PDA

View Full Version : bpm on execute access


jbe
October 11th, 2005, 04:03
Hi

I am trying to stop my script at the oep

After some exceptions I toogle a bmp with

bprm cbase, csize

but the packer section read code memory before execute the oep instruction

Can I set access to execute and toogle a bpm on access to stop the script when it executes and not reads the code section?

Where can I found a good manual or help about script commands, programation ?

Thanks in advance

Josu

Ricardo Narvaja
October 11th, 2005, 06:00
in olly is not possible put BPM on EXECUTE without READ, or WRITE, but i make a olly patched for this case, put this olly in the same folder your and use for this cases, in this olly if you put a BPM on ACCESS don´t stop in read or write, only execute (are modified for this task for put old BPM on ACCESS use your old ollydbg)
is a little slow but if the program don´t stop in exceptions (you add in debugging exceptions for don´t stop) and you put a bpm on access and RUN this olly stop in the first line executed.

http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/OLLY%20PARC HEADO%20PARA%20BUSCAR%20OEPs.rar
("http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/OLLY%20PARCHEADO%20PARA%20BUSCAR%20OEPs.rar
")

take a little time take a cofeee and let the program reach the oep

Ricardo

jbe
October 11th, 2005, 06:54
Thanks

It works fine

The packer jmps to the OEP without stops.

I have found about 50 bytes of stolen bytes, so I need to stop before to check the POPADs and to filter the instructions stolen by the packer.

Thanks for the pached olly

Josu