Reaching an address with ollydbg

Question

I have some questions about how to reach an address by bypassing a few hundred lines. Assume that we have the following scenario:

                   + -----------------------+
          004019EF |                        |   <----- we are here
                   |   content of function  |
                   |   004019EF             |
                   |                        |
                   |                        |
                   +------------------------+
                   |                        |
                   |     this area contains |
                   |     lines which        |
                   |     I want to bypass   |
                   |     quickly            |
                   |                        |
                   +------------------------+
         00401E1F  |                        |     <-- we want to go here
                   |     content which I    |
                   |     want to analyze    |
                   |                        |
                   |                        |
                   +------------------------+

So, the situation is that I am for example at 004019EF and then I figured out that the location at 00401E1F also seems to be important. And I decide to go there. For that reason, I click on Ctrl+G, type the target address and set a breakpoint(clicking F2) at 00401E1F. Then I let it run. But the program doesn't reach the place. It terminates the process and ends at a location with RETN. So, I started the process again. But this time, I step manually from line 004019EF to 00401E1F. On the way, I eliminate all the lines/instructions which leads to a termination by replacing them with a NOP instruction. At the end, I reach the address 00401E1F.

My question would be :

When I replace instructions with a NOP or change the flags of jump-instructions to modify the execution flow of the programm, then will these modifications be a problem for the content of 00401E1F ?

I mean can I say the following :

"These instructions causing problems, so deleting them with NOP would be unproblematic"

OR

Am I going to miss some results of the area between 004019EF and 00401E1F which could be important for the content of 00401E1F ? If yes, then:

Is there another way to bypass that lines to reach the target address without patching/changing lines or instructions?

Answer 1

Am I going to miss some results of the area between 004019EF and 00401E1F which could be important for the content of 00401E1F ?

It's impossible to know if that code contains side effects without analyzing that code.

Is there another way to bypass that lines to reach the target address without patching/changing lines or instructions?

Yes, you have two options:

1. Change registers. The most straightforward approach would be to just change EIP. This can of course be problematic though with regard to side effects.
2. If the code before 00401E1F is executed conditionally, satisfy whatever conditions are required such that that code doesn't get executed.

Answer 2

What Jason said. Consider this C code:

int size;
int nelem=1;
struct whatever *data;
if (debugger_is_running)
    nelem-=2;                 // pass an unreasonable value to malloc
size=sizeof (struct whatever)*nelem;
if ((data=malloc(size))==NULL)
    abort_program("No memory");
......
// use data here

It's the nelems-=2 instruction you want to patch out. If you just nop out the call to abort_program, your data will still be a NULL pointer and cause the program to crash whenever you use it, much later.

You really need to analyze everything between your code blocks, find out how the program detects the debugger, and change that piece of code.