When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;
it should be e874010000 as a single instruction which is a call to some routine but it shows them like the picture above,
before the EIP jumps shown place there are instructions which are below,
I think int 2Dh (anti debug) is probably related to this situation. Can somebody enlighten me ? Or show some source to read and learn what is exactly going on here ?
OK I have managed to solve this problem by clicking right, then Analysis then Remove object scan for module. I think Olly is misinterpreted the code for some reason, even if I did not understand why this solved my problem. Anyway If there is somebody to explain why Olly did this, is welcomed.