I set up a breakpoint in the Hex Dump to see when an instruction accesses a part of the hex dump. However, there's a function in the program that gets called constantly and triggers the breakpoint. However since it constantly triggers it, I can't do anything else within the program. How can I make it so certain instructions never trigger a breakpoint?

What about setting a regular conditional BP on the function instruction, rather than using a memory breakpoint? You should be able to exclude certain conditions by using the != operator. i.e. if you often find that eax==10 when the BP is hit, then add the negative condition "IF EAX != 10", etc.

Or check the flags, maybe sometimes ZF==0 when the BP is hit, maybe sometimes it's ZF==1. Set one negative condition "IF ZF != 0" and you'll only get half the breakpoint hits. That kind of thing. You'll need to be inventive.

The new 2.x version reportedly supports conditional *memory* breakpoints, you might want to try that instead. Then you could set up the same kind of negative conditional for an instruction address (IF EIP != ?) but from a memory BP perspective instead. Maybe that's more what you had in mind.

Kayaker

Thanks for your reply. A conditional memory breakpoint sounds like just what I need. But I'm using OllyDbg 2.0 and I can't seem to find it. I right-click an address in the Hex Dump and choose Breakpoint -> Memory... but there's no entry for the condition.