All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
65 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
0
votes
0answers
148 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
1answer
285 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
3
votes
2answers
138 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
2answers
252 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
3
votes
1answer
219 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
5
votes
2answers
670 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
5
votes
1answer
900 views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
3
votes
1answer
154 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...
1
vote
1answer
746 views

Reverse Packet Encryption with server side checks

My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will ...
1
vote
2answers
143 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
-1
votes
1answer
218 views

What syntax does OllyDbg follow in its dissassembly window?

I have some understanding of Assembly after reading some tutorials and a few chapters from the "PC Assembly Book". Right now, I am trying to understand the instructions I see in OllyDbg, but it seems ...
1
vote
2answers
7k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
1
vote
1answer
1k views

OllyDBG translate ASM to C

I'm trying to reverse engineer an library function back to C/C++ code. But the function that I reverse is almust done, i just need a little bit help for making it compleet. Here is the assembly code:...
0
votes
2answers
270 views

Understanding FCOMP instruction and extracted value from address operand

I'm trying to reverse engineer an application made in vb6. At a certain point it compares an input number to a constant number, my goal here is to extract that number, now i found where the comparison ...
0
votes
1answer
114 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
1
vote
2answers
1k views

Find messagebox string with ollydbg

For some reason i can't find any string matching the MessageBox text of a program when searching with "search all reference strings" , why is that?
-1
votes
1answer
459 views

Ollydbg gives output in which assembly language instructions in Intel or AT&T syntax?

Ollydbg gives default output in which assembly language instructions in Intel or AT&T syntax ? Is there an option to change the assembly language syntax ?
1
vote
0answers
238 views

Reversing apps with statically linked libraries

another newbie question from me. Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy ...
0
votes
3answers
280 views

\xDA\x9Fb - what's that?

(Alert: I'm new with all this) I'm trying to find out what the following (dis)assembly does: MOV EAX,DWORD PTR SS:[EBP-54] ; PTR to ASCII "\xDA\x9Fb" I seem to understand that the value at ...
0
votes
1answer
163 views

Use the functionality available in the unknown DLL [closed]

Consider I have got a DLL file which contains some functions and classes that I am not aware of. It might be lack of documentation, or the unwillingness of the programmer to provide the documentation ...
0
votes
0answers
784 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
1
vote
0answers
179 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
2
votes
3answers
12k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2
votes
1answer
718 views

Studying Zeus 2.X

I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using this code. I've built my own builder to work on my test environment. Right know I want to do a very specific ...
4
votes
1answer
982 views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
4
votes
1answer
834 views

Where is the code for a global variable declaration in Ollydbg?

Consider this code snippet: I'm trying to find the code that declares the global variable in Ollydbg. I can't find where it is.
-2
votes
1answer
143 views

How can I do this in less than 10 bytes of space?

I have some value stored at a memory location. I have 10 bytes of space and have following to do: push registers copy a string constant "abcedfghijkl" to that memory location restore registers Is it ...
0
votes
1answer
390 views

Most efficient way to extend a program using a DLL [closed]

I have wrote a program in C++ and I built it as a DLL. I want to utilize functions that are in this DLL in another program to overwrite other functions. Unfortunately, they're not any exports and ...
2
votes
1answer
5k views

Viewing an exported DLL function in OllyDbg - garbage code

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions. First, I used this tool - http://www.nirsoft.net/utils/...
1
vote
2answers
805 views

Understanding packet byte structures with OllyDbg

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received. Packets like login are easy to structure because ...
0
votes
1answer
395 views

Change program's codepage / charset

I dont have any experience with assembler or reversing code. I need to change charset of .exe program to support turkish characters. I have opened it in Ollydbg do some tests. There are several ...
4
votes
2answers
6k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
1
vote
1answer
543 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
5
votes
2answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
1
vote
1answer
2k views

how to convert this ASM to C

I have this function that I know its responsible for making some nice math between a 2D vector to return the highest 3D Y value at the provided 2D coordinate. I also know it takes two parameters, int ...
12
votes
2answers
12k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
5
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters ...