Questions tagged [ollydbg]

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

Filter by
Sorted by
Tagged with
0
votes
1answer
147 views

Using breakpoints from OllyDbg in Windbg

I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks. In OllyDbg, the following ...
0
votes
1answer
1k views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
0
votes
1answer
296 views

How to capture Data from OllyDbg window?

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, ...
0
votes
1answer
589 views

How to copy memory strings on OllyDBG v2.01?

I'm trying to figure out how to copy "properly" strings from memory, I see there are very few plugins available for ollydbg2.x.x and the one I've tried, called BinaryCopyEx didn't work ok, for ...
0
votes
1answer
367 views

create a string in ollydbg, x32dbg, immunity or similar

I have found a code cave in an executable and want to call winapi functions. What do i have to write in the assembly window to create a string which can later be referenced? For learning i changed ...
0
votes
1answer
714 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
0
votes
1answer
320 views

Entry point of malicious child process

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
0
votes
1answer
2k views

Is it possible to find the changes of the debugged .exe file ollydbg?

I have two .exe files and one of them was debugged by someone, i want to compare it with the original one and find the codes that was changed, is it possible to do that ? If it's, how can i do it ? ( ...
0
votes
1answer
143 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
0
votes
1answer
133 views

ollydbg plugin patch notification

Im developing a plugin in which I would like to be notified when user makes some modification to the code. I know there is a patch table which can be accessed through Plugingetvalue function but I ...
0
votes
1answer
1k views

how to calculate this distance?

I dont know how to calculate the jump distances : [Address | Binary value| ollydbg(jmp, call...)] 004014B6 $- FF25 30114000 JMP DWORD PTR DS:[<&MSVBVM60.#100>] ; MSVBVM60....
0
votes
2answers
711 views

Reading the process memory yields different results

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
0
votes
2answers
771 views

large exe in ollydbg

I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process. I am on windows 7, ...
0
votes
2answers
680 views

run a command when bp is hit in OLLY 1.10

I would like to automate a process of enabling buttons with cond bp. First, I found that function user32.EnableWindow is called from mfc110u.dll. So I went there and set cond bp on the second arg of ...
0
votes
1answer
407 views

Most efficient way to extend a program using a DLL [closed]

I have wrote a program in C++ and I built it as a DLL. I want to utilize functions that are in this DLL in another program to overwrite other functions. Unfortunately, they're not any exports and ...
0
votes
1answer
962 views

What are best practices for reversing a dll that is injected into another process?

For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread. How do you do this with ease? Currently I am setting a breakpoint on ...
0
votes
0answers
41 views

finding best way to bypassing password check process

i am working to openning or bypassing a password . at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and ...
0
votes
0answers
39 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
0
votes
1answer
57 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
0
votes
1answer
43 views

Is it possible to view PE headers in xdbg just like ollydbg?

In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible?
0
votes
0answers
49 views

Shellcode doesn't match OllyDbg

I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
0
votes
0answers
42 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
0answers
30 views

Ollydbg Plugin Development

I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify ...
0
votes
0answers
27 views

Protections against disassembly tools

I am very new to reverse engineering and thus, I struggle to even know the right search terms for effective research. I have been trying to reverse engineering an encryption algorithm of a software ...
0
votes
0answers
33 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
0
votes
0answers
147 views

Best way to find data in running executable (ollydbg/x32dbg/CheatEngine) that I found in Ghidra?

I have located a function that I would like to reverse engineer in a game. The function pulls character strings from a large array. I am trying to find this array's contents. The line in Ghidra is: ...
0
votes
0answers
77 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
0
votes
1answer
93 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
0
votes
1answer
352 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
52 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
0answers
70 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
0answers
201 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
0answers
94 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
0
votes
1answer
91 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
2answers
171 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
0
votes
1answer
233 views

How to get back to program's main code (user-space) while attaching to de bugger

I have a small program that I wanted to debug. I run OllyDbg version 2 and attached the program to the debugger. I received this window: You can see that the addresses are from the Kernel memory. ...
0
votes
1answer
2k views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
0
votes
1answer
714 views

How do I find address of a global variable in Ollydbg?

I have the line CMP BYTE PTR DS:[EAX+1620], 0 How do I find the memory address of EAX+1620 so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of ...
0
votes
1answer
937 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware ...
0
votes
1answer
2k views

Search for sequence of bytes with OllyDbg

I want to search for sequence of bytes in OllyDbg. Is it possible? How can I do this?
0
votes
1answer
508 views

OllyDbg can't set permanent breakpoint

I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, ...
0
votes
1answer
115 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
0
votes
0answers
864 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
0
votes
2answers
445 views

How I can get the text with c# from Tkinter (python) window?

I'm trying to find a way how I can read the textbox inside the idle. The Idle is (I think) written in python (Tkinter ?). I have tried to find the function which reads the textbox.text through ...
0
votes
0answers
261 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
-1
votes
1answer
498 views

Ollydbg gives output in which assembly language instructions in Intel or AT&T syntax?

Ollydbg gives default output in which assembly language instructions in Intel or AT&T syntax ? Is there an option to change the assembly language syntax ?
-1
votes
2answers
750 views

Add Section to pe file function error [closed]

I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...
-1
votes
1answer
339 views

Automated static code analysis

Both IDA Pro and OllyDBG automatically analyze the binary on load to identify whats code and data. I assume its a complicated process and I would like to learn more about this process. How is this ...
-1
votes
1answer
68 views

ollydbg: CMP - what the difference

What is the difference between: MOV SI,WORD PTR DS:[ESI+0D] CMP SI,1388 and CMP WORD PTR DS:[ESI+0d],1388
-1
votes
1answer
346 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...

1
5 6 7
8
9