I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process.
I am on windows 7, 3 gigs of RAM and Intel Quad core Q6600.
Tried Olly 2.0 as well as Ollydbg by The legend of Random also but the same thing happens.
Are there any plugins that can handle the analysis process or is there something i need to do to make it work? Please suggest.
Large exe files are primarily due to large amounts of embedded data. Embedded data may mean binary resources and/or overlay. Large file sizes can also be due to static linking.
If it is due to overlay then you may try to strip the overlay using any decent PE editor such as exeinfo pe and then try to load it in Ollydbg to do an analysis. However the exe will probably function differently with a missing overlay.
The other and more probable reason for crashing may be due to an anti-debugging trick or a bug such as the fpu bug in Ollydbg v1. For that try to use a patched Ollydbg and there are plenty available.
As u mentioned, olly crashes, probably it doesnt, but becayse the file is large olly takes some times and hangs for that time being, windows 7 shows the error message fir closing the olly or to wait, just hit wait application to respond, and there can also be an exploit which is crashing olly so check for that, and also if peid shiws its a vb app, iw ould first load it in vb decompiler, it gives a better result for visual basic applications after refrencing to it, debug it in olly.
