Hot answers tagged

25

It very much depends on what framework they use in order to do their windowing. It could be MFC, WPF, WinForms, WTL, QT, wxWidgets, pure Windows API. There's a lot of frameworks and they all handle the final routing of messages differently. I'll answer the question for the cases that are either directly built on top of Windows API or where they're using the ...


22

The SCAS instruction is used to scan a string (SCAS = SCan A String). It compares the content of the accumulator (AL, AX, or EAX) against the current value pointed at by ES:[EDI]. When used together with the REPNE prefix (REPeat while Not Equal), SCAS scans the string searching for the first string element which is equal to the value in the accumulator. ...


17

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly). There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more ...


16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. and static analysis of a binary. Static program analysis is the analysis of computer software that is ...


15

IDA Pro offers two tracing options: Instruction tracing Debugger->Tracing->Instruction Tracing It is very slow tracing process, since IDA monitors registers and has to record the address, the instruction, and changes values of registers, that were changed by the instruction. Function tracing Debugger->Tracing->Function Tracing. It is a subcategory of ...


14

I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out. My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...


13

Here is a way how you would go back to the caller. The following is a small C++ crackme for demonstration #include<stdio.h> #include<string.h> #include<conio.h> int main() { char code[50]; char valid[]="12345"; printf("Enter your password : \n"); gets(code); if(!strcmp(code,valid)) printf(&...


11

open calc.exe in ollydbg c:\ollydbg.exe calc.exe press Ctrl + G and type GetMessageW press F2 to set a breakpoint and press F9 until it breaks when it is broken press ctrl+f9 to run until return press shift+f4 to set a conditional log breakpoint in the expression edit box type [esp+4] in the decode value of expression select pointer to MSG structure (UNICODE)...


10

Given your requirements, you'd be much better off sticking with WinDbg. OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need. OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.


9

@DCoder has certainly answered this, so here is only some notes, or, at least it started out as a short note, and ended up as a monster. OllyDbg uses MASM by default (with some extension). In other words: operation target, source Other syntaxes are available under (depending on version): Options->Debugging Options->Disasm Options->Code E.g. IDEAL, HLA ...


9

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.


9

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If you are working on a modern system I think x64dbg is a better choice because it was designed to work there. That said, x64dbg isn’t better in all aspects. One ...


8

There is clearly not enough of information to get you the exact answer. However, I will try my best to demonstrate logic behind what happens. That in a way might give you an idea how to go about locating the encryption function. I will assume you are using Windows, since it has not being stated otherwise. The main logic of ordinary (and when I say ordinary,...


8

While in the CPU/Disassembly window, press Ctrl+G (for "Goto"). Type "send" and press the OK button. This should bring you to the address of the send() function in WS2_32.dll and you can set a breakpoint on this address.


8

Select the MOV EDI, EAX instruction and press Shift+F4 to open the Conditional log breakpoint window. In that window, specify eax as the expression, set Pause program to Never, and set Log value of expressions to Always: Press the OK button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is ...


8

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.


7

Set breakpoints on GetWindowText() and GetDlgItemText() and have the target program read your input text. If the breakpoint is hit, you can trace up the call-stack to see what code is reading your input text and where in memory it's being stored. If neither breakpoint is hit, you can try setting a conditional breakpoint on SendMessage(), filtering it to ...


7

Go to the memory window in Ollydbg. Find the code section (usually .text) of the module you want to break on return to. Right click the memory section and set break-on-access or hit F2. You'll break once execution reaches that memory. You can also change the memory access to read only and you'll get an exception when execution hits that memory segment. You ...


7

The usual approaches to this: Start typing what you want to say, but don't submit it yet. Use Cheat Engine to perform a memory scan for the string you have typed. Once you've found it, set a read-only HWBP, then submit the chat. The chat function should perform a read on the memory holding your chat string, setting off the BP. Hook strcpy() and related ...


7

Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc). The value is non-zero on my system, but it is different value, and it's not constant. Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the ...


7

The C compiler doesn't create any assembly code to declare and initialize global fundamental data types, so you won't see anything like MOV ..., 3 in OllyDbg for your program above. In the disassembly of your program below, you can see that the global variable is stored at dword_402000, which is hardcoded to begin with a value of 3:


7

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// protocols ;) All of them have a textual interface that should be suitable for braille-interfaces. But I guess that the killer-feature of radare2 for blind people is ...


7

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA is primarily geared towards static analysis (though it does have dynamic debugging functionality, as you've noted), where OllyDbg (and x32dbg/x64dbg, Immunity ...


6

I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static & dynamic. The definitions provided here come from this 2003 publication on code obfuscation : http://www.cs.arizona.edu/solar/papers/CCS2003.pdf Static disassembly is where the file being disassembled isn't executed during the course of ...


6

My guess: DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883 ^^ ^ ^ ^^^^ || Addr Data CRC16 |` Length ` Data tag D for data L20 for 0x20 or 32 hex bytes, or 64 hex digits I000000 the address (note ...


6

FYI, the injection method to which you're referring is called dynamic forking or process hollowing. When you attach to the child process with OllyDbg, OllyDbg will create a new thread for itself, but the main thread (the one that would have been resumed with NtResumeThread() from the parent) will still be suspended. Once you've attached with OllyDbg, you ...


6

PE files have several sections like .code , .data, .bss etc. Each of the sections have a special purpose, such as the .code section usually contains the programs code i.e. the instructions, the .data sections houses the initialized variables etc. The above rule is merely a convention followed by compilers. In a packed/obfuscated program, the convention may ...


6

No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should locate your main() and set a breakpoint there manually instead. There is a lot going on behind the scene before execution flow reaches main(). The code that ...


6

Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no reason to assume there's code there. See https://stackoverflow.com/questions/13812554/in-ollydbg-how-do-you-force-hint-disassembly-at-a-location for how to ...


6

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.


Only top voted, non community-wiki answers of a minimum length are eligible