Hot answers tagged

19 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
  • 206
12 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
  • 1,602
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
  • 1,602
7 votes
Accepted

how to attach to a process as soon as it is loaded in memory

One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads. Some other way ...
  • 5,890
7 votes

Where is the code for a global variable declaration in Ollydbg?

The C compiler doesn't create any assembly code to declare and initialize global fundamental data types, so you won't see anything like MOV ..., 3 in OllyDbg for your program above. In the ...
7 votes
Accepted

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
  • 2,486
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
  • 8,689
7 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
  • 2,164
7 votes

How to see addresses in Graph view in IDA

Switch to graph mode, then go to menu Options-General, Disassembly tab and enable [x] Line Prefixes (graph) Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605....
  • 35.1k
6 votes

Are there any modern assembly-level patching tools?

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.
  • 61
6 votes
Accepted

Why doesn't Olly's analyzation work properly in this code section?

Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no ...
6 votes
Accepted

OllyDBG, managed to patch file, now can I automate this?

Okay, I suppose you just want to create a program that patches the already existing file, so here's how I'd do it. First, you need the offset in the file. That means that offset 0 is the first byte, ...
  • 1,273
6 votes
Accepted

Best and smarter way to improve unpacking skills

There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic ...
  • 1,062
6 votes
Accepted

How to set a breakpoint at the specific location on the stack in OllyDbg

Take the offset of the stack place you wanna breakpoint at Go to memory dump, and press Ctrl + G (Go), and put the address there, and press Ok Right click the first value, and go to Breakpoint -> ...
  • 1,273
6 votes

Use OllyDbg to identify what happens when a button is pressed

If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To ...
  • 2,862
6 votes

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer: For a dump to work correctly, there are a couple of more things you need to do ...
  • 1,043
6 votes

how to add instructions to executable

What you're looking for is a codecave. Take a look at http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves; it has a good intro on how to get started.
  • 1,331
6 votes

Reverse engineer a checksum algorithm from application

Here are the ideas I came up with: Use CheatEngine's advanced memory analysis to "breakpoint whenever the value 0x12345678 appears somewhere". Use any decent debugger's (such as OllyDbg) to add a ...
  • 11.4k
6 votes
Accepted

Where ES/GS/FS are pointing to?

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
  • 11.4k
6 votes

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its ...
  • 8,689
5 votes

Looking for the specific text in EXE file

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode. If ...
  • 117
5 votes
Accepted

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, ...
5 votes
Accepted

Reversing a Windows service

If you want to debug the service initialization and it happens automatically (not triggered by some action you perform), you probably can't do it on any Windows newer than XP with ollydbg. You'll have ...
  • 632
5 votes
Accepted

\xDA\x9Fb - what's that?

As Ian Cook said, the most likely scenario is that this "ASCII" is not a string at all. Disassemblers like OllyDbg will call pretty much anything "ASCII" if it's zero terminated and does not contain ...
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
5 votes
Accepted

Find messagebox string with ollydbg

There are many, many possible reasons: the MessageBox text may be combined from several shorter snippets before being used the text may be hidden in the resource part of the executable the text may ...
5 votes
Accepted

Getting Access Violation when patching a program

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, ...
  • 11.4k
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
  • 1,602
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
  • 35.1k

Only top scored, non community-wiki answers of a minimum length are eligible