Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   OllyDbg is not good at supporting breakpoints in multi-threading environment (https://forum.exetools.com/showthread.php?t=18341)

BlackWhite 08-03-2017 15:35

OllyDbg is not good at supporting breakpoints in multi-threading environment
 
I have encountered OllyDbg's failing to trigger
breakpoints set in other threads several times
especially hardware breakpoints.

Is there any way to solve this problem?

Thanks.

wilson bibe 08-04-2017 00:42

If I understood your question a way is is use the olly_hardware_breakpoint plugin and save yours BP, if you have problem to find your calls to dll,ocx,etc..., load the BP saved by the OHB, when you load the app in olly.
Greetings...

BlackWhite 08-04-2017 20:02

Quote:

Originally Posted by wilson bibe (Post 109947)
If I understood your question a way is is use the olly_hardware_breakpoint plugin and save yours BP, if you have problem to find your calls to dll,ocx,etc..., load the BP saved by the OHB, when you load the app in olly.
Greetings...

My question is actually as follows:
(1) There are two functions say f() and g();
(2) OllyDbg debugs f() and sets a breakpoint inside g();
(3) g() is executed by another thread which is not the same as the thread
executing f();
(4) When g() is executed, the breakpoint set inside will not be triggered
whether it's a software breakpoint or hardware one.

So, do you think olly_hardware_breakpoint plugin can solve this problem?

Thanks.

Naides 08-04-2017 21:01

Try instead a hardware memory-read pointer to the byte or word at the beginning of the instruction you want to break-in: That may trip the BP because regardless, before an instruction is executed, it is read by the thread.

BlackWhite 08-07-2017 00:59

Quote:

Originally Posted by Naides (Post 109959)
Try instead a hardware memory-read pointer to the byte or word at the beginning of the instruction you want to break-in: That may trip the BP because regardless, before an instruction is executed, it is read by the thread.

Yes, I have tried this trick, but it did not work.

computerline 08-09-2017 01:28

You could enable Options / Events/ Pause on new thread, maybe that could solve your problem.

BlackWhite 08-10-2017 20:43

Quote:

Originally Posted by computerline (Post 110048)
You could enable Options / Events/ Pause on new thread, maybe that could solve your problem.

Yes, it works.
Thank you for this great idea.


All times are GMT +8. The time now is 21:51.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX