Hi everybody!

I am just stuck with a seems-to-be-trivial problem. I need a conditional breakpoint that breaks if ESI is not equal to 0x11010504 and ESI is not equal to 0x1101E434.


If I try to write "(esi != 11010504)&&(esi != 1101E434)", Olly still stops when ESI=1101E434

Breakpoint "!(esi IN (11010504,1101E434))" also is not giving the expected result. How can I get the result that I need?


Thanks,
kao.

p.s. Olly version is 1.09d.
p.p.s. Yes, I read the manual. And yes, I've used Google before asking...

i also have a problem with conditional breakpoints, similar to yours..

the condition "BYTE [EDX]==36" doesn't work properly.
for example, it also breakes if EDX=0..
i'm not sure what is wrong. maybe the problem is, that the memory value at [EDX]=[0] is undefined/can't be accessed, so it breaks by default.

but then if i try "(BYTE [EDX]==36)&&(EDX!=0)" it still doesn't work.. it isn't even accepted as a valid expression, as it seems.

and that's just one example. there were more occasions like that.
leads to the conclusion that the expression handling is buggy.
or can anyone explain that behaviour?

maybe it requires 0x36 ? dunno, just random guess.

well there seems to be some problem with the syntaxes posted

first q
at any given time esi cant be equal to x and y
it can be either equal to x or not equal to x
so may be you should try using or
{
.if esi != ***** will break every where except *****
if esi == ***** will break only at ******
if esi == ***** or ++++++ may break at two points
}
needs some checking and i dont have access to olly atm so may post edits later but i never faced some problems with cond break
and i use it all times (gotta use it when debugging ddraw fullscreen apps and it will freeze with hard bpt)
else how to find what call is called with [edx+5ch]

second q
why not try writing like byte ptr ds:[ebx] == 0x36 and once it breaks then try abbreviations

instead of just conditional try using conditional log and choose to log always so that the log window shows you what really your condition means to olly and what was your assumption of the condition

many times olly will tell you unknown thats a big hint to write proper condition rather than breaking head

Sorry, my english obviously is not good enough.

I wish that olly continues if ESI=0x11010504. I wish that Olly continues if ESI=0x1101E434. Otherwise Olly should stop. Hopefully it is now clear.

The problem is very strange. The following breakpoint is working (unpacked exe, addresses in EXE code segment):
esi!=400100&&esi!=400400

This breakpoint is not working (packed exe, these addresses are in loaded OCX code segment):
esi!=11010504&&esi!=1101E434

Any ideas?