2

I loaded an MS-Windows executable in Ollydbg. But as soon as I hit run from the Debug menu a message shows up:

Breakpoint set at address 76A010B1 is corrupt (contains hex code instead of int3 ...)

And the program doesn't run, rather it breaks to Ollydbg. I am puzzled. What is really going on? I see an isdebugger call. Fixing it, also, it doesn't run the program. I suppose it's using some advanced anti debugging technique. Any suggestions?

Here is the log from windbg:

(a9c.1fd4): Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SYSTEM32\ntdll.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SYSTEM32\KERNEL32.DLL - 
eax=7fe73000 ebx=00000000 ecx=00000000 edx=775edbeb esi=00000000 edi=00000000
eip=7757f9fc esp=0be4ff58 ebp=0be4ff84 iopl=0  nv up ei pl zr na pe nc
cs=0023      ss=002b      ds=002b      es=002b fs=0053 gs=002b efl=00000246
ntdll!DbgBreakPoint:
    7757f9fc cc              int     3
Improve this question

1 Answer 1

Reset to default
2

The API isDebuggerPresent(), determines whether the calling process is being debugged by a user-mode debugger. I advise you to use IDA to see all the types of controls antidebug, you can see some http://msdn.microsoft.com/en-us/library/windows/desktop/ms679303%28v=vs.85%29.aspx, also you can automate with plugins for olly, for example http://code.google.com/p/aadp/

Improve this answer
6
  • The thing is that when i hook olly to the process the program just breaks . I neutralized isdebuggerpresent . Stil the problem is not resolved. Any thoughts ?
    – parthibd
    Mar 31, 2014 at 19:29
  • There will probably be other controls that prevent debugging, have you tried to use the aadp plugin?
    – invictus85
    Mar 31, 2014 at 19:39
  • I tried but no positive outcome . Let me explain it to you a little bit . When i checked the binary with peid it shows it is compiled with visual c++ . But in fact it runs on java vm . I guess it uses jni to call native function but its just a guess . And no matter what i try , the process terminates or just hangs when i try to hook up a debugger to the process.
    – parthibd
    Mar 31, 2014 at 21:04
  • This is a shot in the dark, but if it starts running in a JVM, can you possibly inject an option like this: -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=10 In command-line java debugging, this (and I might have missed some context with the dt_socket env var) will pause a Java process until you attach a debugger at the specified port.
    – avgvstvs
    Apr 1, 2014 at 3:02
  • Or maybe download the source for the OpenJDK jvm and force your system to hook to ITS binary while you have it in debug mode... (Sorry, new to disassembly so if these ideas suck just tell me...)
    – avgvstvs
    Apr 1, 2014 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.