have you tried deleting all old .udd and .bak files in ollydbg directory
(i think you have as you say you ran a new ollydbg in a new folder )
any way if you havent then do try it some corrupted udd forces abnormal behaviours like you have set a break point on .data and it corrupts the flow of execution (olly warns about break points on .data still you might have embedded it some how into .udd )
well if that is not the case msvcrt.dll is a
sfc file (ie this file is protected by windows from being modified inadvertantly
inadvertantly being the key word
so you can always try sfc/scannow from commandline
to check for its correctness (you will need your windows cd for it to work properly
if it found that your msvcrt is corrupt it will extract a
correct and valid msvcrt.dll from cd and replace it
in both system32\dllcache as well as system32
if you dont have cd
then you atleast need the i386 folder in one of your partition (look for snakefoot site or axcells site for tips on playing with sfc
cd path changing tips
now one more way would be to catch the exception itself from ollydbg
by using ollydbg as jit (just in time) and look at its call stack to find why and where it errs and see if this is called by your program that you loaded
or some antiviral dlls (those which load into every apps if you are running
an av
btw msvcrt.dll in my computer looks for an image base of
0000010C 00000078 DD 78000000 ; ImageBase = 78000000
but you say it errs in 77
i cant understand if it being relocated
so i loaded msvcrt and looked for your string refs
i see it is there
Text strings referenced in msvcrt:.text, item 150
Address=780195F6
Disassembly=PUSH msvcrt.78034C64
Text string=ASCII "Access violation - no RTTI data!"
it is referanced here
Code:
780195F3 MOV ESP, DWORD PTR SS:[EBP-18]
780195F6 PUSH msvcrt.78034C64 ; /Arg1 = 78034C64 ASCII "Access violation - no RTTI data!"
780195FB LEA ECX, DWORD PTR SS:[EBP-24] ; |
780195FE CALL msvcrt.__non_rtti_object::__non_rtti_object ; \__non_rtti_object::__non_rtti_object
it is called from these places
Code:
Call tree
Called from Procedure Calls Comment
msvcrt.780195FE msvcrt.__non_rtti_object::__non_rtti_object msvcrt.exception::exception Sys
msvcrt.__RTtypeid+81
msvcrt.780196C4
ad it calls exception code so some _try _catch _throw _finally sequence is corrupt i would assume
hope you can provide some good info rather then not working as
it doesnt mean anything
btw there are lot of msvcrt.dll ( it is redistributable dll so you can fetch a copy from ms too and try putting it in a local directory
and load the app (dont try replacing it in system dir at first go)