While opening a binary in Ollydbg, I get a warning that the debugged program has modified the debugging registers. The following entry is in the log: Address: 7749218E Modified debug registers of main thread

DR0: old 77EC2D07, new 77D11208 DR7: old 00002155, new 00000154

After this, once the rest of the program has loaded and the execution is paused, it says: Break on single-step trap or INT1 set by application - application was unable to process exception.

The application in question is malware, so I believe this is a type of anti-debugging countermeasure.

How do I step past or patch out the above?

  • TLS Directory RVA at offset 000001A0 and TLS Directory Size at offset 000001A4. However, neither one has a value set. I don't think this this binary uses TLS callbacks. – Utkonos Mar 16 '15 at 0:46
  • Several possibilities without more information - Does the sample include DLLs (they will run before Olly breaks)? Does the sample import functions from itself (the TLS table can be constructed dynamically)? Do you have plug-ins running? Does the effect happen with any other files? – peter ferrie Mar 16 '15 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.