Search code examples
debuggingollydbg

Ollydbg condition

I need Ollydbg to pause when one of the registers contains a certain string. Any way I could accomplish that?

Solution

  • I dont understand you clearly. You cant load strings in a register at all :) You can set a breakpoint on the loading data. for example -> your value "Have a nice day!", set a BP on this adress. Olly will break everytime the string is loaded. Else I cant understand your question.

    But still here a little tutorial.

    First I loaded my pe file and found a string "GAMMA" its a configuration creation programm for a onlinegame.

    http://img7.imagebanana.com/img/hu6kg56k/findstr.png

    Now lets find it in the Dump. Doubleclick on "GAMMA" in the references, now we are it the disasm window, doubleclick the PUSH or follow in dump section and goto string expression. Select Your string and set a hardwarebp like below.

    http://img7.imagebanana.com/img/pejyx72i/bp.png

    Hit F9 or the play button at the top of Olly and we break at the first point where our string is loaded. Sure if you want to find a specific place you have to step and step again until you find your point.

    http://img6.imagebanana.com/img/f7w15fr6/hwbp1.png

    EDIT:

    You may trace the code with F7 to see when the string is called from the stack.