0

I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.

I received this window:
enter image description here

You can see that the addresses are from the Kernel memory.
I want to see the code of the program, I tried to double click on all the opened thread but everyone are in a kernel memory.
I noticed that the header is:

CPU - main thread, module USER32

Maybe the problem is that it showing me the module's memory and not the program's memory.

Any idea how I can switch to the program's memory (user-space memory)?

0

I found how to do it.

Just right click on the code, choose Select module and choose the main module which is usually on the top.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.