21 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
Clint_2018's user avatar
14 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
mrexodia's user avatar
  • 1,652
10 votes
Accepted

Where ES/GS/FS are pointing to?

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
NirIzr's user avatar
  • 11.8k
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
mrexodia's user avatar
  • 1,652
9 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
dsasmblr's user avatar
  • 2,234
9 votes

How to see addresses in Graph view in IDA

Switch to graph mode, then go to menu Options-General, Disassembly tab and enable [x] Line Prefixes (graph) Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605....
Igor Skochinsky's user avatar
  • 36.6k
7 votes
Accepted

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
jvoisin's user avatar
  • 2,516
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,989
6 votes

Reverse engineer a checksum algorithm from application

Here are the ideas I came up with: Use CheatEngine's advanced memory analysis to "breakpoint whenever the value 0x12345678 appears somewhere". Use any decent debugger's (such as OllyDbg) to add a ...
NirIzr's user avatar
  • 11.8k
6 votes

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its ...
Megabeets's user avatar
  • 8,989
6 votes

What is the difference between IDA and OllyDbg?

OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis. IDA is the de-facto tool for doing static analysis and ...
joxeankoret's user avatar
  • 4,488
6 votes
Accepted

replacing static value with variable

Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear. MOV DWORD PTR SS:[EBP-30],400400 MOV DWORD PTR SS:[...
Abigail's user avatar
  • 684
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
Jason Geffner's user avatar
5 votes
Accepted

Find messagebox string with ollydbg

There are many, many possible reasons: the MessageBox text may be combined from several shorter snippets before being used the text may be hidden in the resource part of the executable the text may ...
Guntram Blohm's user avatar
5 votes
Accepted

Getting Access Violation when patching a program

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, ...
NirIzr's user avatar
  • 11.8k
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
mrexodia's user avatar
  • 1,652
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
Igor Skochinsky's user avatar
  • 36.6k
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Searching for strings in ollydbg

From my experience, OllyDbg is not so good with handling string references. Is it because the search only looks for strings which are used in functions? As far as I know, "Search for >> All ...
Megabeets's user avatar
  • 8,989
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
peter ferrie's user avatar
  • 4,709
5 votes
Accepted

Searching for comments in ollydbg

Searching for user comments can be done like this: OllyDbg V1 Right Click >> Search for >> User-defined comment OllyDbg V2 Right Click >> Search for >> All user comments ...
Megabeets's user avatar
  • 8,989
5 votes
Accepted

what means ollydbg EIP location?

To quote from the "X86 Assembly book" in WikiBooks: The EIP (Extended Instruction Pointer) register contains the address of the next instruction to be executed if no branching is done. EIP ...
Megabeets's user avatar
  • 8,989
4 votes

ollydbg ASLR and DEP bypass without mona

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
xyz's user avatar
  • 173
4 votes

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

Sorry for the late answer but I only now noticed this question. Disclaimer: I work at Hex-Rays, mainly on IDA development. It so happens that we have a few blind users. With their help, in recent ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

A thought - Visual Studio has good accessibility features (according to their blog at least) and it can display assembly code for a compiled app. This is good if you want to learn what complied ...
Vitaly Osipov's user avatar
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
NirIzr's user avatar
  • 11.8k
4 votes

How are addresses calculated from the values in x86 segment registers?

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
NirIzr's user avatar
  • 11.8k
4 votes

EBP + C what is that?

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the ...
Nordwald's user avatar
  • 2,906
4 votes

Ollydbg not displaying full info

OllyDbg, just as other debuggers, needs symbol information in order to retrieve function names. Such information is usually kept inside a Program Database (PDB) file or DBG file which produced by the ...
Megabeets's user avatar
  • 8,989
4 votes

What other methods can be used to find file paths in an executable?

there are API's that are required to write to a file an example of documented apis used to open and write to a file are file open -> kernel32.CreateFile file write -> kernel32!WriteFile these apis ...
blabb's user avatar
  • 16.4k

Only top scored, non community-wiki answers of a minimum length are eligible