PDA

View Full Version : Setting a Conditional Breakpoint on every command

Tom_Smith
December 27th, 2006, 16:48
In Ollydbg:

Suppose I want a program to break if EAX==00000052.

I know how to set a conditional breakpoint on a single command.
(F2)

And I know how to set Breakpoints on all InterModular calls.
(Right Click>Search for>All intermodular calls>Right Click>Set breakpoint on every command)

Is there a way to set a Conditional Breakpoint on every command or every InterModular call with one stroke?

It seems there is no way to do them all at the same time, you must do each individually.

-Tom.
disavowed
December 28th, 2006, 10:56
You could write a script to single-step each instruction until EAX == 52, but this would probably take a long time to execute. I'd recommend finding the specific instruction(s) where EAX is modified or tested, and set your conditional breakpoint(s) there.
blabberer
December 28th, 2006, 12:01
bruteforce breaking

if you are really intending to break only when some register = some const
assuming that condition is really happening

you can do
ctrl+t --> in the condition is true box type eax == "YOUR CONST"
and then ctrl+ f11 (trace in)

should break when the condition is met

for example in calc.exe in xp-sp2
Log data, item 0
Address=0101258B
Message=Conditional pause: eax == 77c617ac
will break after executing 20690 executions

Run trace, selected line
Back=20690.
Thread=Main
Module=calc
Address=01012475 <ModuleEntryPoint>
Command=PUSH 70

Run trace, selected line
Back=1.
Thread=Main
Module=calc
Address=01012586
Command=MOV EAX, DWORD PTR DS:[<&msvcrt._acmdln>]
Modified registers=EAX=77C617AC <-----------

broke here

Run trace, selected line
Back=0.
Module=calc
Address=0101258B
Command=MOV ESI, DWORD PTR DS:[EAX]


btw why cant you set one time conditional breakpoint on all intermaodular calls ??
simply right click set log break on all commands and specify your condition in the condition box and set up pause never pause log whatever you wish
you cant see it in context ??

Code:


Log data

Address    Message

0101248A   CALL to GetModuleHandleA

             pModule = NULL

010127BA   CALL to _controlfp

             CWnew = 10000

             CWmask = 30000

010125BD   CALL to GetStartupInfoA

             pStartupinfo = 0007FF48

01001667   CALL to GetCommandLineW

010016BA   CALL to CharNextW

             pCurrentChar = ""C:\WINDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "C:\WINDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = ":\WINDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "\WINDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "WINDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "INDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "NDOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "DOWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "OWS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "WS\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "S\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "\SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "SYSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "YSTEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "STEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "TEM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "EM32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "M32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "32\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "2\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "\calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "calc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "alc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "lc.exe""

010016BA   CALL to CharNextW

             pCurrentChar = "c.exe""

010016BA   CALL to CharNextW

             pCurrentChar = ".exe""

010016BA   CALL to CharNextW

             pCurrentChar = "exe""

010016BA   CALL to CharNextW

             pCurrentChar = "xe""

010016BA   CALL to CharNextW

             pCurrentChar = "e""

010016BA   CALL to CharNextW

             pCurrentChar = """

010017FE   CALL to LoadIconW

             hInst = 01000000

             RsrcName = "SC"

0100180D   CALL to LoadCursorW

             hInst = NULL

             RsrcName = IDC_ARROW

01001818   CALL to GetSysColorBrush

             Index = F (15.)

01001836   CALL to RegisterClassExW

             pWndClassEx = 0007FDD8

01001FD2   CALL to LocalAlloc

             Flags = LPTR

             Size = 800 (2048.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "+/-"

             Buffer = 000A7558

             Count = 400 (1024.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "C"

             Buffer = 000A7560

             Count = 3FC (1020.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "CE"

             Buffer = 000A7564

             Count = 3FA (1018.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Backspace"

             Buffer = 000A756A

             Count = 3F7 (1015.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Sta"

             Buffer = 000A757E

             Count = 3ED (1005.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "."

             Buffer = 000A7586

             Count = 3E9 (1001.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "And"

             Buffer = 000A758A

             Count = 3E7 (999.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Or"

             Buffer = 000A7592

             Count = 3E3 (995.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Xor"

             Buffer = 000A7598

             Count = 3E0 (992.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Lsh"

             Buffer = 000A75A0

             Count = 3DC (988.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "/"

             Buffer = 000A75A8

             Count = 3D8 (984.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "*"

             Buffer = 000A75AC

             Count = 3D6 (982.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "+"

             Buffer = 000A75B0

             Count = 3D4 (980.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "-"

             Buffer = 000A75B4

             Count = 3D2 (978.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Mod"

             Buffer = 000A75B8

             Count = 3D0 (976.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "x^y"

             Buffer = 000A75C0

             Count = 3CC (972.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Int"

             Buffer = 000A75C8

             Count = 3C8 (968.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Not"

             Buffer = 000A75D0

             Count = 3C4 (964.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "sin"

             Buffer = 000A75D8

             Count = 3C0 (960.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "cos"

             Buffer = 000A75E0

             Count = 3BC (956.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "tan"

             Buffer = 000A75E8

             Count = 3B8 (952.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "ln"

             Buffer = 000A75F0

             Count = 3B4 (948.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "log"

             Buffer = 000A75F6

             Count = 3B1 (945.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "sqrt"

             Buffer = 000A75FE

             Count = 3AD (941.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "x^2"

             Buffer = 000A7608

             Count = 3A8 (936.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "x^3"

             Buffer = 000A7610

             Count = 3A4 (932.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "n!"

             Buffer = 000A7618

             Count = 3A0 (928.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "1/x"

             Buffer = 000A761E

             Count = 39D (925.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "dms"

             Buffer = 000A7626

             Count = 399 (921.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "%"

             Buffer = 000A762E

             Count = 395 (917.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "F-E"

             Buffer = 000A7632

             Count = 393 (915.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "pi"

             Buffer = 000A763A

             Count = 38F (911.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "="

             Buffer = 000A7640

             Count = 38C (908.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "MC"

             Buffer = 000A7644

             Count = 38A (906.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "MR"

             Buffer = 000A764A

             Count = 387 (903.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "MS"

             Buffer = 000A7650

             Count = 384 (900.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "M+"

             Buffer = 000A7656

             Count = 381 (897.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Exp"

             Buffer = 000A765C

             Count = 37E (894.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Ave"

             Buffer = 000A7664

             Count = 37A (890.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Sum"

             Buffer = 000A766C

             Count = 376 (886.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "s"

             Buffer = 000A7674

             Count = 372 (882.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Dat"

             Buffer = 000A7678

             Count = 370 (880.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "("

             Buffer = 000A7680

             Count = 36C (876.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING ""

             Buffer = 000A7684

             Count = 36A (874.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "0"

             Buffer = 000A7688

             Count = 368 (872.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "1"

             Buffer = 000A768C

             Count = 366 (870.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "2"

             Buffer = 000A7690

             Count = 364 (868.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "3"

             Buffer = 000A7694

             Count = 362 (866.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "4"

             Buffer = 000A7698

             Count = 360 (864.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "5"

             Buffer = 000A769C

             Count = 35E (862.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "6"

             Buffer = 000A76A0

             Count = 35C (860.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "7"

             Buffer = 000A76A4

             Count = 35A (858.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "8"

             Buffer = 000A76A8

             Count = 358 (856.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "9"

             Buffer = 000A76AC

             Count = 356 (854.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "A"

             Buffer = 000A76B0

             Count = 354 (852.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "B"

             Buffer = 000A76B4

             Count = 352 (850.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "C"

             Buffer = 000A76B8

             Count = 350 (848.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "D"

             Buffer = 000A76BC

             Count = 34E (846.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "E"

             Buffer = 000A76C0

             Count = 34C (844.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "F"

             Buffer = 000A76C4

             Count = 34A (842.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Hex"

             Buffer = 000A76C8

             Count = 348 (840.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Dec"

             Buffer = 000A76D0

             Count = 344 (836.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Oct"

             Buffer = 000A76D8

             Count = 340 (832.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Bin"

             Buffer = 000A76E0

             Count = 33C (828.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Qword"

             Buffer = 000A76E8

             Count = 338 (824.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Dword"

             Buffer = 000A76F4

             Count = 332 (818.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Word"

             Buffer = 000A7700

             Count = 32C (812.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Byte"

             Buffer = 000A770A

             Count = 327 (807.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Degrees"

             Buffer = 000A7714

             Count = 322 (802.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Radians"

             Buffer = 000A7724

             Count = 31A (794.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Grads"

             Buffer = 000A7734

             Count = 312 (786.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Cannot divide by zero."

             Buffer = 000A7740

             Count = 30C (780.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Invalid input for function."

             Buffer = 000A776E

             Count = 2F5 (757.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Result of function is undefined."

             Buffer = 000A77A6

             Count = 2D9 (729.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Error: Positive Infinity."

             Buffer = 000A77E8

             Count = 2B8 (696.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Error: Negative Infinity."

             Buffer = 000A781C

             Count = 29E (670.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Operation was canceled."

             Buffer = 000A7850

             Count = 284 (644.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Calc does not have enough memory to continue."

             Buffer = 000A7880

             Count = 26C (620.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "The requested function may take a very long time to complete.

Do you want to abort the operation now?"

             Buffer = 000A78DC

             Count = 23E (574.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "calc.hlp"

             Buffer = 000A79A8

             Count = 1D8 (472.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Cannot open Clipboard."

             Buffer = 000A79BA

             Count = 1CF (463.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "There is not enough memory for data.

Close one or more programs, and then try again."

             Buffer = 000A79E8

             Count = 1B8 (440.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "calc.chm"

             Buffer = 000A7A92

             Count = 163 (355.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Calculator"

             Buffer = 000A7AA4

             Count = 15A (346.)

0100200E   CALL to LoadStringW

             hInst = 01000000

             RsrcID = STRING "Not Enough Memory"

             Buffer = 000A7ABA

             Count = 14F (335.)

01002052   CALL to LocalReAlloc

             hMemory = 000A7558

             NewSize = 586 (1414.)

             Flags = LMEM_MOVEABLE

010020ED   CALL to CreateWindowExW

             ExtStyle = 0

             Class = "EDIT"

             WindowName = "CalcMsgPumpWnd"

             Style = WS_OVERLAPPED|WS_VISIBLE

             X = 80000000 (-2147483648.)

             Y = 0

             Width = 80000000 (-2147483648.)

             Height = 0

             hParent = NULL

             hMenu = NULL

             hInst = 01000000

             lParam = NULL

010021EA   CALL to lstrcpyW

             String1 = calc.01014DD4

             String2 = "0"

010021F1   CALL to lstrlenW

             String = "0"

010021EA   CALL to lstrcpyW

             String1 = calc.01014E64

             String2 = "0"

010021F1   CALL to lstrlenW

             String = "0"

01007C0A   CALL to LocalAlloc

             Flags = LPTR

             Size = 94 (148.)

01007C2B   CALL to LocalAlloc

             Flags = LPTR

             Size = 8

773D0000   Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Tom_Smith
December 28th, 2006, 14:54
OK, thanks guys.

There are a number of ways to go about it.

I knew about the trace option, but it can take a long time, so it may be efficient, but not the quickest way to do things.

Probably the first step is to show "ALL Intermodular Calls", and
"Set a conditional log breakpoint" on each call if and when when EAX==52.

Problem with this method is you can get a "false negative".

Becasue EAX may at some point equal 52, but it's value may change before an Intermodular Call is made, therefore, the program never breaks.

Of course, the first replier, "Disavowed", suggests breaking on any instruction that modifies EAX, which is better.

I want to note that Ollydbg numeric comparisons for the purposes of breaking are not done in hexadecimal.

For example, if you want to break on EAX=00006089
the condition needs to be written as EAX==6089
or
if you want to break on EBX=00000200
you can write the condition as bh==2

-Tom.
blabberer
December 29th, 2006, 11:05
Quote:

I want to note that Ollydbg numeric comparisons for the purposes of breaking are not done in hexadecimal.


??
could you eloberate a little more ?? if possible with some code snippets conditions and your interpretation of ollydbg's apparent non use of hex according to your understanding ??
disavowed
December 29th, 2006, 13:36
Quote:
[Originally Posted by Tom_Smith;63434]For example, if you want to break on EAX=00006089
the condition needs to be written as EAX==6089

I haven't verified that what you said is true, but if it is, it might be because OllyDbg is interpretting a value as octal if it has leading zeros and no A-F digits.