Log in

View Full Version : is this a bug?


hackerman
February 20th, 2005, 00:02
hi all

load a target in olly then hold on ctrl and move up or down couple of times
0051EB7B |. E8 31230000 CALL UEDIT32.00520EB1 ; \UEDIT32.00520EB1
0051EB80 |. 59 POP ECX
0051EB81 |. EB 03 JMP SHORT UEDIT32.0051EB86
0051EB83 |> 56 PUSH ESI
0051EB84 |. FFD7 CALL EDI
0051EB86 |> 8D43 FE LEA EAX,DWORD PTR DS:[EBX-2]
thats was happened:

0051EB7A |? 13E8 ADC EBP,EAX
0051EB7C |? 3123 XOR DWORD PTR DS:[EBX],ESP
0051EB7E |? 0000 ADD BYTE PTR DS:[EAX],AL
0051EB80 |. 59 POP ECX
0051EB81 |. EB 03 JMP SHORT UEDIT32.0051EB86
0051EB83 |> 56 PUSH ESI
0051EB84 |. FFD7 CALL EDI
0051EB86 |> 8D43 FE LEA EAX,DWORD PTR DS:[EBX-2]

zero1
February 23rd, 2005, 20:25
nope that's not a bug. it's not just aligned (not viewing the correct offset). If your code is full of JUMP instructions and after those command you put a garbage byte, your code would look meaningless at first glance.

analyze this code:
jump code.hello
db 'EB'
hello:
pop eax


which when transferred to machine code will look:
eb01
eb ;garbage byte
58

but olly will not fix the view (same with HIEW) except if you follow the jump instruction:
00000000 eb01 ;jmp code.00000003
00000002 eb58 ;jmp code.00000059