Ollydbg Help Required. :-/
Hello all,
Yes I know only my 2nd post and I am already seeking your assistance with a problem I am having recently sorry but I am desperate and stuck with this one. Within the last week I am having trouble getting Ollydbg to trace through some applications that I was able previously to trace without any issues and I am not sure what has caused this to happen. I have tried tracing the same applications on a different PC using the same version of Ollydbg and they trace fine so I am unsure why I am currently unable to trace them using this PC. Let me explain the problem that I am experiencing this has only started to happen with in the last week or so. When I now try and debug any of these applications I am getting an Exception error I have tried using shift + F7 to pass the exception but this does not seem to allow the application to continue to execute. I am getting this same error for a number of applications that have not been changed in any way or updated and are not packed why would I suddenly not be able to debug applications that I could previously as I am still able to trace them on another PC that I have but really want to fix the problem on this PC. I think it may have something to do with msvcrt.dll which I believe is a dll file (I have tried replacing this file but still get the same error) that holds common C/C++ functions here is an example of the error I am getting when trying to trace the applications. Stack [0012F69C]=77C114BC (msvcrt.77C114BC), ASCII "Access violation - no RTTI data!" ESI=0012F730 Any help or advice in how to correct this and explanations as to why it has suddenly occurred will be greatly appreciated. The only thing I can recall changing/updating on my PC recently is ZoneAlarm and also I applied some updates via the Windows Update site. Thanks, ISquishWorms. |
1 Attachment(s)
ISquishWorms
Use SHIFT+F9 Or look attach |
Hi all,
Thanks ilyacr that did kind of work in that it now seems to allow the trouble some applications to continue further however I am still hitting this exception often enough that hitting Shift F9 becomes frustrating I wonder what has caused this to suddenly happen. I am sure it’s not Ollydbg at fault as I have even tried downloading it again and running it with in a different folder so I am sure it has something to do with another outside file on my PC. Thanks for the link to the exceptions as well which once I am able to download I will I think I need more posts or something like that before I can. Anyway thanks again for the tip and if you or anyone else can help me get rid of this problem with out the need to repeatedly hit Shift F9 I would be grateful. Thanks, ISquishWorms. |
have you tried deleting all old .udd and .bak files in ollydbg directory
(i think you have as you say you ran a new ollydbg in a new folder ) any way if you havent then do try it some corrupted udd forces abnormal behaviours like you have set a break point on .data and it corrupts the flow of execution (olly warns about break points on .data still you might have embedded it some how into .udd ) well if that is not the case msvcrt.dll is a sfc file (ie this file is protected by windows from being modified inadvertantly :) inadvertantly being the key word :) so you can always try sfc/scannow from commandline to check for its correctness (you will need your windows cd for it to work properly :) if it found that your msvcrt is corrupt it will extract a correct and valid msvcrt.dll from cd and replace it in both system32\dllcache as well as system32 if you dont have cd :) then you atleast need the i386 folder in one of your partition (look for snakefoot site or axcells site for tips on playing with sfc cd path changing tips now one more way would be to catch the exception itself from ollydbg by using ollydbg as jit (just in time) and look at its call stack to find why and where it errs and see if this is called by your program that you loaded or some antiviral dlls (those which load into every apps if you are running an av btw msvcrt.dll in my computer looks for an image base of 0000010C 00000078 DD 78000000 ; ImageBase = 78000000 but you say it errs in 77 :( i cant understand if it being relocated :( so i loaded msvcrt and looked for your string refs i see it is there Text strings referenced in msvcrt:.text, item 150 Address=780195F6 Disassembly=PUSH msvcrt.78034C64 Text string=ASCII "Access violation - no RTTI data!" it is referanced here Code:
780195F3 MOV ESP, DWORD PTR SS:[EBP-18] Code:
Call tree hope you can provide some good info rather then not working as it doesnt mean anything btw there are lot of msvcrt.dll ( it is redistributable dll so you can fetch a copy from ms too and try putting it in a local directory and load the app (dont try replacing it in system dir at first go) |
Hi everyone,
Thanks for trying to help me in this matter JuneMouse much appreciated I had considered that the .udd and .bak files may of become corrupt and this is partly why I had downloaded Ollgdbg again and tried it in a different folder with no success. I tried your sfc /scannow suggestion and it did report some files that seemed to have been modified and I replaced them using my XP installation CD and rebooted but unfortunately the problem was still there (I never knew about sfc so I have learnt something new even if that did not seem to correct the issue I am having). Then reading you reply further you mentioned antivirus which suddenly reminded me (thank you so much your now my top mouse!) that the problem had first appeared after installing ZoneAlarm Security Suite Version 5.5.062.004. No I thought to myself this can’t be the reason as I have the antivirus in ZoneAlarm turned off. However I decided to install ZoneAlarm on another PC (that I was still able to trace on using Ollydbg) and one of the applications which until recently I have been able to trace without a problem and sure enough I get the same exception an as previously mentioned and shown below. (msvcrt.77C114BC), ASCII "Access violation - no RTTI data!" Yes it is 77 maybe ZoneAlarm is relocating it for its own evil purposes I have no idea. :confused: Strangely the program I am trying to trace will still run and execute fine outside of Ollydbg which I also don’t understand. Which brings me to conclude that there is a compatibility issue between ZoneAlarm Security Suite Version 5.5.062.004 and I guess possibly other versions of ZoneAlarm Security Suite? After establishing the cause I tried closing ZoneAlarm Security Suite but this does not solve the problem either. I am guessing I need to uninstall ZoneAlarm Security Suite completely because I sure am not doing away with my Ollydbg that wins every time over ZoneAlarm Security Suite! I am just hoping now that once I have uninstalled and removed ZoneAlarm Security Suite completely that I will be able to trace these applications again without any problems I will let you know how I get on. Thanks again all those that helped me in resolving this matter, ISquishWorms. (Don’t let them bytes beat ya!) |
All times are GMT +8. The time now is 07:46. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX