Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
4answers
2k views

How to cause program to stop execution when a particular value is found in memory

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X ...
1
vote
1answer
4k views

Debugging the code executed on a new thread

I would like to step into some code which is ran on a new thread. Luckily, after the initial startup this is the only thread that is newly created in the program. I can set the debugger to break on ...
1
vote
1answer
350 views

Strange behaviour of Wine dlls under OllyDbg [duplicate]

I've noticed something strange. OllyDbg seems to correctly load Wine's own dlls. But when I check PE header in OllyDBG it differs from that what I would expect. In all other cases file content is an ...
1
vote
1answer
2k views

How can I tell if an app is using anti-debug techniques? [closed]

How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
1
vote
2answers
87 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
1
vote
2answers
919 views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
1
vote
1answer
394 views

Why do debuggers sometimes not show entire call stack?

There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg. Let me explain what I mean. Consider this example: I ...
1
vote
2answers
4k views

What is \Sessions\1\BaseNamedObjects\NamedBuffer?

I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are. Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
1
vote
2answers
665 views

How to bypass or block GetSystemTime?

I have a DLL that call GetSystemTimeAsFileTime and set it for check time to prevent program runing Now I want to replace it with fixed date and time for example 07/25/2017 instead of real and dynamic ...
1
vote
1answer
5k views

Access violation when reading [OLLYDEBUG]

Any time I try to crack a program I get this error in olly: What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
1
vote
1answer
3k views

OllyDbg: how to record all funtion calls for attached process

I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10. I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here. My plan is: I ...
1
vote
1answer
1k views

x64dbg and ollydbg error not enough memory

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
1
vote
1answer
2k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
1
vote
1answer
872 views

How do you calculate Address Start / Size of PE Section like .rdata / .data

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine. I started of with trying to map the memory map's addresses exactly the same ...
1
vote
1answer
402 views

False positives with conditional breakpoint in OllyDBG

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW()...
1
vote
2answers
2k views

how to find OEP when packer runs from original code section?

i think its pretty easy to find the OEP when the packer runs from a different section. there are many tricks, such as running a trace until you hit the codesection, or breaking on writes to the IAT, ...
1
vote
1answer
708 views

OllyDbg Labelling

As you know, OllyDbg provides labelling. When I see referenced address which assembly code has, I would get information(Label name) if referenced address is labeled. But If labeled address would be ...
1
vote
1answer
1k views

Find function that references string

I want to hook a certain function in a program, the problem is I don't know where the function is located. All I know is that it takes as an argument a string. A string that I know. My problem is I am ...
1
vote
2answers
890 views

Find and step VEH handlers with Olly?

I was looking for a way to get to the VEH handler (specified by the application being reversed) that gets called when an exception occurs. I have read this question and it explains some things nicely, ...
1
vote
1answer
819 views

How to efficiently debug Loops with OllyDbg/Immunity?

I'm currently reversing a function which looks like the following .text:0040383F 8D 04 BF lea eax, [edi+edi*4] .text:00403842 6A 14 push 20 .text:00403844 C1 E0 03 ...
1
vote
2answers
6k views

Hints to reverse engineering a QT software

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA. This software use a protection schema to indetify the number of click made on a QList. After a random amount ...
1
vote
1answer
886 views

Would OllyDbg help recognizing the passed parameters between the caller and the calle?

The calling convention used in assembly differs depending to the compiler, so I need to know How ollydbg2.01 would help me to recognize the parameters passed from caller to the callee and the values ...
1
vote
2answers
449 views

Passing an environment to debugged program in Olly/Immunity

I am debugging a program that reads an environment variable. So far, I could not find how to launch it in Immunity/Olly with a custom environment. Anybody know how this can be done?
1
vote
1answer
2k views

After a CALL instruction, jumping to RETN

I'm trying to analyze a piece of code, I'm confused about the following line: CALL fct.00402589 Then after that, I come across a block beginning with RETN.(See below)Here are a couple of lines of ...
1
vote
1answer
1k views

Why is mhook failing to hook my function?

So I'm exploring mhook 2.3 and have build a sample executable specifically for this purpose. I have an injector that injects a dll containing mhook into the target process. This all works ...
1
vote
1answer
78 views

Dump array of char* ASCII text to file? (ollydbg or x32dbg)

This question is similar to: List arrays (de-reference pointers) in Ollydbg I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
1
vote
1answer
82 views

HIEW Sharing Violation On Edit

I'm still very new to the whole reverse engineering field. I wanted to start learning by bypassing an activation code prompt. I found the line in OllyDbg, and moved the EXE to HIEW (Hacker Eye View) ...
1
vote
1answer
224 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
1answer
105 views

Detailed API call descriptions not available in x64dbg

I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying ! There is an example from the two ...
1
vote
1answer
370 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
1
vote
1answer
191 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
391 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
1
vote
1answer
109 views

OD mode change from kernel to normal

I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
1
vote
1answer
197 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
1
vote
1answer
242 views

Unable to find Send/Recv type calls in Network Application

Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client. I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
1
vote
2answers
782 views

Why the program can't write to specific memory area

I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here). When I run it without debuggers in my VMWare it runs without errors. I started to analyze it with ...
1
vote
1answer
323 views

What is the quickest way to run code of my own DLL?

Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly ...
1
vote
1answer
543 views

What are all those instructions before the initally selected instruction in OllyDbg?

When I open a program in a debugger like OllyDbg or x64dbg, there are a lot of instructions before the initially selected instruction. Why does the debugger choose this instruction specifically to ...
1
vote
2answers
8k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
1
vote
1answer
125 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
1
vote
1answer
164 views

Ollydbg| Inconsistent results as compared to the stack view pane

I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor ...
1
vote
1answer
2k views

Unpacking ASpack Malware

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement: MOV ...
1
vote
1answer
644 views

Memory activity tracking

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and ...
1
vote
1answer
632 views

How to check if a memory range or an address is DEP-enabled or not?

Is there any easy way by using windbg/ollydbg to figure out a memory range or simply an address is DEP-enabled or not?
1
vote
2answers
1k views

Recognizing CLib functions in Ollydbg or IDA

I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
1
vote
1answer
1k views

IDA Pro - Error When Modifying JMP Instruction

I am new to ASM. Working in IDA Pro 6.8 on a 64-bit executable. I am not able to modify the jmp address for this instruction: ........ .text:0000000141BAFB57 loc_141BAFB57: ...
1
vote
1answer
3k views

OllyDbg plugins not working

I am using OllyDbg 2.1.0.4 and I cant get any plugins to work. I have tried ODbgScript.1.82, OllyDump v2.1.0.2 and Advanced Labels v1.3.0.9. When I tried the first two I got Plugins tab greyed out. ...
1
vote
1answer
760 views

OllyDbg, breakpoint log and encoding

I can set up a breakpoint in OllyDbg and make it log a string in following ways: [esp-4] - OllyDbg will figure out if it should log a number, a string or whatever STRING [[esp-4]] - OllyDbg will show ...
1
vote
3answers
462 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...

1
3 4
5
6 7
9