 
View Full Version : int3 traping problem on XP
Anonymous
October 2nd, 2003, 23:50
I having problem with traping the following test code.
@@:
    xor eax,eax
    jnz @b
    int3
    ret
Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area.
What's wrong?
I'm on XP1.
BiMode
Anonymous
October 2nd, 2003, 23:52
I having problem with traping the following test code. 
<pre>
@@: 
   xor eax,eax 
   jnz @b 
   int3 
   ret 
</pre>
Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area. 
What's wrong? 
I'm on XP1. 
BiMode
blabberer
October 3rd, 2003, 09:49
004024F6      33C0       XOR EAX,EAX
004024F8      75 07      JNZ SHORT 00402501                       
004024FA      CC         INT3
004024FB      C3         RETN
004024FC      90         NOP
i havent understood what you are asking but i assembled this in place in olly and used new origin here option and single stepped through this it seems to work flawlessly  xor eax,eax makes eax,0 and changes the zero flag to 1
so the jnz isnt taken next step int3 is executed and i see a notification in olly status bar stating int3 in blah blah  and the next instruction ret returns to what ever is in stack top
Anonymous
October 3rd, 2003, 20:32
NO, you misunderstood me.
try to create the exe that has the code above (and set Olly as JIT too).
run the exe and use OllyDbg to trap the fault and you will see.
Don't forget to look at EIP and see which is at.
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.