Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Attached process paused at ntdll.DbgBreakPoint

Topic created on: August 3, 2011 08:43 CDT by Parre .

Hi

I have some trouble with debugging a certain online 3d game due to what seems like some debugging-protection. I have searched the net for anything that has to do with it but can't find any solution.

What happens is that when i attach Olly to the process it stop at ntdll.DbgBreakPoint.
I have to attach Olly to the process and can not start the game from within Olly due to the game needing a few extra start-parameters in the shortcut. Another problem is that the game will only run for about 10 seconds while it is looking for a server. After that i have to restart it again. This adds to the problem because i have to be able to bypass the anti-debugging protection every time i run it. Maybe i can just bypass it directly in ntdll.dll?

I am pretty new to this and very confused inb what is really happening. This is something i can not solve on my own. Any ideas?

Regards
Parre

  livedontexist   August 4, 2011 01:12.27 CDT
If you want to pass arguments to Olly look at the File - Set New arguments menu in Olly 2.01. There probably is something similar even in the older version of Olly....although I haven't checked that out.

Cheers
Arvind

  Parre     August 4, 2011 08:33.50 CDT
> livedontexist: If you want to pass arguments to Olly look at the File - Set New arguments menu in Olly 2.01. There probably is something similar even in the older version of Olly....although I haven\'t checked that out.
>
> Cheers
> Arvind

Thank you! That made it all a whole lot easier.
I can now load the exe into Olly and run it but it doesn't break on any of my breakpoints. I assume this is what the ntdll anti-debugging feature does. Any ideas how to bypass it?

  livedontexist   August 4, 2011 12:21.27 CDT
I'm quite new to this but what if you say put an instruction on the very next instruction after the Entry point? Are you saying it wouldn't break even there?

The point is...maybe those breakpoints aren't being reached at all. Just guessing :)

  Parre     August 6, 2011 19:14.37 CDT
> livedontexist: I\'m quite new to this but what if you say put an instruction on the very next instruction after the Entry point? Are you saying it wouldn\'t break even there?
>
> The point is...maybe those breakpoints aren\'t being reached at all. Just guessing :)

Tried some and it breaks on some breakpoints which makes it even harder to figure out. I found a plugin called Ollysockettrace which sets breakpoints on everytinh ghtat has to do with sockets. It should solve my problem but Olly just doesn't break. I can see the red bars scrolling in the Olly but it jumps straight over all of them. Any ideas?

Edit: It does break at RtlRaiseException every time i run it though.

Note: Registration is required to post to the forums.

There are 31,314 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit