Breaking DLL with OLLY

[deXep]

Maybe u need loaddll.exe, download it from ollydbg homepage

I edited my post but the edit hasn't shown up and at the bottom it says:

Last edited by Wackyass : 09-29-2004 at 22:43. Reason: Forget to mention I tried LoadDLL

I already used that which is how I unpacked neolite in no time but the rest of the custom packing can not be unpacked further unless it is getting certain data from the host process. Which means that I need to halt operation and step through while running which was easy with Softice on bpint 3 but I don't know how to go about it other than what I have already tried.

Wackyass

Ok I would suggest you uninstall and install the program again to start over fresh. You can use the option in olly: options-> debugging options -> events -> and set Break on new module (DLL). Once you break on the dll, alt+e and double click on it. Right click on the entry point and select new origin here. Then start your unpacking or whatever.

Ok, after doing some more investigating and older techniques I was able to break on int 03 by replacing the dll entry point to CC and unchecking the exception for int 03 in Olly. HOWEVER, I am unable to attach to the process since it is hung in memory and Olly shows this Yes/No dialog box:

-->
In order to perform action that is not supported by OS, OllyDbg has injected short piece of code into the debugged application, but received no response within 5 seconds. Do you want to wait for another 5 seconds? (If you answer No, the consistency and stability of program is not guaranteed and you should restart it as soon as possible).
-->


Any help from this point would be greatly appreciated.

Wackyass

[goggles99]

Sorry to bump an old thread, but I thought this may help someone else too.

I actually found this thread on Google while searching for this OllyDbg error. There isn't much out there on it but it is very annoying and makes setting breakpoints impossible (since OllyDbg keeps looping witht his error message).

In order to perform action that is not supported by OS, OllyDbg has injected short piece of code into the debugged application, but received no response within 5 seconds. Do you want to wait for another 5 seconds? (If you answer No, the consistency and stability of program is not guaranteed and you should restart it as soon as possible).

I found out that I got this error only when the "Decode registers for any IP" option was checked under Options -> Debugging Options -> Registers tab.

I havn't debugged OllyDbg yet to find out exactly what is causing this error.

Beware, I didn't check this option manually. I have found that a couple of settings seem to sometimes "activate" somehow once in a while.

Hope this is helpfull to someone else looking for help or at least something to keep in mind in case you ever encounter this problem...

[omidgl]

Use this option ---> Debugging Options > Events > Break on new module (DLL)

Regards
O M I D