Questions about debugging

[magicanoo]

Hello,

I'm trying to learn C++ and assembly basics,in addition,I've been playing around with Ollydbg and faced some problems:
-Can't search all constants when i'm attaching to the process(sometimes)
Error message: "unable to read memory of debugged process XXXX-XXXX"

-problem in breakpoints: for example I set breakpoints on 15 commands..1 by 1..It passes the first 10 commands without pausing,but when after it pauses in the 11th command,it pauses again in the previous commands which confuses me which ones are the related offsets.

-Is there a more distinct way to figure the offsets for a certain function instead of setting a breakpoint on every search result?some search results"only PUSH" are over 100 results.

-Am I doing it right?search for all constants -> hexadecimal XX->set breakpoint on each push+mov commands and hit start?because sometimes the application bugs after changes made in the assembler and it won't run again.

I apologize if my questions weren't accurate enough to be understood.

[Schickl]

Originally Posted by magicanoo

-problem in breakpoints: for example I set breakpoints on 15 commands..1 by 1..It passes the first 10 commands without pausing,but when after it pauses in the 11th command,it pauses again in the previous commands which confuses me which ones are the related offsets.

If it doesn't pause there, the commands were not executed.
There might be a JMP command somewhere.
INT3 Breakpoints only work on code that is executed, if you want to pause at points where the process accesses specific memory regions you will have to use Memory/Hardware breakpoints(the number of hardware breakpoints is very limited)

-Is there a more distinct way to figure the offsets for a certain function instead of setting a breakpoint on every search result?some search results"only PUSH" are over 100 results.

Don't really know what you mean

-Am I doing it right?search for all constants -> hexadecimal XX->set breakpoint on each push+mov commands and hit start?because sometimes the application bugs after changes made in the assembler and it won't run again.

Normally INT3 breakpoints shouldn't make any troubles
BUT code can be dynamic and if you set a breakpoint there and the code is modified afterwards the breakpoint is lost(obviously) and olly will tell you so

[magicanoo]

Originally Posted by Schickl

Don't really know what you mean

For example,I want to know which commands were executed without setting breakpoints,e.g. in 15seconds or until i stop it manually..Is it possible?

[Schickl]

Originally Posted by magicanoo

For example,I want to know which commands were executed without setting breakpoints,e.g. in 15seconds or until i stop it manually..Is it possible?

I doubt it
And even if it would be possible you would get a lot(and i mean it) of commands
You wouldn't want to go through

There's one thing you can do, which is a bit similar to what you need
It's a run trace
If you enable this olly will just go through every command
That's painfully slow!

Just make a breakpoint and fight your way through everything