PDA

View Full Version : Problems when trying to debug



titanium
04-04-2010, 09:26 AM
I recently moved to a 64 bit os (windows 7) and the first thing I noticed is that even though some 32 bit programs will disassemble correctly, some like cs:source will not.

Whenever I attempt to debug it, I get the following:

No prior disassembly possible
ntdll!DbgBreakPoint:
77be000c cc int 3
77be000d c3 ret
77be000e 90 nop
77be000f 90 nop
77be0010 8b4c2404 mov ecx,dword ptr [esp+4]
77be0014 f6410406 test byte ptr [ecx+4],6
77be0018 7405 je ntdll!DbgBreakPoint+0x13 (77be001f)
77be001a e8411d0100 call ntdll!ZwTestAlert (77bf1d60)
77be001f b801000000 mov eax,1
77be0024 c21000 ret 10h


Is there any fix or something I can do to be able to disassemble this specific game or do I have to go back to using a 32 bit OS?

Also I am aware of this thread ->http://forum.gamedeception.net/threads/19635-OllyDb-Cant-Debug-Game?highlight=cant+debug but I only get this issue on a 64 bit operating system and not in a 32 bit one. The file isn't packed by upx or any other packer either..

j1gs4w
04-04-2010, 11:45 PM
Give Olly Advanced a try (http://www.tuts4you.com/download.php?view.75), it has a featured called "x64 Compatibility-mode (single-step)"; i had some problems on my laptop (win7 64bit), and this took care of it.

titanium
04-07-2010, 02:25 AM
Sorry for the late reply I've been busy with other stuff.

I tried your suggestion but I got a kernelbase.dll error. I've tried to get around it by trying several compatibility modes and making sure the machine and my account have proper permissions but I was not able to get it to work. I tried searching on google for a fix but there wasn't any that seemed legit.
I installed windows xp on a different partition and to my surprise I also get the same error on that 32 bit machine now.

I'll try using that plugin you mentioned on 32 bit to see if it works there, I'll update this post with the results when I do it.

Guy
04-08-2010, 08:55 AM
What application are you using that you're having issues with?

j1gs4w
04-08-2010, 09:19 AM
What application are you using that you're having issues with?

since its in CSS section, i am assuming its CSS, tho this wont be the first post where its posted in the wrong section.

titanium
04-09-2010, 04:42 AM
Yes it is counter-strike: source, I referred to it as cs:source in the 1st post sorry for not posting the full name.

titanium
04-24-2010, 04:40 PM
Update: I noticed that now all the programs that I try to debug break on ntdll!DbgBreakPoint as well, not just CSS, also I noticed that whenever I pause, a new thread/process appears out of nowhere and instead of showing me the original disassembly (where the program's entry point is) it shows me the code of this new thread/process which happens to be the code where the ntdll stuff is located.

So is this some sort of windows bug that I should report or is it me that I did something wrong?