View Single Post
  #2  
Old 10-05-2005, 00:24
JuneMouse
 
Posts: n/a
well olly dbg doesnt stop on the dll initialization stage becuase there seems to be no
DllInit code in there so it finsishes up initialisation and directly goes to loaded sode

if you really want to step through all the init crap
view file --> load the dll
then ctrl+g type 50f2 (addr of entry point and change the e9 a6 to ebfe )
right click save in new name

load this in ollydbg it will be looping endlessly on the infinite jump
hit f12 pause
and change back the bytes to e9 a6 and single step through
or just right click and break point memory on write at that address

you will see who is writing what and when

[code]
Log data, item 0
Address=10054883
Message=Memory breakpoint when writing to [100540F3]

10054883 8910 MOV DWORD PTR DS:[EAX],EDX

eax = 100540F3
edx = FFFAD924

what the heck is this dll for ?? is it really named so weird ??
hope it was not viral
Text strings referenced in dfb58hh1:.text, item 34
Address=10002F62
Disassembly=MOV DWORD PTR SS:[EBP-128],dfb58hh1.10009438
Text string=ASCII "A security error of unknown cause has been detected which has
corrupted the program's internal state. The program cannot safely
continue execution and must now be terminated.
"
Reply With Quote