PE files have several sections like .code
, .data
, .bss
etc. Each of the sections have a special purpose, such as the .code
section usually contains the programs code i.e. the instructions, the .data
sections houses the initialized variables etc.
The above rule is merely a convention followed by compilers. In a packed/obfuscated program, the convention may not always hold true. You can have instructions in data segment and vice-versa. This is done for various reasons like thwarting analysis ,disassembly etc.
When in Ollydbg you try to set a INT3
breakpoint on an instruction that happens to be in a section marked for data, Ollydbg would complain and that is the message you see.
The reason for this is suppose that the instruction you set a breakpoint on is actually data. In this case, when the program reads in the value at the address it would read 0xCC
(INT3 -> 0xCC) instead of the actual value. That can crash the program. Further since this is a read operation, the breakpoint will never be hit.
If you want, you may disable the message in Ollydbg options, however doing that is not always recommended. Instead if you are sure that it is an instruction, you may ignore the warning and set the breakpoint.
The other way is instead of using a INT3
breakpoint, set a Hardware breakpoint (HWBP) on execution at the aforesaid address. This way the program would not crash, even if the hwbp was set on data. HWBP's are enforced my the CPU and does not modify the program in any way unlike INT3
breakpoints