OllDbg error message

Question

I have the follwoing error message:

 Don't know how to step because memory at address 00000000 is not readable.
 Try to change EIP or pass exeption to program.

Because I dont know how to change the EIP, I try it with exception passing. So: When I click Shift+F7/F8 to pass exception to the program, then nothing happens. When I try Shift+F9 the program runs in a RETN instruction, somewhere at the end of the whole process. So, the whole thing doesnt work. After that, I try the following: In the Debugging options(in the Exeptions-Tab) I enable the field "Memory access violation". But the error message comes again.

My question is now: How can I fix that problem?

The second thing is(i dont know if that information is relevant but I write it): When I open the malware with ollydbg a message appears to inform me that is encrpyted or compressed. You know, the typical error message when you deal with packed malware. But the problem is, that I definitely unpacked it. And the beginning of that, is a normal beginning/intro like:

       PUSH EBP
       MOV EBP, ESP
       ...

Also, when I open the packed version of the process with PEiD, it tells me that it is packed with FSG 1.3.3 -> bart/xt. When I open the unpacked version of the malware, PEiD tells me : Nothing found * So, I am very confused about the fact that Ollydbg talks about compressed/packed data although I have unpacked it. So, how that can be?

best regards,

Answer 1

Ollydbg talks about compressed/packed data although I have unpacked it. So, how that can be?

Ollydbg is wrong and flat out doesn't work for a lot of things! Messages it gives should be taken with a grain of salt. It's likely that when you unpacked the binary you provided a bad entry point or included the junk encrypted data with it that is no longer used.

Because I dont know how to change the EIP

Right click EIP in the register portion of Olly's CPU window.

I try it with exception passing

EIP is the instruction pointer, if it is trying to execute the memory at address 0, your program will definitely fail to run correctly. It's likely you set the entry point when unpacking to be zero, which is absolutely wrong. If the program has no exception handler defined, and you pass the exception, it'll just bubble up to windows and cause a crash("close this program/debug" dialog).

Great alternative that'd rule out any ollydbg issues you're having: http//x64dbg.com