Thread: OllyDBG Problem

Results 1 to 5 of 5
  1. #1
    D-Vid the DBag's Avatar
    Join Date
    Jan 2011
    Gender
    male
    Posts
    146
    Reputation
    10
    Thanks
    13
    My Mood
    Lurking

    OllyDBG Problem

    Hey guys,
    I am having a slight issue, and I don't know if it's user error, or if it's an error on the program's fault.

    But...
    Everytime I load CShell.dll into OllyDBG, it shows the addresses starting from:
    Code:
    771F0000
    and ending at:
    Code:
    772C5FFF
    This is not correct, since CShell starts at:
    Code:
    37101000
    and ends at:
    Code:
    37AD106C
    Could someone explain to me either:
    1. How to fix this issue.
    2. If it's something wrong with me, or OllyDBG.



    Here's a SS of what I mean:


  2. #2
    Departure's Avatar
    Join Date
    Nov 2010
    Gender
    male
    Posts
    818
    Reputation
    125
    Thanks
    1,785
    My Mood
    Doh
    D-VID did you attach to Cshell? can you take a screen shot of the title bar so we can see what module your in, looks like your in ntdll module

  3. The Following User Says Thank You to Departure For This Useful Post:

    D-Vid the DBag (02-21-2011)

  4. #3
    D-Vid the DBag's Avatar
    Join Date
    Jan 2011
    Gender
    male
    Posts
    146
    Reputation
    10
    Thanks
    13
    My Mood
    Lurking
    Quote Originally Posted by Departure View Post
    D-VID did you attach to Cshell? can you take a screen shot of the title bar so we can see what module your in, looks like your in ntdll module
    Yeah, I will attach the SS in a sec, but that's what I am trying to figure out also.
    It shows as ntdll.[addresshere]
    but yet, it IS attached to CShell.dll

    SS:


    Holy shit.
    I really feel dumb right now.
    Sorry guys, I just smoked a FAT bowl of some dank ass weed, and I just realized by fucking around with it and telling it to run like 3 different times, that it is in fact user error. :P
    It's loaded up in CShell module now.

    SS PROOF:

    Last edited by D-Vid the DBag; 02-21-2011 at 03:55 AM.


  5. #4
    freedompeace's Avatar
    Join Date
    Jul 2010
    Gender
    female
    Posts
    3,035
    Reputation
    340
    Thanks
    2,784
    My Mood
    Sad
    I don't think you got a full version of the file. Might have been a half-successful dump lol

  6. #5
    whit's Avatar
    Join Date
    Jan 2010
    Gender
    male
    Posts
    7,170
    Reputation
    490
    Thanks
    2,252
    Hit F9 twice