1

I put INT3 breakpoint and starting the program. The OllyDbg break at the breakpoint, but when I step over, the OllyDbg put a hardware breakpoint. (Yesterday not happened in OllyDbg, but today during training it happened.)

ٍEdit : A red square usually occurs when step over, but goes to the next line immediately. But in this call, when i click F8 to step over, the program has stopped and no longer works.

enter image description here

1 Answer 1

1

That is The Default Behavior for almost every Debugger.
you might not have noticed it when the Function Returned Quickly
you should always see a red flicker on every F8 (StepOver) on a call

it is an internal breakpoint set by ollydbg /any debugger and handled by ollydbg / almost all debugger

how would a debugger know to stop where after executing unknown instructions inside a call

see a gif for the flicker when doing f8 which executes the return silently
and no red flicker if you step in with f7

enter image description here

if the program stopped working it might have an anti-debugging trick inside the call try stepping in instead of step over of follow the call set a breakpoint deep inside the function and check

4
  • Thank you very much, yes you are right. but in this specific CALL the ollyDbg stops, and all buttons not working, i also edit the post. please check it.
    – Jason
    Commented Aug 2, 2021 at 15:03
  • But, this call works good on windows XP, i mean after F8 on this call, i can step over to another instructions. Today this problem happened, yesterday works well.
    – Jason
    Commented Aug 2, 2021 at 15:09
  • @Jason. Try deleting the .udd and .bak files that OllyDbg creates when debugging an executable.
    – fpmurphy
    Commented Aug 3, 2021 at 11:22
  • as @fpmurphy commented try deleting the udds
    – blabb
    Commented Aug 3, 2021 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.