Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
60
questions with no upvoted or accepted answers
6
votes
0
answers
673
views
Shotcuts in immunity debugger
Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
- 2,038
5
votes
1
answer
2k
views
Understanding AutoIT "compilation"
I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support.
I have tried looking for 3rd party ...
- 225
4
votes
0
answers
174
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
4
votes
0
answers
53
views
Mouse click breakpoint
Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated.
I did as it is written in these threads:
Thread ...
- 61
4
votes
0
answers
279
views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
3
votes
0
answers
105
views
How to see parameters in stack in x64dbg like in OllyDbg for known API calls?
Based on Detailed API call descriptions not available in x64dbg
When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack:
I've installed both ...
- 161
3
votes
0
answers
64
views
Tracing without breakpoints
I need:
To start tracing without breakpoints.
To do something in a program.
To stop tracing. This step may be replaced with a breakpoint but not the first step.
The thing is I need to do some ...
- 163
3
votes
0
answers
276
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
3
votes
0
answers
265
views
Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg
I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour.
When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header
compared to that what ...
- 293
2
votes
0
answers
59
views
The execution is not at AddressOfEntryPoint after patching .text section bytes
I have a shellcode and want to inject my shellcode into a PE file (a simple compiled c program that prints Hello World on the screen) . My shellcode size is 0x2a1 and the .text section of my PE file ...
2
votes
0
answers
50
views
Antidebug plugin for ollydbg 2.01
Can't find any working anti-antidebug plugin for olly 2.01. Maybe anyone can give me one?
- 61
2
votes
0
answers
118
views
Find an address of injected code via GetModuleHandleA
I am reversing really old game (20 years old).
l2.exe loads Dsetup.dll Network.dll. (not sure about order)
inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
- 121
2
votes
0
answers
31
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
2
votes
0
answers
1k
views
OllyDbg how to see the main thread (all memory in the cpu)
I can't figure out how to see more than the [CPU - main thread, module ]
in the CPU window.
Sometimes when I jump to an address the title changes just to [CPU - main thread]
and now I can see all of ...
- 21
2
votes
0
answers
5k
views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
- 123
2
votes
0
answers
242
views
Ollydbg Instructions Are Splitted
When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;
it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
- 21
1
vote
0
answers
589
views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
- 11
1
vote
0
answers
279
views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
- 111
1
vote
0
answers
419
views
How to bring the message box other than error message box
The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
1
vote
0
answers
461
views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
- 11
1
vote
0
answers
74
views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...
- 9
1
vote
0
answers
165
views
Getting a full trace (every line) from ollydbg
When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see:
Address hexDumb Command comments EAX ECX etc...
0042AD43 ...
- 151
1
vote
0
answers
221
views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
- 149
1
vote
0
answers
154
views
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
- 109
1
vote
0
answers
76
views
How can I retrieve port configs and IDs of a USBxpress serial device from software DLLs?
I'm new to the coding game. I've been using Ollydbg to try and find the info but it seems it's encrypted. I was hoping I could locate the info so I can program my device to work with the software it's ...
1
vote
0
answers
319
views
What causes a blank memory dump in OllyDbg?
I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to:
I'd ...
- 1,800
1
vote
0
answers
427
views
How do you find and set a BP on OutputDebugString calls in OllyDBG?
I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using ...
- 111
1
vote
0
answers
923
views
OllyDbg: break on memory allocation?
In OllyDbg, is there a way to break when memory is allocated?
Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
- 11
1
vote
0
answers
190
views
Am I interpreting the instructions correctly or not. (ollydbg + executable)
I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem.
It is about an old Rockstar game, "Bully: The scholarship edition" (released 2007 - aka "...
- 111
1
vote
0
answers
715
views
OllyDbg step over command not behaving exactly as the Immunity Debugger
I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.
In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
- 111
1
vote
0
answers
796
views
program terminates right after opening in ollydbg
So here's the thing, a few years ago I bought 2 games from a Russian site, sketchy I know, but they worked really well, I was instructed to protect the files with Themida as this was used in a gaming ...
- 11
1
vote
0
answers
909
views
Ignore Path and Extension in OllyDBG 2?
I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
- 11
1
vote
0
answers
141
views
Tracing what references a buffer in memory using Olly?
im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
- 11
1
vote
0
answers
346
views
Getting writes on address 0x00000000 while in OllyDbg
I am trying to analyze a game with OllyDbg.
However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with ...
- 133
1
vote
0
answers
290
views
Reversing apps with statically linked libraries
another newbie question from me.
Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy ...
- 161
1
vote
0
answers
1k
views
OllyDbg can't run program (breakpoint error, access violation)
So this is from some "Reversing with Lena" tutorial series on how to start out with reverse engineering and OllyDbg. (Found here https://tuts4you.com/download.php?view.124) It's a bit old but should ...
- 11
1
vote
0
answers
669
views
Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode
When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
1
vote
0
answers
212
views
How to call DebugActiveProcessStop from disassembled code?
I am debugging an application. Another process is debugged by this application.
Here is the call
00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>]
I want to ...
- 11
1
vote
0
answers
747
views
Why does calling the original function from my hook fail?
I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below.
The hook works fine ...
- 11
1
vote
0
answers
485
views
StrongOD Driver missing
Rather short question.
So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet ...
- 71
1
vote
0
answers
505
views
Olly hangs and lags
For some reason whether I open a program or attach to it, sometimes Olly 2 will behave really weird. It will either freeze and hang forever when I do things like placing a breakpoint, or more commonly,...
- 57
1
vote
0
answers
2k
views
Suddenly unable to load exe into OllyDbg - process terminates before execution
A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are "...
- 585
1
vote
0
answers
909
views
Where can I find ollydbg 2.1
I've seen a few references to ollydbg 2.1.0.4, but the official ollydbg website only has version 2.01. Can someone point me to a download for it? Can't find it googling either...
- 19
1
vote
0
answers
1k
views
Ollydbg and hundreds of events under QT GUI
I'm trying to debug an application that uses QT GUI library. The problem is that I can't even start debugging as ollydbg seems to be processing ~1k events per second where in stack trace I see all of ...
- 111
1
vote
1
answer
104
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
- 31
1
vote
1
answer
1k
views
How to get Arg in Ollydbg
I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg
Now, The EXE file which i was trying to ...
- 29
0
votes
0
answers
31
views
Referenced Memory in runtrace for OllyDBG 1.x
I wanted to know if there is any way I could get the referenced memory in the run trace?
I tried using OllyDBG 2.x but it doesnt seem to work.
0
votes
0
answers
168
views
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).
The problem now is on a Windows program. I start it ...
- 1
0
votes
0
answers
159
views
finding best way to bypassing password check process
i am working to openning or bypassing a password . at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and ...
- 1
0
votes
0
answers
1k
views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
- 1