|
Sometimes Olly just fail to debug a program, (exceptions and terminated)
I think it has to do with some exceptiontrick, a way to detect if the program is being debugged.
There are some plugins for olly, letting olly being undetected by the program. Keep up-to-date with those plugins. I know two.
-IsDebuggerPresent
-UnhandledExceptionFilter
Ofcause new programs, will eventuelly at some time have been packed by new packers (which programs like PEid dont recognise), and with new Antidebugger-trick.
In this case, I usually have multiple programs, (debuggers, disassemblers, resource hackers, etc..)
But in the end, it's about being able to debug/disassemble, so you must know how to defeat antidebugger tricks and learn how they work. But if you're a beginner, I usually just move on until somebody makes a tut about it :)
... Just what I would do in my case :)
|