0

I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, just this one is making problems. Olly accepts breakpoints in session, but forgets their locations after the program gets restarted (meaning all BPs get deleted in this one dll). Analysis of this dll outputs in olly message “Quick statistical test of module reports that its code section is either compressed, encrypted, or contains large amount of embedded data. Results of code analysis can be very unrealiable or simply wrong. Do you want to continue analysis?”. I have tried using PEiD and nothing was found. I can open dll with a simple hex editor and find all op code hex data, so I think the dll is not encrypted or packed, and it has to do with Olly dbg. Can anyone give any suggestion?

  • try to use dynamic bp, at every run set a script to toggle a bp on start_address+offset where the offset is constant, if the code is polymorphic you should lean to some unobfuscator/unpacker – Abr001am Sep 13 '16 at 14:15
0

Is this library dynamically loaded? (At runtime, e.g. using API like LoadLibaray, LdrLoadDll)

Then you may need to set your breakpoints dynamically as well. For example, using Olly's scripting capabilities. If the library is always loaded at the same offset, memory breakpoints could also prove useful.

  • Hi, Yes, dll is dynamically loaded, but Olly usually does not have a problem with that. There are at least 10 dlls that get loaded, and only this one is making BP problems. I don’t think dll is packed, or in any way protected, otherwise one could not open it with hex editor (like notepad++) and find hex notation of OP code. I’ll try to find some resources which explain how to set dynamically BP via scripts. – Tree Sep 15 '16 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.