7

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:

Debugged application has modified the debugging registers. 
Maybe it called ZwContinue() or SetDebugContext(). 
The modifications are saved to the log.

What does that mean? How can I fix it? I did not change any options such that I use the default configurations.

edit: As I try to describe it in the comments, I can open the same sample in ollydbg v1.10, but not in ollydbg v2.01. I mean, I can open it in v2.01, but it starts at a RETN instruction & process terminated. Now, I have read at http://www.ollydbg.de/version2.html that olly replaces ZwContinue() with the INT3 instruction. I compare the opened sample in v1.10 with the sample in v2.01 and yes, in v1.10 it has a lot of INT3 instructions, but in v2.01 there is INT3. As I also said below, I need v2.01 because of the Debug child process option.

best regards,

Improve this question
5
  • It means your sample is trying to implement some kind of anti-debugging mechanism by changing the processor registers that deal with debugging. To do this in Windows, it could have used the ZwContinue or the SetDebugContext API calls. You might try setting breakpoints on these API functions and check if one of them gets called.
    – Guntram Blohm
    Apr 1, 2015 at 9:42
  • Ok, when I close the message, the program starts at a RETN instruction and the process is terminated. To search & set a BP, I click on the disassembler window -> Search for -> All intermodular calls .... it gives a list of intermodular calls in ntdll with only two functions: kernel32.BaseQueryModuleDate and another undefined function (kernel32.7C687074).
    – user3097712
    Apr 1, 2015 at 10:41
  • I also use Search for -> Commands...type "CALL ZwContinue". It finds a call to NtContinue, I set a BP at this point/instruction, restart th debug session...but the message appers again. Using that method, ollydbg cannot fintd SetDebugContext.
    – user3097712
    Apr 1, 2015 at 10:53
  • If you don't absolutely need to debug the program from the beginning of its execution, you may want to try to run the program outside of the debugger and then once it's running, attach to its process with OllyDbg. This will allow you to bypass any early anti-debug tricks.
    – Jason Geffner
    Apr 1, 2015 at 14:53
  • No, I wanted to debug it from the beginning...but as I can see, I have no other options. I'll try to attach it. The funny thing is: I can open the same sample in ollydbg v1.10 without getting a such annoying message. But with Ollydbg v2.01, the described problem above appears. I do not know, why. I checked out the options of both and try to figure out if there is a difference between the default settings. I can say that these are nearly the same, except the missing options in ollydbg v1.10, of course. The reason why I try to use ollydbg v2.01 is that I need the debug child process option.
    – user3097712
    Apr 1, 2015 at 18:46

2 Answers 2

Reset to default
2

What are the debug registers

The technical meaning of this warning is simply that Olly noticed the program you're debugging changed the CPU's debug registers. These registers are available to facilitate CPU-enabled debugging. The original use case is speeding up debugging efforts by using these CPU specific features.

There are some broad advantages for using the debug registers by debuggers in general and for anti-analysis executables in particular.

  1. More efficient/fast debugging experience.
  2. Faster debugged made timing-based anti-debugging harder by drastically shortening the time certain debugging tasks take to complete.
  3. Hardware assisted breakpoints and debugging features are harder to bypass or detect, and got less attention since most reversing related debuggers did not use them in the past.

bullets 2 and 3 might seem the same, but although achieving a similar goal the cause is completely different.

Difference between Ollydbg1 and 2

Olly v2 started using debug registers by default for it's own debugging efforts. This wasn't too common for anti-analysis specific debuggers such as olly previously, which proved quite helpful at the begining and was a decent idea. It's important to note olly1 exposed debug register usage, but it had less of a focus and wasn't the default behavior.

This can be turned off by un-checking this checkbox: Ollydbg configuration

Improve this answer
1

I have encountered this issue too. In my opinion, it may mean the debuggee applies some anti-debugging measures, BUT it must NOT mean that. For evidence, I've tested it with some PEs that cannot contain any anti debugging measures. I used Olly v2, and in settings I made Olly to stop on System breakpoint when starting/attaching applications. If you know the book Practical Malware Analysis (PMA), I've loaded Labs 20-01, 7-2 (just randomly) and set hardware breakpoints on entry point and some other locations. And I had the same issues - the breakpoints have been modified to zero.

Improve this answer
1
  • Data break points are cleared before system break you shiuld look up windbg apply dbp command ro get a n understanding
    – blabb
    Aug 17, 2016 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.