2

What is the difference between Ctrl-F9 and F9 in OllyDbg except the fact that the first command will stop the program execution on the next RET instruction while the second command will stop the program execution on the next breakpoint/program termination ?

I just noticed that the debugging application give the different results in these cases (different register values after function call, etc) while executing the following code:

; ...
CALL module_name.some_address
TEST EAX, EAX
; ...

I've set breakpoints on each of these instructions and noticed that the behavior is different when I just press F9 after first breakpoint or press F7 and Ctrl-F9.

Why ?

2
  • f9 executes the program ctrl+f9 traces (recursively steps over ) through the program if your binary has some antidebugging measures tracing can trigger them there isnt enough information to provide an answer apart from quoting ollydbg.hlp about these Global Shortcut Behaviours
    – blabb
    Sep 15, 2014 at 17:37
  • @blabb Ok, even if this function have some debugger detection why did it work in Ctrl-F9 and didn't work in case of F9? Both of them are handled from the debugger. What is the difference? Sep 15, 2014 at 21:25

1 Answer 1

4

I don't know exactly how this feature is implemented in Ollydbg, but we can have a look at how it is implemented in x64_dbg as it is open-source.

The Ctrl-F9 (execute till return) functionality is implemented by cbDebugRtr in x64_dbg_dbg/debugger_commands.cpp. We can see that it calls StepOver which is a method provided by TitanEngine.

CMDRESULT cbDebugRtr(int argc, char* argv[])
{
    StepOver((void*)cbRtrStep);
    cbDebugRun(argc, argv);
    return STATUS_CONTINUE;
}

In the TitanEngine document the description of StepOver is described as follows :

StepOver function

The StepOver traces code by single-stepping over calls. This tracing function sets an INT3 breakpoint after the call, which is used to call your callback. There is no guarantee that code execution will return from that call, and thus no guarantee that your callback will ever be called. The breakpoint is run only once, and is removed once your callback has finished.

TitanEngine is also open-source, here is the implementation of StepOver in TitanEngine / TitanEngine.Debugger.Control.cpp

__declspec(dllexport) void TITCALL StepOver(LPVOID StepCallBack)
{
    ULONG_PTR ueCurrentPosition = GetContextData(UE_CIP);
    unsigned char instr[16];
    MemoryReadSafe(dbgProcessInformation.hProcess, (void*)ueCurrentPosition, instr, sizeof(instr), 0);
    char* DisassembledString = (char*)StaticDisassembleEx(ueCurrentPosition, (LPVOID)instr);
    if(strstr(DisassembledString, "CALL") || strstr(DisassembledString, "REP") || strstr(DisassembledString, "PUSHF"))
    {
        ueCurrentPosition += StaticLengthDisassemble((void*)instr);
        SetBPX(ueCurrentPosition, UE_BREAKPOINT_TYPE_INT3 + UE_SINGLESHOOT, StepCallBack);
    }
    else
        StepInto(StepCallBack);
}

After each step the callback function cbRtrStep is called which checks if the current instruction is a RET and if so the debugger is stopped. (x64_dbg_dbg/debugger.cpp)

void cbRtrStep()
{
    unsigned int cipch = getCIPch();
    if(cipch == 0xC3 or cipch == 0xC2)
        cbRtrFinalStep();
    else
        StepOver((void*)cbRtrStep);
}

So, to sum up, Ctrl-F9 is doing step-over until it encounters a RET instruction. If you press F7 and Ctrl-F9 the debugger will single-step the instructions of the function; the function you are calling might be doing debugger detection that is not triggered when setting a breakpoint after this function.

2
  • Ok, even if this function have some debugger detection why did it work in Ctrl-F9 and didn't work in case of F9? Both of them are handled from the debugger. What is the difference? Sep 15, 2014 at 21:24
  • I can't tell without seeing the code. The debugger detection method could for example by looking for INT3 opcodes in the function code.
    – ekse
    Sep 16, 2014 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.