Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

Conditional Memory Breakpoint

Support forums for OllyDbg 32-bit Assembler-Level Debugger.
Developed by Oleh Yuschuk (http://www.ollydbg.de)
Locked
Cinolt

Conditional Memory Breakpoint

Post by Cinolt »

I set up a breakpoint in the Hex Dump to see when an instruction accesses a part of the hex dump. However, there's a function in the program that gets called constantly and triggers the breakpoint. However since it constantly triggers it, I can't do anything else within the program. How can I make it so certain instructions never trigger a breakpoint?
User avatar
Kayaker
Posts: 4179
Joined: Thu Oct 26, 2000 11:00 am

Post by Kayaker »

What about setting a regular conditional BP on the function instruction, rather than using a memory breakpoint? You should be able to exclude certain conditions by using the != operator. i.e. if you often find that eax==10 when the BP is hit, then add the negative condition "IF EAX != 10", etc.

Or check the flags, maybe sometimes ZF==0 when the BP is hit, maybe sometimes it's ZF==1. Set one negative condition "IF ZF != 0" and you'll only get half the breakpoint hits. That kind of thing. You'll need to be inventive.

The new 2.x version reportedly supports conditional *memory* breakpoints, you might want to try that instead. Then you could set up the same kind of negative conditional for an instruction address (IF EIP != ?) but from a memory BP perspective instead. Maybe that's more what you had in mind.

Kayaker
Cinolt

Post by Cinolt »

Thanks for your reply. A conditional memory breakpoint sounds like just what I need. But I'm using OllyDbg 2.0 and I can't seem to find it. I right-click an address in the Hex Dump and choose Breakpoint -> Memory... but there's no entry for the condition.
Locked