I am trying to stop execution at a certain address. The problem is that the address does not contain any code yet, but by the time the execution reach that point it will.

After execution has passed that address it will be to late, then my address will be cleaned of any code.

I canīt put a breakpoint directly at that address so I thought Iīd give Run trace a try.

Well, so far so good, I think I set all the conditions right and so on but I canīt seem to get the actual trace started, when I press Trace into (Ctrl+F11) it takes one step and one step only.
I have tried having the Run trace window log to a file and all sorts of stuff but to no avail, I still need to sit and press Ctrl+11 a couple of billion times... and it simply is not possible to get to my address within reasonable time, I really need it to run until that point and brake there.

The condition I have set is EIP=1001F1A5
That being my address.

So, to recap, I open my executable, it gets paused.
I press CTRL+T and type in EIP=1001F1A5 next to "Condition is TRUE" and check the box.

I choose Open or clear runtrace (nothing happens)
I press CTRL+11, it takes one step.

I read somewhere that I should press CTRL+11 only once so I tried waiting for a while after the first ctrl+11... nothing happened. And the process is still paused, no logfile or run trace window is updated.

I have tried all sorts of combinations and whatnot in the above procedure... simply is not working.

Am I doing something wrong?
In case Im doing it right and there seems to be a bug Iīm sitting on a Windows XP second edition and a P4 processor with hyperthreading.

[Edit]

Ah, I forgot to say, I have also tried just starting the execution again with F9, but then I dont get any Runtrace data logged, and it also does not brake when EIP=1001F1A5 when I do that.

[Edit nr2]

Hmm, ok, well I found out that the trace is actually working out fine if I set some other condition than EIP=....
For instance when I use command count only it does trace.. hmmz.. guess I cant have it stop at eip like that no?
Have to use the EIP range option?

well when you are dealing with eip range why not use
the provided functionality
rather than using a boolean expression

use the first eip is in range
set the first box and second box with respective values
and press ctrl+f11 it should stop when your eip is executed

like this

Log data, item 0
Address=00401023
Message=Conditional pause: EIP in range 00401023..00401028

and it should stop only once if it is not a part of loop

Just a thought...
Sometimes it works if i put EIP==some value intead of a single "=" sign... in the condition box...

Give it a try...

i have played with runtrace but i really don't know how to use it.. can somone please explain what it does ? and how can i use it ? if it helps me with program and getting a serial or something faster then by all mean stell me


warf

use ollyscript with a little script than put a hardware bpx in your location and each time reach the address, look if EIP point to the code you expect, compare and if is the code stop the script and the program wiil be stopped in your address, in the moment you want.

Ricardo Narvaja