0

I'd like to use Ollydbg2 to debug FLTLDR.EXE, which is spawned when my document is opened in Microsoft Word. I can't run FLTLDR.EXE manually I don't think, it seems to need to be run or hosted by Word. I have ticked the "Debug child processes" in Olly and tried to debug Word, but an exception is raised before I can even open the document.

Any ideas?

Many thanks

user7427917
  • 9
  • 3

1 Answers1

0

For this you have to create a registry key to tell the OS that you want your app, FLTLDR.EXE, to be started with a debugger attached to it.

Follow the steps in the link: https://msdn.microsoft.com/en-us/library/a329t4ed(v=vs.100).aspx

After setting the registry key just launch Word application. The execution of FLTLDR.EXE causes the ollydbg to start automatically. From this point you can continue debugging.

side note: receiving exceptions while attaching to some application with the debugger is normal. Most of the time Shift+F9 solves the problem and you can continue but if it's happening several times on a same address you can save the exception address and then Shift+F9...

EWD-0-
  • 113
  • 9