4

I want to set a breakpoint and suddenly the following message appears:

You want to place breakpoint outside the code section. INT3 breakpoint set on data will not execute and may have disastrous influence on the debugged program. Do you really want to set breakpoint here?

Note: you can permanently disable this warning in Options|Security.

Without knowing what that is, I would guess that is not allowed to set the breakpoint. So my question would be:

How can I bypass the annoying message? Or better: what must I do to not see this?

6

PE files have several sections like .code , .data, .bss etc. Each of the sections have a special purpose, such as the .code section usually contains the programs code i.e. the instructions, the .data sections houses the initialized variables etc.

The above rule is merely a convention followed by compilers. In a packed/obfuscated program, the convention may not always hold true. You can have instructions in data segment and vice-versa. This is done for various reasons like thwarting analysis ,disassembly etc.

When in Ollydbg you try to set a INT3 breakpoint on an instruction that happens to be in a section marked for data, Ollydbg would complain and that is the message you see.

The reason for this is suppose that the instruction you set a breakpoint on is actually data. In this case, when the program reads in the value at the address it would read 0xCC (INT3 -> 0xCC) instead of the actual value. That can crash the program. Further since this is a read operation, the breakpoint will never be hit.

If you want, you may disable the message in Ollydbg options, however doing that is not always recommended. Instead if you are sure that it is an instruction, you may ignore the warning and set the breakpoint.

The other way is instead of using a INT3 breakpoint, set a Hardware breakpoint (HWBP) on execution at the aforesaid address. This way the program would not crash, even if the hwbp was set on data. HWBP's are enforced my the CPU and does not modify the program in any way unlike INT3 breakpoints

  • thank you for your great answer. I have read about Hardware Breakpoints, so then I will try it. Again, thx. – user3097712 Jul 9 '14 at 23:45
  • EDIT: Hardware Breakpoint did not work because suddenly the process is terminated before the breakpoint comes. So, I try again a software breakpoint, ignore the message let run ollydbg and it helps – user3097712 Jul 10 '14 at 0:25
  • @user3097712 It is possible to detect hardware breakpoints as an anti-debugging feature. See this – 0xec Jul 10 '14 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.