1

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code 4000001E. If I configure the executable for a compatibility mode of Windows XP (Service Pack 3) within the file properties then this exception does not occur and the binary executes as expected. The executable does not produce an exception when running with a debugger attached.

What is the root cause of this exception, and how would I determine it?

  • What version of OllyDbg are you using? Does this problem still occur with the latest version (2.01)? – Jason Geffner Jul 10 '15 at 14:21
  • It happens in both Ollydbg 1.10 and Immunity 1.85. I'll try it with 2.01 and post back. – Jeremy McKeown Jul 13 '15 at 20:47
  • funny fact: I've had a similar problem, and switching to XP (SP3) actually did work... there's something fishy going on with Win7 debugger support I suppose. – vaxquis Apr 18 '16 at 14:37
  • Although I'm not entirely sure this is the case, I've stumbled upon this while searching for an answer... it seems that it can be caused by 64-bit/32-bit clash in the debugger. Which version of Win7 are you using? It seems that switching to XP compat. forces 32-bit compatibility, while, for some reason, in native Win7 64-bit even 32-bit apps can (?) sometimes switch to 64-bit code in debugger, resulting in nasty things. – vaxquis Apr 18 '16 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.