Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 02-12-2005, 22:39
bgrimm bgrimm is offline
Friend
 
Join Date: Jan 2004
Location: South of The North Pole
Posts: 66
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 3 Times in 3 Posts
bgrimm Reputation: 0
F9->Shift-F9 Exception passing in Olly

Perhaps a simple "How does it work that way?" question:

I was just practicing on an ExeSheild packed target and was wondering how/why Ollydbg acts differently when, after triggering a memory access violation, if you hit "F9" THEN "Shift-F9", it stops program execution, just "Shift-F9", proggy runs off on its own.

If that didn't make much sense, I am confused on WHY this works:

For a simple unpack of an Exeshield target, I just loaded it in Olly.
Then ran it and it hit a memory access violation:

00405B52 8B00 mov eax,dword ptr ds:[eax]
00405B54 EB 01 jmp short TestApp_.00405B57

Access Violation when reading [00000000] ... blah blah blah.

Now if I hit "F9" and then pass the exception with Shift-F9, I stop one byte past the OEP and all is good.
If I just pass the exception with "Shift-F9", proggy runs and no stop... ok, whatever.

When I'm stopped at the exception and I press "F9", nothing really seems to happen, its not appearing to trace an instruction or anything, so what does it do? <confused>

A tutorial from Hacnho had this F9-Shift-F9 steps in it but it did not really explain WHAT had happened.

Thanks,
-bg
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Passing of Niklaus Wirth - RIP arthur plank General Discussion 18 07-27-2024 02:38
Asprotect Last Exception britedream General Discussion 10 11-03-2005 20:59
IDA IDC-script: cannot shift right properly amitophia General Discussion 2 03-28-2004 18:26


All times are GMT +8. The time now is 14:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )