Skip to main content
21 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
Clint_2018's user avatar
14 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
mrexodia's user avatar
  • 1,697
11 votes
Accepted

Where ES/GS/FS are pointing to?

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
NirIzr's user avatar
  • 11.8k
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
mrexodia's user avatar
  • 1,697
9 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
dsasmblr's user avatar
  • 2,234
9 votes

How to see addresses in Graph view in IDA

Switch to graph mode, then go to menu Options-General, Disassembly tab and enable [x] Line Prefixes (graph) Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605....
Igor Skochinsky's user avatar
  • 36.8k
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,999
6 votes

Reverse engineer a checksum algorithm from application

Here are the ideas I came up with: Use CheatEngine's advanced memory analysis to "breakpoint whenever the value 0x12345678 appears somewhere". Use any decent debugger's (such as OllyDbg) to add a ...
NirIzr's user avatar
  • 11.8k
6 votes

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

OllyDbg has stopped the execution at ntdll!RtlUserThreadStart, what seems like almost the "System Breakpoint" which is the location where the operating system uses to break so the debugger can do its ...
Megabeets's user avatar
  • 8,999
6 votes

What is the difference between IDA and OllyDbg?

OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis. IDA is the de-facto tool for doing static analysis and ...
joxeankoret's user avatar
  • 4,488
6 votes
Accepted

replacing static value with variable

Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear. MOV DWORD PTR SS:[EBP-30],400400 MOV DWORD PTR SS:[...
Abigail's user avatar
  • 684
5 votes
Accepted

Getting Access Violation when patching a program

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, ...
NirIzr's user avatar
  • 11.8k
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
mrexodia's user avatar
  • 1,697
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
Igor Skochinsky's user avatar
  • 36.8k
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Searching for strings in ollydbg

From my experience, OllyDbg is not so good with handling string references. Is it because the search only looks for strings which are used in functions? As far as I know, "Search for >> All ...
Megabeets's user avatar
  • 8,999
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
peter ferrie's user avatar
  • 4,709
5 votes
Accepted

Searching for comments in ollydbg

Searching for user comments can be done like this: OllyDbg V1 Right Click >> Search for >> User-defined comment OllyDbg V2 Right Click >> Search for >> All user comments ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

what means ollydbg EIP location?

To quote from the "X86 Assembly book" in WikiBooks: The EIP (Extended Instruction Pointer) register contains the address of the next instruction to be executed if no branching is done. EIP ...
Megabeets's user avatar
  • 8,999
4 votes

ollydbg ASLR and DEP bypass without mona

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
xyz's user avatar
  • 173
4 votes

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

Sorry for the late answer but I only now noticed this question. Disclaimer: I work at Hex-Rays, mainly on IDA development. It so happens that we have a few blind users. With their help, in recent ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
NirIzr's user avatar
  • 11.8k
4 votes

How are addresses calculated from the values in x86 segment registers?

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
NirIzr's user avatar
  • 11.8k
4 votes

EBP + C what is that?

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the ...
Nordwald's user avatar
  • 2,906
4 votes

Ollydbg not displaying full info

OllyDbg, just as other debuggers, needs symbol information in order to retrieve function names. Such information is usually kept inside a Program Database (PDB) file or DBG file which produced by the ...
Megabeets's user avatar
  • 8,999
4 votes

What other methods can be used to find file paths in an executable?

there are API's that are required to write to a file an example of documented apis used to open and write to a file are file open -> kernel32.CreateFile file write -> kernel32!WriteFile these apis ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

getting the static address/offset of a variable

Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic. You can try with Cheat engine (CE). If ...
Riptide's user avatar
  • 188
4 votes
Accepted

How to set a Mouse Click BreakPoint in OllyDbg?

All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is LRESULT CALLBACK WindowProc( _In_ HWND hwnd, _In_ UINT uMsg, _In_ WPARAM wParam,...
blabb's user avatar
  • 16.4k
4 votes
Accepted

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image ...
NirIzr's user avatar
  • 11.8k
4 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use OllyDbg over x32dbg/x64dbg. Since OllyDbg was the debugger of choice for so ...
dsasmblr's user avatar
  • 2,234

Only top scored, non community-wiki answers of a minimum length are eligible