All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
0answers
75 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
-1
votes
1answer
162 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
1
vote
1answer
235 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
3
votes
1answer
2k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
2
votes
1answer
981 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
1
vote
1answer
1k views

how do I bypass ZwQueryInformationProcess as anti-debugging protection

How do I defeat the ZwQueryInformationProcess() anti-debugging protection for the ProcessDebugPort class? Unlike isDebuggerPresent() I found this really hard to bypass in my skill... Does anyone ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
2
votes
0answers
217 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
1
vote
2answers
621 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
2
votes
1answer
2k views

Conflict of OllyDbg plugins

I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg. As I have only a very basic idea of how plugins work, I ...
2
votes
0answers
199 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
1
vote
3answers
417 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
9
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
0
votes
1answer
86 views

Where is the code for ollytlscatch?

I've been trying to get antiResHacker.exe as mentioned in this question: How to prevent use of Resource editors However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
2
votes
2answers
8k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
5
votes
1answer
2k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
4
votes
1answer
626 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
1
vote
1answer
4k views

How to prevent application from killing OllyDbg

I want to run an OllyDbg and attach it to some starting later process. But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
12
votes
5answers
24k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
1
vote
1answer
2k views

How can I tell if an app is using anti-debug techniques? [closed]

How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
1
vote
1answer
547 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...