4

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg.

How can i do that ?

I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is used for this case but it is not compatible with the above version of Olly.

Thanks for your help!

3
  • 1
    What keeps you from using the Ollydbg version where this plugin is compatible?
    – ixje
    Sep 8, 2013 at 7:28
  • @justsome i have tried the old version with that plugin and is not working either ! Sep 8, 2013 at 9:29
  • 1
    OllyDbg has conditional breakpoint capabilities, have you tried that first?
    – gandolf
    Sep 10, 2013 at 14:12

2 Answers 2

4

I'd suggest you use OllyDBG version 1.10 (non-plugin) or Other edition like odbgSND.

You can use Conditional BP with below grammar:

UNICODE [EAX]=="HamiD a.k.a AHA"

OllyDbg treats EAX as a pointer to UNICODE string, converts it to ASCII and compares with text constant. If you want the Unicode value of the register must be written as the following conditions:

EAX == 75007500

This condition is triggered if the value of EAX equal uu Unicode.

1

Check these out :

http://www.openrce.org/forums/posts/634

http://www.woodmann.com/forum/archive/index.php/t-8043.html

And here is two conditions I recently used in Olly:

([UNICODE[esp+10]] !="BAR") && ([UNICODE[esp]] =="FOO")
[[STRING[esp+8]] =="FOO"] && [[STRING[esp+4]] !="BAR"] 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.