I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address!
I want to set a bp when for example ECX == 12345678 , i can do this on specific address with this condition , but i want do this on whole module, that when any where in a module ECX is equal to 12345678 , the debugger stops the procedure.
Is there any solution for my question? Or is there any scripts that do the same thing i told?
(Not exactly an answer but too long for a comment)
This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to be very very slow.
A debugger does not actually know all the register values at every single point in the program. It doesn't know any register values until a debug break. So if any breakpoint triggers, it will be able to read those values and act on them (hence conditional breakpoints on a specific address).
That means if you want to know if a register has a certain value at any time during execution, you will probably have to single step the whole program. That is, execute one instruction, break, read values, execute one instruction, break, read values, ...
That's what a run trace usually does but I never used them due to speed. You may want to look around OllyDbg's trace features to see if it offers what you need but know it's probably going to be really slow.
ctrl+t -> Set Trace Condition
checkmark condition is true check box and enter the condition
in your case ecx == 12345678
and start tracing with either ctrl+f11 or ctrl+f12
snap shot shows trace record for condition ecx == eip
