Results 1 to 6 of 6

Thread: Conditional Break?

  1. #1
    RITZ
    Guest

    Run trace condition?

    I need to pause execution when any register contains a specific value. I'd also like to know if it's possible to pause when a specific string of data is written to the stack.
    Last edited by RITZ; June 27th, 2006 at 15:54.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    OllyDbg help file -> Breakpoints -> Conditional Breakpoint

    In other words, RTFM.

  3. #3
    RITZ
    Guest
    Forums like this exist for people to share information they got from the manual. Don't abuse the RTFM acronym.

    My question regarding the register condition is if I can specify any and all registers. I was not able to find that in the help file. Hence why I made the post...
    Last edited by RITZ; June 27th, 2006 at 21:31.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    Conditional BPs can be easy.

    This is thanks to the program made by L. Spiro, his program can be found at this link: http://www.memoryhacking.com

    The debugger is in the tools menu, there is a 'conditions' button, if you click that button it will bring up the conditions editor.
    Last edited by Aquatic; June 27th, 2006 at 21:54.

  5. #5
    Super Moderator
    Join Date
    Dec 2004
    Posts
    1,529
    Blog Entries
    15
    need to pause execution when any register contains a specific value
    ? you want ollydbg to stop if eax or ecx or edx or esp or ###
    contains lets says 12345678 ??

    give it a condition like

    ECX == 0x12ffb0 || EBP== 0x12ffb0 || REG == same constant || another reg == Same Constant

    i would have liked it easier like specifiying r32 == SOME CONST

    but ollydbg wont like genreal specification
    Log data, item 301
    Address=00401031
    Message=Conditional breakpoint at win.00401031: Undefined registers not allowed in expression


    as to string in stack you can check it with some thing like

    string [[esp+0x60]]

    it will stop if there is a string in starting at specified address

    Log data, item 22
    Address=0040103E
    Message=Conditional breakpoint at win.0040103E: "D:\Borland\odbg110\win.exe"

  6. #6
    RITZ
    Guest
    About the registers thing, that's what I was wondering. If you could specify all registers with one token or if you had to specify them all in manually.

    About the string in stack. Thanks, that's perfect.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Conditional BP
    By REAP in forum OllyDbg Support Forums
    Replies: 2
    Last Post: November 8th, 2013, 23:40
  2. Conditional Memory Breakpoint
    By Cinolt in forum OllyDbg Support Forums
    Replies: 2
    Last Post: September 16th, 2010, 05:14
  3. Conditional BPs in WinDbg
    By omega_red in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: November 16th, 2005, 03:28
  4. Conditional breakpoints?
    By Anonymous in forum OllyDbg Support Forums
    Replies: 2
    Last Post: August 13th, 2003, 13:21
  5. Conditional Breakpoint
    By Anonymous in forum OllyDbg Support Forums
    Replies: 5
    Last Post: January 27th, 2003, 11:06

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •