PDA

View Full Version : Olly Crashed On Loading App


kangdangda
March 17th, 2007, 22:31
I am debugging a game exe file using Olly. That exe file was encrypted and Peid 0.93 sees nothing,so I decided to manually unpack it.However,when I load it using Olly,it crashes Olly before reaches its EP.After more exploration,I found the app will stop at its EP and don't crash if I minimize the Dessembly window of Olly to just 10 lines.The Displayed asm code is:

006FE014 > B8 00000000 MOV EAX,0 <--- EP here,
006FE019 60 PUSHAD
006FE01A 0BC0 OR EAX,EAX
006FE01C 74 68 JE SHORT Game.006FE086
006FE01E E8 00000000 CALL Game.006FE023
006FE023 58 POP EAX
006FE024 05 53000000 ADD EAX,53
006FE029 8038 E9 CMP BYTE PTR DS:[EAX],0E9
006FE02C 75 13 JNZ SHORT Game.006FE041
006FE02E 61 POPAD <--- Ok ,nothing happens when Dessembly windows is small enough only to see this line and above.
006FE02F EB 45 JMP SHORT GAME.006FE076 <---Crashes When I Continue dragging to Expand Dessembly window to see this line

So I wonder if it is an Anti-Olly protection or just an Olly bug? The poped out error msgbox says olly crashes at 0x0004AA2F2 in ollydbg.exe by a floating operation error

Thanks for any suggestions.

kangdangda
March 18th, 2007, 04:33
After several hours of endeavor,i have to shrink the dessembly window of Olly to workaround the crash problem.Now another problem arises.The exe has an anti-olly mechnism embeded within it.If it detects the existence of Olly,whenever it is under debugging by Olly or running standalone, it will throw exceptions and pop up a message window and finally exit.The Olly plugins such as Invisible.dll ,HideDebugger.dll,IsDebugV1.4.dll,AdvancedOlly.dll all fail to hide Olly successfully.
So any ideas?

fr33ke
March 18th, 2007, 05:02
I have seen this entrypoint before, and I think it's the floating point trick:
Code:
6FE037: dt 9.2233720368547758075e18

Read more about it @http://board.flatassembler.net/topic.php?t=5820.

kangdangda
March 18th, 2007, 09:50
Thanks a lot! It is the point. Now I have patched my Olly at 0x4AA2f2 to be DB38 and the nasty crash disappeared.
And could you please tell me which protector is likely to be used with such an enrypoint style?

fr33ke
March 18th, 2007, 10:13
Xtreme Protector most likely.

kangdangda
March 18th, 2007, 20:35
Now I've checked it out.It is protected by Themida 1.8.2.

kangdangda
March 19th, 2007, 03:04
Deos any one know how to bypass the anti-olly tircks of Themida 1.8.2?
I've tried many ,but will always be detected.
There is an similar UmpackMe Test,
http://www.tuts4you.com/blogs/download.php?view.1173

Thanks in advance.

SiGiNT
March 21st, 2007, 14:16
The ARTeam site has info on Themida.

SiGiNT

kangdangda
March 22nd, 2007, 08:44
Thanks a lot. I've found SubZero's tut and now it doesn't seem to be an untackable problem any more.