1

When I open a program in a debugger like OllyDbg or x64dbg, there are a lot of instructions before the initially selected instruction. Why does the debugger choose this instruction specifically to have it under the cursor? What is with the instructions on the list that appear before it? Were some of them executed?

1 Answer 1

2

Probably you are talking about the "system breakpoint". This is the location that the OS uses to break so the debugger can do its work. In x64dbg you can get more information by loading symbols for ntdll.dll. You will notice that the function is called LdrpDoDebuggerBreak. If you're not interested in the Windows loader you can simply disable it.

disable system breakpoint

The actual exception for the system breakpoint is STATUS_BREAKPOINT. The LdrpDoDebuggerBreak uses the INT3 instruction to throw this exception to the debugger. Basically the OS is signalling the debugger that it finished the process initialization phase and also giving the debugger a chance to modify the thread context or process memory.

You can see it in the code:

int3

2
  • Is there some reasoning behind the location of this breakpoint? Like why in that address specifically?
    – Helmy
    Nov 21, 2016 at 19:40
  • I updated the answer to hopefully address your question.
    – mrexodia
    Nov 21, 2016 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.