1

In OllyDbg, is there a way to break when memory is allocated?

Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/obfuscated code.

The memory map seems to only allow breaks on already allocated memory.

If not Ollydbg, is there another tool that can do this?

Thanks,

Geoff

  • I've got my GREM, but I'm still pretty new to reversing.
  • 3
    Put a breakpoint on kernel32.VirtualAlloc. If that doesn't work, put it on ntdll.NtAllocateVirtualMemory – Martin Dec 9 '16 at 20:16
  • You can probably set bp in msvcrt or heap functions in kernel32 as well – blabb Dec 10 '16 at 8:45
  • Thanks, this should work. I was so caught up in the code that I forgot that malloc is just a wrapper for other lower-level system calls. How do I formally accept this as an answer? – Geoff Dec 14 '16 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.