Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-05-2005, 00:24
JuneMouse
 
Posts: n/a
well olly dbg doesnt stop on the dll initialization stage becuase there seems to be no
DllInit code in there so it finsishes up initialisation and directly goes to loaded sode

if you really want to step through all the init crap
view file --> load the dll
then ctrl+g type 50f2 (addr of entry point and change the e9 a6 to ebfe )
right click save in new name

load this in ollydbg it will be looping endlessly on the infinite jump
hit f12 pause
and change back the bytes to e9 a6 and single step through
or just right click and break point memory on write at that address

you will see who is writing what and when

[code]
Log data, item 0
Address=10054883
Message=Memory breakpoint when writing to [100540F3]

10054883 8910 MOV DWORD PTR DS:[EAX],EDX

eax = 100540F3
edx = FFFAD924

what the heck is this dll for ?? is it really named so weird ??
hope it was not viral
Text strings referenced in dfb58hh1:.text, item 34
Address=10002F62
Disassembly=MOV DWORD PTR SS:[EBP-128],dfb58hh1.10009438
Text string=ASCII "A security error of unknown cause has been detected which has
corrupted the program's internal state. The program cannot safely
continue execution and must now be terminated.
"
Reply With Quote
  #2  
Old 10-05-2005, 14:47
wildmans
 
Posts: n/a
Thanks for this information ! Man it's great if you're stuck, and someone is willing to give new insights to your problem. Thank you for that. I get it now, just have to read a bit more about dllmain on the MSDN or something :P

The DLL is absolutly not virii It's part of an addon for fs2004. It got my attention because of the neolite2 compression
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 09:38.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )