Olly conditional breakpoint help

I am using OllyDbG and am somewhat of a newb.

Anyway, I successfully breakpointed on the function Kernel32.Writefile when I save the file.

I want to create a conditional breakpoint on Kernel32.Writefile, but only when it refers to a specific file indentified by the filename. Now the first parameter of Kernel32.Writefile is ".hFile" which identifies the file, so that's exactly what I need to use.

So yeah, I only want to break when Kernel32.Writefile writes to a specific file identified by it's filename using a conditional breakpoint in Olly. I don't have any experience in conditional breakpoints.

I searched and found this topic, maybe someone can make sense of it?

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=310&page=

[Squidge]

The handle that Writefile uses is a handle to a file, not a filename, so you will have to breakpoint on CreateFileA first to obtain the file handle that will go with the filename before placing the conditional breakpoint on the WriteFileA.

[xobor]

Exactly as Squidge wrote

in last Olly press ALT+F1 (Plugins->Command Line->Command Line)

in editbox type bp CreateFileA, STRING [[ESP+4]]=="yourfilename"

press F9, when Olly breaks press CTRL+F9 (run until return), press F8 (one step) and read value at eax - it's handle for your file

so in Command Line plugin add new breakpoint

bp WriteFile, [[ESP+4]]==90

(of course you must replace value 90 by your eax value)

and go for debugging

hope this helps

xobor, I put that into the command line and set the bp, but it still breaks on the CreatefileA for any file.

Are you sure that is a conditional breakpoint?

I assume [[ESP+4]] = EAX

Why not just do bp CreateFileA, STRING EAX=="yourfilename" ?

[Squidge]

Windows API functions take there parameters on the stack, so using EAX is a bad idea, it may work for a single call, but it will not always work.

I read the Ollydbg help file on conditional breakpoints but it isn't easy to understand.

I wish there were more examples.

[Squidge]

If you look just below the examples, there's a complete description of what an expression is, which is not exactly difficult to understand. The examples just help this along.

I tried this:

[STRING [esp+4]]=="ckinfo.zip"

And it worked fine, breaking only when "ckinfo.zip" was opened.

I didn't try xobor's expression, but it seems that he's looking for a dword? Maybe got the handle confused with the filename.

I tried your method with CreatefileA, and it still breaks when any file is created by the process.

I did a regular bp CreatefileA and the path to my file showed up in EDX as ASCII.

[xobor]

sorry for delayed replay but problems with internet provider

so right before I put my reply in this thread I tried this cond breakpoints with last version of ollydbg so I have no idea why it is not working for rhodium (i'm working on W2000 prof SP3 ...)

squidge's example is formerly the same as me Ollydbg didn't take a difference between STRING [xxxx] and [STRING xxx] (it's also in helpfile)

so rhodium on what windows are you running may be we can try it on same system

regards