2

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;

it should be e874010000 as a single instruction which is a call to some routine but it shows them like the picture above,

enter image description here

before the EIP jumps shown place there are instructions which are below,

enter image description here

I think int 2Dh (anti debug) is probably related to this situation. Can somebody enlighten me ? Or show some source to read and learn what is exactly going on here ?

OK I have managed to solve this problem by clicking right, then Analysis then Remove object scan for module. I think Olly is misinterpreted the code for some reason, even if I did not understand why this solved my problem. Anyway If there is somebody to explain why Olly did this, is welcomed.

Improve this question
4
  • There is a good answer here: reverseengineering.stackexchange.com/questions/1541/…
    – Carlos Garcia
    Apr 12, 2015 at 17:13
  • I have read this post before I post my question. But my problem is consistent. When I open the program and not run yet, Ollydbg still could not give correct instructions, If my problem was related to that post I should have faced this when the program is running, am I wrong ?? Also I have opened program with static analysis tool other than ollydbg it shows all instructions clearly.
    – zorrrrro
    Apr 13, 2015 at 9:09
  • A lot of things happen before Olly stops execution, maybe the antidebugging code runs in a TLS-callback or alike.
    – Carlos Garcia
    Apr 13, 2015 at 9:22
  • Possible duplicate of INT 2D Anti-Forensic Method
    – Joshua
    Sep 7, 2018 at 3:56

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.