2

I opened a simple reverse me windows application in ollydbg, then it shows the code for the "ntdll". Since I want to view code and run "ReverseMe" I double clicked the "ReverseMe" on the "Executable Modules" window. Then it shows the code for the "ReverseMe". But when I click "run" button, it runs the "ntdll", I placed a break point on second line in "ReverseMe" but still it runs the "ntdll" and then it terminates after about 600 milliseconds and when I click the "Entry" tab under "Executable Modules" window, it shows that the "entry" is "ntdll" how to set the entry to "Reverseme" or if it cannot be changed or ntdll is the compulsory entry point, then suggest me a way to run the "ReverseMe". And since I placed a break point at the very beginning of the "ReverseMe" it can't be a exit process on the code of the "ReverseMe" program. But it actually runs ntdll at first.

EDIT: Log data

Address    Message
           OllyDbg v1.10

           File 'D:\Other\Reverse Engineering\studying.reversing.OLLY.debugger.video.tutorials\tutorials\snd-reversingwithlena-tutorial01.tutorial\files\reverseMe.exe'
           New process with ID 000000AC created
00401000   Main thread with ID 00001E60 created
77CEC6D0   New thread with ID 00000738 created
77CEC6D0   New thread with ID 000013D0 created
00400000   Module D:\Other\Reverse Engineering\studying.reversing.OLLY.debugger.video.tutorials\tutorials\snd-reversingwithlena-tutorial01.tutorial\files\reverseMe.exe
             CRC changed, discarding .udd data
6FAF0000   Module C:\WINDOWS\system32\apphelp.dll
72280000   Module C:\WINDOWS\SYSTEM32\DAVHLPR.DLL
72290000   Module C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\COMCTL32.DLL
749E0000   Module C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
749F0000   Module C:\WINDOWS\SYSTEM32\SspiCli.dll
74BC0000   Module C:\WINDOWS\SYSTEM32\kernel.appcore.dll
74BD0000   Module C:\WINDOWS\SYSTEM32\shcore.dll
74C60000   Module C:\WINDOWS\SYSTEM32\COMDLG32.dll
74DF0000   Module C:\WINDOWS\SYSTEM32\bcryptPrimitives.dll
74F70000   Module C:\WINDOWS\SYSTEM32\SHELL32.dll
763D0000   Module C:\WINDOWS\SYSTEM32\SHLWAPI.dll
76420000   Module C:\WINDOWS\SYSTEM32\msvcrt.dll
76770000   Module C:\WINDOWS\SYSTEM32\ADVAPI32.dll
76850000   Module C:\WINDOWS\SYSTEM32\RPCRT4.dll
76920000   Module C:\WINDOWS\SYSTEM32\profapi.dll
             Invalid or compressed Image Export Directory
76930000   Module C:\WINDOWS\SYSTEM32\USER32.dll
76A80000   Module C:\WINDOWS\SYSTEM32\sechost.dll
76AD0000   Module C:\WINDOWS\SYSTEM32\combase.dll
76D80000   Module C:\WINDOWS\SYSTEM32\KERNEL32.DLL
76E60000   Module C:\WINDOWS\SYSTEM32\KERNELBASE.dll
77090000   Module C:\WINDOWS\SYSTEM32\GDI32.dll
775F0000   Module C:\WINDOWS\SYSTEM32\powrprof.dll
776A0000   Module C:\WINDOWS\SYSTEM32\cfgmgr32.dll
776E0000   Module C:\WINDOWS\SYSTEM32\FirewallAPI.dll
77740000   Module C:\WINDOWS\SYSTEM32\windows.storage.dll
77CA0000   Module C:\WINDOWS\SYSTEM32\NETAPI32.dll
77CC0000   Module C:\WINDOWS\SYSTEM32\ntdll.dll
74A10000   Module C:\WINDOWS\SYSTEM32\IMM32.DLL
           Debugged program was unable to process exception
           Thread 00001E60 terminated, exit code 4000001E (1073741854.)
           Thread 000013D0 terminated, exit code 4000001E (1073741854.)
72170000   Module C:\WINDOWS\SYSTEM32\fwbase.dll
           Process terminated, exit code 4000001E (1073741854.)

closed as unclear what you're asking by peter ferrie, perror, 0xec, jvoisin, ebux Aug 15 '16 at 9:48

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

by default the first breakpoint is always the System Breakpoint

select options (ALT+O)
select Start from Debugging
select the radio button Entry point of main module
in starting the application group

now ollydbg will break on PeHeader->EntryPoint

enter image description here

comment edited in

The log you edited in shows that process was terminated with 4000001E wow64 single step exception you are soing some x64 / x32 mixup my odbg version is latest v 2.01 earlier version 1.10 has problems running in lates os it was ok upto xpsp3 only

  • I think your version of OLLY is different than mine, but I found it and it's already selected. see the pic i68.tinypic.com/2hztq4k.png – Pretty_Girl Aug 5 '16 at 12:05
  • you're correct, the version I was using was old. Can you place it as an answer then I can accept it? – Pretty_Girl Aug 5 '16 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.