Stack Overflow
Stack Overflow

Questions tagged [ollydbg]

OllyDbg is a Ring3, Win32 debugger.

OllyDbg is a Windows 32-bit assembly level debugger and disassembler created by Oleh Yuschuk. OllyDbg operates in Ring3, or userland, rendering it unable to debug device drivers and kernel components.

It supports user created plugins. Currently version 2 is in development by Oleh.

More information can be gotten from the homepage.

276 questions
0
votes
1 answer

Unknown module in OllyDbg 2.01 "Assemble" command

I'm disassembly a crack-me and I want to replace an empty space with the WINAPI SetDlgItemText() which takes three parameters. I successfully added the three "push" instruction but when I try to assemble call OllyDbg…
incud
  • 541
  • 1
  • 9
  • 17
0
votes
0 answers

Sometimes some of my bytes disappear in my exploit. Why?

I try write my own exploit. The idea is simple - overwrite return address to place where is opcode 'jmp esp'. In esp is address of my shellcode. So I have this simple program: #include #include void do_something(char…
Mariusz
  • 349
  • 2
  • 7
0
votes
1 answer

Recognizing passed parameters in a CALL instruction using Ollydbg

The calling convention used in assembly differs depending to the compiler. The Question is: How ollydbg2.01 would help me to recognize the parameters passed from caller to the callee and values returned back to the caller from the callee for a CALL…
was.chm
  • 15
  • 3
0
votes
2 answers

Get more detailed comments in OllyDBG

I'm trying to get to know OllyDbg (1.10) a bit, but one specific setting I couldn't find. I saw in a tutorial movie the following: POP ECX ; Test.00627CB But in my version of Olly, I just see the POP ECX. No commenting. I checked all the…
Steven Van Ingelgem
  • 872
  • 2
  • 9
  • 25
0
votes
2 answers

Hexadecimal editing with and without ollydbg weird issue

I am very confused with this one. I was trying to do some manually exe patching because I had an idea for a program. so I made a really small file in assembly (5kb) that just basically creates a txt file. I opened it up with ollydbg and added this…
Darrin Woolit
  • 69
  • 1
  • 7
0
votes
1 answer

Decompiling x86 PE binary to C?

I'd like to know if there's any way to generate the C code of a x86 PE binary. I don't really need this, I just want to learn how some closed-source software are working. From my common sense, I think the process is: Converting the x86 binary to…
Alon Gubkin
  • 56,458
  • 54
  • 195
  • 288
0
votes
1 answer

Conditional Breakpoint, EBP contains string pointer

I need to use a conditional breakpoint to find the location when EBP-44 contains the pointer to a specific string. I tried using ollydbg, but because EBP-44 is mostly 0 (or other unreadable memory) the Run Trace fails with Run trace: invalid…
JINX
  • 43
  • 6
0
votes
1 answer

error when trying to move the first byte from a string into a register

I'm pretty new at masm and I need to make a pocket calculator. I have done the macros for +, -, /, * and i'm putting my expression in the EBX register. for example: I type "1 + 2 =" and the EBX takes all that string and stores it. I'm trying to…
hepifish
  • 734
  • 1
  • 9
  • 15
0
votes
1 answer

ollydbg change unicode string bulk method

I want to change many of parts of a unicode string in ollydbg. Is there any plugin or trick that can be used to replace bulky of unicode string at once? For example, if 100 unicode 'test' words exist in the string reference then I want to change all…
user3138338
  • 91
  • 3
  • 10
0
votes
1 answer

What does Ollydbg termination code 0 and 1 means?

I am debuggin an application. After loading i click f9 then program is getting terminated. Termination code at the bottom-left of ollydbg is showing status 1. I want to know What does Ollydbg termination code 0 and 1 means?
Mavenkp
  • 27
  • 1
  • 2
  • 6
0
votes
1 answer

Save run trace in OllyDbg 1.10 using ODbgScript

I'm trying to automate Ollydbg 1.10 to run a program in trace over mode and save it to a log file. I'm using ODbgScript plugin to do this. Here is the commands manual. The script skeleton looks like this: coe //continue to run after…
assafmo
  • 1,047
  • 3
  • 15
  • 32
0
votes
1 answer

Which version of assembly does OllyDbg disassemble binary to?

So I understand that there are many assemblers such as MASM, FASM, NASM, etc. But which version is the disassembler in OllyDbg and Cheat Engine?
user2601542
  • 1
  • 1
0
votes
1 answer

determine the address of the allocated region in VirtualAlloc?

According to this VirtualAlloc allows the value of address parameter to be null and the "the system determines where to allocate the region." The question is, is there a way to know the allocated address? If yes, how?
srh snl
  • 797
  • 1
  • 19
  • 42
0
votes
1 answer

ollydbg entry point changes after run

I have been following a lot of tutorials on how to use ollydbg, but I have a problem that seems to be consistent across different executables. The entry point seems to be "crap", but changes after the initial run. This makes it extremely hard to…
Jano
  • 1
  • 2
0
votes
4 answers

Tips for debugging a made-for-linux application on windows?

I'm trying to find the source of a bug I have found in an open-source application. I have managed to get a build up and running on my Windows machine, but I'm having trouble finding the spot in the disassembly where the issue is. I have tried three…
John Gietzen
  • 48,783
  • 32
  • 145
  • 190
1 2 3
…
18 19