Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
0
votes
1answer
39 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
0
votes
0answers
36 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
6
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
0
votes
1answer
31 views

OllyDbg: Constant does not fit into operand

I'm trying to assemble this instruction: I'm not being able to do it.. When I test with MOV AX,55000 I get this error: I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
0
votes
2answers
155 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
1answer
61 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
1
vote
1answer
67 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
1answer
71 views

Detailed API call descriptions not available in x64dbg

I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying ! There is an example from the two ...
0
votes
1answer
66 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
43 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
0answers
40 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
0answers
149 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
2answers
112 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
0answers
58 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
2answers
38 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
0
votes
1answer
293 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
1
vote
1answer
72 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
3
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
0
votes
1answer
145 views

OllyDbg “runs away” when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
2
votes
2answers
5k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
1
vote
1answer
127 views

Finding out what calls win32u.dll functions

There's a button which, when clicked, writes some data to the clipboard. I'm trying to call the function this button executes using DLL Injection. I managed to find the function in win32u.dll which ...
1
vote
3answers
273 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
0
votes
0answers
47 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
0answers
71 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
3
votes
0answers
58 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
0
votes
1answer
62 views

To find a keyboard shortcut inside an application

The app has a "secret dialog window" and I'm sure it appears after pressing combination of some buttons. How I can find the combination in this app?
1
vote
0answers
68 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
1
vote
1answer
279 views

Call Stack vs Intermodular Calls in Ollydbg

What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
0
votes
0answers
27 views

All referenced strings using ollydbg

i was trying to search for "All referenced strings using ollydbg v1.10 and got some error "could not read memory of debugged processt(77550000..77626fff) kindly help me solve the problem.[ ][1]
-1
votes
1answer
129 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
1
vote
0answers
51 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
0
votes
0answers
96 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
164 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
1answer
764 views

How to see address in Graph view Ida

In Ida when I want to see the address of code I must switch to Text view How can I see the address of code with Graph view ? By the way, is there grapgh viwe in OllyDbg?
1
vote
2answers
445 views

How do I tell OllyDbg where my source code is?

I am aware of this question, but I don't understand the only answer given. How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
1
vote
1answer
112 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
336 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
3
votes
2answers
282 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
3
votes
2answers
139 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
0
votes
1answer
6k views

General consensus on Lena's tutorials? [closed]

I often see Lenas "reversing for newbies" talked about as a very solid introduction to reverse engineering. It uses OllyDbg as the primary program. (I'd be more interested personally in using IDA, ...
7
votes
3answers
7k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
1answer
203 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
2
votes
1answer
1k views

Reversing a program with dongle

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start. From looking through the disassembly ...
6
votes
2answers
1k views

Ollydbg terminated while loading dll

When I try to load a DLL of a game client I get this error: How can I completely load this dll?
11
votes
4answers
3k views

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader. ...
1
vote
0answers
95 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
1answer
219 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
3
votes
1answer
659 views

Command for Command line plugin does not work

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
3
votes
2answers
252 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
2
votes
1answer
286 views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...