Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  OllyDBG Process Terminated

Topic created on: April 28, 2014 14:33 CDT by mindbender25 .

Hello,
as a nooby I'm trying to analyze a malware sample with OllyDBG, but I couldn't get the program to run. After less then a second "Terminated" appears.
I aldready tried to use Addons like "Hide Debugger" and "HideOD" and configured OllyDBG to ignore all exceptions - nothing helped.

By using xPELister I noticed that the values SizeOfCode and SizeOfInitializedData seem to be wrong. I tried to repair it with LordPE, but this also didn't success to run the file.

Now I come to an end with my beginner knowledge and would be very glad if someone could help me with this.

Here's call stack:
all stack of main thread
Address    Stack      Procedure / arguments                                             Called from                   Frame
001125E4   7C91DE5C   Includes ntdll.KiFastSystemCallRet                                ntdll.7C91DE5A                001125F4
001125E8   7C801E3A   ntdll.ZwTerminateProcess                                          kernel32.7C801E34             001125F4
001125F8   003F2399   Includes kernel32.7C801E3A                                        003F2393                      001125F4
0011F270   003F346C   003F0018                                                          003F3467                      0011F26C
0012BEE8   003F0009   003F0018                                                          003F0004                      0012BEE4
0012BEF4   00AD0621   Includes 003F0009                                                 00AD061F                      0012FC40
0012FC44   00AD0036   00AD0242                                                          00AD0031                      0012FC40
0012FC48   0040186F   Includes 00AD0036                                                 malware_.0040186D             0012FE6C
0012FC4C   0040185D   ? malware_.0040186A                                               malware_.00401858
0012FC5C   004019C0   ? malware_.004011F2                                               malware_.004019BB

No posts found under this topic.
Note: Registration is required to post to the forums.

There are 31,054 total registered users.


Recently Created Topics
Ultimate Hacking Cha...
Jun/21
CreateMutex
May/31
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
crystalwade
Jul/20
test

nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit