Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
0 votes
0 answers
78 views

How to get decryption keys from an offline player?

I am just starting to learn reverse engineering from lena lectures. I have 2 encrypted sample vids and an offline player which is able to decrypt the videos and play them, is there any way,I can get ...
No One In particular's user avatar
0 votes
1 answer
64 views

How to analyze changing sections before the entry point?

I am currently looking at a packed binary that modifies the .text and other sections on startup. The sections in question are empty when stored on disk (only a non-zero virtual size). Interestingly, ...
Bobface's user avatar
  • 101
3 votes
0 answers
271 views

How to see parameters in stack in x64dbg like in OllyDbg for known API calls?

Based on Detailed API call descriptions not available in x64dbg When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack: I've installed both ...
kuhi's user avatar
  • 161
3 votes
1 answer
196 views

Ida+Windbg alternative of Olly's "Back to user code" feature

I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating. It works fine under x32 windows server 2003. But what about nowadays?! ...
  tejinaji's user avatar
4 votes
0 answers
546 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
jinscoe123's user avatar
1 vote
1 answer
111 views

What is the output for this and how?

*(_BYTE *)(Key + Integer_count - 1) + 79 Here : Key = 0x22EC278 (dw 'Âx') or Stack[000015B8]:0019FC2C db 78h ; x Stack[000015B8]:0019FC2D db 0C2h ; Â Stack[000015B8]:0019FC2E db 2Eh ; . Stack[...
Satyam Singh's user avatar
2 votes
0 answers
84 views

The execution is not at AddressOfEntryPoint after patching .text section bytes

I have a shellcode and want to inject my shellcode into a PE file (a simple compiled c program that prints Hello World on the screen) . My shellcode size is 0x2a1 and the .text section of my PE file ...
Hossein Ahmadi's user avatar
2 votes
0 answers
74 views

Antidebug plugin for ollydbg 2.01

Can't find any working anti-antidebug plugin for olly 2.01. Maybe anyone can give me one?
izparika's user avatar
4 votes
0 answers
70 views

Mouse click breakpoint

Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated. I did as it is written in these threads: Thread ...
izparika's user avatar
2 votes
1 answer
150 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
i_am_learning's user avatar
3 votes
0 answers
73 views

Tracing without breakpoints

I need: To start tracing without breakpoints. To do something in a program. To stop tracing. This step may be replaced with a breakpoint but not the first step. The thing is I need to do some ...
oleedd's user avatar
  • 163
2 votes
0 answers
157 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
Vetal.lebed's user avatar
0 votes
1 answer
218 views

WinGraph32 for the OllyFlow plugin

I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says: Wingraph32 is not ...
appas's user avatar
  • 103
1 vote
1 answer
160 views

Ollydbg - How to find the code of the method OnChange of text field delphi?

I have an application programmed with delphi. I want to find the section of code of the function OnChange of a text field. How to find it on Ollydbg? Also, how can I set breakpoint on any window show ...
devlooper's user avatar
4 votes
2 answers
599 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
Lftbrito's user avatar
2 votes
0 answers
33 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
Nicholas Humphrey's user avatar
1 vote
1 answer
1k views

x64dbg is unable to find string references vs. Ollydbg

I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
Bob36180's user avatar
1 vote
1 answer
186 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
Aedries's user avatar
  • 11
1 vote
1 answer
125 views

Ollydbg - automatically add hardware breakpoint when step over

I put INT3 breakpoint and starting the program. The OllyDbg break at the breakpoint, but when I step over, the OllyDbg put a hardware breakpoint. (Yesterday not happened in OllyDbg, but today during ...
Jason's user avatar
  • 89
1 vote
0 answers
811 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
jamesluschen's user avatar
0 votes
1 answer
268 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
user37385's user avatar
1 vote
2 answers
327 views

OllyDbg - ReadFile API

I am learning reverse engineering (Lena's Reversing for Newbies) Part 2. I'm confused about ReadFile API. In Part 2, I created a blank Keyfile.dat near application (without a key in it). pBytesRead :...
Jason's user avatar
  • 89
1 vote
1 answer
148 views

Changing a label's text on window

I'm using OllyDbg v2 for debugging. Target is a simple executable file with few labels. It has been written in C++ builder. Looks like labels are located dynamically, so I can't get its text using ...
Abdurahmon's user avatar
2 votes
1 answer
291 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
Anonymous's user avatar
0 votes
0 answers
31 views

Referenced Memory in runtrace for OllyDBG 1.x

I wanted to know if there is any way I could get the referenced memory in the run trace? I tried using OllyDBG 2.x but it doesnt seem to work.
Dhawal Darji's user avatar
0 votes
0 answers
200 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
LucaG's user avatar
  • 1
0 votes
1 answer
179 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
Sejt's user avatar
  • 3
0 votes
1 answer
355 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
Synaps3's user avatar
  • 101
1 vote
1 answer
2k views

Calling/debugging calls to DLL via ollydbg or x64dbg

I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end). How do I ...
Bronson Swags's user avatar
1 vote
1 answer
252 views

How to find out what stack frame EBP belongs to

i'm newbie to all the subject of RE so this question may sound easy. on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are ...
Daniel Benisti's user avatar
0 votes
0 answers
186 views

finding best way to bypassing password check process

i am working to openning or bypassing a password . at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and ...
amir's user avatar
  • 1
1 vote
1 answer
587 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
Loliconaoquadrado's user avatar
0 votes
1 answer
150 views

what means "ilegal use of registers"?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
Loliconaoquadrado's user avatar
0 votes
0 answers
2k views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
w4po's user avatar
  • 1
0 votes
1 answer
204 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
erabe's user avatar
  • 3
2 votes
1 answer
257 views

OllyDBG saved executable crashes

I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
skudo's user avatar
  • 51
0 votes
1 answer
249 views

Is it possible to view PE headers in xdbg just like ollydbg?

In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible?
Mery Ted's user avatar
  • 232
-1 votes
1 answer
152 views

ollydbg: CMP - what the difference

What is the difference between: MOV SI,WORD PTR DS:[ESI+0D] CMP SI,1388 and CMP WORD PTR DS:[ESI+0d],1388
Andrey Mironov's user avatar
0 votes
0 answers
77 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
lightning's user avatar
0 votes
0 answers
79 views

Ollydbg Plugin Development

I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify ...
Homayoon's user avatar
0 votes
1 answer
262 views

OllyDbg - change loaded file name - Fix error caused by renamed file

There is a tool called LuteBot which is used in the game Mordhau to be able to make the player play midi files with the in game lute. In the tool you need to specify the location of the file ...
Black's user avatar
  • 101
1 vote
2 answers
584 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
Daan Rozebloem's user avatar
0 votes
0 answers
104 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
Mery Ted's user avatar
  • 232
1 vote
1 answer
392 views

Dump array of char* ASCII text to file? (ollydbg or x32dbg)

This question is similar to: List arrays (de-reference pointers) in Ollydbg I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
user30755's user avatar
1 vote
1 answer
213 views

HIEW Sharing Violation On Edit

I'm still very new to the whole reverse engineering field. I wanted to start learning by bypassing an activation code prompt. I found the line in OllyDbg, and moved the EXE to HIEW (Hacker Eye View) ...
ZyadS29's user avatar
  • 11
0 votes
1 answer
250 views

Nop the string in online games

So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn My question is how is that possible? I just edit ...
Frd's user avatar
  • 9
0 votes
1 answer
80 views

OllyDbg: Constant does not fit into operand

I'm trying to assemble this instruction: I'm not being able to do it.. When I test with MOV AX,55000 I get this error: I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
kuhi's user avatar
  • 161
0 votes
1 answer
310 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
Radu's user avatar
  • 103
1 vote
1 answer
2k views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
lim matthew's user avatar
2 votes
1 answer
351 views

Detailed API call descriptions not available in x64dbg

I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying ! There is an example from the two ...
Bob36180's user avatar

1
2 3 4 5
9