I have the follwoing error message:
Don't know how to step because memory at address 00000000 is not readable.
Try to change EIP or pass exeption to program.
Because I dont know how to change the EIP, I try it with exception passing. So: When I click Shift+F7/F8 to pass exception to the program, then nothing happens. When I try Shift+F9 the program runs in a RETN instruction, somewhere at the end of the whole process. So, the whole thing doesnt work. After that, I try the following: In the Debugging options(in the Exeptions-Tab) I enable the field "Memory access violation". But the error message comes again.
My question is now: How can I fix that problem?
The second thing is(i dont know if that information is relevant but I write it): When I open the malware with ollydbg a message appears to inform me that is encrpyted or compressed. You know, the typical error message when you deal with packed malware. But the problem is, that I definitely unpacked it. And the beginning of that, is a normal beginning/intro like:
PUSH EBP
MOV EBP, ESP
...
Also, when I open the packed version of the process with PEiD, it tells me that it is packed with FSG 1.3.3 -> bart/xt. When I open the unpacked version of the malware, PEiD tells me : Nothing found * So, I am very confused about the fact that Ollydbg talks about compressed/packed data although I have unpacked it. So, how that can be?
best regards,