Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
0
votes
1answer
22 views
How to see address in Graph view Ida
In Ida when I want to see the address of code I must switch to Text view
How can I see the address of code with Graph view ?
By the way, is there grapgh viwe in OllyDbg?
0
votes
0answers
24 views
Debugger does not start with entry point when debugging PE file
I am a beginner in reverse engineering.
I debug a PE file with Olly debugger. But when I open the file in Olly, it immediately run the file. It means it does not enter the entry point. So, I have no ...
1
vote
1answer
39 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
1answer
30 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
0answers
31 views
Debugger stops when popup appears?
I'm very new to disassembly, but I've been using procmon and ollydbg to look at a program. I have found that these EXE appears to be encrypted, it somehow generates a numeric name for a DLL which it ...
0
votes
0answers
41 views
How to run l2.bin under ollydbg?
I'm trying to inject OllyDBG in a process named l2bin, but I've got this error.
/
The l2 client is protected via SmartGuard, I think.
How I can run the l2.bin proccess under OllyDBG?
I've tried ...
0
votes
2answers
42 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
0answers
19 views
How do I save changes to hidden module Olly
I have modified the assembly code of Mod_0C05 whose type is .NET,hidden. There is no file path to that.
And when I tried to copy it to executable, it says:
I'm confused here, how do I save the ...
3
votes
2answers
104 views
Can't find SetCooperativeLevel call in disassembled program
I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
2answers
88 views
Manually unpacking DarkTequila, stumped. Can anyone help?
The malware is packed w/ UPX - can see 0/1 in sections.
Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
0
votes
0answers
31 views
Execute till User in IDA ?
In OLLYDBG I can do Execute till User with Alt+F9
How can I do it with IDA?
1
vote
1answer
37 views
What is happening with these exceptions in OllyDbg?
I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
7
votes
3answers
769 views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
0
votes
0answers
64 views
WS2_32.send is used but not WS2_32.recv
I'm trying to understand the communication between a client and a server. It's been easy to find the sockets' data that are sent using a breakpoint on WS2_32.send calls, but the process never breaks ...
0
votes
0answers
35 views
How to load Inproc COM DLL in ollydbg?
How to load Inproc COM DLL in ollydbg? With the help of loaddll, it does not work, it gives an error Can't load library.
In there are interfaces which are inherited from IUnknown
32 bit dll, ...
0
votes
0answers
18 views
changing an arguments type from word to dword
I have a game where the damage is limited to WORD. Unfortunately this is no longer high enough. The damage is calculated and passed to a number of functions. All of this is in unsigned __int16. I’m ...
1
vote
0answers
38 views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
2answers
177 views
replacing static value with variable
I'm trying to replace a static value:
MOV DWORD PTR SS:[EBP-30],4c
With a value from a specific address:
MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400
But SS:[EBP-30] ...
0
votes
1answer
88 views
OllyDbg “runs away” when stepping over wininet.HttpSendRequestW
I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
100 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
43 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
2answers
154 views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
41 views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
69 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
2answers
137 views
How do I tell OllyDbg where my source code is?
I am aware of this question, but I don't understand the only answer given.
How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
266 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
196 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
99 views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
24 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
147 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
140 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
0answers
55 views
Environment Variables not found in Ollydbg
I tried loading a .dll file into Ollydbg, it loaded some Windows modules, and stopped at ntdll module with the following exception:
Debugged program unable to process exception
I checked the ...
0
votes
1answer
289 views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
0
votes
0answers
86 views
reverse engeneer, patching and reverse tool course
I saw those posts Looking for reverse engneer online course and
Where to find (free) training in reverse engineering? but that not what I looking for.
I looking for RE course that has those subjects:...
0
votes
0answers
89 views
x32dbg can't find instruction in ntdll.dll that ollydbg can
I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP.
Here is what I do :...
3
votes
1answer
646 views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
0
votes
1answer
116 views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
143 views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
215 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
255 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
120 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
4
votes
3answers
153 views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
2answers
226 views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
380 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1answer
59 views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
2
votes
2answers
418 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
0answers
157 views
Finding reference to plain text string (in executable) in IDA or ollydbg
what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable?
I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
155 views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
216 views
what means ollydbg EIP location?
i'm reading the solution of an exercise ( keygen me )
and i found this :
Load OllyDbg, where EIP is located
EIP = 0x51BDE1
What does it means ?? and how can i find this !
Thanks
3
votes
1answer
97 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
