A New Anti-Olly Trick

[waliedassar]

It is a buffer overflow in ollydbg v1.10. It occurs when olly tries to find the .sym file for the being-loaded module.

POC:
/>http://ollytlscatch.googlecode.com/files/trick.exe
/>https://docs.google.com/document/d/1T5LPY3qDkxmR1XVgxnsKW42lggS5iSjtQwFXOtNfqMM/edit

Further details:
/>http://waleedassar.blogspot.com/2011/12/new-ollydbg-anti-debug-trick.html

/>http://www.virustotal.com/file-scan/report.html?id=97f2c22d3fde1db56aaef4e555e32927d0a0087e7e92d369093ac5ac749e83d9-1324964958