, just jumped to or called – evlncrn8 Sep 21 '14 at 18:48
  • Your NOPs are 0x90 but the debugger is still seeing them as a jump table, a table of addresses that in this case are not addresses to anywhere that makes sense ... 0x90909090 or whatever. So they are not being repopulated at runtime. Except, if the code is part of the startup code for a packed or encrypted executable then it is possible that those addresses are being overwritten by unpacked code. – Paddywhacker Sep 24 '14 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.