Ollydbg Help Required. :-/

Hello all,

Yes I know only my 2nd post and I am already seeking your assistance with a problem I am having recently sorry but I am desperate and stuck with this one.

Within the last week I am having trouble getting Ollydbg to trace through some applications that I was able previously to trace without any issues and I am not sure what has caused this to happen. I have tried tracing the same applications on a different PC using the same version of Ollydbg and they trace fine so I am unsure why I am currently unable to trace them using this PC.

Let me explain the problem that I am experiencing this has only started to happen with in the last week or so. When I now try and debug any of these applications I am getting an Exception error I have tried using shift + F7 to pass the exception but this does not seem to allow the application to continue to execute. I am getting this same error for a number of applications that have not been changed in any way or updated and are not packed why would I suddenly not be able to debug applications that I could previously as I am still able to trace them on another PC that I have but really want to fix the problem on this PC. I think it may have something to do with msvcrt.dll which I believe is a dll file (I have tried replacing this file but still get the same error) that holds common C/C++ functions here is an example of the error I am getting when trying to trace the applications.

Stack [0012F69C]=77C114BC (msvcrt.77C114BC), ASCII "Access violation - no RTTI data!"
ESI=0012F730

Any help or advice in how to correct this and explanations as to why it has suddenly occurred will be greatly appreciated. The only thing I can recall changing/updating on my PC recently is ZoneAlarm and also I applied some updates via the Windows Update site.

Thanks,

ISquishWorms.

ISquishWorms
Use SHIFT+F9
Or look attach

Hi all,

Thanks ilyacr that did kind of work in that it now seems to allow the trouble some applications to continue further however I am still hitting this exception often enough that hitting Shift F9 becomes frustrating I wonder what has caused this to suddenly happen. I am sure it’s not Ollydbg at fault as I have even tried downloading it again and running it with in a different folder so I am sure it has something to do with another outside file on my PC. Thanks for the link to the exceptions as well which once I am able to download I will I think I need more posts or something like that before I can.

Anyway thanks again for the tip and if you or anyone else can help me get rid of this problem with out the need to repeatedly hit Shift F9 I would be grateful.

Thanks,

ISquishWorms.

have you tried deleting all old .udd and .bak files in ollydbg directory
(i think you have as you say you ran a new ollydbg in a new folder )
any way if you havent then do try it some corrupted udd forces abnormal behaviours like you have set a break point on .data and it corrupts the flow of execution (olly warns about break points on .data still you might have embedded it some how into .udd )

well if that is not the case msvcrt.dll is a
sfc file (ie this file is protected by windows from being modified inadvertantly inadvertantly being the key word

so you can always try sfc/scannow from commandline
to check for its correctness (you will need your windows cd for it to work properly if it found that your msvcrt is corrupt it will extract a
correct and valid msvcrt.dll from cd and replace it
in both system32\dllcache as well as system32

if you dont have cd then you atleast need the i386 folder in one of your partition (look for snakefoot site or axcells site for tips on playing with sfc
cd path changing tips

now one more way would be to catch the exception itself from ollydbg
by using ollydbg as jit (just in time) and look at its call stack to find why and where it errs and see if this is called by your program that you loaded
or some antiviral dlls (those which load into every apps if you are running
an av


btw msvcrt.dll in my computer looks for an image base of
0000010C 00000078 DD 78000000 ; ImageBase = 78000000

but you say it errs in 77 i cant understand if it being relocated

so i loaded msvcrt and looked for your string refs
i see it is there

Text strings referenced in msvcrt:.text, item 150
Address=780195F6
Disassembly=PUSH msvcrt.78034C64
Text string=ASCII "Access violation - no RTTI data!"

it is referanced here

780195F3  MOV     ESP, DWORD PTR SS:[EBP-18]
780195F6  PUSH    msvcrt.78034C64                               ; /Arg1 = 78034C64 ASCII "Access violation - no RTTI data!"
780195FB  LEA     ECX, DWORD PTR SS:[EBP-24]                    ; |
780195FE  CALL    msvcrt.__non_rtti_object::__non_rtti_object   ; \__non_rtti_object::__non_rtti_object

it is called from these places

Call tree
Called from                       Procedure                                     Calls                             Comment
msvcrt.780195FE                   msvcrt.__non_rtti_object::__non_rtti_object   msvcrt.exception::exception       Sys
msvcrt.__RTtypeid+81
msvcrt.780196C4

ad it calls exception code so some _try _catch _throw _finally sequence is corrupt i would assume

hope you can provide some good info rather then not working as
it doesnt mean anything

btw there are lot of msvcrt.dll ( it is redistributable dll so you can fetch a copy from ms too and try putting it in a local directory
and load the app (dont try replacing it in system dir at first go)

Hi everyone,

Thanks for trying to help me in this matter JuneMouse much appreciated I had considered that the .udd and .bak files may of become corrupt and this is partly why I had downloaded Ollgdbg again and tried it in a different folder with no success.

I tried your sfc /scannow suggestion and it did report some files that seemed to have been modified and I replaced them using my XP installation CD and rebooted but unfortunately the problem was still there (I never knew about sfc so I have learnt something new even if that did not seem to correct the issue I am having).

Then reading you reply further you mentioned antivirus which suddenly reminded me (thank you so much your now my top mouse!) that the problem had first appeared after installing ZoneAlarm Security Suite Version 5.5.062.004. No I thought to myself this can’t be the reason as I have the antivirus in ZoneAlarm turned off. However I decided to install ZoneAlarm on another PC (that I was still able to trace on using Ollydbg) and one of the applications which until recently I have been able to trace without a problem and sure enough I get the same exception an as previously mentioned and shown below.

(msvcrt.77C114BC), ASCII "Access violation - no RTTI data!"

Yes it is 77 maybe ZoneAlarm is relocating it for its own evil purposes I have no idea.
Strangely the program I am trying to trace will still run and execute fine outside of Ollydbg which I also don’t understand.

Which brings me to conclude that there is a compatibility issue between ZoneAlarm Security Suite Version 5.5.062.004 and I guess possibly other versions of ZoneAlarm Security Suite?

After establishing the cause I tried closing ZoneAlarm Security Suite but this does not solve the problem either. I am guessing I need to uninstall ZoneAlarm Security Suite completely because I sure am not doing away with my Ollydbg that wins every time over ZoneAlarm Security Suite! I am just hoping now that once I have uninstalled and removed ZoneAlarm Security Suite completely that I will be able to trace these applications again without any problems I will let you know how I get on.

Thanks again all those that helped me in resolving this matter,

ISquishWorms. (Don’t let them bytes beat ya!)