Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
2
votes
1answer
957 views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...
2
votes
1answer
1k views

finding a RC4 Encryption function in obfuscated assembly code with no symbols

RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
2
votes
1answer
1k views

Intercept serial check

I've been playing around with RE for a bit now and a friend sent over a crackme. I figured mise well try and crack it. The first thing I did was to put the executable into Exeinfo PE and there was ...
2
votes
1answer
2k views

Simple Program Being Paused Somewhere in ntdll

The following is a simple program I wrote to be debugged in OllyDbg: main(){ exit(0); } I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I ...
2
votes
1answer
8k views

Program won't run in a olly

I loaded an MS-Windows executable in Ollydbg. But as soon as I hit run from the Debug menu a message shows up: Breakpoint set at address 76A010B1 is corrupt (contains hex code instead of int3 ...) ...
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
2
votes
1answer
616 views

reversing without IDA or OLLYDBG

I am blind, and both IDA and OllyDBG don't wrok with my screenreader. What are my best choices for reverse engineering tools for both windows and linux? I am somewhat familiar with both gdb and ...
2
votes
1answer
2k views

Get address of where process mapped in Windbg

I'm looking for the start address of where myfile.exe mapped into memory using Windbg. For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
2
votes
1answer
1k views

Reversing a program with dongle

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start. From looking through the disassembly ...
2
votes
1answer
298 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
2
votes
1answer
923 views

Dump a child process created by malware with an ALTERNATIVE process hollowing process

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
2
votes
1answer
5k views

How to trace every instruction that was executed?

When I use "trace into" it doesn't log every single executed instruction in the "Run Trace" window only some of them. I have to set breakpoints in order for some of the instructions to be logged. ...
2
votes
2answers
4k views

OllyDbg 1.10 - attaching to running process suspends it indefinitely

In my OllyDbg v1.10, when I attempt to attach the debugger to a running process, Olly behaves as if it was successful, but the process is frozen (I'm unable to bring the window back up). I've tried ...
2
votes
1answer
927 views

OllyDbg Break when memory equals value

I'm wanting to have olly run a program and break when a particular memory location equals a given value. For instance, if I could have it run until the value at address 0xFB2D0024 == 0xE9, and then ...
2
votes
0answers
769 views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
2
votes
1answer
3k views

I'm unable to copy to executable (ollydebug)

I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
2
votes
0answers
3k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
2
votes
0answers
217 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
0answers
192 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
2
votes
1answer
117 views

Safecom TA-810 protocol (having trouble with the CRC)

(i've also posted this question on stackoverflow before i found out there was a specific stackexchange site for reverse engineering. My bad. Original post here: https://stackoverflow.com/questions/...
1
vote
3answers
990 views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
1
vote
3answers
3k views

OllyDBG, managed to patch file, now can I automate this?

In Olly I managed to patch the file to no longer compare for a specific flag. Is it possible to automate this? Basically I changed a JNZ to a JZ. Is there a way to could do the same thing with a hex ...
1
vote
2answers
3k views

Getting the correct memory address for a specific value

I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was ...
1
vote
1answer
953 views

Reverse engineer a checksum algorithm from application

I'm trying to write to a certain file format directly out of an application. Although the file format itself is extremely simple, it contains a 32-bit checksum I don't know how to calculate. I have ...
1
vote
2answers
806 views

Understanding packet byte structures with OllyDbg

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received. Packets like login are easy to structure because ...
1
vote
3answers
270 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
1
vote
1answer
466 views

what means ollydbg EIP location?

i'm reading the solution of an exercise ( keygen me ) and i found this : Load OllyDbg, where EIP is located EIP = 0x51BDE1 What does it means ?? and how can i find this ! Thanks
1
vote
2answers
1k views

Find messagebox string with ollydbg

For some reason i can't find any string matching the MessageBox text of a program when searching with "search all reference strings" , why is that?
1
vote
2answers
148 views

Ollydbg v 1.10 plugin writing

I am trying to write a plugin which, beside other things, would need to write assembly of some code segments into a file. Since the documentation is somewhat lacking I'm lost on some things and not ...
1
vote
2answers
1k views

how do I debug full screen applications

I need to debug an old (1999) full screen application. When I window the application and attach olly the program crashes. I have heard of remote debugging. Would running the program on a VM and then ...
1
vote
2answers
611 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
1
vote
3answers
725 views

Is it possible to capture the standard output of a process in Ollydbg?

I'm debugging an out-of-process COM server (an EXE), started by a dummy application I wrote. I attach the debugger when the instance is created and let the dummy application make calls to the server. ...
1
vote
1answer
4k views

How to prevent application from killing OllyDbg

I want to run an OllyDbg and attach it to some starting later process. But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
1
vote
2answers
442 views

How do I tell OllyDbg where my source code is?

I am aware of this question, but I don't understand the only answer given. How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?
1
vote
1answer
822 views

Finding the player animation function of a game

I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know ...
1
vote
1answer
10k views

Searching for strings in ollydbg

I have the following program: int main() { char buff[11] = "helloitbd9"; int x = 4; printf("%d", x); return 0; } I can see the string "helloitbd9" through a hexdump of the binary, ...
1
vote
1answer
513 views

Ollydbg not displaying full info

Ollydbg isn't displaying the full info for me sometimes. (I want to see the function names like on the left side) How can I get it to display the function names all the time?
1
vote
1answer
2k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
1
vote
1answer
1k views

OllyDBG translate ASM to C

I'm trying to reverse engineer an library function back to C/C++ code. But the function that I reverse is almust done, i just need a little bit help for making it compleet. Here is the assembly code:...
1
vote
1answer
323 views

List arrays (de-reference pointers) in Ollydbg

I'm trying to interpret some contents of memory, it would be nice to decode contents of the lower left window in Olly (memory hex dump). A specific example is a char** array. Specifically char *argv[...
1
vote
1answer
691 views

Search via push address in OllyDbg

I have an address (eg. 00423D8C) and I would like to know how to make a search on the main thread like this : PUSH 00423D8C (and so is it is possible). Here is an example of what I would like to get ...
1
vote
1answer
639 views

Why do i get into endless loop in winapi when i am debugging?

I am debugging some quiz program called "abex crackme 1" When I execute this program without debugging, it shows a simple message box, which reads "Make me think your HD is a CD-Rom" After I click ...
1
vote
1answer
519 views

Anti-Debugging technique in Os-monitor [closed]

Im trying to bypass some trial functionnalities in os-monitor, the point is, after running it through ollydbg, a notification appears to tell that executable segment is encrypted with exe-packing ...
1
vote
2answers
12k views

OllyDbg find function by name

I have exe file that I want to edit function in it. I know what is the function name, but how can I found the address by it name?
1
vote
1answer
889 views

How to find out why OllyDbg crashes?

I'm using OllyDbg v2.01 to analyse a specific binary. The binary is calling createProcess() and afterwards it's checking the return value via test eax, eax. EAX contains 00000001 so the createProcess()...
1
vote
2answers
348 views

Reaching an address with ollydbg

I have some questions about how to reach an address by bypassing a few hundred lines. Assume that we have the following scenario: + -----------------------+ 004019EF | ...
1
vote
4answers
2k views

How to cause program to stop execution when a particular value is found in memory

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X ...
1
vote
1answer
3k views

Debugging the code executed on a new thread

I would like to step into some code which is ran on a new thread. Luckily, after the initial startup this is the only thread that is newly created in the program. I can set the debugger to break on ...
1
vote
1answer
315 views

Strange behaviour of Wine dlls under OllyDbg [duplicate]

I've noticed something strange. OllyDbg seems to correctly load Wine's own dlls. But when I check PE header in OllyDBG it differs from that what I would expect. In all other cases file content is an ...
1
vote
1answer
2k views

How to dump a DLL not listed using Process Explore and similar tools

I am trying to reverse engineer a DLL that may contain malware. One thing I noticed is that it hides itself from the DLL LDR_MODULE list. So, when I use Ollydbg or smiler tools I do not see it and ...