Hi All,
Whenever I try to load a VB executable in OllyDbg v1.10(OS:Windows XP Professional), I keep getting this error:



Is this a Anti-Debugger Trick? I dont think so because I have the plugins like Hide Debugger, IsDebuggerPresent installed.

Someone please help...

Thanks in advance!!!

May be is a trick, may be is just an exception. What happens when you do Shift F9 and pass the exception to the program?

What happens when you run the app first then attach it to Olly debug?

Is the app p-code or compilated?

Common wisdom says that plain old tracing of a VB application with a debugger (Olly) seldom helps. . .

Thanks for the reply!

When I press Shift+F9, nothing happens. Then I pressed F9 and I got the message



When attached Olly to the running process, it says


When F9 is pressed, got the same error message as mentioned in my previous post.

I am not sure if the VB application is Native/P-code compiled..(may be some one help...)

PS: I tried to run the application with Numega SmartCheck but it crashed.
But I could successfully decompile the application with VB Decompiler Lite V2.5

> When F9 is pressed, got the same error message as mentioned in my
> previous post.

Keep pressing Shift-F9.

or if you dont want to keep pressing shift+f9

add this exception to ignore list

options -> debuging options -> exceptions -> add last exception
-> chckmark ignore this check box -> ok

now you can just shift f9 one time and it will probably run
withoutproblems or crash if it crashed then its upto
some mischief and you have work to do to find whats it upto

else its some incompatibilty between myriad versions of
os compilers bug of authors and other innumerable aspects

so whats the solution read around find entry point
hard break trace trace trace trace till it finds that
you a stubborn guy/gal and fails in front of you and spitting
its secrets of why its crashing , generarting exceptions

oh btw tracing vb applications in olly may be a little pain
as naides opined but but as he also stated some where else
in another thread there is nothing to beat tracing
(including finding out tricks that stop you from tracing)
if you prefer to name some of the vb jump tables find vbhelper plugin by joe stewert

or simply find this sequnce

sub dword ptr ss:[esp+const],const
jmp const


there will be several of them

thats your entry point into the wndproc on almost
all vb applications



i found this sequnce on xyz vb application
-->right click set break point on everycommand


f9nned the application


and ollydbg broke

Log data, item 0
Address=00402258
Message=Breakpoint at vb.00402258
the sequnce it broke was

00402258 SUB DWORD PTR SS:[ESP+4], 43
00402260 JMP vb.00402CA0




f7iing two time i land here


thats it you can beat it now

The exception you recieve is no anti-debugger trick. I debugged a lot of (my own) vb programs and you recieve this exception for example when an object is searched in a collection that does not exist. Nothing to worry about and you can indeed add it to the ignore list.

Thanks everyone for the reply. The problem is solved by adding the exception to the Ignore list.

Thanks a lot!!!