Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
3
votes
1answer
181 views

Different offsets in different Windows versions

I loaded a file into OllyDbg, and on my Windows 8, I see offsets of this format '7780XXXX': 7780DE50 7780DE52 ... On my XP machine it goes like this 0041XXXX: 004171A2 004171A4 ... Why is there a ...
3
votes
1answer
319 views

Ollydbg 2.1 Allow for multiple saves or not make backups

I have been looking all around for an answer to this, so I am hoping I find an answer here. I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, ...
3
votes
2answers
177 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
1answer
1k views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
3
votes
1answer
212 views

Reversing DDRAW application

I have an old game that I am wanting to increase the resolution on. The problem is that the game is ancient and was written using DDRAW and GDI .A few things are weird with this application, First ...
3
votes
1answer
2k views

OllyDBG causes executables saved by it to ask for administrator privileges when run

Whenever I save an executable in OllyDBG (Right-click, Copy to executable, All modifications then Save File), the saved executable asks for administrator privileges when I run it. I tried opening ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
3
votes
0answers
98 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
3
votes
0answers
414 views

What does fs register value mean in x86 application? [duplicate]

I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows: What does this value 0x53 mean? Does it have some connection with the address ...
3
votes
2answers
526 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file had a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But ...
3
votes
0answers
208 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
2
votes
2answers
3k views

help in finding a specific function of a game

After playing around with pointers I'm trying to get the address of a specific function in a game. this function prints player input to the screen and broadcasts it to all online players since it's a ...
2
votes
2answers
5k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
2
votes
3answers
13k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2
votes
1answer
4k views

Finding send function for tcp packets in game client

I am trying to find the function that sends packets to the server in a game client. I have read many tuts about finding the SEND function. But they are not helpful in finding in my case. So i started ...
2
votes
1answer
1k views

Reverse engineer a checksum algorithm from application

I'm trying to write to a certain file format directly out of an application. Although the file format itself is extremely simple, it contains a 32-bit checksum I don't know how to calculate. I have ...
2
votes
3answers
916 views

Want to get back into reverse engineering havn't for a few years whats a good starting point for getting back into it?

I used to make maphacks for a game called Warcraft 3. I want to get back into reverse-engineering but with today's technologies (i.e. with the internet being fast enough to download data instead of it ...
2
votes
2answers
398 views

Change RadASM hotkey and add middle mouse click hotkey

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy ...
2
votes
2answers
1k views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
2
votes
1answer
1k views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
2
votes
2answers
3k views

ollydbg ASLR and DEP bypass without mona

In case Immunity Debugger (and hence mona) doesn't work for me, is there a quick way for me to check loaded image for DEP, SafeSEH and ASLR using OllyDbg alone? Manual inspection is acceptable too. I'...
2
votes
2answers
6k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...
2
votes
1answer
2k views

Why doesn't Olly's analyzation work properly in this code section?

I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize. I am new to reverse engineering and trying to manually ...
2
votes
2answers
2k views

OllyDbg and XMM0 vs MM0 registers

How can I view the XMM0-XMM7 registers within OllyDbg? I can right click on the registers window and go to view MMX registers, but I'm not exactly sure that these are the same. I see an instruction: ...
2
votes
1answer
117 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
2
votes
1answer
1k views

Searching for comments in ollydbg

I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. ...
2
votes
3answers
2k views

Trying to decompress a hello world program using OllyDbg v201

I'm trying to learn how to unpack a simple executable which has been compressed with crinkler, let be the nasm listing here compressed with crinkler. example1.asm: global start ; kernel32.lib ...
2
votes
2answers
261 views

Stepping through a program to figure out what subroutines are being called?

I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being ...
2
votes
2answers
449 views

Avoid re-enabling patches between reruns in Ollydbg

In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again. Is there a menu ...
2
votes
1answer
3k views

Methods of discovering the location of nag/pop-up screens besides string search?

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is ...
2
votes
2answers
9k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
2
votes
1answer
1k views

What is the difference between F9 and Ctrl-F9 in OllyDbg

What is the difference between Ctrl-F9 and F9 in OllyDbg except the fact that the first command will stop the program execution on the next RET instruction while the second command will stop the ...
2
votes
1answer
1k views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
2
votes
1answer
2k views

Reverse engineering windows service

I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own ...
2
votes
1answer
66 views

OllyDBG saved executable crashes

I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
2
votes
1answer
59 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
2
votes
2answers
1k views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
2
votes
2answers
1k views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
2
votes
1answer
936 views

Is it possible to print out the assembly code in ollydbg

I wanted to know if it is possible to print out the assembly code which I analyze in ollydbg. I mean to have all of that on a paper. Sometimes I do not have access to my laptop. In such cases I would ...
2
votes
3answers
3k views

How to go into thread function knowing only the thread handle

How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
2
votes
1answer
760 views

Studying Zeus 2.X

I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using this code. I've built my own builder to work on my test environment. Right know I want to do a very specific ...
2
votes
1answer
6k views

Viewing an exported DLL function in OllyDbg - garbage code

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions. First, I used this tool - http://www.nirsoft.net/utils/...
2
votes
1answer
615 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
559 views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
1answer
286 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
2
votes
1answer
1k views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
2
votes
1answer
2k views

Finding Addresses in Ollydbg from IDA [duplicate]

So I have an address from IDA which is: .text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?
2
votes
1answer
390 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
2
votes
2answers
7k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
2
votes
2answers
3k views

Why does program fail to run under several debuggers?

To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...

1 2
3
4 5
9