I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, just this one is making problems. Olly accepts breakpoints in session, but forgets their locations after the program gets restarted (meaning all BPs get deleted in this one dll). Analysis of this dll outputs in olly message “Quick statistical test of module reports that its code section is either compressed, encrypted, or contains large amount of embedded data. Results of code analysis can be very unrealiable or simply wrong. Do you want to continue analysis?”. I have tried using PEiD and nothing was found. I can open dll with a simple hex editor and find all op code hex data, so I think the dll is not encrypted or packed, and it has to do with Olly dbg. Can anyone give any suggestion?
1
-
try to use dynamic bp, at every run set a script to toggle a bp on start_address+offset where the offset is constant, if the code is polymorphic you should lean to some unobfuscator/unpacker– Abr001amSep 13, 2016 at 14:15
Add a comment
|
1 Answer
Is this library dynamically loaded? (At runtime, e.g. using API like LoadLibaray, LdrLoadDll)
Then you may need to set your breakpoints dynamically as well. For example, using Olly's scripting capabilities. If the library is always loaded at the same offset, memory breakpoints could also prove useful.
-
Hi, Yes, dll is dynamically loaded, but Olly usually does not have a problem with that. There are at least 10 dlls that get loaded, and only this one is making BP problems. I don’t think dll is packed, or in any way protected, otherwise one could not open it with hex editor (like notepad++) and find hex notation of OP code. I’ll try to find some resources which explain how to set dynamically BP via scripts.– TreeSep 15, 2016 at 18:45