Log in

View Full Version : bad assembly analysis


Necr0Potenc3
February 10th, 2005, 04:16
this is the code:
http://necrotoolz.sourceforge.net/IRW/Main.c ("http://necrotoolz.sourceforge.net/IRW/Main.c")
the executable:
http://necrotoolz.sourceforge.net/IRW/IRWLauncher.exe ("http://necrotoolz.sourceforge.net/IRW/IRWLauncher.exe")
and the error:
http://necrotoolz.sourceforge.net/IRW/badanalysis.jpg ("http://necrotoolz.sourceforge.net/IRW/badanalysis.jpg")

the display starts at line 527. the executable was compiled with vs.net 2003 and I'm using olly 1.10 in winxp pro (sp2)

Necr0Potenc3
February 10th, 2005, 04:22
btw, I know it says (int)(INT_PTR)WriteProcessMemory... but disregard that since no cast is necessary.

and even though I remove the cast, the bad assembly analysis remains

blabberer
February 10th, 2005, 05:02
i see it correctly with 0llydbg v 1.10
what version you are using
did you try analysing it once more ??
probably you have some messed up .udd file in there which puts it
try finding irwblah.udd and delete it and re load the exe

here is the same snippet in my copy of ollydbg

0040204D |.>MOV EDX, DWORD PTR SS:[ESP+110]
00402054 |.>MOV ECX, DWORD PTR SS:[ESP+32C]
0040205B |.>SUB EDX, EBP
0040205D |.>SUB EDX, ESI
0040205F |.>SUB EDX, 7
00402062 |.>PUSH 0 ; /pBytesWritten = NULL
00402064 |.>MOV DWORD PTR DS:[EAX+3], EDX ; |
00402067 |.>MOV EAX, DWORD PTR SS:[ESP+34] ; |IRWLaunc.<ModuleEntryPoint>
0040206B |.>PUSH EAX ; |BytesToWrite = 0
0040206C |.>PUSH EBX ; |Buffer = 7FFDF000
0040206D |.>PUSH ESI ; |Address = 0
0040206E |.>PUSH ECX ; |hProcess = 01010101
0040206F |.>CALL NEAR DWORD PTR DS:[<&KERNEL32.WriteProcessMemory>] ; &#92;WriteProcessMemory

also try compiling with debugging info and see the source using ctrl+f5
along side

Necr0Potenc3
February 10th, 2005, 05:06
yeap... I deleted the udd files and now it displays the assembly correctly. stupid of me not to have thought of that before

crap.. I thought I accidently had written code that messes up disassemblies lol

thanks anon