Pages: 1
Author Topic: Found an Olly glitch!  (Read 1960 times)
Offline (Unknown gender) score_under
Posted on: February 07, 2009, 06:02:42 pm

Joined: Aug 2008
Posts: 308

View Profile
Code: [Select]
00402D76      64:               PREFIX FS:                                ;  Superfluous prefix
00402D77      2E:               PREFIX CS:                                ;  Superfluous prefix
00402D78      66:               PREFIX DATASIZE:                          ;  Superfluous prefix
;No, Olly, that prefix is pretty vital. NOT superfluous.
00402D79      F0:               PREFIX LOCK:                              ;  Superfluous prefix
00402D7A      36:               PREFIX SS:                                ;  Superfluous prefix
00402D7B      65:               PREFIX GS:                                ;  Superfluous prefix
00402D7C      3E:8700           XCHG DWORD PTR DS:[EAX],EAX
Do you see anything wrong with that disassembly?

That's right, all the superfluous prefixes surrounding the real one (PREFIX DATASIZE: is not superfluous) confuse Olly into thinking the command will be "XCHG DWORD PTR DS:[EAX],EAX". In fact, it executes as "XCHG DWORD PTR DS:[EAX],AX".

Small bug, but I thought it was amusing at the time.

I edited the code to do this - you won't find this in any application :P

Oh yeah, "xchg eax,eax" compiles, in Olly, as "90" ("nop") instead of "87C0" ("xchg eax,eax"). "xchg ebx,ebx", however, doesn't.
« Last Edit: February 07, 2009, 06:17:49 pm by score_under » Logged
Pages: 1