21
votes
Accepted
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
- 226
14
votes
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
Disclaimer: I am the main developer of x64dbg, take that into account :)
I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
- 1,652
10
votes
Accepted
When to use OllyDgb over Immunity Debugger
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
- 20.6k
9
votes
Displaying IDA names in x64dbg or OllyDbg
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
- 1,652
9
votes
Accepted
Where ES/GS/FS are pointing to?
On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
- 11.7k
8
votes
What is the difference between IDA and OllyDbg?
To put it very simply, there are two primary methods of analysis:
Static Analysis: Analyzing an executable while it's not running.
Dynamic Analysis: Analyzing an executable while it's running.
IDA ...
- 2,204
8
votes
How to see addresses in Graph view in IDA
Switch to graph mode, then go to menu Options-General, Disassembly tab and enable
[x] Line Prefixes (graph)
Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605....
- 36.2k
7
votes
Accepted
Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user
You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
- 2,506
7
votes
How to break when specific text is found
You are searching for Conditional Breakpoints
OllyDBG
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Conditional Breakpoint
Displays dialog window asking user to ...
- 8,909
6
votes
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer:
For a dump to work correctly, there are a couple of more things you need to do ...
- 1,063
6
votes
how to add instructions to executable
What you're looking for is a codecave. Take a look at http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves; it has a good intro on how to get started.
- 1,331
6
votes
Reverse engineer a checksum algorithm from application
Here are the ideas I came up with:
Use CheatEngine's advanced memory analysis to "breakpoint whenever the value 0x12345678 appears somewhere".
Use any decent debugger's (such as OllyDbg) to add a ...
- 11.7k
6
votes
OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application
OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its ...
- 8,909
6
votes
Accepted
replacing static value with variable
Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear.
MOV DWORD PTR SS:[EBP-30],400400
MOV DWORD PTR SS:[...
- 684
5
votes
Accepted
Reversing a Windows service
If you want to debug the service initialization and it happens automatically (not triggered by some action you perform), you probably can't do it on any Windows newer than XP with ollydbg. You'll have ...
- 632
5
votes
Accepted
\xDA\x9Fb - what's that?
As Ian Cook said, the most likely scenario is that this "ASCII" is not a string at all.
Disassemblers like OllyDbg will call pretty much anything "ASCII" if it's zero terminated and does not contain ...
- 257
5
votes
Accepted
Patching a string using DLL injection and OllyDbg
How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))?
A process doesn't have a base offset; I believe you mean the base ...
- 20.6k
5
votes
Accepted
Find messagebox string with ollydbg
There are many, many possible reasons:
the MessageBox text may be combined from several shorter snippets before being used
the text may be hidden in the resource part of the executable
the text may ...
- 12.9k
5
votes
Accepted
Getting Access Violation when patching a program
This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write.
This can happen because that address's page is protected and cannot be written to, ...
- 11.7k
5
votes
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
- 1,652
5
votes
How are addresses calculated from the values in x86 segment registers?
In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
- 36.2k
5
votes
how to overcome setunhandledexceptionfilter in ollyDebugger?
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed ...
- 11.7k
5
votes
Accepted
Searching for strings in ollydbg
From my experience, OllyDbg is not so good with handling string references.
Is it because the search only looks for strings which are used in functions?
As far as I know, "Search for >> All ...
- 8,909
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,701
5
votes
Accepted
Searching for comments in ollydbg
Searching for user comments can be done like this:
OllyDbg V1
Right Click >> Search for >> User-defined comment
OllyDbg V2
Right Click >> Search for >> All user comments
...
- 8,909
5
votes
Accepted
what means ollydbg EIP location?
To quote from the "X86 Assembly book" in WikiBooks:
The EIP (Extended Instruction Pointer) register contains the address
of the next instruction to be executed if no branching is done.
EIP ...
- 8,909
5
votes
What is the difference between IDA and OllyDbg?
OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis.
IDA is the de-facto tool for doing static analysis and ...
- 4,425
4
votes
Accepted
Use the functionality available in the unknown DLL
I can't post comments for now, since I'm new on this forum
I'm not sure I fully understand your level of understanding here. Do you know some basic stuff in reversing field ?
If so, you should load ...
- 465
4
votes
OllyDbg - how to jump to a specific section within a (PE) Portable Executable?
Hit Ctrl+G and enter the address of the code you want to execute. Then press Ctrl+* (the numeric keypad * key, not the Shift+F8 key).
- 20.6k
4
votes
Accepted
Ollydbg v 1.10 plugin writing
ReadCommand() Returns bytes from internally cached buffer and returns atmost MAXCMDSIZE Bytes
the below snippet will take an address (HEX ONLY)
read the command print the bytes and disassembly ...
- 16.2k
Only top scored, non community-wiki answers of a minimum length are eligible