Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
0
votes
0answers
2 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
1
vote
0answers
13 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
-2
votes
0answers
26 views
Change window name + Friendlyappname
I want to modify the "Adobe Flash Player 31" its a Unicode string to "Testt of the Dem Cas" I tried using HxD and it would not work as anticipated. I do not want to use a 3rd party tool to do it (I ...
2
votes
2answers
72 views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
32 views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1answer
44 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
2answers
78 views
How do I tell OllyDbg where my source code is?
I am aware of this question, but I don't understand the only answer given.
How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
2
votes
2answers
100 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
110 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
69 views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1answer
21 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
48 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
2
votes
1answer
126 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
0answers
38 views
Environment Variables not found in Ollydbg
I tried loading a .dll file into Ollydbg, it loaded some Windows modules, and stopped at ntdll module with the following exception:
Debugged program unable to process exception
I checked the ...
0
votes
1answer
96 views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
0
votes
0answers
77 views
reverse engeneer, patching and reverse tool course
I saw those posts Looking for reverse engneer online course and
Where to find (free) training in reverse engineering? but that not what I looking for.
I looking for RE course that has those subjects:...
0
votes
0answers
45 views
x32dbg can't find instruction in ntdll.dll that ollydbg can
I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP.
Here is what I do :...
2
votes
1answer
259 views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
0
votes
1answer
90 views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
0
votes
1answer
79 views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
1answer
190 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
102 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1answer
89 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
4
votes
3answers
135 views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
2answers
112 views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
0
votes
1answer
215 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1answer
43 views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
1
vote
2answers
267 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
0answers
133 views
Finding reference to plain text string (in executable) in IDA or ollydbg
what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable?
I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
149 views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
143 views
what means ollydbg EIP location?
i'm reading the solution of an exercise ( keygen me )
and i found this :
Load OllyDbg, where EIP is located
EIP = 0x51BDE1
What does it means ?? and how can i find this !
Thanks
3
votes
1answer
92 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
321 views
How can I see the heap data in ollydbg?
I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc().
I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
1
vote
1answer
274 views
Finding the player animation function of a game
I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
1
vote
1answer
431 views
Finding Addresses in Ollydbg from IDA [duplicate]
So I have an address from IDA which is:
.text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1
vote
0answers
92 views
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
1answer
130 views
Unable to find Send/Recv type calls in Network Application
Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client.
I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
2
votes
1answer
468 views
Searching for comments in ollydbg
I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
5
votes
1answer
226 views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
1
vote
2answers
770 views
Getting the correct memory address for a specific value
I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was ...
5
votes
2answers
386 views
Reversing Self-Modifying Malware
recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
1answer
2k views
Searching for strings in ollydbg
I have the following program:
int main() {
char buff[11] = "helloitbd9";
int x = 4;
printf("%d", x);
return 0;
}
I can see the string "helloitbd9" through a hexdump of the binary, ...
1
vote
1answer
128 views
Why do debuggers sometimes not show entire call stack?
There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg.
Let me explain what I mean. Consider this example:
I ...
0
votes
1answer
492 views
How can I dynamically debug a malicious DLL? [duplicate]
English isn't my first language, So I will do my best )
I am trying to analyze some malware NotPetya and I can run the malware by running :
rundll32.exe notpetya.dll #1
I am using Olly and trying ...
1
vote
2answers
1k views
What is \Sessions\1\BaseNamedObjects\NamedBuffer?
I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are.
Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
0
votes
0answers
432 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
5
votes
1answer
552 views
OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application
i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000
check the ...
0
votes
1answer
329 views
How do I find address of a global variable in Ollydbg?
I have the line
CMP BYTE PTR DS:[EAX+1620], 0
How do I find the memory address of EAX+1620 so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of ...
4
votes
1answer
280 views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
4
votes
1answer
124 views
Weird looking assembly-code bunch
I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls):
0040E978 . 53 ...
