Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
21
votes
3answers
9k views

Advantages of OllyDbg 1 over OllyDbg 2

I see that most RE tutorials around the web that give RE examples use OllyDbg 1, even if the tutorial was written after the release of OllyDbg 2. Is there any particular reason for that? Is version 2 ...
15
votes
1answer
19k views

What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?

I disassembled a file with OllyDbg and it had the following instruction: REPNE SCAS BYTE PTR ES:[EDI] What does that exactly mean ?
13
votes
1answer
4k views

Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?

I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
12
votes
2answers
23k views

How can I set a breakpoint for a button click?

I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible? Any tools or tricks to assist in this?
12
votes
2answers
12k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
12
votes
2answers
3k views

Should I switch from WinDbg to OllyDbg?

I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
11
votes
5answers
23k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
11
votes
4answers
3k views

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader. ...
10
votes
4answers
10k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
9
votes
3answers
12k views

How can I prevent Immunity Debugger / OllyDbg from breaking on attach?

When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
9
votes
3answers
7k views

Jump back to the caller

I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app. I load the exe from file menu with input arguments Set breakpoint on msvcr71.printf function After this ...
8
votes
3answers
3k views

Unable to set breakpoints in keygen

I like security as a hobby and I not so often I read and play with a few simple KeyGen games and I enjoy it. Reversing and KeyGen is very interesting but I'm a beginner and my questions are probably ...
7
votes
3answers
4k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
7
votes
3answers
5k views

Windows API reference for OllyDbg

There is an old help file containing Windows API I used few years ago with ollydebug, which can jump to the appropriate help page of function when double clicking on the function in the disassembly ...
7
votes
2answers
2k views

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory. Now fixing the sections headers is fairly easy - i just ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
7
votes
1answer
4k views

Issue opening executable module in OllyDBG

I am running windows 8.1 and OllyDBG 2.0. When I attach to a process and view the executable modules, I want to open one. However, when I double click on one of the modules, it won't open in the main ...
6
votes
2answers
4k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
6
votes
4answers
7k views

Tracing to a function during debugging?

I am trying to find an encryption algorithm for a game client, but I need to find the actual register/stack in the client before I can decrypt/encrypt the packets correctly (on my emulated server side)...
6
votes
3answers
13k views

Find a string that I entered in ollydbg

Say, there's an input box and I enter a text. Can I somehow find the location that text is entered?
6
votes
2answers
8k views

How to set a breakpoint at the specific location on the stack in OllyDbg

Is there any way to set a breakpoint at the specific location on the stack in OllyDbg? I have some value (argument of the function) on the stack and I want to break on every memory access at this ...
6
votes
2answers
1k views

Is there any tool which parses ollydbg run trace?

I'm currently working on a tool to automate several actions which relate to unpacking software. I would like to use the run trace of Ollydbg (1.10 preferred since it has many antidebug/usage/etc ...
6
votes
2answers
1k views

Ollydbg terminated while loading dll

When I try to load a DLL of a game client I get this error: How can I completely load this dll?
6
votes
1answer
1k views

Finding a certain function in game(TS4)

I am trying to find a function that places a furniture on the ground when I buy it and click the spot. This is the way I am trying to do solve it at the moment. Find the address of money with cheat ...
6
votes
1answer
224 views

How to distinguish different compiler codes in ASM?

While reversing an executable with olly, theres compiler code and user code. So how do i recognise the compiler codes ? Lets say if the executable is visual basic, it has a jmp and a call in the first ...
6
votes
0answers
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
5
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters ...
5
votes
4answers
1k views

Are there any modern assembly-level patching tools?

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is ...
5
votes
2answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
5
votes
1answer
7k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
5
votes
2answers
3k views

OllyDbg: Automatically extract string when breakpoint is hit

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
5
votes
2answers
569 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
5
votes
2answers
1k views

How to obtain decrypted virus body of Bolzano virus using Ollydbg 1.10 debugging on windows OS

I installed windows NT 4.0 service pack 6 on vmware player. Then I added Ollydbg 2 from vmware shared folder into windows NT. I extracted ollydbg zip and run ollydbg.exe. I am getting this error : ...
5
votes
1answer
806 views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
5
votes
1answer
3k views

Ollydbg 2: Breaking after attaching to a suspended process

When analyzing malware, I come across packers that inject the actual malware code into a newly spawned process and execute it that way. For that, they create a process in suspended state, inject the ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
5
votes
3answers
5k views

Break points in OllyDBG

I'm trying to set breakpoints in OllyDBG, I found the address that I wish to break on and I've hit F2 in order to set the breakpoint. However, when the program runs the code, it doesn't break. I'm ...
5
votes
1answer
1k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
5
votes
1answer
291 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
5
votes
1answer
2k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
5
votes
1answer
1k views

In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?

I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg. I am compiling C programs on one machine (XP Vm actually) and running them in ...
4
votes
2answers
6k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
4
votes
4answers
4k views

Use OllyDbg to identify what happens when a button is pressed

I am entirely new to reverse engineering, but nonetheless I have been given the challenge by a friend to crack a computer program he wrote. Having never done this before, my research online suggested ...
4
votes
3answers
2k views

Cannot call function (properly) in ollydbg

I need some help regarding calls in assembly with Ollydbg. I'm messing around with a simple application. So far, so good, I created a codecave for myself to add some code. But whenever I try to ...
4
votes
2answers
3k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
4
votes
1answer
782 views

Where is the code for a global variable declaration in Ollydbg?

Consider this code snippet: I'm trying to find the code that declares the global variable in Ollydbg. I can't find where it is.
4
votes
1answer
608 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
4
votes
2answers
1k views

Decoding the wire protocol (over RS232) for custom hardware <-> windows application?

Background I have a hardware device with an RS232 port, and a Windows (XP) application that it talks to. No OS-level drivers beyond basic serial, so all the decoding is done in the app. I have the ...
4
votes
1answer
3k views

how to add instructions to executable [duplicate]

I need to add code into an assembled program. If I am only changing a jump, I change JE to JNE and that is simple. If I need to add only a couple of instructions, I can find a section with a bunch ...
4
votes
1answer
900 views

Why did the program entry point become 'sub esp, 1C'?

I compiled the following C++ code with MinGW and opened it in OllyDbg 2.01. And the program stops at the following lines: CPU Disasm Address Hex dump Command ...