2

I have the following problem:

in an assembly code I have a call into a function. When I step into the function and analyze a little bit, after a while ollydbg says that is suddenly terminated and I can not do anything against that. You know, after terminating ollydbg does not allow to step futher.

My question would be: Is is possible to go back to the line where the function is called and step over the function ? I mean, after knowing that the function is terminating the whole thing i would not go again in that function.

  • 1
    If the control flow reaches that function, it will terminate the process anyway, no matter whether you stepped in or over it. You might want to investigate the exact reason why the function does it. – Dmitry Janushkevich Jul 3 '14 at 7:51
  • in my case that what you wrote is not true. At same place where the CALL instruction comes, I step over and do it my work further. The process did not terminate. – user3097712 Jul 6 '14 at 23:23
2

Here is my considerations based on your description.

Say you have some function, that you want to step into for analyze purposes. Here is list(non exhaustive) of conditions, that can take debugger down

  • Unhandled exception was thrown when you tried to step into(maybe anti-debugging trick)
  • You're trying to step into address, that, actually, doesn't exists(unlikely, but may be)

Anyway, if you want the community to help you, there is lack of technical details in your topic. Here is the list of things, that worth providing: OS, commands prompted (breakpoints, etc), debugger listing(IMHO, Windbg better).

About "time shifting". As you can see, main OS is not suitable for analyzing purposes. Consider doing this in virtual environment. Best practice is to save initial snapshot of all the configuration and go step-by-step through all parts of interest doing snapshots when needed. The advantage of this approach is that you can rollback previous configuration easily without roughly duplication of all the steps.

| improve this answer | |
2

When you say step over, I assume you actually want to not execute that function. This can be done by changing the value of EIP.

In olly you can actually highlight the line you want to skip to, right click, and select New origin here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.