5

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the image below Application stopped working

And if we close the application it will stop at 700000 address.check the below image700000 address

And i already checked the debugged configuration of olydbg to the below setting.Event configuration of ollydbg

Now if anyone tell me how to solve this that would be great.And let me know if my configuration is wrong on this.I am using ollydbg v1.10

Improve this question
1
  • why not try with 2.0? It looks like it correctly stops at @402950
    – Paweł Łukasik
    Sep 26, 2017 at 18:03

1 Answer 1

Reset to default
6

OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its work -- but not exactly there. The address which you are in is inside NTDLL and you have nothing to be afraid of being there.

I believe that there's a bug (or a configuration which I'm not aware of) in OllyDbg in which the program breaks in RtlUserThreadStart although your settings is set to first break on program's entry. RtlUserThreadStart is kind of every thread's entrypoint so I wonder maybe Olly hits this-not-exactly System Breakpoint even though it is not configured to do so.

Both OllyDbg v2 and x64dbg doesn't have this problem and they would break on program's entrypoint as expected, unless you configure it elsewhere.

For example, here's the program as it loaded on Ollydbg version 2:

enter image description here

And here's how it looks like when it configure to break on System Breakpoint:

enter image description here

You can configure it by using Alt+O >> Debugging >> Start and check "System Breakpoint" under "When starting application, make first pause at".

As you can see, the program broke on a different address which is considered as the System Breakpoint.

x64dbg also breaks in this address:

enter image description here

You can configure x64dbg inital breakpoints in Options >> Preferences >> Events.

Anyway, in your case, pressing F9 or Run in OllyDbg v1 will take you to the program's entrypoint.

I highly recommend to use x64dbg which is an active open-source project, unlike Ollydbg which is absolutely outdated.

Here are some resources:

Improve this answer
2
  • 1
    +1 for recommnding x64dbg. I guess the point for using Olly is that Lena's tut contains steps to follow in Olly but probably they can be used in other tools almost 1-to-1.
    – Paweł Łukasik
    Sep 26, 2017 at 20:05
  • @Megabeets How is ntdll.77B2746D translated to ntdll!RtlUserThreadStart. Thanks
    – Dr Deo
    Nov 3, 2017 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.