PDA

View Full Version : Ollydbg Bad prefix?


DaBookshah
November 9th, 2006, 22:10
In a crackme, I find this:

00401662 F3: PREFIX REP: ; Superfluous prefix
00401663 C3 RETN

Is this one of those exploits of olly not recognising prefixes properly? apparently it was written in asm so it has to be there on purpose. If it is an exploit, what is the correct behaviour?

evlncrn8
November 9th, 2006, 22:28
trace it and see
isn't that the purpose of a crack me?

DaBookshah
November 9th, 2006, 22:50
I thought the point was that olly would execute it wrong, and disregard the prefix when it shouldn't or something like that. In any case, olly treats it just as a return, but I am suspicious.

fr33ke
November 10th, 2006, 08:03
REP only has effect on string instructions (LODS, SCAS, CMPS, MOVSB, INSB and OUTSB). On all other instructions it is ignored.

It was probably only put there to confuse you