Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

57 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
1 answer
2k views

Understanding AutoIT "compilation"

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
user avatar
  • 215
4 votes
0 answers
583 views

Shotcuts in immunity debugger

Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
user avatar
3 votes
0 answers
192 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
user avatar
3 votes
0 answers
271 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
user avatar
  • 638
3 votes
0 answers
243 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
user avatar
2 votes
0 answers
1k views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
user avatar
2 votes
0 answers
5k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
user avatar
2 votes
0 answers
232 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
user avatar
1 vote
0 answers
16 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
user avatar
1 vote
0 answers
182 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
user avatar
1 vote
0 answers
278 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
user avatar
1 vote
0 answers
73 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
user avatar
  • 9
1 vote
0 answers
131 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
user avatar
1 vote
0 answers
177 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
user avatar
  • 139
1 vote
0 answers
140 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
user avatar
  • 109
1 vote
0 answers
71 views

How can I retrieve port configs and IDs of a USBxpress serial device from software DLLs?

I'm new to the coding game. I've been using Ollydbg to try and find the info but it seems it's encrypted. I was hoping I could locate the info so I can program my device to work with the software it's ...
user avatar
1 vote
0 answers
284 views

What causes a blank memory dump in OllyDbg?

I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to: I'd ...
user avatar
  • 1,615
1 vote
0 answers
375 views

How do you find and set a BP on OutputDebugString calls in OllyDBG?

I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using ...
user avatar
  • 111
1 vote
0 answers
830 views

OllyDbg: break on memory allocation?

In OllyDbg, is there a way to break when memory is allocated? Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
user avatar
  • 11
1 vote
0 answers
179 views

Am I interpreting the instructions correctly or not. (ollydbg + executable)

I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem. It is about an old Rockstar game, "Bully: The scholarship edition" (released 2007 - aka "...
user avatar
  • 111
1 vote
0 answers
655 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
user avatar
1 vote
0 answers
722 views

program terminates right after opening in ollydbg

So here's the thing, a few years ago I bought 2 games from a Russian site, sketchy I know, but they worked really well, I was instructed to protect the files with Themida as this was used in a gaming ...
user avatar
1 vote
0 answers
802 views

Ignore Path and Extension in OllyDBG 2?

I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
user avatar
  • 11
1 vote
0 answers
138 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
user avatar
  • 11
1 vote
0 answers
338 views

Getting writes on address 0x00000000 while in OllyDbg

I am trying to analyze a game with OllyDbg. However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with ...
user avatar
1 vote
0 answers
287 views

Reversing apps with statically linked libraries

another newbie question from me. Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy ...
user avatar
  • 161
1 vote
0 answers
1k views

OllyDbg can't run program (breakpoint error, access violation)

So this is from some "Reversing with Lena" tutorial series on how to start out with reverse engineering and OllyDbg. (Found here https://tuts4you.com/download.php?view.124) It's a bit old but should ...
user avatar
  • 11
1 vote
0 answers
651 views

Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
user avatar
1 vote
0 answers
209 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
user avatar
  • 11
1 vote
0 answers
689 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
user avatar
  • 11
1 vote
0 answers
437 views

StrongOD Driver missing

Rather short question. So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet ...
user avatar
  • 71
1 vote
0 answers
499 views

Olly hangs and lags

For some reason whether I open a program or attach to it, sometimes Olly 2 will behave really weird. It will either freeze and hang forever when I do things like placing a breakpoint, or more commonly,...
user avatar
1 vote
0 answers
2k views

Suddenly unable to load exe into OllyDbg - process terminates before execution

A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are "...
user avatar
  • 515
1 vote
0 answers
887 views

Where can I find ollydbg 2.1

I've seen a few references to ollydbg 2.1.0.4, but the official ollydbg website only has version 2.01. Can someone point me to a download for it? Can't find it googling either...
user avatar
1 vote
0 answers
1k views

Ollydbg and hundreds of events under QT GUI

I'm trying to debug an application that uses QT GUI library. The problem is that I can't even start debugging as ollydbg seems to be processing ~1k events per second where in stack trace I see all of ...
user avatar
  • 111
1 vote
1 answer
972 views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
user avatar
0 votes
1 answer
122 views

x64dbg is unable to find string references vs. Ollydbg

I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
user avatar
0 votes
1 answer
58 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
user avatar
0 votes
0 answers
39 views

Is there a way to refresh PDB read during file loading with Odbg 1.10?

Is it possible to make OllyDbg reload PDB symbols on each load of file? ie, refresh. Just like the option Analysis -> Remove object scan from module but rather automatic on file reload.
user avatar
  • 314
0 votes
0 answers
42 views

Ollydbg - Nag screen location

I am watching part5 of lena151 RE tut. the creator said : do understand that the nag is generated in the above call at 004898FE, but is effectively created in MFC42.dll in this call at 489912 So, How ...
user avatar
  • 69
0 votes
0 answers
26 views

Referenced Memory in runtrace for OllyDBG 1.x

I wanted to know if there is any way I could get the referenced memory in the run trace? I tried using OllyDBG 2.x but it doesnt seem to work.
user avatar
0 votes
0 answers
87 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
user avatar
  • 1
0 votes
0 answers
52 views

finding best way to bypassing password check process

i am working to openning or bypassing a password . at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and ...
user avatar
  • 1
0 votes
0 answers
403 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
user avatar
  • 1
0 votes
0 answers
55 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
user avatar
0 votes
0 answers
50 views

Ollydbg Plugin Development

I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify ...
user avatar
0 votes
0 answers
65 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
user avatar
  • 202
0 votes
0 answers
147 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
user avatar
  • 101
0 votes
0 answers
309 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
user avatar
0 votes
0 answers
247 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
user avatar