Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
426
questions
0
votes
0answers
14 views
Is there a way to refresh PDB read during file loading with Odbg 1.10?
Is it possible to make OllyDbg reload PDB symbols on each load of file? ie, refresh.
Just like the option Analysis -> Remove object scan from module but rather automatic on file reload.
0
votes
1answer
46 views
Ollydbg - automatically add hardware breakpoint when step over
I put INT3 breakpoint and starting the program. The OllyDbg break at the breakpoint, but when I step over, the OllyDbg put a hardware breakpoint. (Yesterday not happened in OllyDbg, but today during ...
0
votes
0answers
29 views
Ollydbg - Nag screen location
I am watching part5 of lena151 RE tut.
the creator said : do understand that the nag is generated in the above call at 004898FE, but is effectively created in MFC42.dll in this call at 489912
So, How ...
1
vote
0answers
85 views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
0
votes
1answer
41 views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
1
vote
1answer
67 views
Ollydbg - Readfile API
I am learning reverse engineering. (Lenas Reversing for Newbies) Part 2
I'm confused about Readfile API.
In part2 , i created blank Keyfile.dat near application. (Without key in it)
pBytesRead : ...
1
vote
1answer
51 views
Changing a label's text on window
I'm using OllyDbg v2 for debugging. Target is a simple executable file with few labels. It has been written in C++ builder. Looks like labels are located dynamically, so I can't get its text using ...
2
votes
1answer
96 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
0
votes
0answers
26 views
Referenced Memory in runtrace for OllyDBG 1.x
I wanted to know if there is any way I could get the referenced memory in the run trace?
I tried using OllyDBG 2.x but it doesnt seem to work.
0
votes
0answers
61 views
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).
The problem now is on a Windows program. I start it ...
0
votes
1answer
62 views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0
votes
0answers
27 views
Ollydbg skippingover breakpoint
I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set.
If I run the ...
0
votes
0answers
84 views
Ollydbg 110 vs Ollydbg 201 - Different assembly code (lena151 tutorials)
i started RE with lena151 tutorials. i downloaded latest version of ollydbg -> version 2.01
Then i open first sample : reverseMe.exe .
In ollydbg 2.01 the first jump is JNE
But in ollydbg 1.10 the ...
0
votes
1answer
99 views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
1
vote
1answer
320 views
Calling/debugging calls to DLL via ollydbg or x64dbg
I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end).
How do I ...
1
vote
1answer
78 views
How to find out what stack frame EBP belongs to
i'm newbie to all the subject of RE so this question may sound easy.
on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are ...
0
votes
0answers
58 views
Unable to debug with Debuggers
I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
0
votes
0answers
50 views
finding best way to bypassing password check process
i am working to openning or bypassing a password . at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and ...
1
vote
1answer
156 views
What is physical address on a pe reader?
What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
0
votes
1answer
39 views
what means "ilegal use of registers"?
I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
0
votes
0answers
203 views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
0
votes
1answer
94 views
Debugging Encrypted Malware with Multiple Threads
What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
2
votes
1answer
120 views
OllyDBG saved executable crashes
I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
0
votes
1answer
78 views
Is it possible to view PE headers in xdbg just like ollydbg?
In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible?
-1
votes
1answer
98 views
ollydbg: CMP - what the difference
What is the difference between:
MOV SI,WORD PTR DS:[ESI+0D]
CMP SI,1388
and
CMP WORD PTR DS:[ESI+0d],1388
0
votes
0answers
50 views
Develop a Hello World plugin for Ollydbg
I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
0answers
44 views
Ollydbg Plugin Development
I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify ...
0
votes
1answer
124 views
OllyDbg - change loaded file name - Fix error caused by renamed file
There is a tool called LuteBot which is used in the game Mordhau to be able to make the player play midi files with the in game lute.
In the tool you need to specify the location of the file ...
1
vote
2answers
169 views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
0
votes
0answers
55 views
How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?
So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file.
how can i do this in IDA ...
1
vote
1answer
134 views
Dump array of char* ASCII text to file? (ollydbg or x32dbg)
This question is similar to: List arrays (de-reference pointers) in Ollydbg
I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
1
vote
1answer
132 views
HIEW Sharing Violation On Edit
I'm still very new to the whole reverse engineering field. I wanted to start learning by bypassing an activation code prompt. I found the line in OllyDbg, and moved the EXE to HIEW (Hacker Eye View) ...
0
votes
1answer
158 views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
0
votes
1answer
57 views
OllyDbg: Constant does not fit into operand
I'm trying to assemble this instruction:
I'm not being able to do it..
When I test with MOV AX,55000 I get this error:
I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
0
votes
1answer
172 views
Can't find injected DLL in OllyDbg
I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked.
I am using the ...
1
vote
1answer
540 views
Entry point of a program
im new to assembly and reverse engineering, i have a question regarding to how the address work.
I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
1answer
141 views
Detailed API call descriptions not available in x64dbg
I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying !
There is an example from the two ...
0
votes
1answer
822 views
How to change the title of a windows GUI app when patching? (the title that usually writes the application name)
So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
59 views
Which APIs are responsible for terminating process icons in Taskbar?
I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :
it does ...
0
votes
0answers
123 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
1
vote
2answers
338 views
Ollydbg: How to set a conditinal breakpoint for a register gets special value
I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address!
I want to set a bp when for example ECX == 12345678 , i can do this on ...
1
vote
1answer
196 views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
0
votes
0answers
263 views
How to bring the message box other than error message box
The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
1
vote
1answer
876 views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
1
vote
3answers
2k views
Cyber security student wanting to start learning reverse engineering [duplicate]
I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated
What should I learn before I start to learn reverse engineering?
Is learning C/...
0
votes
0answers
176 views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
0answers
210 views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
3
votes
0answers
155 views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
0
votes
1answer
150 views
To find a keyboard shortcut inside an application
The app has a "secret dialog window" and I'm sure it appears after pressing combination of some buttons. How I can find the combination in this app?
1
vote
0answers
70 views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...