Program crash

[LaDidi]

a DEC ECX couldn't crash an application !...
Have you check the dump ?
Are you sure your application isn't multi-threaded and there's a watchdog which verify this part of code ?
Regards

[dyn!o]

LaDidi: with all respect my friend... don't say things you ain't sure.

DEC ECX in your opinion can't crash or cause a special operation? How much would you bet on it? I hope not much since it can. It can perform many other wild things. I suggest you to read about viruses with advanced metamorph engines. Anyway, that's not important in *this* case but think again:

it's Hardlock, so it uses hardlock.sys (and maybe haspnt.sys) drivers. You still don't see the possibility of flags (decrement result) controlling?

Mahmut: make sure you completely removed hardlock.sys/haspnt.sys communication (you can run the software and check active drivers, or just remove the drivers).

Regards.

@dyn!o:
According to the Intel and AMD manuals, the DEC instruction can cause several exceptions, but only when working with memory addresses. There are no defined exceptions when working with registers.

Please can you give us an example how a "DEC reg8/reg16/reg32" instruction can cause any exception or do anything else than decrementing (or incrementing when a register underflow occurs) the register? (and please don't come with breakpoints or the trap flag since they are no result of the DEC instruction as such)