Hot answers tagged

19 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
user avatar
  • 206
12 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
user avatar
  • 1,602
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
user avatar
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
user avatar
  • 1,602
7 votes
Accepted

OllyDbg FPU anti-debug

Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc). The value is non-zero on my ...
user avatar
  • 4,511
7 votes

What is the difference between static disassembly and dynamic disassembly?

I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static & dynamic. The definitions provided here come from this 2003 publication on code ...
user avatar
  • 2,603
7 votes

Where is the code for a global variable declaration in Ollydbg?

The C compiler doesn't create any assembly code to declare and initialize global fundamental data types, so you won't see anything like MOV ..., 3 in OllyDbg for your program above. In the ...
user avatar
7 votes
Accepted

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
user avatar
  • 2,486
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
user avatar
  • 8,579
7 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
user avatar
  • 2,144
6 votes

Decoding the wire protocol (over RS232) for custom hardware <-> windows application?

My guess: DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883 ^^ ^ ^ ^^^^ || Addr Data ...
user avatar
6 votes
Accepted

Ollydbg 2: Breaking after attaching to a suspended process

FYI, the injection method to which you're referring is called dynamic forking or process hollowing. When you attach to the child process with OllyDbg, OllyDbg will create a new thread for itself, but ...
user avatar
6 votes
Accepted

Suspicious breakpoint message in ollydbg

PE files have several sections like .code , .data, .bss etc. Each of the sections have a special purpose, such as the .code section usually contains the programs code i.e. the instructions, the .data ...
user avatar
  • 5,850
6 votes
Accepted

Why did the program entry point become 'sub esp, 1C'?

No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should ...
user avatar
6 votes
Accepted

Why doesn't Olly's analyzation work properly in this code section?

Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no ...
user avatar
6 votes

Are there any modern assembly-level patching tools?

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.
user avatar
  • 61
6 votes
Accepted

how to attach to a process as soon as it is loaded in memory

One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads. Some other way ...
user avatar
  • 5,850
6 votes
Accepted

OllyDBG, managed to patch file, now can I automate this?

Okay, I suppose you just want to create a program that patches the already existing file, so here's how I'd do it. First, you need the offset in the file. That means that offset 0 is the first byte, ...
user avatar
  • 1,253
6 votes
Accepted

Best and smarter way to improve unpacking skills

There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic ...
user avatar
  • 1,042
6 votes
Accepted

How to set a breakpoint at the specific location on the stack in OllyDbg

Take the offset of the stack place you wanna breakpoint at Go to memory dump, and press Ctrl + G (Go), and put the address there, and press Ok Right click the first value, and go to Breakpoint -> ...
user avatar
  • 1,253
6 votes

Use OllyDbg to identify what happens when a button is pressed

If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To ...
user avatar
  • 2,832
6 votes

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer: For a dump to work correctly, there are a couple of more things you need to do ...
user avatar
  • 1,043
6 votes

how to add instructions to executable

What you're looking for is a codecave. Take a look at http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves; it has a good intro on how to get started.
user avatar
  • 1,321
6 votes

Reverse engineer a checksum algorithm from application

Here are the ideas I came up with: Use CheatEngine's advanced memory analysis to "breakpoint whenever the value 0x12345678 appears somewhere". Use any decent debugger's (such as OllyDbg) to add a ...
user avatar
  • 11.3k
6 votes
Accepted

Where ES/GS/FS are pointing to?

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
user avatar
  • 11.3k
6 votes

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its ...
user avatar
  • 8,579
6 votes

How to see addresses in Graph view in IDA

Switch to graph mode, then go to menu Options-General, Disassembly tab and enable [x] Line Prefixes (graph) Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605....
user avatar
  • 34.6k
5 votes

Looking for the specific text in EXE file

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode. If ...
user avatar
  • 117
5 votes
Accepted

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, ...
user avatar
5 votes
Accepted

Reversing a Windows service

If you want to debug the service initialization and it happens automatically (not triggered by some action you perform), you probably can't do it on any Windows newer than XP with ollydbg. You'll have ...
user avatar
  • 632

Only top scored, non community-wiki answers of a minimum length are eligible