2

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.

Attach to the game before entering the game map

But when I start to play the game and enter the game map, the game crash when the breakpoint triggered. And also, when I try to reattach the Cheat Engine, the memory cannot be read.

Attach to the game after entering the game map

And when I go back to the main menu again, the protection is being turn off... I can view the memory, and debug again.

Any idea which on which function should add bp in order to trace this memory protection? I already add bp on the IsDebuggerPresent, but it doesn't trigger, so I'm pretty sure it's not the one..

  • Cheat Engine may be conflicting with OllyDbg. Try using only one at a time. OllyDbg can view the process's memory as well, so there's really no need to use Cheat Engine anyway. – Jason Geffner Jan 4 '14 at 16:36
  • Yes, I already try using Olly alone and CE alone as well. If I attach to the game right after it run, I can access and edit the memory even when I'm playing it. But only memory editing, debugging will crash the game. But if I attach the game after the game starts, not only debugging, I can't even view the memory. – Ahmad Hafiz Jan 4 '14 at 23:04
  • You may want to try SIDE for anti-anti-debugging: woodmann.com/forum/showthread.php?15268-SIDE – Jason Geffner Jan 5 '14 at 16:03
2

At first try to start with hardware BP instead of software BP ("the regular ones") but remember that you only have 4 hardware BPs and they are per specific thread.

In addition, taking into account that you are saying

the memory cannot be read

then I would suggest

  • to set BP on VirtualFree/NtFreeVirtualMemory and trace from there back to understand if memory was freed intentionally or because of some bug.
  • if the above is not working, try to use hardware BPs on the same functions and also on GetThreadContext to check if there is anti-debugging present to clean the hardware BPs.
0

If you're using OllyDbg (Not OllyDbg 2), there are plugins that help fool the application into thinking it's not being debugged.

Check out the "Hide Debugger" plugin.

If that doesn't work, then you'll probably have to go in and figure out what it's doing by hand. You might want to try breaking once you hit start, and then doing some static analysis to figure out what's going on from that point. Best of luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.