Log in

View Full Version : int3 traping problem on XP


Anonymous
October 2nd, 2003, 23:50
I having problem with traping the following test code.

@@:
xor eax,eax
jnz @b
int3
ret

Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area.

What's wrong?
I'm on XP1.

BiMode

Anonymous
October 2nd, 2003, 23:52
I having problem with traping the following test code.

<pre>
@@:
xor eax,eax
jnz @b
int3
ret
</pre>

Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area.

What's wrong?
I'm on XP1.

BiMode

blabberer
October 3rd, 2003, 09:49
004024F6 33C0 XOR EAX,EAX
004024F8 75 07 JNZ SHORT 00402501
004024FA CC INT3
004024FB C3 RETN
004024FC 90 NOP
i havent understood what you are asking but i assembled this in place in olly and used new origin here option and single stepped through this it seems to work flawlessly xor eax,eax makes eax,0 and changes the zero flag to 1
so the jnz isnt taken next step int3 is executed and i see a notification in olly status bar stating int3 in blah blah and the next instruction ret returns to what ever is in stack top

Anonymous
October 3rd, 2003, 20:32
NO, you misunderstood me.

try to create the exe that has the code above (and set Olly as JIT too).
run the exe and use OllyDbg to trap the fault and you will see.

Don't forget to look at EIP and see which is at.