well i saw a crackme that was crashing ollydbg this way
the crakme is here
http://biw.rult.at/vbb/upload/showthread.php?threadid=1042
so i kinda modified ollydbg to prevent it from crashing
Code:
########################################################################################################################################################
DO NOT USE WORD WRAP IN NOTEPAD AND MAXIMIZE SCREEN FOR BETTER VIEWABILITY
########################################################################################################################################################
here is the modification i did to ollydbg
004AF644 > \60 PUSHAD ; well safety
004AF645 . 6A 03 PUSH 3 ; MEM_RESILENT I THINK NOT SURE COPY PASTE
004AF647 . FF35 26574D00 PUSH DWORD PTR DS:[4D5726] ; poked around and saw olly using it so i am using it
004AF64D . FF35 20574D00 PUSH DWORD PTR DS:[4D5720] ; poked around and saw olly using it so i am using it
004AF653 . 52 PUSH EDX ; poked around and saw olly using it so i am using it
004AF654 . E8 B31CFBFF CALL OLLYDBGm._Readmemory ; what else reading memory
004AF659 . B8 25000000 MOV EAX, 25 ; set % as scan charecter
004AF65E . 8B3C24 MOV EDI, DWORD PTR SS:[ESP] ; you might have noticed i have not popped up stack
004AF661 . 8B4C24 08 MOV ECX, DWORD PTR SS:[ESP+8] ; you might have noticed i have not popped up stack
004AF665 . F2:AE REPNE SCAS BYTE PTR ES:[EDI] ; scanning for % in the debugstring
004AF667 . 83F9 00 CMP ECX, 0 ; will be zero only if the string didnt contain %
004AF66A . 75 0E JNZ SHORT OLLYDBGm.004AF67A ; bad boy
004AF66C . 83C4 10 ADD ESP, 10 ; popping stack contents of ReadMemory call
004AF66F . 61 POPAD ; safety relese
004AF670 . E8 B775FFFF CALL OLLYDBGm.004A6C2C ; restore old instruction that was buggered up for this check and call it
004AF675 .^ E9 141CF8FF JMP OLLYDBGm.0043128E ; jmp back to original place
004AF67A > 83C4 10 ADD ESP, 10 ; popping up stack contents of Readmemory
004AF67D . 61 POPAD ; safety release
004AF67E . 83C4 08 ADD ESP, 8 ; popping the original args
004AF681 .^ E9 CD1CF8FF JMP OLLYDBGm.00431353 ; jmping to readmemory failure place
######################################################################################################################################################
this is the call i am diverting to my modification
######################################################################################################################################################
00431289 . /E9 B6E30700 JMP OLLYDBGm.004AF644
######################################################################################################################################################
the above is my code what i did was to parse the string any string that conmes to this place for % specifier if it existed it will not output that string
if it didnt exist it will output that string
hope it may be of help to some one can some one test this on armadillo and tell me whether it works properly i know it works on this crackme
ollydbg version 1.10
tested on w2k sp4
any other test reports on different os are also appreciated