1

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the executable without any debugger I always have enough memory.

Ollydbg breaks before I can even debug. x64dbg breaks while debugging.

With ollydbg I have used the 32bit executable of the program.

The OPc looks like this:

00007FF6A179B097 | int3                                    |
00007FF6A179B098 | sub rsp,48                              |
00007FF6A179B09C | lea rcx,qword ptr ss:[rsp+20]           |
00007FF6A179B0A1 | call <executable>.7FF6A0C58980          |
00007FF6A179B0A6 | lea rdx,qword ptr ds:[7FF6A230CE80]     |
00007FF6A179B0AD | lea rcx,qword ptr ss:[rsp+20]           |
00007FF6A179B0B2 | call <executable>.7FF6A17CC4EC          |
00007FF6A179B0B7 | int3                                    | <-

But I guess this isn't any help. We just know that the last call produces this error ?!

EDIT: I have 12 gb of ram.

Regards

2

Based on the comments exchanged above, it sounds like the program uses anti-debugger code. You have a few options to deal with it:

  1. Find and disable (NOP / jump-over / etc.) the anti-debugging code.
  2. Try to hide your debugger (manually or by using a stealthing plugin).
  3. Run your program without a debugger, and then after it's up and running, attach to it with your debugger.

Option #1 requires the most effort, but is guaranteed to work.

Option #2 can save time over Option #1, but can involve a lot of trial-and-error.

Option #3 is the easiest option, IMHO, as long as you don't need to debug your target from its entry point. It assumes that the anti-debugging code only executes at the very beginning of the program, which is typically a safe assumption.

  • 2
    I found a plugin for x64dbg (its also for other dbgrs) called: ScyllaHide. Everything works expected now :) – Sens4 Apr 29 '16 at 15:17
  • Option #2 FTW then ;) – Jason Geffner Apr 29 '16 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.