Log in

View Full Version : Strange ? in the asm


helloword
March 23rd, 2003, 03:52
This is a sampler of disam by Ollydbg:
0040FDAD . 8242 BC 56 add byte ptr ds:[edx-44], 56
0040FDB1 ? EA 612C58F3 3D0E jmp far 0E3D:F3582C61
0040FDB8 ? 07 pop es
0040FDB9 ? 99 cdq
0040FDBA ? 25 41C3957B and eax, 7B95C341
0040FDBF ? E5 B5 in eax, 0B5
0040FDC1 ? E1 74 loopde short 0040FE37
0040FDC3 ? 2BC3 sub eax, ebx

But the second line should be
0040FDB5 F3:
0040FDB6 3D 0E079925 cmp eax, 2599070E

Can someone give me some explanation regarding this issue ?

itsme
March 23rd, 2003, 07:12
ollydbg doesn't know where the start of the command to disassemble is, so makes a guess, and gets it wrong. CTRL+G and enter the right address. If this happens constantly, it's probably anti-debugging/anti-disassmbler code. Quite simple to do, just put E9 before actual code and then push the address on the stack and return. disassembler will produce garbage result.

eg.

call poop
db e9 ; disassembler/debugger thinks this is jump instruction
push 452a7d ; and screws up this command (hides it from cracker/etc)
retn

poop: pop eax
inc eax
push eax
retn ; return to "push 452a7d" instruction.