OllyDbg: How to set conditional breakpoint on a register value?

Question

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ".

I read that I have to use Olly v1.10 for this purpose. When I go to "Debug" -> "Set Condition" I can write in the text field "Condition is TRUE" for instance this:

EAX == 00000010

I press F9 (Run) and the breakpoint will work. So once EAX becomes 0x10 olly will stop. However when I do this:

UNICODE[EAX] == "Enter"

it doesn't work. What am I doing wrong? Doesn't matter which program I use and which Olly version, I can't get this to work. I would like to match strings like "Enter text" as well, so any appearance of "Enter".

In the end I'm basically looking for a way to stop olly once a specific string is loaded into RAM. How can I achieve this?

Any help is appreciated. Thanks!

Answer 1

there is a slight syntax change between 1.1 and 2.01 the square are compulsory even when not dereferencing

so to have a condition where eax points to unicode string you need a condition like

[UNICODE EAX] == "what"

suppose you have code like this

#include <stdio.h>
#include <windows.h>
wchar_t *strings[] = { L"is this what", L"does it matter", L"what is this",
  L"who are you", L"why am i doing this", L"lest scoot from here"
};
PWCHAR foo (int a) {
  return strings[a];
}
int main(void ) {
  for(int i=5;i>=0;i--) {
    printf("%S\n",foo(i));
  }
  return 0;
}

setting a break as shown in screenshot will break correctly in 2.01

Answer 2

It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
For example in Olly 2, by pressing Shift+F2 you can type your condition UNICODE [EAX] == "Enter" in the dialog box.

If the debugger doesn't break on the condition you can check the values of EAX by setting a conditional log breakpoint(Shift+F4). set the settings like shown:

Now while the program is running and you are waiting to break here, open the log window and check what are the values in EAX and why the debugger is not breaking.