Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
3
votes
1answer
794 views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
3
votes
1answer
196 views

Reversing DDRAW application

I have an old game that I am wanting to increase the resolution on. The problem is that the game is ancient and was written using DDRAW and GDI .A few things are weird with this application, First ...
3
votes
1answer
2k views

OllyDBG causes executables saved by it to ask for administrator privileges when run

Whenever I save an executable in OllyDBG (Right-click, Copy to executable, All modifications then Save File), the saved executable asks for administrator privileges when I run it. I tried opening ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
3
votes
0answers
57 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
3
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
3
votes
0answers
362 views

What does fs register value mean in x86 application? [duplicate]

I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows: What does this value 0x53 mean? Does it have some connection with the address ...
3
votes
2answers
460 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file had a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But ...
3
votes
0answers
188 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
2
votes
2answers
3k views

help in finding a specific function of a game

After playing around with pointers I'm trying to get the address of a specific function in a game. this function prints player input to the screen and broadcasts it to all online players since it's a ...
2
votes
3answers
12k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2
votes
1answer
4k views

Finding send function for tcp packets in game client

I am trying to find the function that sends packets to the server in a game client. I have read many tuts about finding the SEND function. But they are not helpful in finding in my case. So i started ...
2
votes
2answers
3k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
2
votes
3answers
896 views

Want to get back into reverse engineering havn't for a few years whats a good starting point for getting back into it?

I used to make maphacks for a game called Warcraft 3. I want to get back into reverse-engineering but with today's technologies (i.e. with the internet being fast enough to download data instead of it ...
2
votes
2answers
389 views

Change RadASM hotkey and add middle mouse click hotkey

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy ...
2
votes
2answers
629 views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
2
votes
1answer
937 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
2
votes
2answers
4k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...
2
votes
1answer
2k views

Why doesn't Olly's analyzation work properly in this code section?

I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize. I am new to reverse engineering and trying to manually ...
2
votes
2answers
2k views

OllyDbg and XMM0 vs MM0 registers

How can I view the XMM0-XMM7 registers within OllyDbg? I can right click on the registers window and go to view MMX registers, but I'm not exactly sure that these are the same. I see an instruction: ...
2
votes
1answer
105 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
1k views

Searching for comments in ollydbg

I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
2
votes
3answers
1k views

Trying to decompress a hello world program using OllyDbg v201

I'm trying to learn how to unpack a simple executable which has been compressed with crinkler, let be the nasm listing here compressed with crinkler. example1.asm: global start ; kernel32.lib ...
2
votes
2answers
3k views

ollydbg ASLR and DEP bypass without mona

In case Immunity Debugger (and hence mona) doesn't work for me, is there a quick way for me to check loaded image for DEP, SafeSEH and ASLR using OllyDbg alone? Manual inspection is acceptable too. I'...
2
votes
2answers
233 views

Stepping through a program to figure out what subroutines are being called?

I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being ...
2
votes
2answers
407 views

Avoid re-enabling patches between reruns in Ollydbg

In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again. Is there a menu ...
2
votes
1answer
3k views

Methods of discovering the location of nag/pop-up screens besides string search?

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is ...
2
votes
2answers
8k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
2
votes
1answer
1k views

What is the difference between F9 and Ctrl-F9 in OllyDbg

What is the difference between Ctrl-F9 and F9 in OllyDbg except the fact that the first command will stop the program execution on the next RET instruction while the second command will stop the ...
2
votes
1answer
1k views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
2
votes
1answer
2k views

Reverse engineering windows service

I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own ...
2
votes
1answer
51 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
2
votes
2answers
763 views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
2
votes
2answers
923 views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
2
votes
1answer
810 views

Is it possible to print out the assembly code in ollydbg

I wanted to know if it is possible to print out the assembly code which I analyze in ollydbg. I mean to have all of that on a paper. Sometimes I do not have access to my laptop. In such cases I would ...
2
votes
3answers
3k views

How to go into thread function knowing only the thread handle

How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
2
votes
1answer
718 views

Studying Zeus 2.X

I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using this code. I've built my own builder to work on my test environment. Right know I want to do a very specific ...
2
votes
1answer
5k views

Viewing an exported DLL function in OllyDbg - garbage code

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions. First, I used this tool - http://www.nirsoft.net/utils/...
2
votes
1answer
284 views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
1answer
174 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
2
votes
1answer
963 views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
2
votes
1answer
1k views

Finding Addresses in Ollydbg from IDA [duplicate]

So I have an address from IDA which is: .text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
2
votes
2answers
5k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
2
votes
1answer
6k views

A simple reverseme application won't run, always loads the code of ntdll and terminates the app [closed]

I opened a simple reverse me windows application in ollydbg, then it shows the code for the "ntdll". Since I want to view code and run "ReverseMe" I double clicked the "ReverseMe" on the "Executable ...
2
votes
2answers
3k views

Why does program fail to run under several debuggers?

To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
2
votes
1answer
1k views

Creating my own custom structure in Ollydbg

In Ollydbg's hex dump window (lower left quadrant of CPU window) one can interpret data as structures, you can right-click on one or more bytes and see the options "Decode as structure" or "Decode as ...
2
votes
1answer
217 views

Analyze a created thread after main thread

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the ...
2
votes
1answer
1k views

How to go back to main thread?

I was analyzing a sample and the function CreateRemoteThread is called with dwCreationFlag = 0, so the created thread starts immediately after creation. OllyDbg jumps to beginning of the new thread. I ...
2
votes
1answer
2k views

Conflict of OllyDbg plugins

I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg. As I have only a very basic idea of how plugins work, I ...
2
votes
1answer
669 views

OllyDbg 2.01 Run Trace “Skip selection option”

In OllyDbg 1.10 it was possible to skip some parts of code when starting run trace(just example): So when there is some heavy code it was possible to skip to trace only some useful information. I ...