Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
0
votes
0answers
19 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
27 views
Compare two traces from ollydbg
I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
1answer
53 views
How to see address in Graph view Ida
In Ida when I want to see the address of code I must switch to Text view
How can I see the address of code with Graph view ?
By the way, is there grapgh viwe in OllyDbg?
1
vote
1answer
58 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
1answer
56 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
2answers
62 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
3
votes
2answers
115 views
Can't find SetCooperativeLevel call in disassembled program
I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
2answers
101 views
Manually unpacking DarkTequila, stumped. Can anyone help?
The malware is packed w/ UPX - can see 0/1 in sections.
Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
1
vote
1answer
43 views
What is happening with these exceptions in OllyDbg?
I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
7
votes
3answers
1k views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
0answers
44 views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
2answers
185 views
replacing static value with variable
I'm trying to replace a static value:
MOV DWORD PTR SS:[EBP-30],4c
With a value from a specific address:
MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400
But SS:[EBP-30] ...
0
votes
1answer
92 views
OllyDbg “runs away” when stepping over wininet.HttpSendRequestW
I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
111 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
64 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
2answers
214 views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
45 views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
86 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
2answers
170 views
How do I tell OllyDbg where my source code is?
I am aware of this question, but I don't understand the only answer given.
How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
545 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
222 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
107 views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
26 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
187 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
143 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
1answer
350 views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
-1
votes
0answers
88 views
reverse engeneer, patching and reverse tool course
I saw those posts Looking for reverse engneer online course and
Where to find (free) training in reverse engineering? but that not what I looking for.
I looking for RE course that has those subjects:...
0
votes
0answers
106 views
x32dbg can't find instruction in ntdll.dll that ollydbg can
I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP.
Here is what I do :...
3
votes
1answer
759 views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
0
votes
1answer
120 views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
153 views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
222 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
310 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
129 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
4
votes
3answers
156 views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
2answers
252 views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
436 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1answer
70 views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
2
votes
2answers
451 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
-1
votes
0answers
165 views
Finding reference to plain text string (in executable) in IDA or ollydbg
what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable?
I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
156 views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
251 views
what means ollydbg EIP location?
i'm reading the solution of an exercise ( keygen me )
and i found this :
Load OllyDbg, where EIP is located
EIP = 0x51BDE1
What does it means ?? and how can i find this !
Thanks
3
votes
1answer
98 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
546 views
How can I see the heap data in ollydbg?
I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc().
I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
1
vote
1answer
454 views
Finding the player animation function of a game
I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
1
vote
1answer
806 views
Finding Addresses in Ollydbg from IDA [duplicate]
So I have an address from IDA which is:
.text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1
vote
0answers
104 views
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
1answer
160 views
Unable to find Send/Recv type calls in Network Application
Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client.
I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
2
votes
1answer
749 views
Searching for comments in ollydbg
I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
5
votes
1answer
260 views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
