3

I attached Ollydbg to a process, and try to set breakpoint on CreateWindowExW. I typed

bpx CreateWindowExW

in command line. Then I checked the Breakpoints window and found it's totally empty.

The same thing works smoothly in IDA pro -- I attached IDA pro to the process I'm going to debug, then in "Modules" window, I choose user32.dll and right click on CreateWindowExW and choose "Add breakpoint".

Actually, I found setting breakpoint on Win32 API in Ollydbg is very very hard to use. Based on all information I got by Google, I only need to run bpx xxxxx to set this kind of breakpoints, but in fact, it's rarely success. Most of time, no breakpoints were set by this.

Did I miss something?

BTW: The process I debugged loaded a lot of DLLs dynamically. Is this the problem?

Improve this question
3

With input focus on the disassembly pane in the CPU window, press Ctrl+G, then type CreateWindowExW to navigate to the first instruction of that function. Then press F2 to set a breakpoint on the first instruction of that function.

This is all documented very clearly in OllyDbg's help file.

Improve this answer
4
  • Thanks for your answer. Your method does worked. However, before I ask this question, I tried my best to search and read related materials including this FAQ page. In section 3, it described exactly the method I mentioned above but not yours. Could please tell me the difference between these two methods, and where is the help file you mentioned?
    – Lingfeng Xiong
    Dec 29 '13 at 17:12
  • 1
    The BPX method described in the FAQ appears to set breakpoints on all static CALLs to the target function made from the current module, which is a really bad way to set a breakpoint. You should disregard that part of the FAQ (Alt+F1 doesn't do anything in OllyDbg 2.0, anyway). The help file in ollydbg.de/odbg110.zip is OLLYDBG.HLP; the help file in ollydbg.de/odbg200.zip is help.pdf.
    – Jason Geffner
    Dec 29 '13 at 21:16
  • I just noticed @blabb's post below regarding BPX vs. BP. Even so, probably best to just use OllyDbg 2.0 and skip the command line interface.
    – Jason Geffner
    Dec 29 '13 at 21:28
  • Thanks for your help. I can only use Ollydbg 1.10 because every time i attach Ollydbg 2.0 to the process I'm debugging will hang both Ollydbg and target process(Ollydbg become no responding when analyzing some modules which used by this process, like user32.dll). Also, Ollydbg 1.10 can only be attached to the target process once -- when I restarted the process I'm debugging, I need to restart Ollydbg too or attaching to target process will hang it, although Ollydbg said it's running. Maybe a bug.. :-(
    – Lingfeng Xiong
    Dec 30 '13 at 0:44
0

ollydbg command line plugin accepts BP for Address and BPX for labels

so if you require that breakpoint be set in Address use bp CreateWindowExW

if you used bpx and no calls existed plugin will open a search for intermodular calls window for you to manually search for the interested api

if you have a call like this

010020ED FF15 A4110001   CALL    NEAR DWORD PTR DS:[<&USER32.CreateWindow>; USER32.CreateWindowExW

plugin will set a break on this call with BPX style for bp style you would need to use bp 10020ED

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.