![]() |
|
#1
|
|||
|
|||
|
I have been playing around with assembling/debugging my own simple little programs and have noticed an oddity while using Olly Debug.
frinstance... I have a call to "CreateWindowExA" with lots of PUSH'es beforehand to load up the details. The problem is, that it does not seem to want to display correctly. For example, a region "without" analysis looks like Code:
0040107D 6A 00 PUSH 0 0040107F FF35 A0314000 PUSH DWORD PTR [4031A0] 00401085 6A 00 PUSH 0 00401087 6A 00 PUSH 0 00401089 68 C8000000 PUSH 0C8 0040108E 68 2C010000 PUSH 12C 00401093 68 00000080 PUSH 80000000 00401098 68 00000080 PUSH 80000000 0040109D 68 0000CF00 PUSH 0CF0000 004010A2 68 12304000 PUSH OFFSET OpenFile.AppName ; ASCII "Win32 Asm Edit" 004010A7 68 00304000 PUSH OFFSET OpenFile.ClassName ; ASCII "Win32ASMEditClass" 004010AC 68 00020000 PUSH 200 004010B1 E8 54030000 CALL <JMP.&user32.CreateWindowExA> Code:
0040107D . 6A 00 PUSH 0 0040107F . FF35 A0314000 PUSH DWORD PTR [4031A0] 00401085 . 6A 00 PUSH 0 00401087 . 6A 00 PUSH 0 00401089 . 68 C8000000 PUSH 0C8 0040108E . 68 2C010000 PUSH 12C 00401093 . 68 00000080 PUSH 80000000 00401098 68 DB 68 ; CHAR 'h' 00401099 00 DB 00 0040109A 00 DB 00 0040109B > 00 DB 00 0040109C 80 DB 80 0040109D 68 DB 68 ; CHAR 'h' 0040109E 00 DB 00 0040109F 00 DB 00 004010A0 CF DB CF 004010A1 00 DB 00 004010A2 68 DB 68 ; CHAR 'h' 004010A3 . 12304000 DD OFFSET OpenFile.AppName ; ASCII "Win32 Asm Edit" 004010A7 68 DB 68 ; CHAR 'h' 004010A8 . 00304000 DD OFFSET OpenFile.ClassName ; ASCII "Win32ASMEditClass" 004010AC 68 DB 68 ; CHAR 'h' 004010AD 00 DB 00 004010AE 02 DB 02 004010AF 00 DB 00 004010B0 . 00E8 ADD AL, CH 004010B2 . 54 PUSH ESP 004010B3 . 0300 ADD EAX, DWORD PTR [EAX] 004010B5 . 00A3 CC314000 ADD BYTE PTR [EBX+4031CC], AH Selection/Right-click Analysis ->During Next analysis, treat selection as->Commands Which is ok, but it is bothering me that I don't know why it is happening. ![]() Is this a "Feature" of Olly? Is it something to do with the alignment of code/data within the sections? Is there some other options I could change. Any tips gratefully received. B. |
| Tags |
| analysis, debug, olly |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Olly pdk 1.08 | ragdog | General Discussion | 4 | 01-05-2014 21:16 |
| Olly PDK question | ferrit.rce | General Discussion | 4 | 10-02-2013 18:46 |
| Olly & .NET | peleon | General Discussion | 8 | 06-21-2007 09:13 |
| Olly BPM | apex | General Discussion | 1 | 02-25-2005 15:02 |