Hi,

I'm using Olly1.10 under XPSP2 and I recently had two programs that didn't stop at the program start.
They loaded and then simply continued to start. Furthermore, no disassembled code appeared in Olly. One was written in .NET the other in VC++.

Needless to say that I couldn't debug the programs. Any idea what could cause these problems ?

Many thanx,

MrSmith

Forget about the .NET program. Olly won't be of much help, anyway, so read some RETeam and Tut4you assays on .NET RCE.

The other one if it indeed is VC++ (Don't trust PEID or other utils, disassemble it with IDA to make sure). There are other ways to make stop the program near the start:Look in Options -> Debugging Options ->Events.

Play around with the settings of "make the first pause at".

Worse case scenario stop at each dll loading until the program code is available in memory, place hardware breakpoints into known API's or in the code near or at the nominal entry point.

if u need

.NET tutorials, 1-9 by tKC

TLS.

You can try PEBrowse Professional Interactive Debugger for the .NET executable.



Get it from http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html