This is the most common breakpoint and you can easily set this breakpoint by double-clicking on the hex representation of an assembly line in the CPU window in OllyDbg. After this, you can see a red highlight over the address of this instruction, as shown in the following screenshot:
Well, this is what you see through the debugger's UI, but what you don't see is that the first byte of this instruction (0xB8 in this case) has been modified to 0xCC (INT3 instruction), which stops the execution once the processor reaches it and returns back to the debugger.
Once the debugger returns back on this INT3 breakpoint, it replaces the 0xCC back to 0xB8 and executes this instruction normally.
The problem of this breakpoint is that, if malware tries to read or modify the bytes of this instruction, it will read the first byte as 0xCC instead of 0xB8, which can break some code or detect the presence of the debugger (which we will cover in...
