2

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the starting address of the new thread and later it called CreateRemoteThread() API and Ollydbg switchs to 002E0000 (dwCreationFlags was set to 0 , so the new thread started immediately)

Now, my question: When I try to set a BP on one of the virtual addresses of the new thread, I get the following error message.

enter image description here

I also tried on Hardware BPs but it did not help. Why I can not set the BP ? In the main thread, everything was ok. How can I bypass this to analyze the new thread with all the BP setting features of Ollydbg ? Note: I am using Ollydbg v1.10

best regards,

Improve this question

1 Answer 1

Reset to default
2

Why I can not set the BP ?

The warning message in the screenshot is telling you that you can set the BP.

Improve this answer
5
  • yes, but when I set the BP and make one step (F7 or F9 or let it run), I never hit the BP and the process terminates itself. Sry, I should add this to my post.
    – user3097712
    May 22, 2015 at 15:33
  • Are you sure the code is being injected into the current process? Or is it being injected into a different process?
    – Jason Geffner
    May 22, 2015 at 15:57
  • I have a call to GetCurrentProcess() in the previous lines
    – user3097712
    May 22, 2015 at 16:04
  • 2
    Please create a new question then regarding the BP not being hit, since it's very different than your current question about not being able to set a BP.
    – Jason Geffner
    May 22, 2015 at 16:07
  • I think I've solved the problem. There was an anti-debug mechanism between the current line and the BP. A typical "BeingDebugged" - trick.
    – user3097712
    May 25, 2015 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.