Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

program runs when loading

Found a bug in OllyDbg? Post a report here.
Locked
alan

program runs when loading

Post by alan »

When I load some programs into olly the program runs strait away and olly doesnt show the code until the program is exeted. It previously was OK can anyone tell me whas wrong.
Thank you
evlncrn8
Posts: 456
Joined: Mon Apr 22, 2002 12:38 pm

Post by evlncrn8 »

tls callbacks?
naides
Posts: 1655
Joined: Sat Jan 12, 2002 12:00 pm
Location: Planet Earth

Post by naides »

Or the brunt of the program happens on a .dll and is started from the .dll entrypoint, when it gets loaded by the .exe and leaves Olly holding the bag while the ".dll" returns, which only happpens when the meat of the program is done. . .

Change Olly settings to break on module load, and see if this is the case. . .
blabberer
Senior Member
Posts: 1535
Joined: Wed Dec 08, 2004 11:12 am

Post by blabberer »


"Anti" OllyDbg:

LoaderFlags and NumberOfRvaAndSizes were modified.. I have Reverse Engineered OllyDBG and Soft ICE to find a few tricks that could slow down the analysis of a binary. With those two modifications, Olly will pretend that the binary isn't a good image and will eventually run the application without breaking at its entry point. This could be a bad thing if you wanted to debug a malware on your computer, because you would get infected.
http://www.honeynet.org/scans/scan33/nico/index.html

may be some thing like this

or may be not but still some other problems like odd imagebase

showpost.php?p=42918&postcount=26
drizz
Member
Posts: 40
Joined: Tue Nov 18, 2003 7:05 pm
Location: .hr

Post by drizz »

Or maybe it's just .Net App? Use PEBrowseDbg.
Locked