Keeps current status of the debugged application. Most of the fields in this structure are for internal use by OllyDbg. Never modify them directly, or this may destabilize the debugging engine
typedef struct t_run { // Run status of debugged application
t_status status; // Operation mode, one of STAT_xxx
ulong threadid; // ID of single running thread, 0 if all
ulong tpausing; // Tick count when pausing was requested
int wakestep; // 0: wait, 1: waked, 2: warned
ulong eip; // EIP at last debugging event
ulong ecx; // ECX at last debugging event
ulong restoreint3addr; // Address of temporarily removed INT3
ulong stepoverdest; // Destination of STAT_STEPOVER
int updatebppage; // Update temporarily removed bppage's
DEBUG_EVENT de; // Information from WaitForDebugEvent()
int indebugevent; // Paused on event, threads suspended
int netevent; // Event is from .NET debugger
int isappexception; // Exception in application, AE_xxx
ulong lastexception; // Last exception in application or 0
int suspended; // Suspension counter
int suspendonpause; // Whether first suspension on pause
int updatedebugreg; // 1: set, -1: reset HW breakpoints
int dregmodified; // Debug regs modified by application
} t_run;
Members:
status
One of the constants of type STAT_xxx,
current status of the debugged application. Status is controlled by the
debugging engine. If you really need to modify it, call Setstatus()
threadid
If in the single-thread mode (run trace, stepping, etc.), the identifier of the thread; otherwise, 0
tpausing
Value returned by GetTickCount() when pausing (status=STAT_PAUSING) was requested, used to timeout this request and undertake additional actions
wakestep
Used together with tpausing to wake up sleeping application
eip
Value of register EIP at the moment when last exception was continued, used together with ecx to step over the command in the case that there are several breakpoints of different kind (INT3, hardware and/or memory) set on the same location
ecx
Value of register ECX at the moment when last exception was continued, used together with eip to step over the command in the case that there are several breakpoints of different kind (INT3, hardware and/or memory) set on the same location
restoreint3addr
Address of the temporarily removed INT3 breakpoint
stepoverdest
Destination of the step over, or 0 if any destination is allowed (like conditional jump)
updatebppage
Request to update temporarily restored memory attributes of the memory pages containing memory breakpoints
de
Structure of type DEBUG_EVENT, description of the pending debug event. In general, valid only if status is STAT_PAUSED or STAT_FINISHED
indebugevent
Application is paused on debug event, therefore Suspendallthreads() does not need to call SuspendThread()
netevent
Indicator of event reported by .NET debugging API
isappexception
One of the constants AE_xxx,
describing exception that occured in the application and was not caused
by the OllyDbg (like INT3 or memory breakpoint). Only application
exception of type AE_APP can be passed to the application
lastexception
Code of the last reported exception
suspended
Suspension counter. If this counter is not 0, application was already suspended. Suspendallthreads() just increases the counter and does not call SuspendThread() again
suspendonpause
Used by Suspendallthreads()
updatedebugreg
-1: request to remove, 1: set hardware breakpoints on request to continue execution of the paused application
dregmodified
Indicates that hardware breakpoints were modified by the debugged application