Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
0
votes
1answer
86 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
0
votes
0answers
29 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
0
votes
1answer
56 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
0
votes
1answer
89 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
43 views

Is it possible to view PE headers in xdbg just like ollydbg?

In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible?
0
votes
2answers
152 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
1answer
56 views

ollydbg: CMP - what the difference

What is the difference between: MOV SI,WORD PTR DS:[ESI+0D] CMP SI,1388 and CMP WORD PTR DS:[ESI+0d],1388
2
votes
1answer
60 views

OllyDBG saved executable crashes

I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
0
votes
1answer
115 views

Nop the string in online games

So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn My question is how is that possible? I just edit ...
0
votes
0answers
43 views

Shellcode doesn't match OllyDbg

I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
0
votes
1answer
1k views

Reverse Packet Encryption with server side checks

I made a DLL that hooks the send function of an MMORPG game. When the send() function is called, it will send the packet in a loop until I stop it instead of just sending the packet one time. My ...
10
votes
5answers
11k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
0
votes
1answer
852 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
5
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
0
votes
0answers
855 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
10
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
1
vote
1answer
181 views

OllyDbg “runs away” when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
0
votes
0answers
42 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
0answers
29 views

Ollydbg Plugin Development

I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify ...
0
votes
1answer
54 views

OllyDbg - change loaded file name - Fix error caused by renamed file

There is a tool called LuteBot which is used in the game Mordhau to be able to make the player play midi files with the in game lute. In the tool you need to specify the location of the file ...
0
votes
0answers
26 views

Protections against disassembly tools

I am very new to reverse engineering and thus, I struggle to even know the right search terms for effective research. I have been trying to reverse engineering an encryption algorithm of a software ...
-1
votes
2answers
299 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
8
votes
4answers
12k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
2answers
73 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
0
votes
0answers
31 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
1
vote
1answer
66 views

Dump array of char* ASCII text to file? (ollydbg or x32dbg)

This question is similar to: List arrays (de-reference pointers) in Ollydbg I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
0
votes
0answers
116 views

Best way to find data in running executable (ollydbg/x32dbg/CheatEngine) that I found in Ghidra?

I have located a function that I would like to reverse engineer in a game. The function pulls character strings from a large array. I am trying to find this array's contents. The line in Ghidra is: ...
1
vote
1answer
70 views

HIEW Sharing Violation On Edit

I'm still very new to the whole reverse engineering field. I wanted to start learning by bypassing an activation code prompt. I found the line in OllyDbg, and moved the EXE to HIEW (Hacker Eye View) ...
0
votes
0answers
69 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
0
votes
1answer
47 views

OllyDbg: Constant does not fit into operand

I'm trying to assemble this instruction: I'm not being able to do it.. When I test with MOV AX,55000 I get this error: I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
1
vote
1answer
179 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
1answer
101 views

Detailed API call descriptions not available in x64dbg

I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying ! There is an example from the two ...
0
votes
1answer
289 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
52 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
0answers
67 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
0answers
192 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
0answers
66 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
2answers
111 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
1
vote
1answer
127 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
2
votes
2answers
7k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
1
vote
1answer
442 views

Finding out what calls win32u.dll functions

There's a button which, when clicked, writes some data to the clipboard. I'm trying to call the function this button executes using DLL Injection. I managed to find the function in win32u.dll which ...
1
vote
3answers
742 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
0
votes
0answers
90 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
0answers
111 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
3
votes
0answers
95 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
0
votes
1answer
93 views

To find a keyboard shortcut inside an application

The app has a "secret dialog window" and I'm sure it appears after pressing combination of some buttons. How I can find the combination in this app?
1
vote
0answers
70 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
1
vote
1answer
566 views

Call Stack vs Intermodular Calls in Ollydbg

What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
-1
votes
1answer
328 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
1
vote
0answers
85 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...

1
2 3 4 5
9