Log in

View Full Version : Sorry guys


Anonymous
January 6th, 2003, 11:40
Hi,

sorry about my last posting which seemed to be cracking related.
But actually it was no request for a crack, it was a question about a strange behaviour of Ollydbg. Let me try again:

If a program runs normal without Ollydbg, but generates exceptions if run under Ollydbg (access violation, single step event, hardware breakpoint), what could be the problem ? Are there some debugging options that I can set within Ollydbg that could avoid this type of problem ?

Thanks,
MrSmith

TBD
January 6th, 2003, 22:40
MrSmith: the problem can be that the program uses SEH to control program execution; to be more exact it raises an exception so that SEH gets control and have a different path.

for this you can configure in Options/Exceptions what to ignore.

ps. also please have a more detailed title to the post

Anonymous
January 7th, 2003, 03:02
I've seen this when a program is encrypted and only decrypts a small part of the program into memory - it then uses exceptions based on INT 3 and the like to trigger loads of the other parts of the program into memory. Of course, once this kind of program is run under a debugger, you only get the first part, hit the exception and Ollydbg gets it. You can't pass the exception to the program as Ollydbg is debugging it and the "program patcher" process that decrypts each section is also waiting on a WaitDebugEvent call. With these types of programs, you simply can't use a debugger on them as they are debugging themselves upon startup. It also means you can't attach to the process whilst it's running.