3

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg.

How can i do that ?

I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is used for this case but it is not compatible with the above version of Olly.

Thanks for your help!

  • 1
    What keeps you from using the Ollydbg version where this plugin is compatible? – ixje Sep 8 '13 at 7:28
  • @justsome i have tried the old version with that plugin and is not working either ! – studentofmp Sep 8 '13 at 9:29
  • 1
    OllyDbg has conditional breakpoint capabilities, have you tried that first? – gandolf Sep 10 '13 at 14:12
4

I'd suggest you use OllyDBG version 1.10 (non-plugin) or Other edition like odbgSND.

You can use Conditional BP with below grammar:

UNICODE [EAX]=="HamiD a.k.a AHA"

OllyDbg treats EAX as a pointer to UNICODE string, converts it to ASCII and compares with text constant. If you want the Unicode value of the register must be written as the following conditions:

EAX == 75007500

This condition is triggered if the value of EAX equal uu Unicode.

1

Check these out :

http://www.openrce.org/forums/posts/634

http://www.woodmann.com/forum/archive/index.php/t-8043.html

And here is two conditions I recently used in Olly:

([UNICODE[esp+10]] !="BAR") && ([UNICODE[esp]] =="FOO")
[[STRING[esp+8]] =="FOO"] && [[STRING[esp+4]] !="BAR"] 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.