2

Is there a way/plugin to make Olly act as a non invasive debugger. Non invasive debuggers don't use the Windows Debug API. Instead, they work by only reading and writing to the target's address space. For instance, WinDbg have this noninvasive mode (/pv) and there's a open source (but unfortunately crude) non invasive debugger called Obsidian.

PS: The problem I am trying to solve is the following: I want to debug a program (let's call it Y) that can only be launched by a parent program (let's say X). But X act as a debugger of Y (preventing Olly from attaching to Y). Moreover, X has some anti debugging techniques. Even after putting a breakpoint on CreateProcessW and DebugActiveProcess (which are AFAIK the only two functions capable of making X debug Y) on X's address space, nothing happens --- ie, they seem to be never called.

A non invasive debugger would allow me to debug Y directly.

1 Answer 1

1

No. Ollydbg is an invasive debugger. It uses the Windows Debugging API. Debugging the target with WinDBG seems to be the best way in your case.

Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.