![]() |
different DLLs have same udd name in OllyDbg
There are 2 DLLs which have same names but have different paths.
OllyDbg will put only one udd file for these DLLs in its udd folder. If I first set some breakpoints on one DLL, then I set some breakpoints on the other, conflicts will occur. When I'm back with the first DLL, the beakpoints set before all disapear. Anyone knows how to solve this problem? Thank you. |
I haven't encountered such a software before. I don't know the actual solution, but I really also wonder it.
BTW if it isn't necessary to analyze both of them simultaneously, you can do it one by one. |
1 Attachment(s)
Try use the DLLLoader01 tool developed by Mr.eXodia in attached for this two dll files and attach the process in olly, it's only an idea.
Regards |
That is really strange, because the file paths (in this case the dll) and the respective sizes are stored in the udd.
Normally Olly appends "_x" where x is a number to a new file with different path. Example with MyDll.dll from 2 different paths, you should find in the UDD-Directory MyDll.udd and MyDll_1.udd. Here is a suggestion: Check the option "Backup old .udd files" under the Menu Options->Appearance->Directories Restart Olly and run two sections with each of the dlls. After that there should be at least one MyDll.udd and another MyDll.bak in your current situation. Open these two files in a HexEditor and check from Offset 62 (decimal) for their paths and size. Regards |
Quote:
when I'm done with the 2nd one and back to the 1st one, the breakpoints dispear for they are actually breakpoints set for the 2nd dll and thus be disabled by OllyDbg. |
Quote:
but, OllyDbg seems not able to switch between them correctly. Is there any settings that can force OllyDbg to create both MyDll.udd and MyDll_1.udd? Or will you please send me a copy of OlldyDbg used by yourself? Thank you. |
1 Attachment(s)
Hi
Do you have this PLUGIN? "Break Point Manager", you can save your breakpoints for the first dll file and use for the second dll fie, only for suggestion uncheck in the path dirctories the "backcup old .udd files". To use this plugin you need set it for your olly changing "OLLYDBG.EXE" for the name of your olly(executable) in any hexeditor ok? Regards |
The first recommended u use LCB Plugin to save your bps. The best plugin.
when you load a file into ollydbg(also so load import library from mainmodule), but imagebase maybe changes on the next loading one's library. OllyDbg have been stored info of Breakpoint by address(VA) which isn't valid with new imagebase. |
a plus 1 for the LCB plugin, it works good for this.
You can also run a second copy of olly and share some of the same paths (plugins scripts symbols) except for the udd folder. This might be better if you are trying to do debug both at the same time. |
| All times are GMT +8. The time now is 14:28. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX