x64dbg and ollydbg error not enough memory

Question

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the executable without any debugger I always have enough memory.

Ollydbg breaks before I can even debug. x64dbg breaks while debugging.

With ollydbg I have used the 32bit executable of the program.

The OPc looks like this:

00007FF6A179B097 | int3                                    |
00007FF6A179B098 | sub rsp,48                              |
00007FF6A179B09C | lea rcx,qword ptr ss:[rsp+20]           |
00007FF6A179B0A1 | call <executable>.7FF6A0C58980          |
00007FF6A179B0A6 | lea rdx,qword ptr ds:[7FF6A230CE80]     |
00007FF6A179B0AD | lea rcx,qword ptr ss:[rsp+20]           |
00007FF6A179B0B2 | call <executable>.7FF6A17CC4EC          |
00007FF6A179B0B7 | int3                                    | <-

But I guess this isn't any help. We just know that the last call produces this error ?!

EDIT: I have 12 gb of ram.

Regards

Answer 1

Based on the comments exchanged above, it sounds like the program uses anti-debugger code. You have a few options to deal with it:

1. Find and disable (NOP / jump-over / etc.) the anti-debugging code.
2. Try to hide your debugger (manually or by using a stealthing plugin).
3. Run your program without a debugger, and then after it's up and running, attach to it with your debugger.

Option #1 requires the most effort, but is guaranteed to work.

Option #2 can save time over Option #1, but can involve a lot of trial-and-error.

Option #3 is the easiest option, IMHO, as long as you don't need to debug your target from its entry point. It assumes that the anti-debugging code only executes at the very beginning of the program, which is typically a safe assumption.