PDA

View Full Version : DLL break on load


pistol pete
August 26th, 2003, 21:01
I'm having trouble having ollydbg break on dll load. I'm debugging an app that uses loadlibrary to dynamically load a dll. When I set the option in ollydbg to break on a dll load it does so, however, when I then proceed to set a breakpoint on a function inside the dll the function isn't executed upon resuming the program running, it appears it has already been executed because the app functions as normal (yes, I'm positive the function I'm setting a breakpoint on is called normally). Any ideas?

I'm testing on Win XP Pro + SP1, P4 2.8GHZ

Teerayoot
August 26th, 2003, 21:42
Press F2 then Press F9 ,It's work well for me.I guest this is another Ollydbg buggys.

Teerayoot
September 10th, 2003, 22:31
SOryy F12 not F2 .

Anonymous
September 10th, 2003, 23:34
I use this approach to set bp in DLL EP. This is very useful if DLL is packed.
I have to say that this is short explanation with regard to my PC environment (XP SP1) and Olly.
Before you have to find EP of DLL (peid,lordpe,...)
After set BP in module ntdll offset 925d
My PC:
77f59e5d 33c0 XOR EAX,EAX --offset 925d
77f59e5f 81ff03000040 CMP EDI,40000003
........
If you land here press ALT-E and check if your dll is in LIST. In this point
Dll is in memory without jumping to EP.
If yes go to the EP and put BP there and remove BP in ntdll (your will)
Remember your address of ntdll offset (note down to sticky) and next you can
put BP on other cases

Bye