All Questions
30 questions
0
votes
0
answers
23
views
Log addresses of every called function in Ollydbg/x64dbg in multi-threaded program
I have 2 programs: one 32bit and the second one 64bit. I use Ollydbg/x64dbg to debug them, respectively. These programs are multi-threaded and I have a difficulty when debugging: when an important ...
3
votes
0
answers
340
views
How to see parameters in stack in x64dbg like in OllyDbg for known API calls?
Based on Detailed API call descriptions not available in x64dbg
When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack:
I've installed both ...
- 161
5
votes
0
answers
690
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 161
2
votes
0
answers
162
views
Find an address of injected code via GetModuleHandleA
I am reversing really old game (20 years old).
l2.exe loads Dsetup.dll Network.dll. (not sure about order)
inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
- 121
4
votes
2
answers
634
views
How to reverse a game and inject a dll in client program?
I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
- 41
1
vote
1
answer
1k
views
x64dbg is unable to find string references vs. Ollydbg
I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
- 89
1
vote
1
answer
192
views
function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?
I need urgent help , I was debugging a software made by Visual basic 6 , and I found
vbavarindexload function and I need to know what is doing ?
Thanks in advance
- 11
1
vote
0
answers
917
views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
- 11
0
votes
1
answer
374
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 101
1
vote
1
answer
2k
views
Calling/debugging calls to DLL via ollydbg or x64dbg
I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end).
How do I ...
0
votes
0
answers
2k
views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
- 1
1
vote
2
answers
601
views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
1
vote
1
answer
412
views
Dump array of char* ASCII text to file? (ollydbg or x32dbg)
This question is similar to: List arrays (de-reference pointers) in Ollydbg
I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
- 11
0
votes
1
answer
261
views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
- 9
2
votes
1
answer
377
views
Detailed API call descriptions not available in x64dbg
I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying !
There is an example from the two ...
- 89
1
vote
1
answer
296
views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
- 11
2
votes
1
answer
2k
views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
- 153
1
vote
0
answers
554
views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
- 11
1
vote
0
answers
74
views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...
- 9
-1
votes
3
answers
757
views
How to know what does the function do?
I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.
My question ...
- 9
1
vote
1
answer
327
views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
- 163
1
vote
1
answer
1k
views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
- 11
24
votes
4
answers
25k
views
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
OllyDbg had been nice in the past, but it stopped development a decade ago, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't ...
- 683
0
votes
1
answer
2k
views
Is there a way to see all "values" in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
- 103
0
votes
1
answer
5k
views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
- 103
2
votes
2
answers
2k
views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
- 23
5
votes
1
answer
451
views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
- 51
4
votes
2
answers
7k
views
How to break when specific text is found
In this line of code:
mov eax,dword ptr [eax+8];
eax+8 contains a long string of text, I want to find out where it originally came from.
In either OllyDbg or x32dbg, how can I break when ...
- 361
0
votes
1
answer
2k
views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
- 191
4
votes
1
answer
3k
views
Displaying IDA names in x64dbg or OllyDbg
I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
- 41