Questions tagged [ollydbg]
A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.
438
questions
1
vote
0
answers
238
views
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:
IDA has the universal PE Unpacker plugin but it works a little bit different.
What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3
votes
1
answer
428
views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
3
votes
1
answer
1k
views
Command for Command line plugin does not work
I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
4
votes
2
answers
606
views
replacing static value with variable
I'm trying to replace a static value:
MOV DWORD PTR SS:[EBP-30],4c
With a value from a specific address:
MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400
But SS:[EBP-30] ...
2
votes
1
answer
1k
views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
4
votes
2
answers
2k
views
Hooking functions in a VMProtect'ed executable
I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
0
votes
1
answer
270
views
Ollydbg to change int length of compiled code
being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
3
votes
3
answers
1k
views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
12
votes
2
answers
16k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
2
votes
3
answers
14k
views
Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter
I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows:
When compared to the image on the tutorial for the step, I ...
2
votes
2
answers
2k
views
How to set a Mouse Click BreakPoint in OllyDbg?
In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
4
votes
2
answers
4k
views
Can't find "referenced string" in OllyDBG
So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, ...
5
votes
2
answers
2k
views
How are addresses calculated from the values in x86 segment registers?
How are the 16-bit values in segment registers used to represent large memory addresses?
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS ...
1
vote
1
answer
156
views
OD mode change from kernel to normal
I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3
votes
1
answer
1k
views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
1
answer
295
views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2
votes
1
answer
744
views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
4
votes
1
answer
2k
views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
4
votes
2
answers
11k
views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
2
votes
1
answer
90
views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2
answers
2k
views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0
votes
1
answer
2k
views
Is there a way to see all "values" in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
5
votes
1
answer
2k
views
In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?
I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg.
I am compiling C programs on one machine (XP Vm actually) and running them in ...
8
votes
1
answer
7k
views
Issue opening executable module in OllyDBG
I am running windows 8.1 and OllyDBG 2.0. When I attach to a process and view the executable modules, I want to open one. However, when I double click on one of the modules, it won't open in the main ...
1
vote
1
answer
173
views
Ollydbg| Inconsistent results as compared to the stack view pane
I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor ...
1
vote
3
answers
4k
views
OllyDBG, managed to patch file, now can I automate this?
In Olly I managed to patch the file to no longer compare for a specific flag. Is it possible to automate this?
Basically I changed a JNZ to a JZ.
Is there a way to could do the same thing with a hex ...
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
5
votes
1
answer
444
views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
4
votes
1
answer
5k
views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
4
votes
1
answer
2k
views
Suspicious breakpoint message in ollydbg
I want to set a breakpoint and suddenly the following message appears:
You want to place breakpoint outside the code section. INT3 breakpoint set on data will not execute and may have disastrous ...
0
votes
1
answer
2k
views
Searching instructions in OllyDbg
I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
0
votes
1
answer
419
views
Finding source of memory modification
I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
3
votes
3
answers
282
views
Debug vs Release binaries - Overflow detection
I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:
push ebp
mov ebp, esp
sub esp, 0F0h
push ebx
push esi
push edi
lea edi, [ebp+var_F0]
mov ecx, ...
0
votes
1
answer
4k
views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1
votes
1
answer
674
views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
0
votes
2
answers
617
views
How to paste 30-(N) number of assembly code to ollydbg
I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
1
vote
1
answer
3k
views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
0
votes
1
answer
359
views
How to get back to program's main code (user-space) while attaching to de bugger
I have a small program that I wanted to debug.
I run OllyDbg version 2 and attached the program to the debugger.
I received this window:
You can see that the addresses are from the Kernel memory.
...
2
votes
2
answers
2k
views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
1
answer
283
views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1
answer
2k
views
Finding the player animation function of a game
I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
0
votes
2
answers
959
views
How to reverse Engineer a game character position on a map
I'm trying to reverse engineer an online game (Dota 2) to get some more info and build a personal assistant with friendlier/ advanced info about my character. First I'm trying to find out the player ...
1
vote
1
answer
1k
views
what means ollydbg EIP location?
i'm reading the solution of an exercise ( keygen me )
and i found this :
Load OllyDbg, where EIP is located
EIP = 0x51BDE1
What does it means ?? and how can i find this !
Thanks
2
votes
1
answer
307
views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1
answer
2k
views
How can I see the heap data in ollydbg?
I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc().
I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
2
votes
1
answer
3k
views
Finding Addresses in Ollydbg from IDA [duplicate]
So I have an address from IDA which is:
.text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1
vote
2
answers
1k
views
Why the program can't write to specific memory area
I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here).
When I run it without debuggers in my VMWare it runs without errors.
I started to analyze it with ...
0
votes
1
answer
1k
views
How can I insert bytes with OllyDbg?
I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
1
vote
0
answers
159
views
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
3
votes
4
answers
13k
views
Unpacking and dumping using ollydump
I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...