Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
384
questions
1
vote
3answers
85 views
Cyber security student wanting to start learning reverse engineering
I'm really interested in learning reverse engineering. especially in regards to malware. although i have a few questions that I cant seem to get the answer to. Any help is much appreciated
What ...
0
votes
0answers
28 views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
0answers
55 views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
3
votes
0answers
37 views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
0
votes
1answer
50 views
To find a keyboard shortcut inside an application
The app has a "secret dialog window" and I'm sure it appears after pressing combination of some buttons. How I can find the combination in this app?
1
vote
0answers
66 views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...
0
votes
2answers
111 views
How to know what does the function do?
I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.
My question ...
0
votes
1answer
42 views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
1
vote
1answer
90 views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
0
votes
0answers
25 views
All referenced strings using ollydbg
i was trying to search for "All referenced strings using ollydbg v1.10 and got some error "could not read memory of debugged processt(77550000..77626fff) kindly help me solve the problem.[ ][1]
-1
votes
1answer
79 views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
0
votes
1answer
145 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
1
vote
0answers
36 views
Getting a full trace (every line) from ollydbg
When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see:
Address hexDumb Command comments EAX ECX etc...
0042AD43 ...
0
votes
0answers
52 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
100 views
Compare two traces from ollydbg
I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
1answer
319 views
How to see address in Graph view Ida
In Ida when I want to see the address of code I must switch to Text view
How can I see the address of code with Graph view ?
By the way, is there grapgh viwe in OllyDbg?
1
vote
1answer
89 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
1answer
181 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
2answers
91 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
3
votes
2answers
128 views
Can't find SetCooperativeLevel call in disassembled program
I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
2answers
200 views
Manually unpacking DarkTequila, stumped. Can anyone help?
The malware is packed w/ UPX - can see 0/1 in sections.
Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
1
vote
1answer
88 views
What is happening with these exceptions in OllyDbg?
I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
7
votes
3answers
4k views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
0answers
76 views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
2answers
218 views
replacing static value with variable
I'm trying to replace a static value:
MOV DWORD PTR SS:[EBP-30],4c
With a value from a specific address:
MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400
But SS:[EBP-30] ...
0
votes
1answer
122 views
OllyDbg “runs away” when stepping over wininet.HttpSendRequestW
I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
171 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
157 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
2answers
432 views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
67 views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
149 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
2answers
305 views
How do I tell OllyDbg where my source code is?
I am aware of this question, but I don't understand the only answer given.
How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
2k views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
361 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
142 views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
39 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
355 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
155 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
1answer
573 views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
3
votes
1answer
1k views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
0
votes
1answer
142 views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
208 views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
250 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
558 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
163 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
3
votes
3answers
169 views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
2answers
342 views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
674 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1answer
120 views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
2
votes
2answers
623 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
