t_run

Keeps current status of the debugged application. Most of the fields in this structure are for internal use by OllyDbg. Never modify them directly, or this may destabilize the debugging engine

typedef struct t_run {                 // Run status of debugged application
  t_status       status;               // Operation mode, one of STAT_xxx
  ulong          threadid;             // ID of single running thread, 0 if all
  ulong          tpausing;             // Tick count when pausing was requested
  int            wakestep;             // 0: wait, 1: waked, 2: warned
  ulong          eip;                  // EIP at last debugging event
  ulong          ecx;                  // ECX at last debugging event
  ulong          restoreint3addr;      // Address of temporarily removed INT3
  ulong          stepoverdest;         // Destination of STAT_STEPOVER
  int            updatebppage;         // Update temporarily removed bppage's
  DEBUG_EVENT    de;                   // Information from WaitForDebugEvent()
  int            indebugevent;         // Paused on event, threads suspended
  int            netevent;             // Event is from .NET debugger
  int            isappexception;       // Exception in application, AE_xxx
  ulong          lastexception;        // Last exception in application or 0
  int            suspended;            // Suspension counter
  int            suspendonpause;       // Whether first suspension on pause
  int            updatedebugreg;       // 1: set, -1: reset HW breakpoints
  int            dregmodified;         // Debug regs modified by application
} t_run;


Members:

status

One of the constants of type STAT_xxx, current status of the debugged application. Status is controlled by the debugging engine. If you really need to modify it, call Setstatus()

threadid

If in the single-thread mode (run trace, stepping, etc.), the identifier of the thread; otherwise, 0

tpausing

Value returned by GetTickCount() when pausing (status=STAT_PAUSING) was requested, used to timeout this request and undertake additional actions

wakestep

Used together with tpausing to wake up sleeping application

eip

Value of register EIP at the moment when last exception was continued, used together with ecx to step over the command in the case that there are several breakpoints of different kind (INT3, hardware and/or memory) set on the same location

ecx

Value of register ECX at the moment when last exception was continued, used together with eip to step over the command in the case that there are several breakpoints of different kind (INT3, hardware and/or memory) set on the same location

restoreint3addr

Address of the temporarily removed INT3 breakpoint

stepoverdest

Destination of the step over, or 0 if any destination is allowed (like conditional jump)

updatebppage

Request to update temporarily restored memory attributes of the memory pages containing memory breakpoints

de

Structure of type DEBUG_EVENT, description of the pending debug event. In general, valid only if status is STAT_PAUSED or STAT_FINISHED

indebugevent

Application is paused on debug event, therefore Suspendallthreads() does not need to call SuspendThread()

netevent

Indicator of event reported by .NET debugging API

isappexception

One of the constants AE_xxx, describing exception that occured in the application and was not caused by the OllyDbg (like INT3 or memory breakpoint). Only application exception of type AE_APP can be passed to the application

lastexception

Code of the last reported exception

suspended

Suspension counter. If this counter is not 0, application was already suspended. Suspendallthreads() just increases the counter and does not call SuspendThread() again

suspendonpause

Used by Suspendallthreads()

updatedebugreg

-1: request to remove, 1: set hardware breakpoints on request to continue execution of the paused application

dregmodified

Indicates that hardware breakpoints were modified by the debugged application