Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

Suspicious breakpoint message in ollydbg

I want to set a breakpoint and suddenly the following message appears: You want to place breakpoint outside the code section. INT3 breakpoint set on data will not execute and may have disastrous ...
4
votes
3answers
2k views

What ways is there for an application to detect that it has been modified?

I am using ollydbg and a Hex editor. I confirmed that once the application is edited in any way it behaves different than normal. My first thought was that the file is checking the checksum value so ...
4
votes
2answers
2k views

Viewing memory permissions in Ollydbg for memory segments

I'm looking for a way to view memory permissions on a specific section of memory using OllyDbg (technically I'm using Immunity but I'm assuming if it exists in Olly it'll be the same there). The ...
4
votes
1answer
2k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
4
votes
3answers
477 views

Is there a tool to see kernel space mapping of a Windows exe?

In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
4
votes
1answer
511 views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
4
votes
2answers
8k views

Looking for the specific text in EXE file

I want to find specific string in the EXE file but when I open the EXE file with OllyDBG and search for the All Referenced Strings I get bunch of texts in the comment area which are like this : ...
4
votes
1answer
985 views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
4
votes
2answers
1k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
4
votes
2answers
3k views

Can't find “referenced string” in OllyDBG

So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, ...
4
votes
1answer
723 views

How to automate task in OllyDBG ? Using Ollyscript or any other tool

I am debugging an app in OllyDBG. I want to create a script or automation. I set a breakpoint on a certain address and goto its stack arguments. There are four stack arguments. I use the address of ...
4
votes
1answer
6k views

Ollydbg 'Copy all modifications to executable' doesn't copy all modifications

I'm editing executables on a(n) (almost) daily bases in Ollydbg and it is very annoying that the 'Copy all modifications to executable' doesn't work properly. All the code I edit in the .text section ...
4
votes
0answers
787 views

How to find a login packet structure (client-side only)? [closed]

As Google did not yield any results, I decided to ask it here. I'd like to reverse the login sequence of a game (using gamespy). In this login sequence, first the game uses the gamespy protocol (...
4
votes
0answers
400 views

Shotcuts in immunity debugger

Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
3
votes
1answer
2k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
3
votes
3answers
175 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
3
votes
2answers
252 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
3
votes
2answers
1k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
3
votes
1answer
1k views

Where ES/GS/FS are pointing to?

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
3
votes
1answer
1k views

Getting Access Violation when patching a program

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error. I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code: ...
3
votes
1answer
2k views

how to attach to a process as soon as it is loaded in memory

I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only ...
3
votes
2answers
5k views

OllyDebugger How to use Find Sequence of commands with wildcard 32bit registers

Lets say I want to find all the MOV EAX, 1234h MOV WORD PTR[EBP+ADDR], AX But it won't be always EAX or EBP+ADDR How do I wildcard search like MOV ???, 1234h MOV WORD PTR[???+ADDR], ?? I tried ...
3
votes
1answer
906 views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
3
votes
2answers
12k views

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
3
votes
1answer
219 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
3
votes
2answers
1k views

How to debug malware that injects itself into another process?

I am kind of new in the field of reverse engineering, so sorry if it is a silly question. I have to analyse some malwares for my bachelor thesis and I am currently trying to reverse engineer a ...
3
votes
2answers
2k views

Reversing a Windows service

I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg. When the malware calls StartServiceCtrDispatcherW, I receive an error: How I can continue to analyze ...
3
votes
1answer
7k views

OllyDbg - how to jump to a specific section within a (PE) Portable Executable?

When loading a .exe file within OllyDbg how can I step into the 'User Code' section? Pressing 'Execute till User Code' (alt-f9) does nothing unfortunately for me. If you need more information don't ...
3
votes
1answer
3k views

Which functions of a dll is called in OllyDBG

I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How? Thanks a lot....
3
votes
2answers
960 views

How can i reverse engineer and patch a USB driver to recognize similar hardware?

I used to have a Logitech G700 mouse that used a wireless proprietary usb receiver. I was using the Logitech setpoint software to customize the mouse's acceleration, macros, and other things. The ...
3
votes
4answers
9k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
3
votes
1answer
983 views

OllyDbg 2: Providing label arguments?

I recently switched from OllyDbg 1 to 2, and I'm really missing a feature the plugin "LabelArgs" provided to me in OllyDbg 1. Labels were extended in a way it was possible to name the first ...
3
votes
1answer
1k views

OllyDbg: Keep comments & labels in rebased DLL

My program loads and unloads a DLL of main interest at runtime. I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most ...
3
votes
1answer
332 views

Some programs have always same addressing and some different

Why do IDA and Ollydbg always open some programs with the main() function at the same address? The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C ...
3
votes
1answer
155 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...
3
votes
3answers
575 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
3
votes
1answer
2k views

Ollydbg -how to call procedure in other DLL (in my case USER32.DLL)

I am trying to call the USER32.DLL function from assembly code. I launched an application (calc.exe) in Ollydbg 2.01. I chose calc.exe just because I know it loads USER32.DLL. I see the format as:...
3
votes
1answer
2k views

copy/pasting sections of code or hex in Ollydbg

Is it possible to somehow copy/paste sections of data in the hex dump, or lines of code in the code (top left in CPU window disassembly window)? Example: cloning a function, and then making some ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
3
votes
1answer
966 views

Seeing previous register values in ollydbg possible?

I wanted to know if one can see old register values in Ollydbg in the register window. I mean, for example, I have the register value of eax like eax=12345678. And, now, let say that I go to the next ...
3
votes
1answer
2k views

OllyDgb1.10 API help file not working

I pointed the API help file to WIN32.HLP (Help -> Select API File -> win32.hlp -> Open) But when I right click on API and click 'Help on Symbolic name' 'Windows Help and Support' comes up and shows ...
3
votes
1answer
443 views

What do the first 16 bytes on the stack represent?

Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes ...
3
votes
2answers
7k views

Setting breakpoint on Win32 API does not work in Ollydbg

I attached Ollydbg to a process, and try to set breakpoint on CreateWindowExW. I typed bpx CreateWindowExW in command line. Then I checked the Breakpoints window and found it's totally empty. The ...
3
votes
2answers
282 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
3
votes
1answer
2k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
3
votes
1answer
659 views

Command for Command line plugin does not work

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
3
votes
2answers
464 views

Highscores being sent as hash

There is a game that has been created with Unity which I'm trying to beat. It sends your high-score to a site and gets posted there. I've sniffed the outgoing traffic and the game sends your username,...
3
votes
1answer
175 views

Different offsets in different Windows versions

I loaded a file into OllyDbg, and on my Windows 8, I see offsets of this format '7780XXXX': 7780DE50 7780DE52 ... On my XP machine it goes like this 0041XXXX: 004171A2 004171A4 ... Why is there a ...
3
votes
1answer
280 views

Ollydbg 2.1 Allow for multiple saves or not make backups

I have been looking all around for an answer to this, so I am hoping I find an answer here. I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, ...
3
votes
2answers
139 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...