Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
-1
votes
0answers
15 views
Reverse Engineering C executable file without codes using edb ubuntu [on hold]
I am new in reverse engineering, and i try to solving challange.I have a c binary code and when i try to run it i get segmantation fault. Main aim is solve seg fault and print screen 3 things. I get ...
-1
votes
0answers
27 views
Themida 2.4.6 unpacker
I already used the ultra 1.4 unpacker script. But in the resulting .exe, there is a packed section part. I need to analyze this part.
And then when I dump it in process too, there is a packed section ...
0
votes
0answers
48 views
WS2_32.send is used but not WS2_32.recv
I'm trying to understand the communication between a client and a server. It's been easy to find the sockets' data that are sent using a breakpoint on WS2_32.send calls, but the process never breaks ...
0
votes
0answers
35 views
How to load Inproc COM DLL in ollydbg?
How to load Inproc COM DLL in ollydbg? With the help of loaddll, it does not work, it gives an error Can't load library.
In there are interfaces which are inherited from IUnknown
32 bit dll, ...
0
votes
0answers
18 views
changing an arguments type from word to dword
I have a game where the damage is limited to WORD. Unfortunately this is no longer high enough. The damage is calculated and passed to a number of functions. All of this is in unsigned __int16. I’m ...
1
vote
0answers
29 views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
2answers
163 views
replacing static value with variable
I'm trying to replace a static value:
MOV DWORD PTR SS:[EBP-30],4c
With a value from a specific address:
MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400
But SS:[EBP-30] ...
0
votes
1answer
58 views
OllyDbg “runs away” when stepping over wininet.HttpSendRequestW
I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
90 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
30 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
2answers
104 views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
35 views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
53 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
2answers
93 views
How do I tell OllyDbg where my source code is?
I am aware of this question, but I don't understand the only answer given.
How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
131 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
174 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
85 views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
23 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
101 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
134 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
0answers
47 views
Environment Variables not found in Ollydbg
I tried loading a .dll file into Ollydbg, it loaded some Windows modules, and stopped at ntdll module with the following exception:
Debugged program unable to process exception
I checked the ...
0
votes
1answer
169 views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
0
votes
0answers
84 views
reverse engeneer, patching and reverse tool course
I saw those posts Looking for reverse engneer online course and
Where to find (free) training in reverse engineering? but that not what I looking for.
I looking for RE course that has those subjects:...
0
votes
0answers
62 views
x32dbg can't find instruction in ntdll.dll that ollydbg can
I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP.
Here is what I do :...
3
votes
1answer
466 views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
0
votes
1answer
109 views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
99 views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
201 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
185 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
100 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
4
votes
3answers
142 views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
2answers
165 views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
299 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1answer
51 views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
1
vote
2answers
345 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
0answers
148 views
Finding reference to plain text string (in executable) in IDA or ollydbg
what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable?
I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
151 views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
174 views
what means ollydbg EIP location?
i'm reading the solution of an exercise ( keygen me )
and i found this :
Load OllyDbg, where EIP is located
EIP = 0x51BDE1
What does it means ?? and how can i find this !
Thanks
3
votes
1answer
96 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
408 views
How can I see the heap data in ollydbg?
I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc().
I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
1
vote
1answer
356 views
Finding the player animation function of a game
I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
1
vote
1answer
580 views
Finding Addresses in Ollydbg from IDA [duplicate]
So I have an address from IDA which is:
.text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1
vote
0answers
96 views
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
1answer
141 views
Unable to find Send/Recv type calls in Network Application
Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client.
I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
2
votes
1answer
567 views
Searching for comments in ollydbg
I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
5
votes
1answer
235 views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
1
vote
2answers
1k views
Getting the correct memory address for a specific value
I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was ...
5
votes
2answers
423 views
Reversing Self-Modifying Malware
recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
1answer
3k views
Searching for strings in ollydbg
I have the following program:
int main() {
char buff[11] = "helloitbd9";
int x = 4;
printf("%d", x);
return 0;
}
I can see the string "helloitbd9" through a hexdump of the binary, ...
1
vote
1answer
156 views
Why do debuggers sometimes not show entire call stack?
There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg.
Let me explain what I mean. Consider this example:
I ...
