I recently ran an application under OllyDbg and noticed a minor inconsistency, while debugging a rep prefixed instruction (Intel® processor). When the debugger hits a breakpoint at a rep prefix'ed instruction, if I attempt to run past it (i.e., press F9), the debugger steps into the same instruction "n" number of times (each time I press F9), "n" being the initial content of ECX register, right before the instruction was first executed. This is comparable to how an emulator would behave! Instead of running past, if I step over that instruction (i.e., press F8), the debugger behaves the way one would expect and steps over to the next instruction. I was wondering whether the inconsistency I am noticing is an oversight or a bug or the intended behavior. OllyDbg folks are best placed to answer that!
0 Comments
|
AuthorFounder of KryptoGuard™ technology initiative, product and services. Archives
June 2021
Categories |