Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
0
votes
2answers
712 views

large exe in ollydbg

I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process. I am on windows 7, ...
0
votes
2answers
664 views

run a command when bp is hit in OLLY 1.10

I would like to automate a process of enabling buttons with cond bp. First, I found that function user32.EnableWindow is called from mfc110u.dll. So I went there and set cond bp on the second arg of ...
0
votes
1answer
393 views

Most efficient way to extend a program using a DLL [closed]

I have wrote a program in C++ and I built it as a DLL. I want to utilize functions that are in this DLL in another program to overwrite other functions. Unfortunately, they're not any exports and ...
0
votes
1answer
943 views

What are best practices for reversing a dll that is injected into another process?

For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread. How do you do this with ease? Currently I am setting a breakpoint on ...
0
votes
0answers
26 views

Nop the string in online games

So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn My question is how is that possible? I just edit ...
0
votes
0answers
39 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
0
votes
1answer
42 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
0
votes
1answer
67 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
43 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
0answers
40 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
0answers
58 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
0answers
149 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
0answers
49 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
0
votes
2answers
159 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
1answer
61 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
0answers
27 views

All referenced strings using ollydbg

i was trying to search for "All referenced strings using ollydbg v1.10 and got some error "could not read memory of debugged processt(77550000..77626fff) kindly help me solve the problem.[ ][1]
0
votes
1answer
299 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
0answers
96 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
2answers
113 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
1answer
145 views

OllyDbg “runs away” when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
0
votes
1answer
174 views

How to get back to program's main code (user-space) while attaching to de bugger

I have a small program that I wanted to debug. I run OllyDbg version 2 and attached the program to the debugger. I received this window: You can see that the addresses are from the Kernel memory. ...
0
votes
1answer
1k views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
0
votes
1answer
584 views

How do I find address of a global variable in Ollydbg?

I have the line CMP BYTE PTR DS:[EAX+1620], 0 How do I find the memory address of EAX+1620 so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of ...
0
votes
2answers
679 views

How to reverse Engineer a game character position on a map

I'm trying to reverse engineer an online game (Dota 2) to get some more info and build a personal assistant with friendlier/ advanced info about my character. First I'm trying to find out the player ...
0
votes
1answer
768 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware start the ...
0
votes
1answer
370 views

What are all those instructions before the initally selected instruction in OllyDbg?

When I open a program in a debugger like OllyDbg or x64dbg, there are a lot of instructions before the initially selected instruction. Why does the debugger choose this instruction specifically to ...
0
votes
1answer
1k views

Search for sequence of bytes with OllyDbg

I want to search for sequence of bytes in OllyDbg. Is it possible? How can I do this?
0
votes
1answer
433 views

OllyDbg can't set permanent breakpoint

I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, ...
0
votes
1answer
114 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
0
votes
0answers
788 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
0
votes
2answers
417 views

How I can get the text with c# from Tkinter (python) window?

I'm trying to find a way how I can read the textbox inside the idle. The Idle is (I think) written in python (Tkinter ?). I have tried to find the function which reads the textbox.text through ...
0
votes
0answers
245 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
-1
votes
1answer
462 views

Ollydbg gives output in which assembly language instructions in Intel or AT&T syntax?

Ollydbg gives default output in which assembly language instructions in Intel or AT&T syntax ? Is there an option to change the assembly language syntax ?
-1
votes
2answers
705 views

Add Section to pe file function error [closed]

I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...
-1
votes
1answer
323 views

Automated static code analysis

Both IDA Pro and OllyDBG automatically analyze the binary on load to identify whats code and data. I assume its a complicated process and I would like to learn more about this process. How is this ...
-1
votes
1answer
135 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
-1
votes
1answer
659 views

ollydbg: how to set a breakpoint at program exit?

How can I break right when the program I am debugging quits? I don't know how to even locate the relevant code.
-1
votes
1answer
688 views

How to crack windowed crackmes?

I am starting with reverse engineering/cracking with advanced knowledge about programming and functioning of the operating system and I saw a whole series of lena151 Lenas Reversing for Newbies but I ...
-1
votes
1answer
220 views

What syntax does OllyDbg follow in its dissassembly window?

I have some understanding of Assembly after reading some tutorials and a few chapters from the "PC Assembly Book". Right now, I am trying to understand the instructions I see in OllyDbg, but it seems ...
-1
votes
1answer
197 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...
-1
votes
1answer
464 views

How to set a label to a memory address in ollydbg2

I have a lot of CALL 0x000XYZW in my code. I want to tell ollydbg that 0x000XYZW address is the function "my_function", and then see CALL my_function in my CPU window. Is it possible to do that ? ...
-1
votes
1answer
530 views

Wrong default starting address

I have no idea how, when or why, but now, the "default address" (the one executed when pressing F9) is 0x77960884. It should be 0x00401000 (when I manually go to 0x00401000, everything works). The ...
-2
votes
4answers
931 views

How to add new button to an executable?

My target exe file has a button. It will display a webpage when the button is clicked on. I used OllyDBG to disassemble this file. My questions are: How can I find the url of this webpage? I have ...
-2
votes
1answer
390 views

Assembly analyze C system() function

So I made a very simple C program to study how C works on the inside. It has just 1 line in the main() excluding return 0: system("cls"); If I use ollydebugger to analyze this program It will show ...
-2
votes
1answer
121 views

How to get same compare result of Eax value in all window OS [closed]

I just started learning assembly. This is how it look in Ollydbg over Windows XpSp3 32Bit: MOV EAX,ESP ADD EAX,0x20 CMP EAX,0xFFFFF JLE SHORT 008A3E51 CMP EAX,0x12A5B0 JLE SHORT 008A3E38 JMP SHORT ...
-2
votes
1answer
143 views

How can I do this in less than 10 bytes of space?

I have some value stored at a memory location. I have 10 bytes of space and have following to do: push registers copy a string constant "abcedfghijkl" to that memory location restore registers Is it ...
-3
votes
1answer
280 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
-4
votes
1answer
4k views

Set a breakpoint before WriteFile operation in OllyDbg [closed]

In the process monitor, I see a WriteFile operation. How can I set a breakpoint and view everything about this operation in OllyDbg? If this is not possible with OllyDbg, what other tools can I use?