Ollydbg breakpoint causing application to perform differently without BP being hit

Question

For the sake of this question I am going to simplify things. Basically I have a CMP that is comparing a memory address to a constant value. I want to change the constant value to force a match.

I tried changing the constant value by hex editing and changing the value in ollydbg. Both methods cause the application to behave in an undesirable way so there must be a double check which checks the constant value. I have not found this second check yet.

Now this is where it gets interesting, if I set a BP with ollydbg on the CMP command without changing anything the application behaves as if there was a change. I have confirmed this multiple times, I do not even have to stop or restart the application, once a BP is set the application behaves in a very distinguishable way and then returns to normal as soon as I remove the BP. This BP is never being hit! I have done some further testing and this only happens if the BP is set on the CMP command or the following 2 commands which are a JE and a MOV

So I am wondering what does ollydbg write to memory to set a BP? and is this detectable?

Answer 1

So I am wondering what does ollydbg write to memory to set a BP? and is this detectable?

By default, OllyDbg overwrites the beginning of an instruction with INT 3 (machine code 0xCC) for a software breakpoint (though it hides this from your view in order to simplify things). This is configurable in OllyDbg v2, which allows you to instead use INT 1, HLT, CLI, etc. for software breakpoints.

Both OllyDbg v1 and OllyDbg v2 allow you to use hardware breakpoints or memory breakpoints instead of software breakpoints. All three types of breakpoints are detectable by the debuggee.