A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are "plaintext", no anti-debugging techniques, simply nothing).

Today, I wanted to come back to said program and suddenly I'm unable to load it into Olly - even before Olly starts its analysis (the bar in the bottom of the window), the process terminates and I land in ntdll.dll. If run without a debugger, the exe works fine - there seem to be no problems.

I'm really puzzled because since then I've made two changes to my PC:

I've also tried this on another PC which hasn't been even powered on for the last month and is basically a clean Win7 install, still to no avail.

At the first glance, this probably looks like battling a TLS Callback protection, but as I said, I'm certain the exe has no protection at all, as I've been able to play around with it a couple days ago.

Are there any 'common' causes for such behavior?

  • Have you tried observing its behavior in other software, e.g. IDA, Hopper? Alternatively try just using the GDB command-line tool to see if it has something against debuggers.
    – JamalS
    Aug 29, 2014 at 18:42
  • The same thing happens in other debuggers I've tried. As I've said, I'm positive it hasn't any kind of protection. I even have C code written a week ago because I was able to reverse some basic calls.
    – user4520
    Aug 29, 2014 at 18:46
  • Would it be possible for you to provide the executable for us to analyze ourselves?
    – JamalS
    Aug 29, 2014 at 19:04
  • So it turns out that attaching to process in OllyDbg 2.0 will work. In 1.10, I have this weird issue where the target process will be frozen by Olly (happens with many other programs, such as MS Notepad). I'll try a fresh Win7 install tomorrow, see what happens.
    – user4520
    Aug 29, 2014 at 19:55
  • check if DbgUiRemoteBreakin in ntdll.dll is patched to jump to exitprocess (or similar), its a pretty common anti attach trick
    – evlncrn8
    Aug 31, 2014 at 21:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.