2

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;

it should be e874010000 as a single instruction which is a call to some routine but it shows them like the picture above,

enter image description here

before the EIP jumps shown place there are instructions which are below,

enter image description here

I think int 2Dh (anti debug) is probably related to this situation. Can somebody enlighten me ? Or show some source to read and learn what is exactly going on here ?

OK I have managed to solve this problem by clicking right, then Analysis then Remove object scan for module. I think Olly is misinterpreted the code for some reason, even if I did not understand why this solved my problem. Anyway If there is somebody to explain why Olly did this, is welcomed.

  • There is a good answer here: reverseengineering.stackexchange.com/questions/1541/… – Carlos Garcia Apr 12 '15 at 17:13
  • I have read this post before I post my question. But my problem is consistent. When I open the program and not run yet, Ollydbg still could not give correct instructions, If my problem was related to that post I should have faced this when the program is running, am I wrong ?? Also I have opened program with static analysis tool other than ollydbg it shows all instructions clearly. – zorrrrro Apr 13 '15 at 9:09
  • A lot of things happen before Olly stops execution, maybe the antidebugging code runs in a TLS-callback or alike. – Carlos Garcia Apr 13 '15 at 9:22
  • Possible duplicate of INT 2D Anti-Forensic Method – Joshua Sep 7 '18 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.