Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
1 vote
0 answers
238 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
3 votes
1 answer
428 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
3 votes
1 answer
1k views

Command for Command line plugin does not work

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
4 votes
2 answers
606 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
2 votes
1 answer
1k views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
4 votes
2 answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
0 votes
1 answer
270 views

Ollydbg to change int length of compiled code

being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow ...
3 votes
3 answers
1k views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
12 votes
2 answers
16k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
2 votes
3 answers
14k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2 votes
2 answers
2k views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
4 votes
2 answers
4k views

Can't find "referenced string" in OllyDBG

So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, ...
5 votes
2 answers
2k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
1 vote
1 answer
156 views

OD mode change from kernel to normal

I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
-3 votes
1 answer
1k views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
1 vote
1 answer
295 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
2 votes
1 answer
744 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
4 votes
1 answer
2k views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
4 votes
2 answers
11k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
2 votes
1 answer
90 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
1 vote
2 answers
2k views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0 votes
1 answer
2k views

Is there a way to see all "values" in memory?

In a program I'm working on, a variable is set using a memory address: mov r9, [0x0000000000472C10] Is this the equivalent? (forgive the python code): value = 55 <---- value at memory address ...
5 votes
1 answer
2k views

In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?

I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg. I am compiling C programs on one machine (XP Vm actually) and running them in ...
8 votes
1 answer
7k views

Issue opening executable module in OllyDBG

I am running windows 8.1 and OllyDBG 2.0. When I attach to a process and view the executable modules, I want to open one. However, when I double click on one of the modules, it won't open in the main ...
1 vote
1 answer
173 views

Ollydbg| Inconsistent results as compared to the stack view pane

I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor ...
1 vote
3 answers
4k views

OllyDBG, managed to patch file, now can I automate this?

In Olly I managed to patch the file to no longer compare for a specific flag. Is it possible to automate this? Basically I changed a JNZ to a JZ. Is there a way to could do the same thing with a hex ...
7 votes
2 answers
2k views

"Debugged application has modified the debugging registers" with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
5 votes
1 answer
444 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
4 votes
1 answer
5k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
4 votes
1 answer
2k views

Suspicious breakpoint message in ollydbg

I want to set a breakpoint and suddenly the following message appears: You want to place breakpoint outside the code section. INT3 breakpoint set on data will not execute and may have disastrous ...
0 votes
1 answer
2k views

Searching instructions in OllyDbg

I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
0 votes
1 answer
419 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
3 votes
3 answers
282 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
0 votes
1 answer
4k views

Run program until completion without debugging step by step [closed]

I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
-1 votes
1 answer
674 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...
0 votes
2 answers
617 views

How to paste 30-(N) number of assembly code to ollydbg

I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. ...
1 vote
1 answer
3k views

Find function's caller locations

I am debugging a program and searching to see when the program is calling WinHttpOpenRequest. I searched using for the function with Ctrl+G I pressed on Follow expression and it put me on the ...
0 votes
1 answer
359 views

How to get back to program's main code (user-space) while attaching to de bugger

I have a small program that I wanted to debug. I run OllyDbg version 2 and attached the program to the debugger. I received this window: You can see that the addresses are from the Kernel memory. ...
2 votes
2 answers
2k views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0 votes
1 answer
283 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1 vote
1 answer
2k views

Finding the player animation function of a game

I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
0 votes
2 answers
959 views

How to reverse Engineer a game character position on a map

I'm trying to reverse engineer an online game (Dota 2) to get some more info and build a personal assistant with friendlier/ advanced info about my character. First I'm trying to find out the player ...
1 vote
1 answer
1k views

what means ollydbg EIP location?

i'm reading the solution of an exercise ( keygen me ) and i found this : Load OllyDbg, where EIP is located EIP = 0x51BDE1 What does it means ?? and how can i find this ! Thanks
2 votes
1 answer
307 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2 votes
1 answer
2k views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
2 votes
1 answer
3k views

Finding Addresses in Ollydbg from IDA [duplicate]

So I have an address from IDA which is: .text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
1 vote
2 answers
1k views

Why the program can't write to specific memory area

I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here). When I run it without debuggers in my VMWare it runs without errors. I started to analyze it with ...
0 votes
1 answer
1k views

How can I insert bytes with OllyDbg?

I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
1 vote
0 answers
159 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
3 votes
4 answers
13k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...

1 2
3
4 5
9