OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Topic created on: October 30, 2012 02:58 CDT by dewew .

How I can make my ollydbg or immunity debugger to stop at calling system dlls?

waleedassar		October 30, 2012 15:01.26 CDT
Options --> Debugging Options ---> Events ---> Break on new module (DLL). This causes OllyDbg to pause at the point the "ZwMapViewOfSection" function has just returned. If you want to break at the "DllMain" function of a system DLL, instruct OllyDbg to pause at "System Breakpoint", select ntdll.dll from executable modules table (ALT+E), and then CTRL+S to search for the following sequence of instructions. push [ebp+0x14] push [ebp+0x10] push [ebp+0xC] call [ebp+0x8] Place a breakpoint on the call [ebp+0x8] instruction. Each time the breakpoint is hit, inspect the stack to see if it is the system dll you are expecting. I am not sure if Immunity has a built-in command for that. In Windbg, it is much easier.

Note: Registration is required to post to the forums.

There are 31,327 total registered users.

Imagery

SoySauce Blueprint
Jun 6, 2008