I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks


If I get you question correctly, you want to change where OllyDbg breaks first when the executable is loaded.

You can change that by going to: Options -> Option.... And then selecting the Startup and exit under the Debugging. There you have an option to select where it will stop when executable is loaded.

enter image description here

You probably have System breakpoint selected.

|improve this answer|||||
  • how did you create the "broken" screenshot effect? Any specific software you used for that? Thanks. – 0xC0000022L Aug 24 '18 at 11:43
  • 1
    @0xC0000022L yup, SnagIt - techsmith.com/screen-capture.html – Paweł Łukasik Aug 24 '18 at 14:48
  • How an UM app can go to KM automatically? It can also be done with gimp, free... – Biswapriyo Aug 25 '18 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.