Jump back to the caller

Question

I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.

1. I load the exe from file menu with input arguments
2. Set breakpoint on msvcr71.printf function

After this two initial steps, when I hit F9 the app show some messages generated with printf function depending from the input arguments(by now i'm testing wrong password which shows the app messages about wrong password). So now I need to jump to the code which hold the logic, the code that made the call to printf, by checking if the pass was good or bad. How this can be done, when I have set breakpoint?

Thanks

Answer 1

Here is a way how you would go back to the caller. The following is a small C++ crackme for demonstration

#include<stdio.h>
#include<string.h>
#include<conio.h>

int main()
{
    char code[50];
    char valid[]="12345";
    printf("Enter your password : \n");
    gets(code);
    if(!strcmp(code,valid))
        printf("That's it!!!\n");
    else
        printf("Try again!!!\n");
    getch();    
    return 0;
}

---

Step 1

Now as usual you load the app in OllyDBG. Now assume that we do not know anything the inner logic of the crackme. So lets put a breakpoint on the functions which prints on the console. So the best bet is to search for all intermodular calls.

---

Step 2

So you see it calls puts .This function is used to display a string on the console and is called from 3 places. So lets place a breakpoint on the function itself so that we can know from where it is called.

Now the function is defined at VA 0x75898D04 . So put a breakpoint over there.

---

Step 3

Now run the app by pressing F9 till breakpoint is hit.

Now look at the stack at the bottom right it shows the place from where puts would return after executing as well as the parameters passed to this function.

Since this parameter passed is the string asking for password we can skip it until we get to the badboy message string. So continue pressing F9 until you get to the point where the parameter passed is the badboy message. (The console meanwhile asks for the password and write something there)

So we run till here.

---

Step 4

puts would return to VA 0x401C66 and the parameter passed is the badboy message. So lets go to 0x401C66. Press Ctrl+G in the CPU window to go there. You can also press Enter directly on the return address shown on the stack.

So we land here.

---

Step 5

Just above the puts call there is a strcmp call checking our entered serial with a hardcoded value. If you explore a little you can see that the hardcoded value is 12345

(You may set a breakpoint on the strcmp call and restart the target to see what is being compared to whom)

So that's the serial which would skip the badboy message and land us to the goodboy message.

I am not suggesting the Ctrl+F9 method because you may sometimes encounter function which never returns. Such functions are specifically coded to obfuscate and thwart static and dynamic analysis. However in other cases Ctrl+F9 method is pretty good.

Answer 2

Once your breakpoint on printf() is hit, press Ctrl+F9 to tell OllyDbg to run until the end of the printf() function, then press F7 to single-step the return instruction back to the caller.

Answer 3

Both of Your ScreenShots are irrelevent the app has terminated in first screenshot and it is in some random ZwMapSection in second screenshot

you posted you set a bp on printf was the breakpoint hit ? if it was hit then you can look at the call stack using ctrl+k ollydbg will show you who called printf

your screenshots do not show if you had hit the break and if you are suspended in call to printf as Jason posted in his comment

also with ollydbg you can use runtrace feature to trace the complete path that can help you isolate the logic have you tried using it