olly "step over" plays instead [Archive] - RCE Messageboard's Regroupment

View Full Version : olly "step over" plays instead

malikah

April 24th, 2008, 12:02

Hi, when I use the "step over" button on a call, olly plays instead of stepping. It never used to do this and it's happening on more than one program..

Any Ideas?

ZaiRoN

April 24th, 2008, 12:51

It depends on the call you are stepping over. Try loading notepad.exe, you should see something like:

Code:



01007505 PUSH EAX

01007506 PUSH ESI

01007507 PUSH EBX

01007508 PUSH EBX

01007509 CALL EDI

0100750B PUSH EAX

0100750C CALL NOTEPAD.01002936

01007511 MOV ESI,EAX

01007513 MOV DWORD PTR SS:[EBP-3C],ESI

01007516 CMP DWORD PTR SS:[EBP-1C],EBX

01007519 JNZ SHORT NOTEPAD.01007522

0100751B PUSH ESI

0100751C CALL DWORD PTR DS:[<&msvcrt.exit>]

Try to F8 on call at 1007509 and 100750C. Olly will step on the first one but it will play notepad on the second call. Guess why?

blabberer

April 24th, 2008, 13:10

does play mean the exe is running like Zairon Says
or do you mean ollydbg starts animating like it does on ctrl+f8
if it is former then i will second Zairons

if it is later see if you have some plugins that sets some OdbgPausedEx LABELs universally and forgets to clean it