2

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the starting address of the new thread and later it called CreateRemoteThread() API and Ollydbg switchs to 002E0000 (dwCreationFlags was set to 0 , so the new thread started immediately)

Now, my question: When I try to set a BP on one of the virtual addresses of the new thread, I get the following error message.

enter image description here

I also tried on Hardware BPs but it did not help. Why I can not set the BP ? In the main thread, everything was ok. How can I bypass this to analyze the new thread with all the BP setting features of Ollydbg ? Note: I am using Ollydbg v1.10

best regards,

2

Why I can not set the BP ?

The warning message in the screenshot is telling you that you can set the BP.

  • yes, but when I set the BP and make one step (F7 or F9 or let it run), I never hit the BP and the process terminates itself. Sry, I should add this to my post. – user3097712 May 22 '15 at 15:33
  • Are you sure the code is being injected into the current process? Or is it being injected into a different process? – Jason Geffner May 22 '15 at 15:57
  • I have a call to GetCurrentProcess() in the previous lines – user3097712 May 22 '15 at 16:04
  • 2
    Please create a new question then regarding the BP not being hit, since it's very different than your current question about not being able to set a BP. – Jason Geffner May 22 '15 at 16:07
  • I think I've solved the problem. There was an anti-debug mechanism between the current line and the BP. A typical "BeingDebugged" - trick. – user3097712 May 25 '15 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.