I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, just this one is making problems. Olly accepts breakpoints in session, but forgets their locations after the program gets restarted (meaning all BPs get deleted in this one dll). Analysis of this dll outputs in olly message “Quick statistical test of module reports that its code section is either compressed, encrypted, or contains large amount of embedded data. Results of code analysis can be very unrealiable or simply wrong. Do you want to continue analysis?”. I have tried using PEiD and nothing was found. I can open dll with a simple hex editor and find all op code hex data, so I think the dll is not encrypted or packed, and it has to do with Olly dbg. Can anyone give any suggestion?
Is this library dynamically loaded? (At runtime, e.g. using API like LoadLibaray, LdrLoadDll)
Then you may need to set your breakpoints dynamically as well. For example, using Olly's scripting capabilities. If the library is always loaded at the same offset, memory breakpoints could also prove useful.