View Full Version : log breakpoint on sections ?
insano
November 27th, 2006, 17:54
possible to set a log breakpoint on data section ?
i want to set a log breakpoint on data section.
i want to log the addresses of the opcodes that are writing data to data section. i want to do a log breakpoint so the programa will not be paused
example ,ecx is a data address
logs
----
0056ffcc mov [ecx], 56
0056fccc mov [ecx], eax (98) 98 was the value EAX was holding when it got log.
possible ?
TSearch has something like this but only on single addresses not sections.
blabberer
November 28th, 2006, 13:29
thats is an incomplete description
is that 56ffcc in your example executed ?
if yes you can set a conditional breakpoint with shift+f4
in the expression column type the expression you want to log and ollydbg will log it for you and you can choose whether to pause never pause or pause on condition
as to why it is incomplete description
that code may be executed only once
consider
global int ret = somefoo();
now it may be transformed into
lea ecx,addr of ret
mov [ecx],ret
and thats all it will never be written again in normal circumstances
now if it is a part of loop then it will get executed again and again
and it makes some sense to log it
but the opcode sequence you describe dont match your description
the opcodes itself can never vary unless it is selfmodifying and if it is self modifying no breakpoints will work it cannot be a const 56 as well as r32 (eax) at the same time in same application
again you can use shift+f4 (conditional log break point) in this situation too
if you want to log multiple expressions you can try the modified commandline plugin (its avl for download in stuph)
a better explanation can yield a better answer
insano
March 17th, 2007, 12:53
sorry
i have a variable located at 00430000 (data section)
i want to log EIP register when some code tries to access 00430000
i can set a memory/hardware breakpoint but this will stop the execution, then i have to press F9 to continue.
i just want log EIP register so Execution wont stop.
thanks
Powered by vBulletin® Version 4.2.2 Copyright © 2020 vBulletin Solutions, Inc. All rights reserved.