What happens when OllyDbg restores hit trace?
Hit trace can be saved between the sessions. If code is self-modifiable, use this option with care. When OllyDbg restores hit trace, it sets INT3 breakpoint on every marked command. This may lead to crash of the debugged application.
What does odbg2 _ pluginnotify ( ) do in OllyDbg?
ODBG2_Pluginnotify() is extended and can force different mode of execution than requested by user. If necessary, plugin may create one or several options pages in a new Plugins options dialog, which is very similar to the Options. Pluginshowoptions() directly opens plugin-related options page.
Is there a sample code for ollydbg.dll?
There is a new sample plugin, traceapi.dll, that demonstrates new features. It uses one-time memory breakpoints to detect all calls from the user code to the Windows API and protocols the arguments and values returned by APIs. Sample code does not include the Visual Studio project for traceapi.
How to set breakpoints in OllyDbg when active?
When active, it requests OllyDbg to set breakpoints on KERNEL32.UnhandledExceptionFilter(), NTDLL.KiUserExceptionDispatcher(), NTDLL.ZwContinue()and NTDLL.NtQueryInformationProcess(). For example, if CPU is in the exception handler and you set hardware breakpoint, it won’t hit!
What does odbg2 _ pluginexception ( ) do in OllyDbg?
If they receive exception notification, ODBG2_Pluginexception() may request to pause application or step over this exception. ODBG2_Pluginnotify() is extended and can force different mode of execution than requested by user.
Why does OllyDbg set temporary INT3 break on zwcontinue?
Therefore OllyDbg sets temporary INT3 break on ZwContinue()and applies changes to the copy of the context in memory. But sometimes it simply doesn’t know that temporary breakpoint is necessary. If process is being debugged, Windows don’t call the unhandled exception filter. Instead, it notifies debugger.