Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
4
votes
0answers
391 views

Shotcuts in immunity debugger

Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
3
votes
0answers
37 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
3
votes
1answer
873 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
3
votes
0answers
182 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
2
votes
0answers
713 views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
2
votes
0answers
3k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
2
votes
0answers
202 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
0answers
173 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
1
vote
0answers
55 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
0answers
66 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
1
vote
0answers
36 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
1
vote
0answers
76 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
1
vote
0answers
116 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
0answers
63 views

How can I retrieve port configs and IDs of a USBxpress serial device from software DLLs?

I'm new to the coding game. I've been using Ollydbg to try and find the info but it seems it's encrypted. I was hoping I could locate the info so I can program my device to work with the software it's ...
1
vote
0answers
171 views

What causes a blank memory dump in OllyDbg?

I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to: I'd ...
1
vote
0answers
195 views

How do you find and set a BP on OutputDebugString calls in OllyDBG?

I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using ...
1
vote
0answers
544 views

OllyDbg: break on memory allocation?

In OllyDbg, is there a way to break when memory is allocated? Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
1
vote
0answers
136 views

Am I interpreting the instructions correctly or not. (ollydbg + executable)

I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem. It is about an old Rockstar game, "Bully: The scholarship edition" (released 2007 - aka "...
1
vote
0answers
386 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
1
vote
0answers
528 views

program terminates right after opening in ollydbg

So here's the thing, a few years ago I bought 2 games from a Russian site, sketchy I know, but they worked really well, I was instructed to protect the files with Themida as this was used in a gaming ...
1
vote
0answers
314 views

Ignore Path and Extension in OllyDBG 2?

I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
1
vote
0answers
120 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
1
vote
0answers
264 views

Getting writes on address 0x00000000 while in OllyDbg

I am trying to analyze a game with OllyDbg. However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with ...
1
vote
0answers
235 views

Reversing apps with statically linked libraries

another newbie question from me. Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy ...
1
vote
0answers
774 views

OllyDbg can't run program (breakpoint error, access violation)

So this is from some "Reversing with Lena" tutorial series on how to start out with reverse engineering and OllyDbg. (Found here https://tuts4you.com/download.php?view.124) It's a bit old but should ...
1
vote
0answers
465 views

Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
1
vote
0answers
173 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
1
vote
0answers
572 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
1
vote
0answers
210 views

Analysis target modifies debugging registers during initial file open in ollydbg

While opening a binary in Ollydbg, I get a warning that the debugged program has modified the debugging registers. The following entry is in the log: Address: 7749218E Modified debug registers of main ...
1
vote
0answers
351 views

StrongOD Driver missing

Rather short question. So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet ...
1
vote
0answers
459 views

Olly hangs and lags

For some reason whether I open a program or attach to it, sometimes Olly 2 will behave really weird. It will either freeze and hang forever when I do things like placing a breakpoint, or more commonly,...
1
vote
0answers
1k views

Suddenly unable to load exe into OllyDbg - process terminates before execution

A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are "...
1
vote
0answers
770 views

Where can I find ollydbg 2.1

I've seen a few references to ollydbg 2.1.0.4, but the official ollydbg website only has version 2.01. Can someone point me to a download for it? Can't find it googling either...
1
vote
0answers
807 views

Ollydbg and hundreds of events under QT GUI

I'm trying to debug an application that uses QT GUI library. The problem is that I can't even start debugging as ollydbg seems to be processing ~1k events per second where in stack trace I see all of ...
1
vote
1answer
668 views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
0
votes
0answers
28 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
0
votes
2answers
111 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
1answer
42 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
0answers
25 views

All referenced strings using ollydbg

i was trying to search for "All referenced strings using ollydbg v1.10 and got some error "could not read memory of debugged processt(77550000..77626fff) kindly help me solve the problem.[ ][1]
0
votes
1answer
146 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
0answers
52 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
2answers
91 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
1answer
122 views

OllyDbg “runs away” when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
0
votes
0answers
738 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
0
votes
0answers
238 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
-1
votes
1answer
414 views

How to set a label to a memory address in ollydbg2

I have a lot of CALL 0x000XYZW in my code. I want to tell ollydbg that 0x000XYZW address is the function "my_function", and then see CALL my_function in my CPU window. Is it possible to do that ? ...
-1
votes
1answer
496 views

Wrong default starting address

I have no idea how, when or why, but now, the "default address" (the one executed when pressing F9) is 0x77960884. It should be 0x00401000 (when I manually go to 0x00401000, everything works). The ...