Log in

View Full Version : Conditional Break?


RITZ
June 27th, 2006, 15:26
I need to pause execution when any register contains a specific value. I'd also like to know if it's possible to pause when a specific string of data is written to the stack.

LLXX
June 27th, 2006, 20:42
OllyDbg help file -> Breakpoints -> Conditional Breakpoint

In other words, RTFM.

RITZ
June 27th, 2006, 21:24
Forums like this exist for people to share information they got from the manual. Don't abuse the RTFM acronym.

My question regarding the register condition is if I can specify any and all registers. I was not able to find that in the help file. Hence why I made the post...

Aquatic
June 27th, 2006, 21:47
Conditional BPs can be easy.

This is thanks to the program made by L. Spiro, his program can be found at this link: http://www.memoryhacking.com

The debugger is in the tools menu, there is a 'conditions' button, if you click that button it will bring up the conditions editor.

blabberer
June 30th, 2006, 11:02
Quote:

need to pause execution when any register contains a specific value


? you want ollydbg to stop if eax or ecx or edx or esp or ###
contains lets says 12345678 ??

give it a condition like

ECX == 0x12ffb0 || EBP== 0x12ffb0 || REG == same constant || another reg == Same Constant

i would have liked it easier like specifiying r32 == SOME CONST

but ollydbg wont like genreal specification
Log data, item 301
Address=00401031
Message=Conditional breakpoint at win.00401031: Undefined registers not allowed in expression


as to string in stack you can check it with some thing like

string [[esp+0x60]]

it will stop if there is a string in starting at specified address

Log data, item 22
Address=0040103E
Message=Conditional breakpoint at win.0040103E: "D:\Borland\odbg110\win.exe"

RITZ
June 30th, 2006, 11:17
About the registers thing, that's what I was wondering. If you could specify all registers with one token or if you had to specify them all in manually.

About the string in stack. Thanks, that's perfect.