Olly Question
 

I have been playing around with assembling/debugging my own simple little programs and have noticed an oddity while using Olly Debug.

frinstance...

I have a call to "CreateWindowExA" with lots of PUSH'es beforehand to load up the details. The problem is, that it does not seem to want to display correctly.

For example, a region "without" analysis looks like
but when I hit "Analyse Code". it looks like:
Can anyone explain why this happens? I have tried fiddling with the settings, but the only difference I can seem to make is with;

Selection/Right-click Analysis ->During Next analysis, treat selection as->Commands

Which is ok, but it is bothering me that I don't know why it is happening.:mad:

Is this a "Feature" of Olly?
Is it something to do with the alignment of code/data within the sections?
Is there some other options I could change.

Any tips gratefully received.

B.

Olly may be just getting confused. As its interpreting your code as data

Make sure you have enabled under options

Analysis 2 -> Show arguments of known functions
Analysis 2 -> Guess number of arguments of unknown functions
Analysis 1 -> Heuristical Procedure recognition

Let me know :)

Thanks for the reply, but no joy. I did already have the settings you mentioned, set (and unset and pretty much all other combinations thereof).

Seem that it is an added "feature" of Olly, although I did notice that it doesn't seem to happen with OllyV2, so will just have to live with the minor inconvenience of it, for now,
or at least until V2 becomes as handy as the original (it's not as if I use half of the features of Olly, but V2 just doesn't seem complete somehow)

would you mind uploading target executable so I might have a look?

is a problem of olly
 

If you work with packed executables, and a seccion is unpacked on the fly and is originallly marked like data section, when end the unpacking job and jump to execute code in this section, olly mantain the initial analisys (thinking is a data section), and display like data. (DBs)
Only removing the initial analisys is posible see the created on the fly executable code.

ricnar

Agree ricnar, I am assuming this is not a packed executable based on his comment. I am guessing possibly section flags are to blame.

Doh
 

:confused:

I dunno how it happened but it seems to have fixed itself. :o

I was all set to upload the .asm as an attachment, when I noticed that I had used an .inc file to clean up some of the code, and it would no longer build.

As it happens, overnight I had managed to delete the file while fiddling with different versions of Masm to see if that was the culprit.

Trouble is I cannot for the life of me remember what else was in the .inc file. all I can remember is that I had changed around the original example to be easier to read, by following the structure of another simple program I had found online (can I remember what it was called, can I &%$# !!)

eg putting the "RegisterWindow" bit in its own procedure. and the same for the message loop, making the whole thing look a lot cleaner.

From what I can tell from what is in the .asm file now, I had put a lot of the includes and a procedure to Show/update the window into the .inc.

So just now when I quickly just added the includes, and put back the separate calls to Show/Update window. I built the executable, and had a quick look in Olly to check that it was still doing the same thing...voila! it had magically fixed itself.

So I think it must have been something in the way that I had used the includes, or called the procedure that had caused Masm to somehow make Olly think portions of the code section were really data. (however the code that would have been in the .inc file was not the code that was displayed incorrectly in Olly)

I just wish I could remember what else I had put in the .inc file. I had thought to start adding useful routines that I might use across different programs into one place, and so put the file along side the other includes that come with Masm32, and then promptly forgot all about it.

So thanks for your answers, to my NON-question. I think perhaps I had better just shut up for now, and stop bothering you nice people.

B

PS Thought I might as well attach the source

Thanks for the help.

I have just spent the last hour trying to recreate the .exe to give the same problem.

Gonna have to put this one down to sunspot activity and get on with my life.

For sanities sake I am going to close the thread and try to put it out of my mind, before I go completely loopy.

B.