2

The following is a simple program I wrote to be debugged in OllyDbg:

main(){
    exit(0);
}

I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I went into options and set a breakpoint at the entry. The program still paused at the same location in ntdll. I then set a breakpoint at main. And it still pauses at some location in ntdll.

What am I doing wrong here?

  • What version of OllyDbg are you using? – Jason Geffner Sep 15 '14 at 14:27
2

The first break is always the system breakpoint.

If you do not want Ollydbg to stop at system breakpoint goto options.

Alt+o -> events and change the make first pause at to EntryPoint Of Main module

When, a parent process creates a child with DEBUG_XXXX flags it should know when the process initialisation has been finished so a notification called ProcessCreate DebugEvent is raised DbgBreakPoint in ntdll.dll is a part of that DebugEvent Notification usually termed as SystemBreakPoint.

Which version of Ollydbg are you using 1.10 or 2.01, do you have plugins loaded ? A simple executable with just an exit should either stop on System BreakPoint or WinMainCrtStartup or at main() only not anywhere else.

| improve this answer | |
  • I did that though, that's the thing. It stills breaks at the system break point. Can I ask what's so special about the "system breakpoint." Is it unique? Why choose it? – hi im gosu Sep 15 '14 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.