Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
1
vote
1answer
2k views

How can I tell if an app is using anti-debug techniques? [closed]

How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
1
vote
2answers
523 views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
1
vote
1answer
274 views

Why do debuggers sometimes not show entire call stack?

There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg. Let me explain what I mean. Consider this example: I ...
1
vote
2answers
3k views

What is \Sessions\1\BaseNamedObjects\NamedBuffer?

I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are. Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
1
vote
1answer
748 views

Reverse Packet Encryption with server side checks

My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will ...
1
vote
2answers
472 views

How to bypass or block GetSystemTime?

I have a DLL that call GetSystemTimeAsFileTime and set it for check time to prevent program runing Now I want to replace it with fixed date and time for example 07/25/2017 instead of real and dynamic ...
1
vote
1answer
4k views

Access violation when reading [OLLYDEBUG]

Any time I try to crack a program I get this error in olly: What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
1
vote
1answer
2k views

OllyDbg: how to record all funtion calls for attached process

I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10. I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here. My plan is: I ...
1
vote
1answer
811 views

x64dbg and ollydbg error not enough memory

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
1
vote
1answer
1k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
1
vote
1answer
753 views

How do you calculate Address Start / Size of PE Section like .rdata / .data

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine. I started of with trying to map the memory map's addresses exactly the same ...
1
vote
1answer
377 views

False positives with conditional breakpoint in OllyDBG

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW()...
1
vote
2answers
2k views

how to find OEP when packer runs from original code section?

i think its pretty easy to find the OEP when the packer runs from a different section. there are many tricks, such as running a trace until you hit the codesection, or breaking on writes to the IAT, ...
1
vote
1answer
634 views

OllyDbg Labelling

As you know, OllyDbg provides labelling. When I see referenced address which assembly code has, I would get information(Label name) if referenced address is labeled. But If labeled address would be ...
1
vote
1answer
1k views

Find function that references string

I want to hook a certain function in a program, the problem is I don't know where the function is located. All I know is that it takes as an argument a string. A string that I know. My problem is I am ...
1
vote
2answers
783 views

Find and step VEH handlers with Olly?

I was looking for a way to get to the VEH handler (specified by the application being reversed) that gets called when an exception occurs. I have read this question and it explains some things nicely, ...
1
vote
1answer
730 views

How to efficiently debug Loops with OllyDbg/Immunity?

I'm currently reversing a function which looks like the following .text:0040383F 8D 04 BF lea eax, [edi+edi*4] .text:00403842 6A 14 push 20 .text:00403844 C1 E0 03 ...
1
vote
2answers
1k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
1answer
796 views

Would OllyDbg help recognizing the passed parameters between the caller and the calle?

The calling convention used in assembly differs depending to the compiler, so I need to know How ollydbg2.01 would help me to recognize the parameters passed from caller to the callee and the values ...
1
vote
2answers
412 views

Passing an environment to debugged program in Olly/Immunity

I am debugging a program that reads an environment variable. So far, I could not find how to launch it in Immunity/Olly with a custom environment. Anybody know how this can be done?
1
vote
1answer
2k views

After a CALL instruction, jumping to RETN

I'm trying to analyze a piece of code, I'm confused about the following line: CALL fct.00402589 Then after that, I come across a block beginning with RETN.(See below)Here are a couple of lines of ...
1
vote
1answer
994 views

Why is mhook failing to hook my function?

So I'm exploring mhook 2.3 and have build a sample executable specifically for this purpose. I have an injector that injects a dll containing mhook into the target process. This all works ...
1
vote
1answer
66 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
1answer
71 views

Detailed API call descriptions not available in x64dbg

I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying ! There is an example from the two ...
1
vote
1answer
162 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
1
vote
1answer
112 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
335 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
1
vote
1answer
202 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
1
vote
1answer
85 views

OD mode change from kernel to normal

I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks
1
vote
1answer
171 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
1
vote
1answer
204 views

Unable to find Send/Recv type calls in Network Application

Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client. I obtained the free, 5.0 version, of IDA, and disassembled GVOnline....
1
vote
2answers
715 views

Why the program can't write to specific memory area

I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here). When I run it without debuggers in my VMWare it runs without errors. I started to analyze it with ...
1
vote
1answer
302 views

What is the quickest way to run code of my own DLL?

Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly ...
1
vote
2answers
7k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
1
vote
1answer
117 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
1
vote
1answer
164 views

Ollydbg| Inconsistent results as compared to the stack view pane

I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor ...
1
vote
1answer
1k views

Unpacking ASpack Malware

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement: MOV ...
1
vote
1answer
581 views

Memory activity tracking

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and ...
1
vote
1answer
522 views

How to check if a memory range or an address is DEP-enabled or not?

Is there any easy way by using windbg/ollydbg to figure out a memory range or simply an address is DEP-enabled or not?
1
vote
2answers
1k views

Recognizing CLib functions in Ollydbg or IDA

I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
1
vote
1answer
844 views

IDA Pro - Error When Modifying JMP Instruction

I am new to ASM. Working in IDA Pro 6.8 on a 64-bit executable. I am not able to modify the jmp address for this instruction: ........ .text:0000000141BAFB57 loc_141BAFB57: ...
1
vote
1answer
2k views

OllyDbg plugins not working

I am using OllyDbg 2.1.0.4 and I cant get any plugins to work. I have tried ODbgScript.1.82, OllyDump v2.1.0.2 and Advanced Labels v1.3.0.9. When I tried the first two I got Plugins tab greyed out. ...
1
vote
1answer
674 views

OllyDbg, breakpoint log and encoding

I can set up a breakpoint in OllyDbg and make it log a string in following ways: [esp-4] - OllyDbg will figure out if it should log a number, a string or whatever STRING [[esp-4]] - OllyDbg will show ...
1
vote
3answers
407 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
1
vote
3answers
966 views

Ollydbg - Remove analysis from module

for a manuelly unpacking process, I need the option "Remove analysis from module." It can be reached by right-click -> Analysis -> Remove analysis from module. But I can not find it in my ollydbg ...
1
vote
1answer
3k views

How to set Message Breakpoints on button in ollyDbg 2.01?

In OllyDbg 110 there is a point: "Message breakpoint on ClassProc". At OllyDbg 2.01 I can not find it:
1
vote
1answer
3k views

OllDbg error message

I have the follwoing error message: Don't know how to step because memory at address 00000000 is not readable. Try to change EIP or pass exeption to program. Because I dont know how to change the ...
1
vote
1answer
1k views

How to disable a button click using Ollydbg?

I am trying to disable a button of a game client. I have checked the answer of this question about how to set a breakpoint for a button message. But, after clicking the button, it breaks on a ...
1
vote
2answers
2k views

Ollydbg problem

When I run Ollydbg in my Windows7 (x32) using kernel mode in StrongOd Plugin it doesn't load correctly and log shows this error: Log data, item 0 Message=StartService Failed, err = 2 And when ...