1

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ".

I read that I have to use Olly v1.10 for this purpose. When I go to "Debug" -> "Set Condition" I can write in the text field "Condition is TRUE" for instance this:

EAX == 00000010

I press F9 (Run) and the breakpoint will work. So once EAX becomes 0x10 olly will stop. However when I do this:

UNICODE[EAX] == "Enter"

it doesn't work. What am I doing wrong? Doesn't matter which program I use and which Olly version, I can't get this to work. I would like to match strings like "Enter text" as well, so any appearance of "Enter".

In the end I'm basically looking for a way to stop olly once a specific string is loaded into RAM. How can I achieve this?

Any help is appreciated. Thanks!

1

there is a slight syntax change between 1.1 and 2.01 the square are compulsory even when not dereferencing

so to have a condition where eax points to unicode string you need a condition like

[UNICODE EAX] == "what"

suppose you have code like this

#include <stdio.h>
#include <windows.h>
wchar_t *strings[] = { L"is this what", L"does it matter", L"what is this",
  L"who are you", L"why am i doing this", L"lest scoot from here"
};
PWCHAR foo (int a) {
  return strings[a];
}
int main(void ) {
  for(int i=5;i>=0;i--) {
    printf("%S\n",foo(i));
  }
  return 0;
}

setting a break as shown in screenshot will break correctly in 2.01 enter image description here

  • Where did you set the breakpoint in Olly 2.01? Did you typed [UNICODE EAX] == "what" in "Trace" -> "Set Condition" -> "Condition 1 is true" ? Still not working for me. – Chris Nov 18 '16 at 15:11
  • Just to clarify: I don't want to set a breakpoint on a specific address (in your example 00DF1295) and check EAX value changes. I want to look for a specific string once it is loaded for the first time in the register EAX (or in any register actually). – Chris Nov 18 '16 at 15:17
  • tracing condition is not breakpoint condition that is a seperate question breakpoints are always tied to some instruction pointer while tracing eax can hold anything from 0 to 2^31 in a 32 bit machine per instruction you cannot read the memory of eax if eax = 0 or for that matter any unreadable memory address please post a seperate question – blabb Nov 18 '16 at 15:38
0

It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
For example in Olly 2, by pressing Shift+F2 you can type your condition UNICODE [EAX] == "Enter" in the dialog box.

If the debugger doesn't break on the condition you can check the values of EAX by setting a conditional log breakpoint(Shift+F4). set the settings like shown: enter image description here

Now while the program is running and you are waiting to break here, open the log window and check what are the values in EAX and why the debugger is not breaking.

  • When I press SHIFT+F2 I can only set a breakpoint on a specific address. But I don't want to do that. I want Olly to stop once a specific ASCII, e.g. "what", is loaded into the register EAX (it can be any place/address in the program). So Olly needs to run over the whole program and not just one address like 001A74EF in your example. – Chris Nov 18 '16 at 15:15
  • If your specific string is hardcoded in the program you can find it in dump and set a breakpoint on it. Otherwise you should break on all the commands that load something in EAX either using MOV or LEA or... – Jango Nov 18 '16 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.