1

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code 4000001E. If I configure the executable for a compatibility mode of Windows XP (Service Pack 3) within the file properties then this exception does not occur and the binary executes as expected. The executable does not produce an exception when running with a debugger attached.

What is the root cause of this exception, and how would I determine it?

Improve this question
4
  • What version of OllyDbg are you using? Does this problem still occur with the latest version (2.01)?
    – Jason Geffner
    Jul 10, 2015 at 14:21
  • It happens in both Ollydbg 1.10 and Immunity 1.85. I'll try it with 2.01 and post back.
    – Jeremy McKeown
    Jul 13, 2015 at 20:47
  • funny fact: I've had a similar problem, and switching to XP (SP3) actually did work... there's something fishy going on with Win7 debugger support I suppose.
    – user15807
    Apr 18, 2016 at 14:37
  • Although I'm not entirely sure this is the case, I've stumbled upon this while searching for an answer... it seems that it can be caused by 64-bit/32-bit clash in the debugger. Which version of Win7 are you using? It seems that switching to XP compat. forces 32-bit compatibility, while, for some reason, in native Win7 64-bit even 32-bit apps can (?) sometimes switch to 64-bit code in debugger, resulting in nasty things.
    – user15807
    Apr 18, 2016 at 14:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.