Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

0
votes
0answers
19 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
27 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
1answer
53 views

How to see address in Graph view Ida

In Ida when I want to see the address of code I must switch to Text view How can I see the address of code with Graph view ? By the way, is there grapgh viwe in OllyDbg?
1
vote
1answer
58 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
56 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
2answers
62 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
3
votes
2answers
115 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
2answers
101 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
1
vote
1answer
43 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
7
votes
3answers
1k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
0answers
44 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
2answers
185 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
0
votes
1answer
92 views

OllyDbg “runs away” when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
111 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
2
votes
1answer
64 views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
2answers
214 views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
45 views

OD mode change from kernel to normal

I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
86 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
1
vote
2answers
170 views

How do I tell OllyDbg where my source code is?

I am aware of this question, but I don't understand the only answer given. How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
545 views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
222 views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
1
vote
1answer
107 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
26 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
1
vote
2answers
187 views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
143 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
1answer
350 views

Searching instructions in OllyDbg

I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
-1
votes
0answers
88 views

reverse engeneer, patching and reverse tool course

I saw those posts Looking for reverse engneer online course and Where to find (free) training in reverse engineering? but that not what I looking for. I looking for RE course that has those subjects:...
0
votes
0answers
106 views

x32dbg can't find instruction in ntdll.dll that ollydbg can

I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP. Here is what I do :...
3
votes
1answer
759 views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
0
votes
1answer
120 views

Ollydbg to change int length of compiled code

being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
153 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
222 views

Is there a way to see all “values” in memory?

In a program I'm working on, a variable is set using a memory address: mov r9, [0x0000000000472C10] Is this the equivalent? (forgive the python code): value = 55 <---- value at memory address ...
0
votes
1answer
310 views

Run program until completion without debugging step by step [closed]

I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
129 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...
4
votes
3answers
156 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
0
votes
2answers
252 views

How to paste 30-(N) number of assembly code to ollydbg

I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
436 views

Find function's caller locations

I am debugging a program and searching to see when the program is calling WinHttpOpenRequest. I searched using for the function with Ctrl+G I pressed on Follow expression and it put me on the ...
0
votes
1answer
70 views

How to get back to program's main code (user-space) while attaching to de bugger

I have a small program that I wanted to debug. I run OllyDbg version 2 and attached the program to the debugger. I received this window: You can see that the addresses are from the Kernel memory. ...
2
votes
2answers
451 views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
-1
votes
0answers
165 views

Finding reference to plain text string (in executable) in IDA or ollydbg

what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable? I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
156 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
251 views

what means ollydbg EIP location?

i'm reading the solution of an exercise ( keygen me ) and i found this : Load OllyDbg, where EIP is located EIP = 0x51BDE1 What does it means ?? and how can i find this ! Thanks
3
votes
1answer
98 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
546 views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
1
vote
1answer
454 views

Finding the player animation function of a game

I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
1
vote
1answer
806 views

Finding Addresses in Ollydbg from IDA [duplicate]

So I have an address from IDA which is: .text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1
vote
0answers
104 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
1answer
160 views

Unable to find Send/Recv type calls in Network Application

Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client. I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
2
votes
1answer
749 views

Searching for comments in ollydbg

I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
5
votes
1answer
260 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...