RCE Messageboard's Regroupment

View Full Version: RCE Messageboard's Regroupment

  • General
  • Plugins
  • Bugs
  • Announcements
  • The Heap
  • OllyScript


General

RCE Messageboard's Regroupment > General
Pages : [1] 2 3 4
  1. Welcome! (0 replies)
  2. Greetings! (0 replies)
  3. Kernel32 debugging capability (2 replies)
  4. [TIP] Messages Spy (15 replies)
  5. OllyDebug Implib scanner (4 replies)
  6. OllyDbg and WinXP ? (4 replies)
  7. forcing OllyDbg (2 replies)
  8. [Tip] Log all API calls and arguments (1 replies)
  9. 2k/XP anyone? (3 replies)
  10. Finding trigger for "break on new module (3 replies)
  11. Description of toolbar button function stays for t (1 replies)
  12. ? hook to a dll export? (2 replies)
  13. What's the meaning of this message??? (5 replies)
  14. Watch descriptions.. (2 replies)
  15. Arrows in the hex dump column in the Disassembler (10 replies)
  16. request for a future version (1 replies)
  17. example of using a watch? (4 replies)
  18. Tutorials anyone??? (7 replies)
  19. Meaning of previous and next on an instruction? (1 replies)
  20. Visual clue for bookmarks? (1 replies)
  21. Source code view? (4 replies)
  22. BP on value? (3 replies)
  23. Search and modify (1 replies)
  24. How to use hit trace??? (12 replies)
  25. debug info import? (4 replies)
  26. Can't Resume Thread (1 replies)
  27. Exports for an exe??? (4 replies)
  28. Path to source files (3 replies)
  29. WM_COMMAND HELP !!! (4 replies)
  30. OFFSET to CPU (4 replies)
  31. Just an idea ... let me know what you think (2 replies)
  32. Olly, cracking tutorials and manuals. (34 replies)
  33. ANTI ATTACH ? (10 replies)
  34. Lock-up when debugging (3 replies)
  35. How I can fix the Sections after OllyDump (3 replies)
  36. Scrolling data window (1 replies)
  37. Viewing exports (1 replies)
  38. about links (9 replies)
  39. Hardware breakpoints (7 replies)
  40. hardware breakpoints on IO ? (1 replies)
  41. breakpoints get removed when DLL is unloaded (3 replies)
  42. re: Ollydbg & Cracking (9 replies)
  43. Feature Request (0 replies)
  44. Debug registers? (3 replies)
  45. Copy a block of strings... (4 replies)
  46. Problems with symbols in OllyDbg, please help (4 replies)
  47. OllyDbg Tutorials (1 replies)
  48. Where can I find OllyDbg plugins? (2 replies)
  49. Memory breakpoint with condittion on EIP (3 replies)
  50. How to get the real entry with ollydbg? (6 replies)
  51. ollydbg106 copy to exe file (3 replies)
  52. Feature request - disassemble mode (no debug) (5 replies)
  53. How can use Microsoft Visual Studio .NET Documenta (3 replies)
  54. Using SEH handlers for protection (Eg. Anti-SICE, (0 replies)
  55. Using SEH handlers for protection (Eg. Anti-SICE, (0 replies)
  56. I would like to compare the run trace list with an (2 replies)
  57. Conditional Breakpoint (6 replies)
  58. [READ THIS] no more cracking related questions !!! (4 replies)
  59. debug dll'? (4 replies)
  60. Functions API is not the same the first time? (4 replies)
  61. Sorry guys (2 replies)
  62. Scripting - Doing stuff on a breakpoint. (4 replies)
  63. How do debuggers terminate the debuggee process? (6 replies)
  64. [POLL] what features do you want in OllyDbg 2.0 (142 replies)
  65. Difference between SoftIce & Ollydbg ? (was so (6 replies)
  66. OllyDbg UDD file (9 replies)
  67. define your own functions (2 replies)
  68. SFX (11 replies)
  69. Whats your favourite feature of OllyDbg? (7 replies)
  70. How do debuggers restore the breakpoint? (7 replies)
  71. Bad or unknown format of 32 bit excutable error me (1 replies)
  72. inspector (0 replies)
  73. Breakpoint examples (0 replies)
  74. Klipfolio (3 replies)
  75. option (1 replies)
  76. Where to begin? (2 replies)
  77. removing JIT debugger (0 replies)
  78. Why Memory breakpoint are not listed in the breack (0 replies)
  79. HMEMCPY o POINT H in XP for OLLYDBG (4 replies)
  80. Proc names in IDA and Olly (1 replies)
  81. Attach (6 replies)
  82. Show SEH handlers on stack frame? (0 replies)
  83. Project Files (0 replies)
  84. Access violation when writing to [00000000] (1 replies)
  85. Changing EIP (1 replies)
  86. Exceptions when debugging??? (3 replies)
  87. Jumping to an address in the disassembler pane (3 replies)
  88. Returning from a function call??? (12 replies)
  89. Calls and jumps to imported functions??? (5 replies)
  90. From code to data??? (6 replies)
  91. Tracing to log file?? (1 replies)
  92. functions imported twice (0 replies)
  93. Can I set bp to every reference to a speific API c (0 replies)
  94. Logging to file ... again (1 replies)
  95. Point H o hmemcpy point in XP (11 replies)
  96. Breakpoint issue (1 replies)
  97. how to hide ollydbg from debuger detection? (3 replies)
  98. Code Injection Errors (35 replies)
  99. Can we unpack with ollydbg? (17 replies)
  100. Code Analyse bug? (3 replies)
  101. Dumping in XP with ollydmp or others dumpers (4 replies)
  102. Conditonal Breaks + Expression (0 replies)
  103. automatic delete *.udd (3 replies)
  104. New UDD file every time??? (2 replies)
  105. Symbols from MAP files (3 replies)
  106. How to find the jump??? (5 replies)
  107. Showing jump path??? (2 replies)
  108. Bad or unknown format (4 replies)
  109. Backwards (0 replies)
  110. SYSCALL ??? (1 replies)
  111. How to breakpoint on menu click? (2 replies)
  112. How does regedt32 save reg values if it doesnt use (2 replies)
  113. Compare OllDbg and SoftICE for debuging applicatio (1 replies)
  114. Loading DLL-files??? (9 replies)
  115. save (1 replies)
  116. which is the current updated site (4 replies)
  117. Just to know if anyone else got this prob when unp (3 replies)
  118. Setting breakpoints on all references of an import (4 replies)
  119. getting patched file with OD (1 replies)
  120. Last ip before break piont (1 replies)
  121. BP problem in WinXP (3 replies)
  122. Tuts for olly (1 replies)
  123. debug symbol information support (0 replies)
  124. Can't run program in ollydbg/Access violation (1 replies)
  125. How to find a window procedure ? (2 replies)
  126. Handles window displays list of handles owned by d (10 replies)
  127. Equivalent of "Hmemcpy" with ollydbg? (16 replies)
  128. API parameter (1 replies)
  129. DETACH OLLY AND CONTINUE RUNNING (0 replies)
  130. DETACH OLLY AND CONTINUE RUNNING (0 replies)
  131. How can I debug MS VC++ applications? (6 replies)
  132. ollydbg 109b freeze with watchman (0 replies)
  133. MS PDB7 support? (0 replies)
  134. Having the same from last run (1 replies)
  135. ollydbg and vb6 (2 replies)
  136. vb6 compile to native code (2 replies)
  137. code opcodes interpreted by OD as data??? (1 replies)
  138. memory dumper (1 replies)
  139. Strange ? in the asm (1 replies)
  140. Conditional breakpoint on memory read access* (2 replies)
  141. Custom function descriptions (4 replies)
  142. Where to post tutorial? (1 replies)
  143. API profile (0 replies)
  144. msvbvm50.lib ?? (1 replies)
  145. Breakpoint (0 replies)
  146. plugins (1 replies)
  147. overflow in 1.09b (0 replies)
  148. How to hide ollydbg? (4 replies)
  149. Windows Error-Program too large to fit in memory (1 replies)
  150. How to bp hmemcpy (17 replies)
  151. Remove bp & run program at same time... (3 replies)
  152. Possible bug in attach to process? (0 replies)
  153. Following pointers in the dump (10 replies)
  154. waiting :) (1 replies)
  155. another ollydbg 2 request (0 replies)
  156. how can i dump PE files for OllyDbg and ollydump. (1 replies)
  157. log modular calls? (2 replies)
  158. why i can't find plugs menu or command bar in (1 replies)
  159. how can i make breakpoint for messages? (3 replies)
  160. rebuild import table (1 replies)
  161. New security anti debuging.How to defeat it? (1 replies)
  162. Search (2 replies)
  163. [REQ] AutoDisable "IsDebuggerPresent" (16 replies)
  164. Offset (2 replies)
  165. [HELP] OD 2.0 problems. need your input ! :) (1 replies)
  166. conditonal breakpoints, didn't find anything (2 replies)
  167. I want to use new version of Ollydbg (2 replies)
  168. Unable to pass exceptin when condition log (2 replies)
  169. What causes Ollydbg to say this? (4 replies)
  170. VB.net and Olly tutorial (1 replies)
  171. I need best ollydbg.ini. (2 replies)
  172. How to use ollydbg in linux box. (3 replies)
  173. How to use ollydbg debug java program that run on (3 replies)
  174. Breakpoints inside dlls? (6 replies)
  175. hwbp inside seft-unpack-prog. (1 replies)
  176. WinAmp (4 replies)
  177. Label Names (3 replies)
  178. Multiple Data Dump Windows (3 replies)
  179. Debugging DLLs (7 replies)
  180. finding function names (3 replies)
  181. BUG in 1.09c ? (17 replies)
  182. hmem (1 replies)
  183. tres preguntas para RN (5 replies)
  184. Breakpoint on file (8 replies)
  185. ollydbg2 feature request - break on certain dll lo (2 replies)
  186. REALLY BUG IN 1.09 C (2 replies)
  187. Debug an EXE on behalf of other users (1 replies)
  188. Unpacking UPX (17 replies)
  189. about plugin api (0 replies)
  190. Code Injection Error! (2 replies)
  191. AL register - How do I modify it? (2 replies)
  192. Run Trace starting condition/EIP? (2 replies)
  193. Run Trace problem (3 replies)
  194. Modifying FP Registers (1 replies)
  195. you deleated my topic! (2 replies)
  196. Truncate an EXE (0 replies)
  197. whats difference between different break points (11 replies)
  198. ExtraCopy plugin (2 replies)
  199. How do I debug IE plugins like an OCX object? (1 replies)
  200. Hardware breakpoint on specify module (6 replies)
  201. Where to download imprect ? (6 replies)
  202. A thought (1 replies)
  203. Getting spaces (4 replies)
  204. Newest 1.09c bugs. (6 replies)
  205. Can someone please send me the HMEMCPY tut!!!!!!! (18 replies)
  206. IDA 4.50 (1 replies)
  207. request import recontruction tut (7 replies)
  208. bpint 3 (2 replies)
  209. is unpacking aspr illegal (18 replies)
  210. how to bpx nag show? (3 replies)
  211. Brake point hlp plz :) (7 replies)
  212. LInux ELF reversing? (1 replies)
  213. newbe Q (1 replies)
  214. how2break on mouse event? (1 replies)
  215. breakpoint please help (1 replies)
  216. breakpoint a var ? (2 replies)
  217. teach (2 replies)
  218. Another bloblems? ,another bugs? (2 replies)
  219. String data reference!,why it's not implement (3 replies)
  220. SV_IsDebug14 do not handle anymore! (0 replies)
  221. New ollydbg 1.09d (0 replies)
  222. Question on memory breakpint (3 replies)
  223. Run Trace question (3 replies)
  224. Is it possible to save Command History? (0 replies)
  225. Question/Bug? (1 replies)
  226. Protect with asprotect! arghhhh! (15 replies)
  227. breakpoints always vanish (8 replies)
  228. Log function arguments on __vbaStrCmp (9 replies)
  229. ??? Questions ??? (4 replies)
  230. Breakpoint on CreateWindowsExA in win2000 (9 replies)
  231. Unable to read memory of debugged program (7 replies)
  232. Changing the ID of a window , how to ? (3 replies)
  233. Plugins for Olly... (1 replies)
  234. Keyboard shortcuts (0 replies)
  235. Source code now show when work on MFC! (1 replies)
  236. Unpacking Softwrap just right click! (15 replies)
  237. od under win98 question (1 replies)
  238. rtrace.exe -- does not crash as expected. (2 replies)
  239. Continue on Softwrap unpacking (0 replies)
  240. Sudden exit? (0 replies)
  241. visual basic debugging (1 replies)
  242. Tutorial - How to find a hardcoded serial and patc (10 replies)
  243. Conditional breakpoints? (2 replies)
  244. Run Trace: stangest behavior (1 replies)
  245. Some ollydbg tutorial .... (12 replies)
  246. Rocognizing calls parameters? (2 replies)
  247. hmemcpy (2 replies)
  248. NOTICE OF INFRINGING ACTIVITY (4 replies)
  249. Dll Main (9 replies)
  250. Help! (6 replies)


Plugins

RCE Messageboard's Regroupment > Plugins
  1. [REQ] help on converting plugin.h to Sphinx C-- (3 replies)
  2. How to get selected address in CPUDUMP ? (9 replies)
  3. Dump process (4 replies)
  4. [download] plugins by gigapede - link (2 replies)
  5. Plugin request (12 replies)
  6. Compiling errors (3 replies)
  7. Plugin request 2 (13 replies)
  8. [plugin] debug other plugins (0 replies)
  9. Hightlighting plugin (6 replies)
  10. CmdBar betas (7 replies)
  11. CmdBar problem on win98 (2 replies)
  12. [ideea] scripting plugin (5 replies)
  13. Plugin request 3! (2 replies)
  14. stayontop plugin (4 replies)
  15. a plugin idea (0 replies)
  16. [plugin] Command Bar 1.08.02 (2 replies)
  17. just another lame idea ;p (4 replies)
  18. plugin.inc for masm? (11 replies)
  19. Import .nms files (1 replies)
  20. Jump analysis (7 replies)
  21. idea (2 replies)
  22. [plugin] OllyDump 2.00.108 by gigapede (7 replies)
  23. OLLYDMP 2.0 (8 replies)
  24. TBD plz fix your link to OllyDump 2.0 (1 replies)
  25. update plugins (3 replies)
  26. wdasm and ollydb (8 replies)
  27. Plugin Skeleton (6 replies)
  28. OllyDump v2.11.108 release (24 replies)
  29. Labeler? (1 replies)
  30. Ollydump 2.20.108 dumping a dll (2 replies)
  31. Plugin idea (6 replies)
  32. Bug (?) in MapConv plugin (5 replies)
  33. IsDebuggerPresent plugin (15 replies)
  34. SV: EXE Rebuilder plugin info (2 replies)
  35. ollydump? (4 replies)
  36. hmemcpy (20 replies)
  37. [plugin] WindowJuggler 0.01 BETA by EsseEmme (3 replies)
  38. [plugin] WindowJuggler 0.02 BETA by EsseEmme avail (8 replies)
  39. [plugin] WindowJuggler 0.03 BETA by EsseEmme out (0 replies)
  40. WindowJuggler 0.04 BETA available (5 replies)
  41. ollydump v 2.21 Cann't Dump this process (10 replies)
  42. [plugin] WindowJuggler 0.05 BETA (4 replies)
  43. [plugin] WindowJuggler v0.06 BETA (2 replies)
  44. DeJunk plugin (3 replies)
  45. icon in url ? (2 replies)
  46. can´t find OEP with DUMP Plugin (8 replies)
  47. Memory searcher plugin? (15 replies)
  48. remote exception identifier plugin (0 replies)
  49. Olly plugin with Borland C++ builder 6.0 (0 replies)
  50. Decoding instructions of type: PUSH DWORD PTR SS:[ (0 replies)
  51. Where to find Ollydump? (3 replies)
  52. BAD OLLYDMP (6 replies)
  53. Multiple STEP_OVER in a row (4 replies)
  54. language packs? (2 replies)
  55. Olly automation project... (7 replies)
  56. [plugin] Labelmaster 0.1 (1 replies)
  57. About upcoming ollydbg 2.x APIs .. (1 replies)
  58. extra copy plugin problems and one feature request (7 replies)
  59. Setting register contents? (1 replies)
  60. help!!! (2 replies)
  61. using breakpoints in a plugin (5 replies)
  62. CommandBar v3.00.108 (10 replies)
  63. [tool] olly2html.pl - Advanced OllyDbg ASM To HTML (2 replies)
  64. Deletenamerange? (0 replies)
  65. Log conditional breakpoint API? (3 replies)
  66. Plugin load path problem / implicit dll linkage (2 replies)
  67. Sendshortcut - ALT key state (needed for close deb (4 replies)
  68. Where can one recommend features? (2 replies)
  69. "find command sequence" feature in plugi (6 replies)
  70. UDD File Format (1 replies)
  71. just an idea!!! (5 replies)
  72. Hardware breakpoints? (5 replies)
  73. Single Stepping? (2 replies)
  74. To Gigapede (12 replies)
  75. Newbie needs help (1 replies)
  76. to Gigapede about cmdbar (0 replies)
  77. TO PSYCKO (6 replies)
  78. about ollydump (1 replies)
  79. how 2 mov ollydump to center of screen? (1 replies)
  80. Address of FS? (4 replies)
  81. Hehe,My first plugin Launcer.dll (6 replies)
  82. what does it stand for ? (1 replies)
  83. CommandBar help (2 replies)
  84. [Plugin Dev Question] Extract highlighed lines in (0 replies)
  85. [NEW Plugin] DLLBreakEx (11 replies)
  86. NEW PLUGIN FOR OLLYDBG (17 replies)
  87. [plugin] OllyPad v1.0 (4 replies)
  88. I can't understand this problem,who can help (3 replies)
  89. Multiple stepping instructions in a script (4 replies)
  90. Attachtoactiveprocess problem (0 replies)
  91. Plugin idea, need comments (1 replies)
  92. ollybd Fader plugin (7 replies)
  93. How to use CommandLine Plugin (1 replies)
  94. code ripper (14 replies)
  95. dump file (3 replies)
  96. GODUP - Godfather+ Olly Debugger Universal Plug-i (32 replies)
  97. [NEW]Ultra String Reference v0.11 for Chinese (5 replies)
  98. DebugActiveProcessStop Plugin for OllyDbg (13 replies)
  99. some noob questions (1 replies)
  100. [req] Step/Autotrace Recorder n Compare (just idea (0 replies)
  101. IsDebugPresent (2 replies)
  102. How to compile the Source code? (0 replies)
  103. how to hide the OD in win98 (1 replies)
  104. How to emulate single step execution? (1 replies)
  105. Help (1 replies)
  106. Borland map file importer plugin (9 replies)
  107. a linking problem (0 replies)
  108. How to get the code selected by the user in the di (3 replies)
  109. TNG Delphi Plugin SQK Fix : (1 replies)
  110. I need Help (1 replies)
  111. Newbie question about name mangling (VC6.0) (4 replies)
  112. Logging all CALLs and RETNs (0 replies)
  113. any simple why to get the debuged process's h (1 replies)
  114. Xp only problem? (4 replies)
  115. Where is OLLYGHOST plugin (2 replies)
  116. IsDebuggerPresent (6 replies)
  117. Where is the link to the plugins download page? (2 replies)
  118. Problem with coding Plugin (2 replies)
  119. Problem with coding Plugin (0 replies)
  120. A new Powerful Plugins for OD (4 replies)
  121. New OllyDbG Plugin (16 replies)
  122. question about reading and writing sth to CPU window in a plugin (2 replies)
  123. [NEW]OllyMachine v0.20 (5 replies)
  124. Modules Functions (1 replies)
  125. recognise operand typwe (2 replies)
  126. Searching opcode (0 replies)
  127. Breakpoint handler (7 replies)
  128. Cannot find GODUP Plugin (5 replies)
  129. Missin constants in plugin.h (0 replies)
  130. finding a a function by name (5 replies)
  131. getting list of breakpoint (0 replies)
  132. Labelmaster feature request (2 replies)
  133. problem with t_module.name (1 replies)
  134. ODBG_pluginreset not good (0 replies)
  135. OLLYSCRYPT COMMAND SUGGESTIONS (3 replies)
  136. Ultra String Reference (5 replies)
  137. Help please OllyDump (3 replies)
  138. HideDebugger \ IsDebugPresent (4 replies)
  139. reading arguments before a function call (2 replies)
  140. Example of Plugin that compiles with Visual Studio 6 or later? (1 replies)
  141. New Olly PE Dumper plugin (27 replies)
  142. Need new method of reading/writting memory of OllyDbg. (0 replies)
  143. Any ideas for plugins? (13 replies)
  144. OllyDbg Breakpoint Manager Plug-in Released (9 replies)
  145. findprocbegin always returns 0 (1 replies)
  146. Bug fix for OllyDump 2.21b (8 replies)
  147. Function to detect if exe is open? (1 replies)
  148. Are Alt+; and Alt+: valid keyboard shortcuts for a plugin? (1 replies)
  149. ApiBreak - New Ollydbg Plugin (14 replies)
  150. NonaWrite - New Ollydbg Plugin (18 replies)
  151. OllyDbg API - Need help using "Assemble" (1 replies)
  152. HideDebugger by Asterix (2 replies)
  153. i want a Calculator (4 replies)
  154. MapConv not loading labels or comments for a DLL? (13 replies)
  155. OllyDbg Heap Vis Plug-in (8 replies)
  156. NtGlobalFlagPlugin for ollydbg (10 replies)
  157. Where can I get Ultra String Reference plug-in? (2 replies)
  158. Problem with smth (10 replies)
  159. BAMBI editor for make scripts easy for ollyscript (2 replies)
  160. Protection (1 replies)
  161. how to build a ollydbg.lib? (2 replies)
  162. Plugin problem! (2 replies)
  163. How can I allocate memory in debugged program? (4 replies)
  164. Any Ideas for tracing the changed memory (0 replies)
  165. DeleteBreakpoints (3 replies)
  166. ollygraph (3 replies)
  167. How to get the call references of a procedure? (7 replies)
  168. Pausedex & go problem (6 replies)
  169. setbreakpoint & pausedex (5 replies)
  170. Need website or link that will let me download HideDebugger (6 replies)
  171. ODBG_Plugincmd problem (4 replies)
  172. CLBPlus! v1.0 plugin released (3 replies)
  173. Olly_Sync Pluggin Combo iDA_Sync Plugin (0 replies)
  174. Where to find all plugins? (1 replies)
  175. [Plugin] Polymorphic Breakpoint (8 replies)
  176. When developing a plugin, how can i debug it? (4 replies)
  177. [Plugin] Bypass Hardware breakpoint protection (2 replies)
  178. New plugin - ASM to HTML (2 replies)
  179. how can i set the plugin icon ? (2 replies)
  180. 2 new plugins (1 replies)
  181. Asm2Clipboard v0.3 available (1 replies)
  182. Data Ripper 1.1 plugin (5 replies)
  183. "Manager" for PluginLoader (0 replies)
  184. Plugin Watches Expression print Value to file c:\logfile.txt (0 replies)
  185. NotePad topmost : plugin (asm only) (5 replies)
  186. ollydbg plugin list (4 replies)
  187. Dump debugged code in textfile (3 replies)


Bugs

RCE Messageboard's Regroupment > Bugs
  1. 1.08b2 slowness (8 replies)
  2. Not showing assembelr text in cpu window (1 replies)
  3. unable to assemble "push 0" (4 replies)
  4. olldbg assemble? (1 replies)
  5. run trace displays incorrect modified register val (3 replies)
  6. bug exception handler (4 replies)
  7. SAL dissasembly (8 replies)
  8. LINK problem?! (8 replies)
  9. ollydbg unable to load the program! (13 replies)
  10. api SetProcessWorkingSetSize (7 replies)
  11. TBD! (1 replies)
  12. SEH and Olly (2 replies)
  13. Kernel32.LockResource Import (3 replies)
  14. Column sizes reset all the time (1 replies)
  15. anyone who can use the ollydbg debug the pelock? (5 replies)
  16. Crash on call stack. (2 replies)
  17. Very strange behaviour (3 replies)
  18. List of bugs and my propositions (0 replies)
  19. Ollydbg handle leak (solves LINK problem?) (1 replies)
  20. Thanks Olly (0 replies)
  21. Attach process doesnt work after previous debug se (1 replies)
  22. Bug in interface 1.09 (1 replies)
  23. BUG in command bar (2 replies)
  24. Breakpoint , comments not save (1 replies)
  25. 1.09a first look/bugs? (2 replies)
  26. bug (olly 1.9) (5 replies)
  27. BUG IN OLLY 1.09 B (2 replies)
  28. [BUG]: Lock-up debugging DirectX-Application (3 replies)
  29. Stack Analyzer (0 replies)
  30. Patches window (2 replies)
  31. [BUG] CRASH on long arguments length (2 replies)
  32. JMP EIP (2 replies)
  33. syntax coloring (3 replies)
  34. Access violation? (7 replies)
  35. Close program (Alt-F2) bug? (1 replies)
  36. DLL initialization failed (6 replies)
  37. arguments (7 replies)
  38. BUG: Inspector Update... (0 replies)
  39. [bug] 1.09c copy of a clipboard(CF_TEXT) (5 replies)
  40. OllyDbg v1.09c File Open Error (1 replies)
  41. Bug or not but the problem is (1 replies)
  42. Unicode handling bug? (0 replies)
  43. Opcode unidentified (0 replies)
  44. Stack dump (2 replies)
  45. Small bug: comments not unicode (0 replies)
  46. Binary copy/paste, is it a bug ? (9 replies)
  47. Cant see Plugins in Ollydebug' v1.09d's (2 replies)
  48. Problem with borland debug information (1 replies)
  49. bug in olly 1.9d, (2 replies)
  50. Maybe a bug... (4 replies)
  51. Log trace doesn't show erased in beta 110 (0 replies)
  52. Display bug... (1 replies)
  53. import libraries & object files (0 replies)
  54. tiny bug in olly (1 replies)
  55. possible bug with Ollyplug-inn "WindowInfos b (3 replies)
  56. Run trace log bugs (0 replies)
  57. subclassed wndproc (4 replies)
  58. Exception Handling (2 replies)
  59. Strange (1 replies)
  60. Access violation in ollydbg when reading [0000000C (0 replies)
  61. 1.10c bug, crash OllyDBG (7 replies)
  62. pushfd makes F4 failed? (0 replies)
  63. Not really a bug (0 replies)
  64. Debugging Microsoft Visual C# / Basic .NET Code... (4 replies)
  65. crash ollydbg 1.10, OD has a big bug (11 replies)
  66. ntdll problem (2 replies)
  67. minor double click bug (0 replies)
  68. minor "file changed" dialog bug (0 replies)
  69. MOVNTPS (SSE instruction) not supported by OllyDbg (0 replies)
  70. TApplication.Initialize not identified (5 replies)
  71. Save File Bug (0 replies)
  72. File | Open, sometimes the exe actually runs (0 replies)
  73. Search for name in current module crash (1 replies)
  74. OllyDbg doesn't find source code for a BCB6 p (5 replies)
  75. Symbol location problems/solution (1 replies)
  76. Can’t load program in OllyDbg (3 replies)
  77. Ollydbg Problem on XP SP2 (9 replies)
  78. Labels do not persist (or do but don't get re (2 replies)
  79. Fullscreen Bug (1 replies)
  80. Broken link on stuph page (4 replies)
  81. Help me (4 replies)
  82. Incorrect page protection attributes (1 replies)
  83. bug in analyze after patching (0 replies)
  84. values of C variables shown as their addreses (3 replies)
  85. JIT Debug Launch Issue (2 replies)
  86. finit int 3 bug (5 replies)
  87. bad assembly analysis (3 replies)
  88. About hardware breakpoints (16 replies)
  89. Never break on EOP (2 replies)
  90. is this a bug? (1 replies)
  91. disasm error in ollydbg (2 replies)
  92. 2 strange things (0 replies)
  93. About the buffer overflow bug (7 replies)
  94. problem with trace with condition (1 replies)
  95. System performance problems while debugging (2 replies)
  96. missing "plugins" menuitem after renaming OllyDbg.exe (2 replies)
  97. the search (1 replies)
  98. Unable to Write to.... (2 replies)
  99. Wait 5 seconds... (2 replies)
  100. OllyDbg v1.10 crashes with more than 32 plugins. (9 replies)
  101. Olly Crashes when Pause is pressed.. HELP! (2 replies)
  102. uninitalised variable in ollyEngine (1 replies)
  103. Crashes the application (2 replies)
  104. serious bug in olly engine! (2 replies)
  105. will ollydbg ever be open source? (1 replies)


Announcements

RCE Messageboard's Regroupment > Announcements
  1. 2nd year of OllyDbg anniversary - 11.Nov.2oo2 (6 replies)
  2. greeting to forum reopen!! (0 replies)
  3. [new] 1.08 released ? (8 replies)
  4. [new] 1.08a released (2 replies)
  5. [ODF] OllyDbg Stuph page update list (33 replies)
  6. [new] 1.08b released (0 replies)
  7. [ODF] get the latest discussions on your desktop (7 replies)
  8. [new] Plugin Development Kit 1.08 beta released (2 replies)
  9. I want to inform to TBD (4 replies)
  10. version 1.09 (2 replies)
  11. [news] 10.Jun.2003 - about OD 2.0 (5 replies)
  12. [new] 1.09c released (6 replies)
  13. 2.0 (6 replies)
  14. happy birthday OllyDbg ! (8 replies)
  15. [new] Preliminary beta of v1.10 (3 replies)
  16. new OllyDbg version 1.10c (0 replies)
  17. NEW - OllyDbg v1.10 (3 replies)
  18. about olly 2 (5 replies)
  19. Why does Olldbg stop / Pause on this Code? (1 replies)
  20. OllyDbg site was shut down (12 replies)
  21. OllyDbg 2 news (30 replies)
  22. OllyDbg 1.10 release mirror (0 replies)
  23. http://www.ollydbg.de/ - works (2 replies)


The Heap

RCE Messageboard's Regroupment > The Heap
  1. downtime (0 replies)
  2. OllyDbg found a fruit salad in Task Manager :) (1 replies)
  3. Ollydbg108beta Can't download? (1 replies)
  4. resource hacking (2 replies)
  5. bundy: you are infected with WORM_KLEZ.H virus (0 replies)
  6. code test (1 replies)
  7. [ODF] [code][/code] available to post code snippet (0 replies)
  8. Merry XMAS (4 replies)
  9. [greetings] Happy New Year (1 replies)
  10. [ODF] for the lazy ones that dont want to register (17 replies)
  11. FAO: TBD. - Just wondering... (5 replies)
  12. downtime -- not anymore (0 replies)
  13. [URGENT] - i need a host for the forum (10 replies)
  14. the ollydbg stuff doesnt display in ie (6 replies)
  15. ollydbg.has.it (1 replies)
  16. count of total posts (4 replies)
  17. [help] sorting OD2.0 requests (20 replies)
  18. [!!!] NO MORE *CRACKING* POSTS [!!!] (15 replies)
  19. [ODF] login problems (4 replies)
  20. C++ and ASSEMBLER tutorials (2 replies)
  21. cookie problem should be solved (2 replies)
  22. Amazing! (2 replies)
  23. Hey,my friendz. (3 replies)
  24. Ollydbg and MASM (6 replies)
  25. Armadillo 1.80 (6 replies)
  26. [forum] No more anonymous posts allowed (0 replies)
  27. [forum] only OD bugs and non crack posts from now (3 replies)
  28. BUG IN THIS FORUM (2 replies)
  29. Hi All (0 replies)
  30. Who is Oleh Yuschuk? (4 replies)
  31. I am.... (11 replies)
  32. Had I been to a wrong "ollydbg homepage" (5 replies)
  33. [tool] tiny hexer - good freeware hex editor (0 replies)
  34. Why does Win9x support Terminate/SuspendThread but (2 replies)
  35. new moderator: psyCK0 (2 replies)
  36. Soft Ice 4.05 (7 replies)
  37. How to set breakpoints on memory read/write? (3 replies)
  38. ida sdk api (0 replies)
  39. Sporadic VCL violation in Delphi 6 (and 5) (0 replies)
  40. Back agin with : Friendly Message ............ (6 replies)
  41. Resize .CODE section (8 replies)
  42. FlexLm Seed finder help (1 replies)
  43. Help on FlexLm script (0 replies)
  44. Detecting Asm Instruction Execution (5 replies)
  45. Dll and Debugger (1 replies)
  46. test post (forum working?) (7 replies)
  47. New API Monitor (8 replies)
  48. Crackers Kit (10 replies)
  49. Please Help.. Searching prog (0 replies)
  50. Kakeeware Application Monitor 1.0 (2 replies)
  51. Good site for assembler info (2 replies)
  52. PE Protecting (2 replies)
  53. Private Messaging? (1 replies)
  54. Searching the posts (3 replies)
  55. RDG Packer Detector V 0.5/1 BETA (6 replies)
  56. 16-bit program like ollydbg (10 replies)
  57. But... If the forum is English only... (0 replies)
  58. help to improve the undocumented API info (2 replies)
  59. ... or some hints \ tips to find the paramaters meaning (1 replies)
  60. Windows Mobile ARM Disassembler (0 replies)
  61. How to save/load (=move) pe sections relative? (0 replies)
  62. Why is this program crashing ? (0 replies)
  63. No E-mail Notification (1 replies)
  64. Search Does Not Work (4 replies)
  65. Stuph Broken Link (2 replies)
  66. This forum back again ! (2 replies)
  67. IMUL (1 replies)


OllyScript

RCE Messageboard's Regroupment > OllyScript
  1. [plugin] OllyScript v0.2 (18 replies)
  2. On exception handling in coming version of OS (0 replies)
  3. [plugin] OllyScript v0.3 (8 replies)
  4. Interesting script for OllyScript... (0 replies)
  5. [plugin] OllyScript v0.4 (17 replies)
  6. [plugin] OllyScript v0.5 (21 replies)
  7. 16 new scripts for OllyScript (1 replies)
  8. Is this possible with OllyScript? (3 replies)
  9. [plugin] OllyScript v0.6 (24 replies)
  10. post 3 Unpack Script! thank SHaG! (1 replies)
  11. ExECryptor 1.53 UnPacking Script! (5 replies)
  12. Basic theory behind creating an unpack/OEP finder (2 replies)
  13. DBPE v2.x Unpacking Script! (3 replies)
  14. ExEcryptor 1.5x Unpacking script (1 replies)
  15. Two Scripts(Acprotect 1.22 and morphine 1.2) (1 replies)
  16. BUG IN OLLYSCRIPT 0.62? (6 replies)
  17. UltraProtect 1.x/ACprotect 1.22 OEP Finder(Default (0 replies)
  18. PESpin v0.3 Stolen Code Finder (8 replies)
  19. tElock 0.9 - 1.0 (private) -> tE! OEP Finder v0 (4 replies)
  20. OllyScript have a big bug (5 replies)
  21. OllyScript site updated (0 replies)
  22. about OllyScript (0 replies)
  23. ASProtect 1.3B Stolen code Finder (9 replies)
  24. OTHER BUG IN OLLYSCRIPT or its me jeje (4 replies)
  25. reaad (1 replies)
  26. OllyScript on Win9x? (0 replies)
  27. [plugin] OllyScript v0.7 (5 replies)
  28. Before posting bugs in OllyScript... (1 replies)
  29. Post two script for new version ollyscript(oscv0.7 (6 replies)
  30. What happened with the oldschool style ? (12 replies)
  31. SVKP 1.3x Stolen code finder v.02 beta (4 replies)
  32. need this special script (6 replies)
  33. Single step exception and OllyScript (0 replies)
  34. Help on script (1 replies)
  35. PECompact 2.01a script (6 replies)
  36. BUG OR NEW FEATURE OF OLLYSCRIPT (19 replies)
  37. [plugin] OllyScript v0.8 (13 replies)
  38. A script for pecompact new version(v2.08) (0 replies)
  39. Arm 3.7Std_release(OllyScript) (47 replies)
  40. PEBundle (1 replies)
  41. ASPRs 1.30 & 1.31 scripts (2 replies)
  42. MEW 10 - OEP finder (my first script) (3 replies)
  43. Script for upxshit 0.6 (snaker) (2 replies)
  44. [plugin] OllyScript v0.85 (3 replies)
  45. New OllyScript error! (4 replies)
  46. 1.23 (1 replies)
  47. Difference (2 replies)
  48. To psycko (5 replies)
  49. GGS0 GGS1 Section headers (2 replies)
  50. Looking to reformat help... (2 replies)
  51. olly scrip use (5 replies)
  52. Installation instructions for OllyScript (0 replies)
  53. Another UPX script (1 replies)
  54. Bug fix of OSC v0.85 (4 replies)
  55. Script for dbpe (all version) v0.2 (3 replies)
  56. Scripts wanted (1 replies)
  57. ESTI / ESTO / DEBUGGING OPTIONS (1 replies)
  58. PEBundle 2.0x - 2.4x script (4 replies)
  59. EZip 1.0 Script (0 replies)
  60. EXE Shield v0.5-->0.8 (ARM Protector v0.1) scri (4 replies)
  61. feature request (1 replies)
  62. Result of DBH (15 replies)
  63. Feature Request (1 replies)
  64. looks like a bug (1 replies)
  65. Script for PESpin v0.7 (4 replies)
  66. (more) feature request (1 replies)
  67. My First Script: Stack based generic a s p r u n p (10 replies)
  68. PESpin 0.3x - 0.4x -> cyberbob Unpack Script v0 (1 replies)
  69. [plugin] OllyScript v0.9 (11 replies)
  70. armadillo (2 replies)
  71. to psycko:ollyscript v0.9 has a bug?,more informat (1 replies)
  72. Script for PesPinv0.7 (0 replies)
  73. Syntax Highlighting for OllyScript in UltraEdit (3 replies)
  74. FOR PSYCKO PLEASE HELP ME (4 replies)
  75. [plugin] OllyScript v0.92 (13 replies)
  76. OllyScript site back online (0 replies)
  77. OllyScript mailing list gone =( (0 replies)
  78. alternative ollyscript dload site? (4 replies)
  79. My first Script (1 replies)
  80. Load File Error? (0 replies)
  81. script under asprotect (4 replies)
  82. New funcionality of OllyScript ? (6 replies)
  83. bug in OllyScript 0.92 ! (3 replies)
  84. asprotect (2 replies)
  85. GOOD JOB (2 replies)
  86. A way to autodetect the script application?? (1 replies)
  87. Mew 11 SE v1.1 script (0 replies)
  88. Problems with unpacking and dumping upx (22 replies)
  89. My flexlm script (1 replies)
  90. To psyCKO: Need help! (3 replies)
  91. Scripts to: JDPack, wwpack32, NeoLite v2.0, PePack (2 replies)
  92. Armadillo Question (2 replies)
  93. OllyScript: Script uploading (3 replies)
  94. Another submenu "View Script" (3 replies)
  95. armadillo (1 replies)
  96. Aspack 2.12 Dll Unpack script doesn't work? (4 replies)
  97. about REPL in OllyScript ... (0 replies)
  98. FIND from address upwards? (1 replies)
  99. compare (0 replies)
  100. Scripts for LameCrypt v1.0 & MEW11 SE v1.2 (0 replies)
  101. aspack212 not support (10 replies)
  102. Who can unpack ActiveX DLL ?? (0 replies)
  103. A Script to find death list in messagebox (14 replies)
  104. Help !!! Aspack 2.12 Not on EXE , Not on DLL... (8 replies)
  105. error in ollyscript (1 replies)
  106. Armadillo (1 replies)
  107. How do I do what is says? (0 replies)
  108. HOW TO USE THE OLLY PLUGING present in txt ot html formats (0 replies)
  109. Bug in OllyScript 0.92? (4 replies)
  110. exe32pack 1.42 (0 replies)
  111. ollyscript gathering iat info script. (2 replies)
  112. Forgotten (?) Feature request (1 replies)
  113. Morphine 2.7 Unpacker? (8 replies)
  114. Armadillo Script (13 replies)
  115. EXECryptor v 2.1.15 (6 replies)
  116. Using "Log window" in Olly to crack a time trial progam (1 replies)
  117. script not work ASProtect 1.2x - 1.3x [Registered] (0 replies)
  118. Saving "unpacked" executable? (2 replies)
  119. Log every jump? (0 replies)
  120. UPX Modified Stub -> Farb-rausch Consumer Consulting (3 replies)
  121. OllyScript V0.92 (4 replies)
  122. Problem with puting bp on code section(s) - AntiCrack example (0 replies)
  123. New scripts available! (0 replies)
  124. Two scripts: Stone's PE-Encrypter & WinKript (0 replies)
  125. Other more: VGCrypt v0.75 (0 replies)
  126. howto BPX with ollyscript ?? (1 replies)
  127. how to find a address (1 replies)
  128. OllyScript Editor v1.0 Beta 3 (3 replies)
  129. Need ya help (2 replies)
  130. Anyone know how to contact VolX? (4 replies)
  131. OllyDBG BreakPoints = Olly Is not Responding! (2 replies)
  132. Armadillo Script v2 (5 replies)
  133. About ASProtect 1.2x - 1.3x [Registered] (20 replies)
  134. trace into the main module only (1 replies)
  135. Is there an alternate URL for OllyScript download? (4 replies)
  136. Can I host OllyScript ? (3 replies)
  137. Contact for SHaG or ollyscript source? (1 replies)
  138. get olly script v.092 (1 replies)
  139. PELock 1.0x -> Bartosz Wojcik [PlugIn needed] (9 replies)
  140. RIP SHaG? (12 replies)
  141. question by a n00b (8 replies)
  142. Ollyscript log.... (3 replies)
  143. remove all breakpoints (0 replies)
  144. Armaccess.dll (1 replies)
  145. R Narvaja - do you have some tutorials about SDprotector? (8 replies)
  146. Theory behind debugging process request -Armadillo (5 replies)
  147. ASPack 2.12 OEP finder - cant find it (5 replies)
  148. Couple Armadillo tutorials by me (3 replies)
  149. bpm on execute access (2 replies)
  150. disable suspicious breakpoint messagebox (1 replies)
  151. ANyone got the sources? (6 replies)
  152. 2 script Armadillo-CopymemII to detach father (method RICARDO and TENKETSU) (1 replies)
  153. Armadillo 3.75C (3 replies)
  154. OllyScript v0.92 incl source available! (0 replies)
  155. OllyScript 0.92 Sources for VC6 (10 replies)
  156. Scripts from the old site can be found here (0 replies)
  157. ODbgScript v1.20 - New Script Window ! (18 replies)
  158. ODbgScript - my wishes for improvement (47 replies)
  159. ODbgScript v1.30 - Feature Requests and Bug Report (100 replies)
  160. armadillo 3.75c script (0 replies)
  161. OllyScript/ODbgScript: great GPA bug ! (9 replies)
  162. Upolyx 0.5 OEP finder&Dumper (0 replies)


General - Page 2

RCE Messageboard's Regroupment > General
Pages : 1 [2] 3 4
  251. Process stays on top of Olly (5 replies)
  252. Unpacking telock? (11 replies)
  253. Jump to <&MSVBVM60.#100> ?? (19 replies)
  254. Fullscreen (8 replies)
  255. DLL break on load (3 replies)
  256. can i change EIP when debug? (1 replies)
  257. plugin feature and winxp (4 replies)
  258. Pausing run trace if buffer full? (1 replies)
  259. Question to: "trace over system dll" (3 replies)
  260. How to write the common.arg (5 replies)
  261. Nag in vb??? (6 replies)
  262. Software detecting Olly Now (18 replies)
  263. Memory Change Logging Utility (4 replies)
  264. trace command (9 replies)
  265. Conditional breakpoints on flags? (3 replies)
  266. Feature or plugin wish - code sequence recognition (5 replies)
  267. How to set condition log on some reference strings (0 replies)
  268. hardware breakpoints not working (4 replies)
  269. SafeSerial OCX Protection (0 replies)
  270. Help Common.arg (8 replies)
  271. Cant find (6 replies)
  272. Windows messages. How to intercept? (2 replies)
  273. Where can i download the stronger pe-lock? (2 replies)
  274. Tut: How to crack XYZ? (2 replies)
  275. Ollydbg w/ anti olly detection (7 replies)
  276. Call Stack Window Empty (1 replies)
  277. Help me out!... (3 replies)
  278. HOw to sue Ollydump dump dll? (2 replies)
  279. 2002 XXXXect vX.X (1 replies)
  280. 2 questions (2 replies)
  281. ollydbg and catchin exceptions (2 replies)
  282. Previous instruction/address (3 replies)
  283. not breaking on oep (7 replies)
  284. Unable to Attach to Process (11 replies)
  285. Help on breakpoints (2 replies)
  286. How set log conditional on all Compare functions ? (1 replies)
  287. Conditional hardware breakpoint? (1 replies)
  288. To the kids that keep posting crack requests (12 replies)
  289. int3 traping problem on XP (3 replies)
  290. Exporting Hit trace data (2 replies)
  291. Break when a particular menu item is clicked (3 replies)
  292. Load old comments (0 replies)
  293. Get rid of anonymous posts? (2 replies)
  294. Hello i'm new italian user (10 replies)
  295. Enable disassembly of non-standard code (14 replies)
  296. Pls I need HMEMCPY tutor (5 replies)
  297. Why i don't make a bpx in..... (1 replies)
  298. how to use symbols just like windbg (1 replies)
  299. ollyGHOST ??? (2 replies)
  300. I'm new with Olly (5 replies)
  301. Not sure?? (1 replies)
  302. watching (0 replies)
  303. attach to process (0 replies)
  304. some little problems (2 replies)
  305. What is the asm code executed by IsDebuggerPresent (1 replies)
  306. Show User Screen???? (6 replies)
  307. Crackmes (7 replies)
  308. breakpoint on USER32.PostMessage (1 replies)
  309. Can OllyDbg debug DOS (MZ) programs? (2 replies)
  310. About .net (1 replies)
  311. Ollydbg stepping bug? (2 replies)
  312. OK - What am I doing wrong (CMDLINE) (2 replies)
  313. Its been quite a while since the last OllyDbg rele (5 replies)
  314. Strange analysis (2 replies)
  315. ARG.x and LOCAL.x labels (2 replies)
  316. Automating Olly? (18 replies)
  317. unpacking telock (1 replies)
  318. Debugging with symbols: missing text of instructio (2 replies)
  319. Strings and buffers as local variables in subrutin (0 replies)
  320. Minor and easy (but important!) feature request (0 replies)
  321. How to install plugins? (1 replies)
  322. How to trace? (0 replies)
  323. logging certain function calls (2 replies)
  324. A few questions from a newbie (2 replies)
  325. OllyDbg can be = TSearch? (3 replies)
  326. Set Working Directory (1 replies)
  327. Save changes (1 replies)
  328. Olly Quit (1 replies)
  329. How to view return value from functions in run tra (0 replies)
  330. New Ollydbg version (4 replies)
  331. How to LOG memory access? (2 replies)
  332. How to analyse a binary module only once??? (0 replies)
  333. Not update of access permissions on memory blocks? (0 replies)
  334. ollywindow on top ? (3 replies)
  335. Ollydbg vs. IDA (4 replies)
  336. Greetings mates, thy needs help!! (0 replies)
  337. Plugin SDK annotations (while working on .NET plug (0 replies)
  338. Mouse Wheel support? (2 replies)
  339. XP equivalent to hmemcpy (5 replies)
  340. symbols or implib (2 replies)
  341. Ollydbg support XP Style UI (0 replies)
  342. "Display Memory" like Command in OllyDbg (3 replies)
  343. Help with point-h in my computer (19 replies)
  344. Learn Olly (26 replies)
  345. Disasm (3 replies)
  346. Isdebbugerpresent (9 replies)
  347. How does Ollydbg calculate 32bit values of segment (1 replies)
  348. Olly tuts (1 replies)
  349. Using OllyDbg (2 replies)
  350. Assembly incorrect for the written code (1 replies)
  351. How to debug DLL ? (9 replies)
  352. OllyDbg tutorials (5 replies)
  353. Logging all CALLs and RETNs (1 replies)
  354. OllyDbg 1.10 is coming... (5 replies)
  355. OllyDbg pauses in another process...? WinXP CZ (9 replies)
  356. hardware bp (5 replies)
  357. How to look for in the Export table of a DLL ? (6 replies)
  358. diff use in os system of OD (0 replies)
  359. LOOPD - help (1 replies)
  360. SSE registers (4 replies)
  361. Unpacked executable won't break (7 replies)
  362. How does Olly convert Floats to hex ...etc? (0 replies)
  363. List of Function Names for user32, shell32, ect (1 replies)
  364. about conditional breakpoint? (1 replies)
  365. CreateProcessA - some question (2 replies)
  366. BMSG breakpoint (3 replies)
  367. Faults off (3 replies)
  368. The disassembly code of all executable modules (0 replies)
  369. Error 11 etc.. (29 replies)
  370. how to set breakpoint on memory range > 4 bytes (2 replies)
  371. does asprotect make trace conditions fail??? (3 replies)
  372. BETA 2 of OLLYDBG 1.10 (11 replies)
  373. how to disable windows? (11 replies)
  374. Strange string (5 replies)
  375. How to debug multifile application (1 replies)
  376. TYPELIB in ressources (0 replies)
  377. String references (8 replies)
  378. Detach from debuggee feature (3 replies)
  379. how to intercept debug events in a debugged proces (2 replies)
  380. Auto apply the patches (1 replies)
  381. when i look ollydbg 2.0 ? (9 replies)
  382. Multi conditional BP ?? (2 replies)
  383. 0EEDFADE exception (6 replies)
  384. Plugins... (3 replies)
  385. BAK and UDD Files Location (1 replies)
  386. steps for beginner (6 replies)
  387. How to disassemble Startup code of Binary (0 replies)
  388. Adding own function parameters? (4 replies)
  389. eax not copied to clipboard correctly (1 replies)
  390. Setting breakpoint on WM_COMMAND (1 replies)
  391. Numbers associated with segments ? (0 replies)
  392. It seems that only softice can solve this problem, (6 replies)
  393. File offset from rebased module (0 replies)
  394. How can i use symbolic debugging information maken (3 replies)
  395. Kernel32.DebugActiveProcess For Anti Debugger. (0 replies)
  396. tracing API's (1 replies)
  397. ASPROTEC - OEP? (13 replies)
  398. BPX on labels from dynamicly loaded DLLs (1 replies)
  399. tracing resource data access/locations (1 replies)
  400. tiny feature request -> beep on bpx (0 replies)
  401. RE OllyDbg Forum (0 replies)
  402. Dual Monitor Support? (0 replies)
  403. re DDRAW methods labelling (0 replies)
  404. to gigapede regarding labeller plugin (5 replies)
  405. Help file & how to setp up plug ins (3 replies)
  406. Help needed on debugger detection (8 replies)
  407. Forcing code sections (3 replies)
  408. How to break on a int 3? (1 replies)
  409. PE sections and the "Contains" column in (0 replies)
  410. How to make multi conditional BP with negations? (4 replies)
  411. kernel32 description? (3 replies)
  412. Deutsche Hilfe oder Anleitung? (2 replies)
  413. Can't resume attached process (1 replies)
  414. OllyDbg can only see one NtXxx function exported f (1 replies)
  415. Suggestions (3 replies)
  416. Total Useless Newbie trying to figure out OllyDbg. (7 replies)
  417. Debug symbols, information, symbol server setup (7 replies)
  418. Can't "Step" after "Pause (2 replies)
  419. Finding OEP op early Armadillo (1 replies)
  420. MFC API (4 replies)
  421. ASProtect 1.23 RC4 (again) - Stolen bytes (5 replies)
  422. Scribble pad? (3 replies)
  423. f*cked up MFC (2 replies)
  424. Altering ASCII text string (4 replies)
  425. How to locate child process entry point ? (9 replies)
  426. No veo las (5 replies)
  427. PLs Help Me In finding point h of my Computer (3 replies)
  428. Found OEP. and then? (1 replies)
  429. Modifying SetTimer (5 replies)
  430. help in finding neolite 2.0 oep in win98 (0 replies)
  431. In ollydbg how 2 operate the F12 function like sof (2 replies)
  432. Is there a way to dereference STRING resource? (4 replies)
  433. Armadillo new anti-olly? (3 replies)
  434. For Teerayoot (4 replies)
  435. OllyDbg v1.10b - where to download? (2 replies)
  436. TOOL FOR AUTOMATIC FOUND OF POINT H (6 replies)
  437. Hi !Can Olly set break point like Si? (7 replies)
  438. how 2 defeat upxpr in olly (3 replies)
  439. skype /no crack request (6 replies)
  440. To Teerayoot (0 replies)
  441. DLL packed by Armadillo (1 replies)
  442. DLL Export not working (1 replies)
  443. How to find references to menu property (1 replies)
  444. How to put a breakpoint on Menu Click Event? (0 replies)
  445. Help PLZ (10 replies)
  446. To Ricardo, re: packers (2 replies)
  447. SVKP 1.3x -> Pavol Cerven HOW to ? (17 replies)
  448. Antidebug (1 replies)
  449. Call stack of main thread help - newbie (0 replies)
  450. Need help on finding a register location... (12 replies)
  451. Breakpoint at callback function inside DLL (2 replies)
  452. Ollydbg in black and white. (3 replies)
  453. What happenned with ExeTools Forum (2 replies)
  454. want To join (3 replies)
  455. PKlite32 (4 replies)
  456. XP problem??? (3 replies)
  457. TCB - Thread control block (1 replies)
  458. complete newbie (1 replies)
  459. A bug of Ollydbg? (3 replies)
  460. Finding a window callback procedure (0 replies)
  461. [Idea] Diff at disassembly level (1 replies)
  462. breakpoint file (1 replies)
  463. .NET Applications (2 replies)
  464. Window ClassProc breaking (0 replies)
  465. Privileged Instruction (8 replies)
  466. Problem Olly with Panda (6 replies)
  467. Help Whit H point (10 replies)
  468. Cpu Usage (2 replies)
  469. Ricardo's site has gone, need backup (5 replies)
  470. How to put a breakpoint on RegistryRead (2 replies)
  471. help with olly (5 replies)
  472. WIN32 Debug API (1 replies)
  473. Safedisc v3 (1 replies)
  474. Breakpoints on programs that steal focus? (2 replies)
  475. Saving DLLs (0 replies)
  476. How does Ollydbg determine if a file might be pack (3 replies)
  477. Safedisc v3 ( NOT A REQUEST ¬_¬ ) (1 replies)
  478. Msn Messenger. (4 replies)
  479. Need Help In Unpacking FSG 2.0!!!!!!!! (7 replies)
  480. Tracing Code as it executes (6 replies)
  481. Cracking and unpacking topics on this board (4 replies)
  482. Problem With Debugging Of Standalong DLLs (0 replies)
  483. CPU disassembler Code vs Executable (1 replies)
  484. Beta testers for 2.0?? (6 replies)
  485. Finding Addresses in Disassembler Window (1 replies)
  486. Freeze when tracing (0 replies)
  487. General tutorials (1 replies)
  488. Saving Changes In Olly Debugger (1 replies)
  489. Ctrl+A in Olly Debugger (8 replies)
  490. Searching commands (4 replies)
  491. Olly Vulnerabilty (0 replies)
  492. Security risks with OllyDbg ? (1 replies)
  493. How to set a breakpointer on a button clicked mess (1 replies)
  494. Looking for spanish tutorials (3 replies)
  495. disassembling a exe (0 replies)
  496. Error (1 replies)
  497. module help (1 replies)
  498. Stopping a module from loading (2 replies)
  499. Strange thing while attaching a process (1 replies)
  500. right OEP in upx (2 replies)


General - Page 3

RCE Messageboard's Regroupment > General
Pages : 1 2 [3] 4
  501. Debugging DirectX and other Full Screen Mode Progr (4 replies)
  502. Symbols for win98? (0 replies)
  503. Swiches (0 replies)
  504. dll detecting olly, cant disassemble (3 replies)
  505. general question about debugging (0 replies)
  506. dump with win98 (0 replies)
  507. Create program to patch excutable (7 replies)
  508. PESpin v1.0 (0 replies)
  509. How uncap PKLite32 1.1? (1 replies)
  510. Animate Into (2 replies)
  511. Ollydbg analysing over and over (1 replies)
  512. Detach OllyDbg Debugger and let's vitim runni (6 replies)
  513. Olly open file but don't stop to EP! (12 replies)
  514. How attach to a process not visible? (5 replies)
  515. Function name of CALL <JMP.&MFC42.#xxx> (2 replies)
  516. Ollydbg and 64bits processor? (0 replies)
  517. Instruction addresses in run traces (2 replies)
  518. Finding MessageBox text (1 replies)
  519. Learn scripts/plugins now or wait for Ollydbg v2? (0 replies)
  520. im a newb (i dont even know what my problem is =D) (0 replies)
  521. Debugging C++ apps bail with access violation (0 replies)
  522. Finding the main loop (0 replies)
  523. soy nuevo con el olyydbg (5 replies)
  524. How to set BreakPoint on IsDebuggerPresent or Writ (3 replies)
  525. 2 questions about Delphi progs (3 replies)
  526. What does TRACE do? (2 replies)
  527. where is the zero flag? (6 replies)
  528. Breakpoint when user type and others (5 replies)
  529. BEST Olly Options for SCript Use (1 replies)
  530. reading register contents (7 replies)
  531. Format String vulnerability patch ? (2 replies)
  532. Program will not load into OllyDbg (2 replies)
  533. tracing in stack (1 replies)
  534. how can I unpack Armadillo (1 replies)
  535. how hide ollydbg under win98 (2 replies)
  536. SetUnhandledExceptionFilter() and win32_2.dll (1 replies)
  537. OllyDbg Source Debugging impossible with lcc-win32 (0 replies)
  538. Entry point outside of the code? (7 replies)
  539. Log data: Syntax error; cause of source code issue (10 replies)
  540. Hardware debug registers (3 replies)
  541. Olly through WinE on Linux (2 replies)
  542. Full Delphi 6 and Delphi 7 IDA signature (2 replies)
  543. upx+sfx (1 replies)
  544. Debug .Net and Powerbuilder programs? (2 replies)
  545. Suspended thread (9 replies)
  546. Stop WM_TIMER messages to an app that uses 100% cp (2 replies)
  547. How to load/save binary snippets? (1 replies)
  548. Question about unicode translation in VB6 vs VB5 (0 replies)
  549. Saving Progress In Ollydbg (2 replies)
  550. XP SP2 kernel32.LoadLibraryA F8 failed (1 replies)
  551. W32Dasm FIX CPU usage (2 replies)
  552. protection tests (21 replies)
  553. PAra Ricardo (3 replies)
  554. Setting Ollydbg as system debugger (2 replies)
  555. exp(in SoftICE) = ???(in OllyDbg) (2 replies)
  556. olly 1.10B? (2 replies)
  557. program detect debugger attachment (3 replies)
  558. unknown identifier (0 replies)
  559. dump registers to file? (0 replies)
  560. Softwrap 6.1.1 (6 replies)
  561. Hey i need to know how to change this please guys. (2 replies)
  562. some technic to stop debugger... included OD (3 replies)
  563. DLL Function Parameter Help (1 replies)
  564. Decrypting file tutorials for olly debug? (1 replies)
  565. Viewing variables in Ollydbg (1 replies)
  566. help me (0 replies)
  567. PKLite 32 (7 replies)
  568. Question about Animate Over (1 replies)
  569. No fixed-width fonts? ie. [code] blocks (0 replies)
  570. Flash favorite v1.31 (3 replies)
  571. Can you hide Olly from 3dsmax? (0 replies)
  572. 16 bit Program (5 replies)
  573. Load minidump into OllyDbg? (0 replies)
  574. commandline history? (5 replies)
  575. CommandLine args? (2 replies)
  576. Setting break points on DLL (4 replies)
  577. Removing hardware breakpoints (1 replies)
  578. Kegening by Ollydbg (4 replies)
  579. Need help using Ollydbg and NASM (1 replies)
  580. Best for keygening (7 replies)
  581. conditional log expression question (2 replies)
  582. OllyDBG offset ? (1 replies)
  583. Source code (1 replies)
  584. "Copy to executable" problem (6 replies)
  585. break points in dll (2 replies)
  586. reversing a dll (3 replies)
  587. Porting a single method of dissassbled dll in c / c++ / VC++ (6 replies)
  588. Changing a jump (2 replies)
  589. Every Exe starts with OllyDebug- You canrt start any program except some like Explorer (7 replies)
  590. Attaching to an executable (2 replies)
  591. What Api to hook to detect outgoing connection? (3 replies)
  592. Ollybug? (4 replies)
  593. safecast (0 replies)
  594. conditional BPX erased (3 replies)
  595. point.h breakpoint (4 replies)
  596. Some DRx Questions (3 replies)
  597. problems with DLL cond. bpx 's failing to match regexp (7 replies)
  598. get stack context (1 replies)
  599. Memory Brekapoints (1 replies)
  600. Tip: Conditional bpx on CreateWindowEx when only a window class or title is known (0 replies)
  601. i need tips for cracking of this chalange.... (1 replies)
  602. VCL api handling all data xfers via TcpIp? (1 replies)
  603. Paths for source files (5 replies)
  604. DO not Get adress of winproc ,why ?????? (1 replies)
  605. How do I make Olly treat .text section as code? (3 replies)
  606. How can VC++6 save procedures as thunks (0 replies)
  607. Anti-ollydbg (6 replies)
  608. upx? ayuda (2 replies)
  609. Source-level debugging problem (8 replies)
  610. tutorial for unpack any armadillo protection using OLLY 0.93 , (but a full one) (2 replies)
  611. OllyDbg used for Realtime debugging of Display Driver (0 replies)
  612. Loading OllyDbg at BootTime (2 replies)
  613. where to get .exe file info? (4 replies)
  614. loading a library (4 replies)
  615. sysenter?? (3 replies)
  616. "STRING [ESP+4]" log breakpoint question (1 replies)
  617. Is this new anti-debugging method or Ollydbg error? (1 replies)
  618. common.arg for MFC42 ?? (0 replies)
  619. ollyscript.dll ??? (4 replies)
  620. Example of custom function for MFC42 (2 replies)
  621. After unpacking UPX-File RCData still encrypted (9 replies)
  622. How to find the OEP of a Crypkey protected program (2 replies)
  623. execute functions in ollydbg (2 replies)
  624. Break on Data (1 replies)
  625. Unpack UltraProtect or Anticrack Protector (6 replies)
  626. How to manual unpack UltraEdit with OllyDbg (6 replies)
  627. Armadillo 4.01a unpack tutorial by KaGra (11 replies)
  628. Visual Basic 6 (1 replies)
  629. Howto put advanced breakpoint (3 replies)
  630. Source Window (2 replies)
  631. Difference between various Analysis 1 options (1 replies)
  632. Problem with conditional message breakpoint (0 replies)
  633. How to find Point-A (0 replies)
  634. Opening an installer with command line (2 replies)
  635. Breaking on execution with installshield (10 replies)
  636. Help for a NOOB :/ can't find hidedebug script for ollydbg (4 replies)
  637. Softice vs Ollydbg (4 replies)
  638. Ollydbg (1 replies)
  639. DebugActiveProcessStop problem... (0 replies)
  640. Softice (0 replies)
  641. Ollydbg F7 (3 replies)
  642. Ricardo Narvaja (13 replies)
  643. RinG-3 DebuggerZ BloCkEr FeaTuRe (3 replies)
  644. Debugging only one DLL (2 replies)
  645. Break/pause on "unhit" instruction? (1 replies)
  646. SetUnhandledExceptionFilter (2 replies)
  647. PEspin v1.1 under Olly (2 replies)
  648. stepping thrugh code! (3 replies)
  649. What am I doing wrong? Concerning Run trace. (4 replies)
  650. .arg file and logging function arguments (0 replies)
  651. Debug Visual Basic (1 replies)
  652. Using OllyDbg with games... (2 replies)
  653. Question about olly. (2 replies)
  654. Question on how to unattach processes without them crashing (8 replies)
  655. OllyDbg v1.10 - Virtual PC - Win2000 (5 replies)
  656. Map Files generated by IDA (1 replies)
  657. Problem with Debug>Call Dll Export (2 replies)
  658. How trace multithreaded programs? (5 replies)
  659. Dumping exe window (3 replies)
  660. Anti Bpx (1 replies)
  661. How to debug a Win32 callback function? (0 replies)
  662. SVK-Protector (3 replies)
  663. Debugging a program which uses its internal resource (0 replies)
  664. zylom.com what softwrap is it? (0 replies)
  665. debug running processes (0 replies)
  666. Scan upper 2GB of process space? (3 replies)
  667. ollydbg /dbghelp.dll/ and .tds files (0 replies)
  668. Ricardo Narvaja (3 replies)
  669. armadillo 3.61 (18 replies)
  670. disasm engine (0 replies)
  671. STEPING OUT (4 replies)
  672. EIP (5 replies)
  673. OEP, PE (6 replies)
  674. HELP!!! (1 replies)
  675. How to edit the Unicode text in the Application using Olly. (0 replies)
  676. OllyDbg Getting Confused? (1 replies)
  677. displaying things in the Registers box (4 replies)
  678. bmsg hwnd wm_CLOSE in Olly (3 replies)
  679. how to log buffer more than 8 length? (3 replies)
  680. I need help for some stdio.h routines (0 replies)
  681. How to rebuild IAT/IT (UPX) (2 replies)
  682. Unexpected error 000000002? (2 replies)
  683. how to use ollydbg for w3wp process (IIS) (0 replies)
  684. Any interactive cmd to modify register and/or memory contents like sice ? (6 replies)
  685. new, where should i start (2 replies)
  686. Function Cross reference (3 replies)
  687. how do you breakpoint on memory access? (4 replies)
  688. Automated step in step out (1 replies)
  689. Unusual exception issues between full run and stepping (5 replies)
  690. program text displayed as multiple question marks (1 replies)
  691. Attaching a process??? How??? (9 replies)
  692. Using Ollydbg with GCC compiled c++/asm (0 replies)
  693. crackme using vbaVarTstEq (5 replies)
  694. IN DUMP (0 replies)
  695. PLUGIN - PLEASE HELP - this is a tiny easy annoyance... (3 replies)
  696. Debugged program unable to process exception (6 replies)
  697. New cpu modules,Is it possible? (1 replies)
  698. com dll unpacking how? (1 replies)
  699. Aspack2.12 IAT HELP PLEASE (4 replies)
  700. load ALL DLLs (0 replies)
  701. [renamed] debugging tips (14 replies)
  702. Any news about OllyDebug v2 ? (0 replies)
  703. Break on Keypress??? (4 replies)
  704. EXEcryptor problems (2 replies)
  705. Problem with program packed with "ASProtect 1.2x - 1.3x [Registered]" (0 replies)
  706. DirectDraw Hooking (0 replies)
  707. stack (1 replies)
  708. armadillo app debugging (1 replies)
  709. Pe_patch file (2 replies)
  710. Help: Problem with BreakPoints (29 replies)
  711. A very newb question about step in and step over (9 replies)
  712. How to watch a specific range of memory ? (2 replies)
  713. problem with xp SP2 (5 replies)
  714. set a BP on ResumeThread? (6 replies)
  715. Damn I really need Going back??? (4 replies)
  716. n00b : help enterpreting debug (5 replies)
  717. load exe with parameters (1 replies)
  718. Ricardo ayudame please (1 replies)
  719. How to find specific instruction? (2 replies)
  720. How to set breakpoints in called EXE file (7 replies)
  721. Thread entry point (3 replies)
  722. Deactivate SOURCE FILES. (0 replies)
  723. attachments on posts? (1 replies)
  724. Cancel "Break on new modules"? (2 replies)
  725. Breaking on file acces... (1 replies)
  726. Convert an assembly mnemonic to hex (6 replies)
  727. Debugging a stack overflow - hardware breakpoints problem (2 replies)
  728. Denial of service to Ollydbg users (0 replies)
  729. Tutorial by Teerayout (0 replies)
  730. OLLYDBG USED TO FOIL STREAMING VIDEO COMPANY FOLLIES (4 replies)
  731. OllyDbg unable to proceed (3 replies)
  732. im from china ,im a beginner,i wanna konw how to pronounce the software? (2 replies)
  733. How to debug child process (5 replies)
  734. Chat dailog box (34 replies)
  735. Attaching problem.. Always Pused (2 replies)
  736. Problems while unpacking armadillo 1.xx-2.xx(PEID said so) (31 replies)
  737. program terminated? (2 replies)
  738. Editing raw packets (26 replies)
  739. just wondering (java JNI DLL-call) (2 replies)
  740. ENTER command (11 replies)
  741. ------------ABOUT OllyDbg v1.09b----------- (1 replies)
  742. debugging a plugin for iexplorer (0 replies)
  743. help! help! (4 replies)
  744. Lastest Version (0 replies)
  745. nOOb Question :( Sry for nOObisme (3 replies)
  746. Memory/Packet Editing (17 replies)
  747. How to debbug a program that have antidebugging routines (5 replies)
  748. How ollybug works (2 replies)
  749. how do you find an encryption fuction? (1 replies)
  750. value edit (6 replies)


General - Page 4

RCE Messageboard's Regroupment > General
Pages : 1 2 3 [4]
  751. loading prog with olly (2 replies)
  752. armadillo script... (11 replies)
  753. Help: Problem with plugin? (2 replies)
  754. Where to begin? For noobies (6 replies)
  755. Help with Breakpoints please (1 replies)
  756. Question on a breakpoint (new to olly and everything else) (4 replies)
  757. Any way (2 replies)
  758. Setting Multiple Breakpoints (2 replies)
  759. TEST EBP,EBP ;i don't understand this (3 replies)
  760. can you set break point (6 replies)
  761. Some questions about the usage of ollydbg (2 replies)
  762. Question on Thread. (2 replies)
  763. Qustion about Hardware Breakpoint (4 replies)
  764. NEW SITE OF RICARDO NARVAJA AND CRACKSLATINOS (15 replies)
  765. new to ollydbg but dont wanna bug everyone (3 replies)
  766. OpenRCE.org (2 replies)
  767. how to trace into the main module only (3 replies)
  768. Scan the packet send to server (2 replies)
  769. how to D FS:0 in OllyDbg?? (2 replies)
  770. ollydbg for x86-64? (0 replies)
  771. i have some kind of question (6 replies)
  772. DirectX 5 (2 replies)
  773. is unpacking illegal ? (4 replies)
  774. Is it possible? (4 replies)
  775. hacking intenet (1 replies)
  776. Modifying the stack (5 replies)
  777. how do i find a breakpoint (1 replies)
  778. Running trace to locate breakpoints (0 replies)
  779. Log with watches (2 replies)
  780. Translator (2 replies)
  781. Another Nub question for you guys.. (6 replies)
  782. a little help for an olly newb. (5 replies)
  783. condition question (6 replies)
  784. gunz online (6 replies)
  785. I've hosted a few of the Olly programs up (0 replies)
  786. Need Help Unlocking Armadillo 4 (3 replies)
  787. Error Entry Point Alert con Olly (1 replies)
  788. ollydbg command line parameter?? (9 replies)
  789. Anti **** (6 replies)
  790. RDG Packer Detector v0.5.6 (0 replies)
  791. Some questions about the rtrace tutorial (1 replies)
  792. Can the TC command stop when excute a given instruction? (8 replies)
  793. Unpacking SF protected exe (1 replies)
  794. Unpack aspack 2.12 with asprotect detection euristica (0 replies)
  795. armadillo.... is it possible? (1 replies)
  796. how does olly pass exceptions to debugee? (3 replies)
  797. User-defined labels (6 replies)
  798. What features do you want in Olly Script Editor v1.0 (1 replies)
  799. Size of the Log (2 replies)
  800. how to view registers? (2 replies)
  801. Upack (3 replies)
  802. Why my Topic is removed (2 replies)
  803. the link is not working any more and i dont find a good download for olly... :[ (2 replies)
  804. seriously need help with this (1 replies)
  805. Nb question: specific string breakpoint (3 replies)
  806. Searching for encryption/decryption (1 replies)
  807. Help on debugging an expiration condition - Newbie (4 replies)
  808. What's log breakpoint & how to use it? (1 replies)
  809. ImpREC and LordPE problems (0 replies)
  810. Where did my topic go? (2 replies)
  811. can I runtrace at winproc in ollydbg (1 replies)
  812. What will olly 2.0 improve on? (12 replies)
  813. How to install the IsDebuggerPlugin? (3 replies)
  814. regarding skype ;-? (14 replies)
  815. asm output (1 replies)
  816. Do Ollydbg detect Sent byte/Recieve byte from the source? (0 replies)
  817. Olly won't run on Windows XP x64 (0 replies)
  818. WPE PRO AND OLLYDBG (0 replies)
  819. PESpin 0.3 , (0.7), 1.0, 1.1 & 1.3 unpacking tutorial (1 replies)
  820. No disk in the drive! (0 replies)
  821. OllyDbg tutorials (3 replies)
  822. mfc42 reference (8 replies)
  823. Command Line (3 replies)
  824. Dependable breakpoint not breaking??? (3 replies)
  825. ####RDG Packer Detector English - translate#### (0 replies)
  826. Getting the debugger to reveal memory access to a string (6 replies)
  827. hardware breakpoints (1 replies)
  828. Search name in modules (2 replies)
  829. reals and jumps (6 replies)
  830. Learn ASM (2 replies)
  831. Is there any packer for visual studio Dot net executable file? (2 replies)
  832. Arma protected DLL questions (6 replies)
  833. Olly Script Editor V2.0 Released (3 replies)
  834. call $+5 ? (2 replies)
  835. dump memory on function entry (1 replies)
  836. NTDLL patch to disallow DR0-DR7 writes from ring3 (6 replies)
  837. Class based offsets (0 replies)
  838. ollydbg color (1 replies)
  839. Hey, Im looking for some information regarding Ollybg (2 replies)
  840. HELP....in ollydbg (3 replies)
  841. a Question for Ricardo Narvaja (6 replies)
  842. how to use a .map file? (2 replies)
  843. about Arma again (7 replies)
  844. how to break when a memory address is accessed? (3 replies)
  845. Hide Debugger fails to provide protection against Terminate Process (6 replies)
  846. Howto Build a new PE Header header or fix the existing?!? (2 replies)
  847. c++ reversing ? (0 replies)
  848. Move location of application corrupts UDD file? (1 replies)
  849. Jumped from where? (and others) (1 replies)
  850. gsx problem (1 replies)
  851. Question to Trace-Log (3 replies)
  852. Turbo Debugger symbols messed up (6 replies)
  853. breaking inside modules (1 replies)
  854. Stupid question, how to remove stuff? (4 replies)
  855. hex dump, or register? (2 replies)
  856. Olly crashes (2 replies)
  857. Can Someone Post a link For Hide Debugger that Actually works? (4 replies)
  858. Question. (3 replies)
  859. How to set breakpoint on message? (11 replies)
  860. how to view your memory breakpoints? (4 replies)
  861. How to change the Disasm Entry? (4 replies)
  862. Breakpoint problem (1 replies)
  863. armadillo (2 replies)
  864. how to get relocation address and size from packed dll ??? (3 replies)
  865. please Ricardo Narvaja i have problem with armadillo (1 replies)
  866. DLL unpacking tutorial (3 replies)
  867. Error: "No response from injected code" (4 replies)
  868. masm / message conditional breakpoints (32 replies)
  869. How ollydbg enumerates process in attach viewer? (3 replies)
  870. REQ: olly 32 plugin problem help (5 replies)
  871. Source code disassembler (2 replies)
  872. how do i do this in olly? (2 replies)
  873. Hi, rookie say hi to everyone, and have a question～ (1 replies)
  874. Some problems rebuilding a DLL. (0 replies)
  875. isdebuggerpresent (1 replies)
  876. its a stupid question but.. (2 replies)
  877. Breakpoint on module (3 replies)
  878. Armadillo App strange Mem-behaviour ? (2 replies)
  879. where can I get the newest version of Ollydgb? (2 replies)
  880. How to find all rows/lines with a specific memory address? (4 replies)
  881. ollydbg crashes/pauses (0 replies)
  882. Debugging a XP service pack problem (2 replies)
  883. IAT Specifics (8 replies)
  884. Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation) (0 replies)
  885. Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation) (13 replies)
  886. ####RDG Packer Detector v0.5.8#### (6 replies)
  887. c0000142 in Macromedia Director (3 replies)
  888. udd files and backtracking (0 replies)
  889. email notifications (3 replies)
  890. REQ: how to extract armaccess.dll (2 replies)
  891. debugger detection (8 replies)
  892. breakpoint on non-API function (3 replies)
  893. RICHARDO : movie collector problem (6 replies)
  894. Check on what address a jump was taken (3 replies)
  895. Super n00b (2 replies)
  896. thinstall over upx (0 replies)
  897. Access violation question (1 replies)
  898. How to use exports? (0 replies)
  899. unaable to locate data in executable file (7 replies)
  900. Disassembling a kernel function (3 replies)
  901. drivers (4 replies)
  902. NanoMite Table DUMP or ArmInline 0.7.1 (5 replies)
  903. How to find text in Ascii (7 replies)
  904. CRC Check on aspr 2.1x (0 replies)
  905. Armadillo - son doesn't run (2 replies)
  906. LordPE problem (6 replies)
  907. virtual function comments (6 replies)
  908. Unable to find binary known ASCII string in dump (5 replies)
  909. how to duplicate items in flyff with ollydbg?or other hacks? (0 replies)
  910. ? - command (3 replies)
  911. Armadillo :-) (9 replies)
  912. Hola Ricardo¡¡¡ (9 replies)
  913. Changing ascii strings (0 replies)
  914. Change the window name (4 replies)
  915. Please Help Me ... (3 replies)
  916. Acceso a Pagina de Ricardo (1 replies)
  917. I will pay real cash for someone to hack a game for me <Dead Serious> (0 replies)
  918. Setting breakpoints in dll's (1 replies)
  919. SmartCheck (4 replies)
  920. Stop a process from exiting (1 replies)
  921. IDA Pro- Bad Character ! (1 replies)
  922. Import (3 replies)
  923. Olly's Shadow (7 replies)
  924. OllyDbg XP style (1 replies)
  925. A few general debugging questions (3 replies)
  926. how I find Overflow? (3 replies)
  927. dll for mobile can't ollydbg open it (0 replies)
  928. How can I set a breakpoint on HMEMCPY using olly? (3 replies)
  929. Very basic Olly question (2 replies)
  930. TrueTime, TrueCoverage, and BoundsChecker (4 replies)
  931. break on click? (2 replies)
  932. How to find text from incoming packets? (1 replies)
  933. anyone know debuger/sniffer to the mobile? (0 replies)
  934. ascii window (2 replies)
  935. WS2_32.dll need help (0 replies)
  936. about ep (0 replies)
  937. Welcome back =) (3 replies)
  938. Dumping function arguments (6 replies)
  939. How to set BP on clicking a button or reading the contents of a textbox? (1 replies)
  940. Microsoft Visual C# / Basic .NET??? (7 replies)
  941. Newbie here (5 replies)
  942. please about nsp pack (6 replies)
  943. WinAmp Freezes (6 replies)
  944. Help finding the correct api (6 replies)
  945. NtReadFile API (2 replies)
  946. Searching for Hide Debugger plugin to download !!!! (3 replies)
  947. Babylon v 5.0.6(r13) challenge ... (0 replies)
  948. yodas protector 1.03.1 (16 replies)
  949. ASProtect 2.0x problem (3 replies)
  950. Terminating Process/Kernel32 (2 replies)
  951. I need something as "bpio" (4 replies)
  952. OLLYDBG WITH SCRIPT PLUGIN (1 replies)
  953. trouble finding CALL ECX and hooking IAT in armadillo packed (1 replies)
  954. newnie want ollydebug soft (2 replies)
  955. executable module names... (2 replies)
  956. ASProtect 2.0x Manual Unpacking Scripts (10 replies)
  957. I set breakpoint on ALL commands in Intermodular calls, but nothing happens! help? (1 replies)
  958. Exception handling (11 replies)
  959. OllyDbg memory breakpoint management (5 replies)
  960. Neolite 2.0 unpacking using olly (5 replies)
  961. [RicardoNarvaja] 2 preguntas sobre ollydbg (5 replies)
  962. Ollydbg and Console mode (2 replies)
  963. hmemcpy questions (1 replies)
  964. Safedisc antidebug trick (0 replies)
  965. ASProtect v1.3x (4 replies)
  966. Insert new opcodes in code caves from any PE file with Ollydbg (0 replies)
  967. Exception Probs (1 replies)
  968. Unpack UPX (7 replies)
  969. ExecuteNInstructions()? (4 replies)
  970. Word .dot decompile (0 replies)
  971. Crocodile-clips (3 replies)
  972. setting a memory breakpoint on priv (2 replies)
  973. Password fishing protected files (1 replies)
  974. how to you save comments (1 replies)
  975. setting function arguments (0 replies)
  976. ClickFix301.xfm Cool Edit Plugin Asprotected v1.23 (0 replies)
  977. Extreme newbie question, CTRL+F7 or F8 (0 replies)
  978. comments from sources (2 replies)
  979. access memory via segment:[offset] (2 replies)


Welcome!

RCE Messageboard's Regroupment > General > Welcome!
Anonymous
11-07-2002, 11:48 AM
Welcome to OllyDbg Users Forum !


2nd year of OllyDbg anniversary - 11.Nov.2oo2

RCE Messageboard's Regroupment > Announcements > 2nd year of OllyDbg anniversary - 11.Nov.2oo2
TBD
11-08-2002, 03:24 AM
heya all,

on 11.Nov.2oo2 OllyDbg celebrates 2 years, so I decided to reopen (thanks to Ro) the OllyDbg Users Forum.

i hope that all OllyDbg users can have a place to share opinions, ideeas & plugins.

enjoy,

TBD
Acid_Cool_178
11-11-2002, 06:38 PM
hehe, OllyDbg is one of the best replacers for SoftIce and it also have grown allot in strength. I have been using OllyDbg from the beginning and is one huge fan of that product.

Let me congrate to Oleh and wish him the best in the future so long he keep it open, and free. I love the man and his motivation on working on the program.

Acid_Cool_178
Anonymous
11-13-2002, 08:17 AM
since the 1.08b1 olldbg start disassamble the MFc42.DLL,make much slower than before.

poor english
TBD
11-13-2002, 09:46 AM
Anonymous: i didnt feel the difference. and i dont think that you will disassemble everyday, so all information is stored in .udd file

[tip] also apply mfc42.lib as import library(Debug/Select import libraries) and everything will be more clearer then :)

ps. if you want to stay more on this forum, please register so we can know you name/alias
Anonymous
11-18-2002, 11:38 AM
im sorry i missed the anniversary..
i remember discovering ollydbg and trying to convey to all my softice friends how magical it was...
more than a year later, they all use ollydbg :)

its such a beautiful thing. thank you ollydbg for being an amazing program.
Wayne
11-18-2002, 12:01 PM
How on earth is it free?
I haven't paid a single cent for OllyDbg, yet:
- it has helped me pretty much every week for the last year
- Oleh has been kind enough to include a couple of my suggestions, and also fix all of my two reported bugs
I can't help but feel like Oleh is getting the raw end of the deal here! :) -- how can you spend so much time on a program, yet give it out for free? Obviously he knows that if he tried to protect it, somebody would crack it, but he'd still at least then be getting _some_ pay for his hard work.

Don't get me wrong - I love freeware! But OllyDbg is too good, and I can't help but feel guilty when I use it for having paid nothing ... :)

Many thanks Oleh, and congratulations on creating - hands-down - the only debugger that can hold it's own against SoftICE. You are a rare and amazing man.
TBD
11-18-2002, 12:23 PM
Wayne: 1oo% agree with you.

i am with Olly from start (2000) and everytime he had listened to my bug reports & requests (plugin architecture, cosmetical things, ...)

and what i gave him in return ? almost nothing (except this site and one beer when we met in .de)

he is great dude and i hope he can resist in this manner long time from now on :)


Greetings!

RCE Messageboard's Regroupment > General > Greetings!
Anonymous
11-08-2002, 02:57 PM
Nice to c u again!
I wish u luck!

The_Philosopher


Kernel32 debugging capability

RCE Messageboard's Regroupment > General > Kernel32 debugging capability
Anonymous
11-12-2002, 03:11 AM
I wish Oleh can upgrade his GREAT tool towards a WIndows KERNEL32 debugger.
TBD
11-12-2002, 07:12 AM
OllyDbg is only a source level debugger, for a kernel debugger it needs to be started before windows (a la SoftIce) - that means a major rework. maybe on version 2.x ... but for now it will stay only as a source level debugger.
Wayne
11-13-2002, 12:59 AM
Are there really that many people that need kernel-level debugging? The majority of debugging is application-based, right? All of my debugging is. SoftICE is already an excellent tool for kernel debugging, so I dont think OllyDebug should go in that direction until its app/source-level debugging is "about as good as it can get" ... :)
Anyway just my thoughts! Hope i havent offended anybody down there in the kernel :D


greeting to forum reopen!!

RCE Messageboard's Regroupment > Announcements > greeting to forum reopen!!
StepIn
11-12-2002, 07:07 AM
greeting to forum reopen!!


[TIP] Messages Spy

RCE Messageboard's Regroupment > General > [TIP] Messages Spy
TBD
11-12-2002, 07:47 AM
1. open program [CTRL+O]
2. Names window [CTRL+N in CPU Window]
3. Find User32.TranslateMessage API
4. right click/FindReferences
5. conditional breakpoint [SHIFT+F4]
6. expression: MSG
log function arguments: Always

now you can do a message spy - good for debugging mouse movements, paint, keyboard, ...

dont forget to read ollydbg.hlp/Evaluation of expressions section

enjoy and if you find cool conditions post them here :)
Wayne
11-13-2002, 12:56 AM
TBD, great tip! but ive done everything you said, but where are the spied message saved? I cant see them in any windows

Thanks,
Wayne
TBD
11-13-2002, 02:20 AM
Wayne: Log Window - ALT+L.
try first on a simple program, only one window(not a dialog)
Wayne
11-13-2002, 04:00 AM
Very, very cool!
TBD
11-13-2002, 04:36 AM
Wayne: glad you like it ... I plan to do this regularly, maybe tip-a-week
Wayne
11-13-2002, 04:42 AM
The more tips the better! I wonder how many other powerful features there are like this that I still havent seen yet? :)
It'll be good when the helpfile is a bit more comprehensive!
Anonymous
11-26-2002, 03:37 AM
I only want to capture WM_COMMAND, how can I do this?
Anonymous
11-26-2002, 03:51 AM
Ah, Message breakpoints via the Windows window ... very nice!
Anonymous
01-03-2003, 11:30 PM
Sorry I did get it regarding the WM_COMMAND.
You mean that we need to enter in the expression box:
MSG==WM_COMMAND

I tried but all WM_xx are also loged
luucorp
01-04-2003, 07:19 AM
greats tip. i will use....
Anonymous
01-04-2003, 08:55 PM
To Log Only WM_COMMAND

do it in this way

1. open program [CTRL+O]
2. Names window [CTRL+N in CPU Window]
3. Find User32.TranslateMessage API
4. right click/FindReferences
5. conditional breakpoint [SHIFT+F4]
6. Condtion box: MSG==WM_COMMAND
7. log function arguments: On Condition

Et Voila
Anonymous
01-09-2003, 10:28 PM
3. Find User32.TranslateMessage API

Hummmm... I cant find it. Is there present in all .exe files?
Thx
TBD
01-10-2003, 05:59 AM
if it has a GUI usually yes. also if it is packed you will not find in Names window (try also Search for/All intermodular calls).

ps. oops, i responded to an anonymous post. bad TBD :)
if you dont know what i am talking aboutm than read <u>this</u> (http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=5&topic=119)
FuZzYBiT
01-10-2003, 01:54 PM
Thanks, that was what I was looking for.
PS. I've registered ... sorry for being anonymous :)
Anonymous
02-01-2003, 06:55 PM
thanks
but where can i do 7. log function arguments: On Condition ? please
Mikelo2k
02-03-2003, 12:48 AM
Thanx 4 the tip man, will come in handy :)


[REQ] help on converting plugin.h to Sphinx C--

RCE Messageboard's Regroupment > Plugins > [REQ] help on converting plugin.h to Sphinx C--
TBD
11-12-2002, 07:57 AM
as i dont have to much time to do this maybe some of you can help me in converting plugin.h to Sphinx C-- syntax.

get compiler from here (http://c--sphinx.narod.ru/indexe.htm)

i already made a simple plugin for OllyDbg in C-- for easy debugging of other plugins.

if you want to help contact me at: tbd.odl@mailnull.com

thanks
TBD
11-28-2002, 02:08 PM
still no one tried Sphinx C-- (except gigapede) ???
you lazy ones :)
Gigapede
12-01-2002, 04:04 AM
TBD: i sent an email.
did it reach?
TBD
12-01-2002, 10:08 AM
gigapede: please wait till monday, till i have access to that email account :)


OllyDebug Implib scanner

RCE Messageboard's Regroupment > General > OllyDebug Implib scanner
Vitaly
11-12-2002, 11:12 PM
Hi!
I have one problem with the import libraries. When I select some library (ex. mfc42.lib or mfc42d.lib) and click "Process" Implib scanner shows many ordinals in my code, but in the CPU window MFC functions still display as numeric ordinals.
What I do wrong? Please help me!
Thanks to Olly for a very good debugger!!!
TBD
11-13-2002, 02:37 AM
Vitaly: i tried on GUIDGEN.EXE from VC package with MFC42.LIB and it works for me.

here are the steps:
1. open GUIDGEN.EXE
2. Debug/Select import libraries
3. Add MFC42.LIB
4. Process

i used OllyDbg 1.08B2, MFC42.LIB - 2.157.890 bytes, GUIDGEN.EXE - 24.649 bytes
Vitaly
11-20-2002, 10:54 PM
Hi!
It's me again. I've try LIBs and GUIDGEN.EXE from Visual Studio 5.0 and haven't any results.
Maybe I must use LIBs from Visual Studio 6.0 only?

Vitaly.

PS. Sorry for my poor English.
TBD
11-21-2002, 02:45 AM
Vitaly: i tried with VS 6.0 and it works perfectly.
also check "Demangle symbolic names" in Options/Addresses
Vitaly
12-05-2002, 08:08 AM
Hello.
Yes, that's right! LIB files from Visual C++ 5 don't work with IMPLIB Scanner.
I tried LIBs from VS 6 and it works for me too.
Thank you, TBD!


How to get selected address in CPUDUMP ?

RCE Messageboard's Regroupment > Plugins > How to get selected address in CPUDUMP ?
Anonymous
11-13-2002, 11:59 AM
I'd like to get selected address in CPUDUMP pane by plugin right click menu.
So, I coded in ODBG_Pluginaction like this;

case PM_CPUDUMP:
pd=(t_dump *)item;
address = pd->sel0;
.........
break;

but I couldn't get address and CPUDUMP pane show nothing!!

Please help me.
Anonymous
11-15-2002, 02:22 AM
sorry for the delay ...
it is a 1.08b2 related bug ... it is fixed in 1.08 final that will be released this weekend (16,17 nov.)

TBD
Gigapede
11-15-2002, 12:15 PM
thanks TBD.

I found one more bug(?).
I couldn't get register value from plugin right click menu.
"preg=(t_reg*)item;" doesn't work.
but this is not serious problem.
I can get selected register value using "Findthread(Getcputhreadid())".
pthread->reg.selected is available.
TBD
11-16-2002, 10:51 AM
gigapede: what does your plugin ? i hope you will share with us when is finished :)
Gigapede
11-17-2002, 09:51 AM
some plugins I made are here.
http://dd.x-eye.net/ollyplugin.html

Sorry, I do not write document yet.
Please guess the usage.

Regards.
Anonymous
11-18-2002, 02:44 AM
Gigapede: woah! great work man!
loved the cmdbar & hidecapt. i will dwelve in others deeper. if you have time maybe we can start working on some documentation. i will gladly help.

thanks for sharing
TBD

ps. i forgot to login ... again :)
Gigapede
11-20-2002, 11:09 PM
TBD: thanks the proposal.
I'm not good at English, so I need much time to write a document.
(one of the reason I respond late).

If you can, please write some.
of course I try.

I am glad to have you like it.
TBD
11-21-2002, 02:47 AM
Gigapede: i will make a page with all plugins that i know, with description, links, ... i hope to finish the page today

i've sent you an email, did you receive it ?
Gigapede
11-22-2002, 04:35 AM
TBD: thanks plugins page.

yes, I've got your email about request 1.
I implemented the request instead of reply it.
Sorry, it was a bad manner.
TBD
11-22-2002, 04:38 AM
Gigapede: updated plugin page with cmdbar100b5.
can you mail me (tbd@despammed.com) at to start talking about plugins ?


1.08b2 slowness

RCE Messageboard's Regroupment > Bugs > 1.08b2 slowness
Cvx
11-13-2002, 04:29 PM
This is probably not a bug.

I'm analyzing a program that uses networking and requires to stay in sync with its server.
However, when using OllyDbg 1.08b2, attaching to a running program takes much more time than it took with 1.06. The DLL-loading stuff seems to be very time consuming now. While attaching, the client program freezes and loses sync, so i can't debug it.

Loading the program from OllyDbg isn't possible, because the program needs to be started from a launcher application.

Is there any chance to speed up the attach functionality? Maybe an option to disable some DLL parsing features?
TBD
11-14-2002, 02:42 AM
Cvx: your program is available on the web ? so i can test it too ...

did you tried in Options/Analysis1 to deselect Auto start analysis of main module and have selected Keep analysis between sessions ?

the ideea is to have all DLL/EXE analysed before actual debugging
Anonymous
11-15-2002, 11:47 AM
to speed it up delete dbghelp.dll if u dont need it
Cvx
11-15-2002, 04:14 PM
your program is available on the web ? so i can test it too ...
No, it isn't.

Auto analysis is turned off, Keep analysis is turned on.

I can (sometimes) work around the out-of-sync problem if i start the program, and attach immediately. This is somewhat time-critical, as i have to get the right moment, when no server connection is established yet.

But that doesn't work all the time, because some of the DLLs are still being loaded while connecting, and that takes ages (around 30 seconds, on a 1900+!)
TBD
11-16-2002, 10:00 AM
Cvx: even if you have had analysed the DLLs before ? hmm, strange.

i cannot help me you more if i cannot test on my system to see where the problem is.

please contact me on email address, maybe we can sort it out somehow
Cvx
11-16-2002, 11:33 AM
The newly released 1.08 revision seems to attach much faster. Loading the DLLs doesn't take too much time now, altough it's not as fast as 1.06. But it works fine for me now.
Thanks for your help.
Anonymous
11-16-2002, 02:18 PM
Cvx: have u tried removing the dbghelp.dll if u dont need it?
Cvx
11-16-2002, 02:39 PM
Yep, tried that. No difference. 1.08 attachs fast enough most of the time now, i have to stick with it i guess.
Anonymous
11-17-2002, 10:20 PM
1.08 works well!


OllyDbg and WinXP ?

RCE Messageboard's Regroupment > General > OllyDbg and WinXP ?
Anonymous
11-13-2002, 08:34 PM
Hi,
last week I set my computer on fire, I set it up with XP. So far so good (or not so good). Everytime I'm debuging some programs OllyDbg stops in the main thread but not in the program.
It look's like this:

7FFE0304 C3 RETN
7FFE0305 9C PUSHFD
7FFE0306 810C24 00010000 OR DWORD PTR SS:[ESP],100
7FFE030D 9D POPFD
7FFE030E C3 RETN
7FFE030F 8BD4 MOV EDX,ESP
7FFE0311 0F05 SYSCALL
7FFE0313 C3 RETN
7FFE0314 90 NOP
7FFE0315 9C PUSHFD
7FFE0316 810C24 00010000 OR DWORD PTR SS:[ESP],100
7FFE031D 9D POPFD
7FFE031E C3 RETN
7FFE031F FF00 INC DWORD PTR DS:[EAX]
7FFE0321 0000 ADD BYTE PTR DS:[EAX],AL
7FFE0323 0000 ADD BYTE PTR DS:[EAX],AL
7FFE0325 0000 ADD BYTE PTR DS:[EAX],AL

Is there a trick how to stop and how to get into the real code?
Hope there is a solution.
Sincerly, ovco
Wayne
11-13-2002, 10:57 PM
Press Ctrl+E (or go View | Executable Modules). Then just select the .exe you want to look at
luucorp
12-18-2002, 05:36 AM
this is address in KERNEL32.DLL
you press F8 --> your real code
xxxxx
12-18-2002, 07:16 AM
Actually you must press ALT+F9 and you will return back to your code
ricnar456
12-18-2002, 10:47 PM
I go to VIEW-MEMORY and put a BPM in a section CODE of the program, RUN and OLLY stops in the first sentence when return to the executable.

Ricardo Narvaja


Not showing assembelr text in cpu window

RCE Messageboard's Regroupment > Bugs > Not showing assembelr text in cpu window
bigglass
11-14-2002, 01:22 AM
This is probably not a bug.

Can i show assembler text in CPU window on non analyzed code .
Can i direct disasm code from same
EIP ?

P.S. Excuse my of bad lang
TBD
11-14-2002, 02:37 AM
bigglass:
1. for CPU window just go to your address, for CPU Dump - right click/Disassemble

2. do you mean to change the EIP to point to another address ? please be more specific, also a little example would help

ps. you have been a member to OllyDbg Users Liner, no ?


forcing OllyDbg

RCE Messageboard's Regroupment > General > forcing OllyDbg
Crick
11-14-2002, 03:26 AM
Hi all!

Is it possible to force OllyDbg to assume that a particular piece of a program being disassembled/debugged is data or code ? (a la IDA)

Thx in advance.
Crick
TBD
11-14-2002, 03:51 AM
Crick: nope ... in this versions is not possible. i talked with Olly about this problem and for this he must change a lot in his code.

maybe in the future it will be possible but not for now.

you can only select in Dump window to show as disassembly, no analysis thou :(
Anonymous
11-16-2002, 11:47 AM
well, mainly ollydbg is coded for an debugging and just uses a simple disasm engine to parse the opcodes from mem/exe..
ida team are dealing only with dead listening :-)
there for they have made an smart disassembler...


downtime

RCE Messageboard's Regroupment > The Heap > downtime
rohan
11-14-2002, 06:52 PM
Sorry about the downtime, my web host went down for about a day.

Ro


OllyDbg found a fruit salad in Task Manager :)

RCE Messageboard's Regroupment > The Heap > OllyDbg found a fruit salad in Task Manager :)
Wayne
11-15-2002, 12:08 AM
I was OllyDebugging Task Manager (taskmgr.exe) that comes with Win2K, for some silly reason that I cant remember now, when I happened to look at the Resources from taskmgr.exe, and low and behold, I see these:
010128F0 MENU 6A 0409 English ( 00000324 &File,&Options,&View,&Windows,&Help
01012C18 MENU 6F 0409 English ( 0000013C Banana
01012D58 MENU 75 0409 English ( 0000012C Apple
01012E88 MENU 77 0409 English ( 00000094 Peach
01012F20 MENU 78 0409 English ( 000002A0 &File,&Options,&View,&Help
010131C0 MENU 79 0409 English ( 00000258 &File,&Options,&View,&Help
01013418 MENU 80 0409 English ( 00000060 Pear

Am I correct in assuming that Peach/Pear/etc are the resource names for the File, Options, View, and Help menus?

PS. Win32dasm failed to see the fruit salad, as it's unicode, it required OllyDbg!
Alienripper
11-15-2002, 09:07 AM
Heh hilarious ! Microsoft people must have been hungry while coding :)


[Tip] Log all API calls and arguments

RCE Messageboard's Regroupment > General > [Tip] Log all API calls and arguments
Wayne
11-15-2002, 06:02 AM
[Requires OllyDbg v1.08 or later]
Load a process, right-click in the disassembly window and select Search For | All Intermodular Calls
In the window that pops up (which will have listed all imported APIs), right-click on it and select Set Log Breakpoint On Every Command
Set the Log Value Of Expression and Log Function Arguments to "Always". Press OK, and you'll see all of the intermodular calls now with addresses highlighted in pink/purple, indicating log breakpoints.
Now simply run the program, then look in the Log window (View | Log) to see which API's got called, in which order, and what arguments were passed. It reads like a book ... :)

Thanks to TBD for introducing me to powerful log breakpoints, which is what lead me to discovering this trick!
TBD
11-15-2002, 08:20 AM
Wayne: nice! thanks for sharing

one thing though, if OllyDbg doesnt know arguments for one of the API than "Log Function Arguments" is disabled.
i will bug Olly about this :)


2k/XP anyone?

RCE Messageboard's Regroupment > General > 2k/XP anyone?
Cvx
11-15-2002, 04:23 PM
I'm currently forced to use Win98SE *sigh*, because i use some programs not available on XP/2000.

As i had no opportunity to test OllyDbg on Win 2000, i'd like to know whether this odd behaviour also occurs on your machines:
When searching a process' memory, the computer freezes, depending on the size of the currently examined memory block. This means, you can't move the mouse nor do anything else, unless the memory block has been entirely read.

Does that happen on Windows 2000 and XP too?

That's not a OllyDbg specific problem. It's something to do with ReadProcessMemory(), it happened in my own debugging helper programs as well.
Anonymous
11-16-2002, 03:05 AM
No serious problems here using XPpro/sp1
Anonymous
11-16-2002, 11:07 AM
I have the same problem using softice on windows 98.
Anonymous
11-16-2002, 11:35 AM
Yep, it seems only W98 freezes on ReadProcessMemory(). I could get around that problem in my own programs by reading the memory in smaller chunks and yield some time to other processes after reading a chunk. Maybe that's an option for OllyDbg too.


[new] 1.08 released ?

RCE Messageboard's Regroupment > Announcements > [new] 1.08 released ?
TBD
11-16-2002, 10:06 AM
http://home.t-online.de/home/ollydbg/odbg108.zip

is this the new 1.08 version ? because on my win98 it crashes at startup.

please try it on your systems and report here any anomalies.
Anonymous
11-16-2002, 11:19 AM
It works well on my win98se.
That's the new 1.08. yea!
Anonymous
11-16-2002, 11:25 AM
win98se - works good here also
Cvx
11-16-2002, 11:31 AM
Works fine on my 98 machine too.
Anonymous
11-17-2002, 10:17 PM
well speed is so good,yeah!
bigglass
11-18-2002, 11:28 PM
Wheen new plugin api realised ?
TBD
11-19-2002, 03:37 AM
bigglass: welcome back. what functions do you need that are not in current plugin api ?
bigglass
11-20-2002, 07:35 AM
i need documentation on undocumented api & some new functions(14 new function after ver 1.06)

More intersting func for manipulate hardware breakpoints
TBD
11-20-2002, 07:50 AM
bigglass: did you make some plugins till now ? i will gladly have a look.

for the new plugin APi i think you must wait till next year, as Olly needs
a vacation after 1.08 intense bug testing


Finding trigger for "break on new module

RCE Messageboard's Regroupment > General > Finding trigger for "break on new module
Anonymous
11-16-2002, 05:58 PM
When an app being debugged triggers a "break on new module" breakpoint, is it possible to see where in the main app code it was called from ? I see the disassembly in the system API sitting on a RET instruction, and single-step F7 seems to issue a run command until the next module load. Examing the stack doesn't seem to help much either.
Anonymous
11-16-2002, 05:59 PM
(Preferably here I would like to find the call to the LoadLibrary function that triggered the BP)
TBD
11-18-2002, 02:51 AM
have you tried call stack (ALT+K) ?
Anonymous
11-19-2002, 04:31 PM
Hmmm, LoadLibraryExA from OLE32. No mention of the application. I can only assume therefore that the app uses OLE to load it's libraries. Scary. On other app's I can see the actual place in the app where the library is loaded.

Cheers for the tip !


Ollydbg108beta Can't download?

RCE Messageboard's Regroupment > The Heap > Ollydbg108beta Can't download?
tsing
11-17-2002, 04:58 AM
http://home.t-online.de/home/Ollydbg/beta108.zip

Private Homepage

-------------------------------------------------------- ------------------------
Das Dokument konnte nicht gefunden werden.
Bitte überprüfen Sie Ihren URL
-------------------------------------------------------------------- ------------
Hinweis :
Bei Dateinamen wird auf Groß- und Kleinschreibung unterschieden

------------------------------------------------------------------ --------------
We are sorry, but the private homepage server could not find the file you asked for.
Please check the URL to ensure that the path is correct.

------------------------------------------------------------------ --------------
404
tsing
11-17-2002, 05:01 AM
o,
so quickly

the 1.08 released

Maybe u should modify the url in "What's new" page;)


Description of toolbar button function stays for t

RCE Messageboard's Regroupment > General > Description of toolbar button function stays for t
yaa
11-17-2002, 07:32 AM
Has in this post's subject I believe that description for each toolbar button function is displayed for too little time. Also, showing a tooltip could be considered.

Regards,
yaa
TBD
11-17-2002, 08:54 AM
i already talked with Olly and he had increased the timeout.
for me is enough ... after using OllyDbg for some time you will know by heart :) as i do ...


? hook to a dll export?

RCE Messageboard's Regroupment > General > ? hook to a dll export?
_Servil_
11-17-2002, 08:43 AM
hello,

i need to hook olly to a dll exported fn. the dll(plugin) is loaded and unloaded for a while at runtime, impossible to locate in mod/mem list. tried the int 3 but olly doesn't handle, maybe due the plugin running in different context than imprec. i3 is handled by softice but i need to use ollydbg. any hint to hook? tia.
TBD
11-17-2002, 08:56 AM
_Servil_: you can select options/event/break on new module and then breakpoint on you needed function
_Servil_
11-17-2002, 03:36 PM
thanks but unfortunatelly it doesn't work host app doesnt call the plugin by getprocaddr/call but creating a thread waiting for it's end (???)
I located the place where the plugin file is accessed,

0043C9EA FF15 DCE14300 CALL NEAR [DWORD DS:43E1DC] ; kernel32.ResumeThread

tracing into there was the INT 2E which olly isn't able trace.
this seems is the thing i couldn't locate the plugin module part in trace log.
any chance to step through the interrupt?
tried to find place where module is loaded and export address retrieved,
but there's not one not sure if this isn't handled by kernel APIs (CreateRemoteThread?), the plugin is first read as late as resumethread is called ;(


Dump process

RCE Messageboard's Regroupment > Plugins > Dump process
Anonymous
11-17-2002, 05:00 PM
There should be a way to dump the image of a process to a file on the disk.

Currently I have to use LordPE to do this.
TBD
11-18-2002, 02:48 AM
you can use ollydump111 by gigapede for dumping. the link is in plugins area.
Anonymous
11-19-2002, 04:34 PM
If you dump each section, you can simply join them up, edit the PE header and you'll have a valid dump. So, really, there is already a way of dumping, but it's not exactly easy or automatic. Then again, this is supposed to be a debugger, not some <censored> tool.
TBD
11-20-2002, 02:47 AM
ollydump111 does everything you said ... automaticaly :)
also dont forget to get all plugins from gigapede ... they rock (loved hidecaption)
Anonymous
11-20-2002, 06:08 AM
Ollydump is very cool! I was searching for useful dump tool for olly.
Special thanx to Gigapede, and also TBD!


[download] plugins by gigapede - link

RCE Messageboard's Regroupment > Plugins > [download] plugins by gigapede - link
Gigapede
11-17-2002, 10:19 PM
<a href="http://dd.x-eye.net/ollyplugin.html
" target="_new">http://dd.x-eye.net/ollyplugin.html
</a>

enjoy!
gfplus
11-24-2002, 05:46 PM
Man you are good.
Anonymous
03-04-2003, 09:58 PM
man you are not good, you are god


What's the meaning of this message???

RCE Messageboard's Regroupment > General > What's the meaning of this message???
yaa
11-18-2002, 06:14 PM
In debugging an application just after opening it with ollydbg I see "13 heuristical procedures, 218 calls to known, 7 calls to guessed functions". Could someone explain the meaning of it? Thx.

Regards,
yaa
TBD
11-19-2002, 03:00 AM
yaa: it is information from analysis module

13 heuristical procedures - 13 procedures detected (e.g. push ebp/mov ebp,esp intro)
218 calls to known - recognized APi calls (GetMessageA, CreateWindowExA,...)
7 calls to guessed functions - user routines called by "call ..."

also it provides info about detected switches, loops, ... good for "Search for/All ..." command
Anonymous
11-19-2002, 08:23 AM
Ok for the APIs and user routines but could you further explain the procedures part. What are they? Also how can the switches, loops, etc. detection functionality be used. Please if you can use an example to clarify the concepts. Thx.

Regards,
yaa
TBD
11-19-2002, 08:41 AM
yaa: forgot to login ? :)

so, a program is made from main part (what windows loader calls on running the exe) and procedures(or routines).

OllyDbg tries to find the procedures by searching for example the stack init - "push ebp/mov ebp,esp".

for example, in OllyDbg 1.08 at 0x4154F0 is procedure called "_Disasm"

for switches,loops,... you can use right-click/Search for/All ... it is easier than looking in table switches and try to remeber who jumps where :) it is just for easy understanding the code.
yaa
11-19-2002, 09:59 AM
TBD what I'm still not getting is the difference between the user routines and those that ollydbg identifies as "heuristical" procedures. Aren't they also user routines??? How do they differ, if they do differ? About loops and switches where is it that you can look for loops?? I only see the possibility of requesting switches.
Thx.

Sorry for not logging in before, I didn't notice that the board lets you post without logging in.

Regards,
yaa
TBD
11-19-2002, 11:53 AM
yaa: oops, no search for loops :)

i think a more detailed explanation is in ollydbg.hlp, in analysis section.
if it is still unclear feel free to ask questions here


unable to assemble "push 0"

RCE Messageboard's Regroupment > Bugs > unable to assemble "push 0"
Anonymous
11-18-2002, 11:09 PM
the assembler displays an error "please specify operand size".

apparently, this error occurs for all "push imm".

version: 1.08
os: win2k sp3
Vortex
11-19-2002, 04:48 AM
Funny,but push 0 works on XP
Press space bar and just type "push 0"
It must to work.
Sorry,if I dind't understud well the
problem.

Regards,

Vortex
TBD
11-19-2002, 04:55 AM
Vortex: did you tried in 1.08 final i hope ?

i talked with Olly about this problem and he said: "Oh, no, not again! This is a bug induced by correction of another bug. This evening, I'll upload corrected archive. "

thank anonymous for the bug report
Gigapede
11-19-2002, 05:38 AM
Probably same bug as above, "Find (sequence of)command(s)" grumbles about "push CONST",too.
Anonymous
11-20-2002, 02:44 AM
The same qustion on my mathine

unable to assamble push XXX

but works on 1.08 b2


Plugin request

RCE Messageboard's Regroupment > Plugins > Plugin request
Wayne
11-19-2002, 05:01 AM
I'd love a plugin that allowed me to simply type in an instruction, such as:
cmp ecx, esi
and it would display in a label underneath, the compiled instruction:
3BCE
It'd be very handy!
TBD
11-19-2002, 12:00 PM
Wayne: i asked Gigapede about it, if he wants to change his cmdbar plugin to include this feature, for example ASM "cmp ecx,esi" as a command
Gigapede
11-19-2002, 02:43 PM
good idea.
I've added this function.
try it plz.

p.s.
line info has bug yet.
once kill focus from combo and set focus again, then add charcter after prev string, the command candidates on label are wrong (prev string is ignored).
Anonymous
11-19-2002, 07:02 PM
Hmm... It crashes if you dont use a ";". Null pointer...

How about changing
p = strstr(string,";");
*p = '\0';
p++;
address = strtoul(p,&stop,16);
Addtolist(0,-1,"Address:%X",address);
// Assemble immediate command. If there are several possible encodings,

to

p = strstr(string,";");
address = 0;
if(p) {
*p = '\0';
p++;
address = strtoul(p,&stop,16);
Addtolist(0,-1,"Address:%X",address);
}
// Assemble immediate command. If there are several possible encodings,

Thanks!
Wayne
11-19-2002, 10:42 PM
Excellent plugin! thanks
It'd be good not having to use semi-colon though
Also it doesn't recognise the PUSH command?
TBD
11-20-2002, 02:57 AM
Wayne: have you downloaded 1.08a from Olly page ?

Gigapede: maybe you can add command completing on TAB key (for example
type Q and TAB and results QUIT)

[TIP] you can select cmdbar editbox with CTRL+D (for those you hate mousing around :) )
Gigapede
11-20-2002, 11:23 PM
update cmdbar
see "Plugin request 2".

TBD: Umm.. editbox seems not to accept TAB key.
thanks the TIP.
did you read such a messy source? ;)
TBD
11-21-2002, 02:51 AM
Gigapede: hehe ... of course :) ... i am used to that, look on my messy sources :)))

messageboard [TIP] click on the name of a user to put it in editbox (save some typing)

editbox does not accept TAB key, so you must reformat your post if it doesnt look right by using "Edit"
Anonymous
11-21-2002, 09:42 AM
yep I'm using 1.08a ... using the cmdbar plugin, 'push 0' returns the following:
Unrecognized command: PUSH
?
TBD
11-21-2002, 09:49 AM
Wayne: is that you ? :)
you must enter like this "asm push 0" - without "" and returns 6A00
also download cmdbar100b4.zip from plugins page
Anonymous
11-21-2002, 10:29 AM
Yep its me, i just dont have my password with me at this computer <grin>
I downloaded the new 100b4 cmdbar plugin and it's working perfectly! thanks -- it's quite a handy feature, im gonna shout myself a drink for thinking of it
Cheers TBD and Gigapede!
Wayne
bigglass
11-22-2002, 01:49 AM
Gigapede: Can additional functionality for breakpoint commands execute some commands(EX: BP expression [,condition] DO commands)
TBD
11-22-2002, 02:42 AM
bigglass: possible but you must do some tricks :)
you must check in _ODBG_Pluginmainloop if OD is in STAT_STOPPED, and if the current EIP is pointing to your address, than DO command (because some of OD functions are atomic, e.g. Run)

check my plugin TBD_Debugplugin for a little example.


Compiling errors

RCE Messageboard's Regroupment > Plugins > Compiling errors
Anonymous
11-19-2002, 11:45 AM
Hi all!

I get the following errors while compiling:
Error E2451 .\cmdexec.c 130: Undefined symbol 'VAL_CPUDASM' in function Assembl
(trying to add some functionality to a plugin).

There is no VAL_CPUDASM in plugin.h. Maybe I have the wrong version of plugin api????

/R
TBD
11-19-2002, 11:55 AM
#define VAL_CPUDASM 53
and it is available in plugin.h 1.07b from command line plugin
Anonymous
11-19-2002, 12:09 PM
Hmmm.... I only found a link to plug106.zip (1.06) on the page? So where can I get 1.07b or later?

Thanks!!!
Anonymous
11-19-2002, 12:50 PM
Ok, sorry, stupid question... Got it now. :)


Watch descriptions..

RCE Messageboard's Regroupment > General > Watch descriptions..
Alienripper
11-19-2002, 11:55 AM
It would be nice to be able to add descriptions to watched variables. When there are over 10 of them it can become a pain to remember which was which. Do you people agree ?
TBD
11-19-2002, 11:59 AM
Alienripper: nice ideea for 1.09 in January. noted.
TBD
12-02-2002, 01:02 PM
[TIP]::undocumented - use semicolon in expressions as comment delimiter
example: 2*2; multiplication test


Arrows in the hex dump column in the Disassembler

RCE Messageboard's Regroupment > General > Arrows in the hex dump column in the Disassembler
yaa
11-19-2002, 12:55 PM
Hello,

could someone explain what is the meaning of the upward, downward, right arrows (or triangles) that appear in the hex dump column in the Disassembler
pane of the CPU window? Is it explained somewhere on the help file?

Regards,
yaa
TBD
11-19-2002, 02:41 PM
there are jump directions (up/down) and right arrows say that a jump has destination to that address
yaa
11-20-2002, 06:37 AM
What about the dollar sign? What is it for? Thx.

Regards,
yaa
TBD
11-20-2002, 07:22 AM
$ means start of a procedure/routine (not 1oo% sure).
yaa
11-20-2002, 07:40 AM
mmmhhh, usually routines have a thick border that groups the relative code toghether. However I sometimes see the dollar sign also next to instructions that are not the start of a routine.

For example debugging OllyDbg's own code I see the following:

00401059 > $ E9 6E400900 JMP OLLYDBG.004950CC

and this is not the start of any routine.

Regards,
yaa
TBD
11-20-2002, 07:42 AM
yaa: yup, that is the module entrypoint - where the program starts
yaa
11-20-2002, 07:54 AM
And what about instructions like the following:

00494134 /. 55 PUSH EBP
004950F4 /. 55 PUSH EBP
00495100 /. 55 PUSH EBP

They seem to be the start of a procedure an yet they have no dollar sign next to them.
It seems that they differ from those "dollar signed" only for the fact that they don't seem to be used anywhere inside the code (the call tree is empty). Could it be that the dollar sign indicates the start of a procedure that is also used inside the progam?

Regards,
yaa
TBD
11-20-2002, 08:05 AM
$ indicates that the procedure is direct called (using call), the other procedures are called indirectly (pushed as arguments to another procedures).
yaa
11-20-2002, 08:18 AM
Does OllyDbg provide an easy and fast way of finding procedures passed as arguments to other procedures?

Regards,
yaa
TBD
11-20-2002, 08:21 AM
yaa: do you mean Find references (CTRL+R)? (you must be on the first line of your procedure)
yaa
11-20-2002, 08:47 AM
Yup, that is what I was looking for. Thx.

Regards,
yaa


request for a future version

RCE Messageboard's Regroupment > General > request for a future version
_Servil_
11-19-2002, 04:01 PM
hello,

i'm requesting feature to step through int 2e instructions, if possible.
Anonymous
11-20-2002, 11:31 AM
afaik, olly is a win32 level debugger and cannot trace into kernel mode code.

//lls


Plugin request 2

RCE Messageboard's Regroupment > Plugins > Plugin request 2
Anonymous
11-19-2002, 06:04 PM
Hey Gigapede!

It'd be handy if your CmdLine plugin would show ascii and dec values of a hex string when the "?" command is used. SoftIce does that. :) I'm not good at C (work as Java coder), but I made a small modification to the Express function. Here is the code, don't laugh if I've made some mistake. Anyway, it works for me.

int IsHex(const char* str)
{
char* ec;
if (str == (char*)0 || *str == '\0')
return 0 ;
(void)strtoul(str, &ec, 16) ;
return *ec == '\0' ;
}

int Express(char *answer,ulong parm) {
int i;
char *p;
char *v = value.value;
char *tmp;
tmp = malloc(5);
tmp[4] = '\0';

if(IsHex(v))
{
for(i = 0; i < 4; i++)
tmp[i] = (char)(v[i*2] * 0x10 + v[i*2+1]);

sprintf(answer, "HEX: %s - ASCII: %s - DEC: %d", v, tmp, strtol(v, &p, 16));
}
else
strcpy(answer,v);

free(tmp);
return 0;
};
TBD
11-20-2002, 02:49 AM
kewl ... do you have a compilied plugin to share with world ? would be nice :))
psyCK0
11-20-2002, 07:53 AM
Ok, here is the link...
www.wascrew.com/CmdBar.dll
(http://www.wascrew.com/CmdBar.dll
)

This also fixes the null-pointer bug with the ASM command
I mentioned in the "Plugin request" thread.

Of course all creds go to Gigapede, I only made small adjustments
to his code. =)
TBD
11-20-2002, 08:22 AM
psyCK0: the link doesnt work from my side. could you please email to me and i will try to host it here. also i sent you an email about this
psyCK0
11-20-2002, 09:14 AM
TBD: done
TBD
11-20-2002, 10:21 AM
psyCK0's bugfixed command bar plugin available here psyCK0_CmdBar.zip (http://rohanpall.com/ollydbg/files/psyCK0_CmdBar.zip)
rohan
11-20-2002, 11:06 AM
Oops.
Gigapede
11-20-2002, 10:11 PM
update cmdbar 1.00 beta4
*bug fix "ASM" command
*show DEC and ASCII using "?" command [request2](include some fix for decoding ASCII)
*bug fix in cmdexec.c/Execute():

case 'V': // Value of expression
n=Expression(&value,s,0,0,NULL,0,0,Getcputhreadid());
-> if (n<0 || result.type==DEC_UNKNOWN) {
this shoude be(?)
-> if (n<0 || value.type==DEC_UNKNOWN) {
Gigapede
11-20-2002, 11:15 PM
TBD: Sorry, I mistook your name.

Ooops! I found out "Edit" after post.
ricnar456
11-22-2002, 02:08 PM
Where i can download the plugin of gigapede, in the page of OLLYDBG in Download? is cmndline plugin is this?

Thanks
Ricardo
mfn
11-22-2002, 02:46 PM
ricnar456:

http://rohanpall.com/ollydbg/files/
ricnar456
11-22-2002, 04:01 PM
yes i found and how i use this, i put de dll in the same directory and when i RUn olly a error in kernel32.dll apears and close OLLY, no instructios or configuration is in the zip, how i use this plugin.

Ricardo
mfn
11-22-2002, 04:13 PM
ricnar456:
If you use cmdbar on Win9x, it doesnt work.
It's a strange bug.
Currently, cmdbar works only on WinNT based OS ;)
ricnar456
11-22-2002, 06:08 PM
arghhhh, 90 % of the users of OLLY in mi list, use W98 SE, why not repair this strange bug first, is a very bad new, buaaa.

Ricardo


example of using a watch?

RCE Messageboard's Regroupment > General > example of using a watch?
Wayne
11-20-2002, 02:16 AM
Can somebody give me an example of using an expression watch? (such as EAX="myname")? and where is watched information reported? the log window? or... ?
I'd love to start using this feature but I'm not sure how to start
Any tips would be appreciated!
Thanks
TBD
11-20-2002, 03:04 AM
Wayne: View/Watches, right click/Add watch (SPACE), expression: string[EAX]

you can use WatchMan plugin by gigapede, it helps on defining watches.
also read OllyDbg help, section Evaluation of expressions.
Wayne
11-20-2002, 03:50 AM
Yeah setting watches is easy enough, but now that it's set, now what? where am i looking for the results -- ive never used watches before, is it like a breakpoint or does it log to the log window, or... ?
Thanks!
TBD
11-20-2002, 04:06 AM
Wayne: ahm ... there is in the menu View, a subitem Watches that opens
a window where you set your watches and also *view* the results :)

the watches window is getting updated on stepping, or by right click/Actualize
Wayne
11-20-2002, 04:18 AM
Bingo! Thanks :)


resource hacking

RCE Messageboard's Regroupment > The Heap > resource hacking
rohan
11-20-2002, 02:40 AM
I've checked out brw, exescope, and resource hacker, do you know of any others that are worth using?

Remember, natural resources are finite! Better to play with the artificial resources ;)

Ro
TBD
11-20-2002, 03:21 AM
ResourceTuner (http://www.heaventools.com/PE_Explorer_resource_tuner.htm?=rt) it is nice looking, but shareware

PEView (http://www.magma.ca/~wjr/PEview.zip) very nice to see the internal structure of PE files - freeware
rohan
11-20-2002, 04:48 AM
I find that resource hacker is the best. Thanks for the info tho ;D

P.S. Any plugins you need uploaded?

Ro


[new] 1.08a released

RCE Messageboard's Regroupment > Announcements > [new] 1.08a released
TBD
11-20-2002, 03:08 AM
download OllyDbg108a (http://home.t-online.de/home/Ollydbg/odbg108a.zip)

* it fixes PUSH const bug
dion
11-23-2002, 04:54 AM
hi, TBD, could u post it here? i dont know why i cant download it from here :(

btw, congrats for new forum ;)
TBD
11-23-2002, 07:39 AM
dion: welcome to the forum. i have no problem downloading from Olly's page but if it wont work on your side i will try to upload here for some period. i have 2mb limitation on this host and i cannot host it for longer time. or if you want i will send it by email.


Tutorials anyone???

RCE Messageboard's Regroupment > General > Tutorials anyone???
yaa
11-20-2002, 06:32 AM
Hello,

I was wondering if anyone is willing to write down tutorials on how OllyDbg could be employed in a debug session eventually as part of a greater set of tools. It would be nice to have a few of these tuts around, tutorials that take nothing for already known and that also show how less well known features of the debugger can be used.
Also, a team project for the development of useful plugins (with source code made available to the public) could be interesting.

Regards,
yaa
TBD
11-20-2002, 07:46 AM
great ideea ... the problem is who is willing to write them ? :)
i would gladly help but only as review/host here - i am not good in
writing tutorials.

i would like to have them concentrate on general things and not in how
to crack/reverse a specific program - something like Olly's run trace
tutorial.
gorshing
11-20-2002, 06:09 PM
I might write something up, but it would be for a specific program though, probably something that comes with Windows or I would include some source code and/or program.

I'm not an expert user of Olly though ... so I don't know how well it would be. Can't hurt to try though :)
yaa
11-20-2002, 06:51 PM
gorshing please do it!
People can further work and improve on what you may write. I was honestly thinking of writing some crackmes just to have a clear target and goal for the tutorials but then I believe they should also be written with intent not to simply show one or the shortest path to reach the goal but to describe as many of OllyDbg's features and how they can be employed toghether.

Regards,
yaa
TBD
11-21-2002, 02:42 AM
i prefer to no be cracking related, more as fixing bugs :)
Olly's runtrace example is good for start ... small programs with errors that
show the power of OD debugging
gorshing
12-03-2002, 11:42 AM
I was going to to do this, but I was checking into things and it seems that pretty much everything is written. I was going to write a newbie/beginner tut, but I don't see anything worth writting about.

Maybe something more in depth? Don't know

yaa, were you wanting a beginngers tut? If so, I could write one of those up

let me know
yaa
12-08-2002, 11:33 AM
Hello gorshing,

having at least ONE beginner tut would be nice. One that pretty much covers everything that a beginner should know to start using OllyDbg I think would be useful to a lot of people.
You could just start writing a tutorial describing the basic stuff and people here can afterwards suggest things that could be added to it.

Regards,
yaa
TBD
12-09-2002, 04:19 AM
a good starting point is OllyDbg Q&A (http://hp.vector.co.jp/authors/VA028184/OllyDbgQA.htm).

the only downside: is in japanese and it needs a good translation. ... but i think one of the forum members from Japan will make one :)


Meaning of previous and next on an instruction?

RCE Messageboard's Regroupment > General > Meaning of previous and next on an instruction?
yaa
11-20-2002, 08:36 AM
Hello all,

what is the meaning of the previous and next commands on an instruction (when available)?

Regards,
yaa
TBD
11-20-2002, 09:08 AM
yaa: in Goto menu ? OllyDbg has a history so you can navigate on different instructions (e.g. enter on call instruction and with previous - minus on numpad - you can go back)


Visual clue for bookmarks?

RCE Messageboard's Regroupment > General > Visual clue for bookmarks?
yaa
11-20-2002, 08:41 AM
Hello,

I believe that providing a visual clue (just like for breakpoints) to placed bookmarks could be a reasonably useful. Has the source code for the bookmarks plugin been made available?

Regards,
yaa
TBD
11-20-2002, 09:03 AM
yaa: one little hint - plugin sdk from Olly's page :)

i dont think that is possible because bookmark system is implemented as a plugin. beside why ? you can use the bookmark list view for easy navigating.


[plugin] debug other plugins

RCE Messageboard's Regroupment > Plugins > [plugin] debug other plugins
TBD
11-20-2002, 11:12 AM
download: TBD_DebugPlugin.zip (http://rohanpall.com/ollydbg/files/TBD_DebugPlugin.zip)
description: loads ollydbg.exe and breakpoints after loading a plugin.
why: i am too lazy to do that over and over again when i test a plugin
usage: only for OllyDbg 1.08 - uses specific breakpoint

enjoy!


Source code view?

RCE Messageboard's Regroupment > General > Source code view?
Anonymous
11-20-2002, 12:23 PM
Hey!

Well, I've RTFM and it doesn't say much about how the source and source files windows are used... Do I have to compile the exe/dll using some specific flags and then put the C source file somewhere???

I know this may me a generic question, but I've mostly debugged without having access to the source so far. ;)
TBD
11-21-2002, 02:39 AM
yup, you need to compile with debug information (Borland or Microsoft)
for example, with MASM:

\masm32\bin\ml /c /coff /Zi main.asm
\masm32\bin\Link /DEBUG /DEBUGTYPE:CV /SUBSYSTEM:WINDOWS main.obj

then you will see the source line on info pane (under the CPU window) and
you can use CTRL+F5 to view the entire source file.

it is groovy :)
Anonymous
11-21-2002, 10:59 AM
Is it only possible to use it with programs writen in asm?
TBD
11-21-2002, 11:06 AM
of course not :) every compiler that makes debug info works ... i tried with Visual C and C-- -> works perfectly.

just look for command switches for you compiler.

[TIP] click on CPU header bar (that with Address|Hex dump|Disassembly|Comment) on Comment tab to switch between Comment->Source->Profile. handy!
gfplus
11-24-2002, 05:52 PM
I try with Delphi and Borland C++ builder - also work excelent


olldbg assemble?

RCE Messageboard's Regroupment > Bugs > olldbg assemble?
Anonymous
11-21-2002, 02:28 AM
how to use olldbg to patch a programe?if you will write lots of bytes?olldbg is not support!such as call XXX(api)
TBD
11-21-2002, 02:54 AM
you must use something like this "call kernel32.ExitProcess" - case sensitive on APi name !!!


run trace displays incorrect modified register val

RCE Messageboard's Regroupment > Bugs > run trace displays incorrect modified register val
crc32
11-21-2002, 03:51 AM
version: 1.08a
os: win2k sp3

there are actually two run trace bugs to report here.

bug #1:
the run trace log file compared to the run trace window displays different modified register values. in fact, the EAX and ECX registers always seem to have the exact same values in the log file. refer to 77A80009, 77A8000E and 77A80013 below.

bug #2:
the run trace window does not seem to "catch" and display modified ECX registers. refer to 77A8000B below.

--------------- run trace window ---------------
77A80009 Main MOV EAX,DWORD PTR [ESI] ; EAX=00137A50
77A8000B Main MOV ECX,DWORD PTR [EAX+3C]
77A8000E Main CALL OLE32.77AA1C16 ; EAX=00000000, EDX=77B33938
77A80013 Main MOV EAX,DWORD PTR [ESI] ; EAX=00137A50
77A80015 Main XOR EDI,EDI ; EDI=00000000

--------------- run trace log file ---------------
77A80009 Main MOV EAX,DWORD PTR [ESI] ; EAX=00137A50, ECX=00137A50
77A8000B Main MOV ECX,DWORD PTR [EAX+3C]
77A8000E Main CALL OLE32.77AA1C16 ; EAX=00000000, ECX=00000000, EDX=77B33938
77A80013 Main MOV EAX,DWORD PTR [ESI] ; EAX=00137A50, ECX=00137A50
77A80015 Main XOR EDI,EDI ; EDI=00000000
TBD
11-21-2002, 04:06 AM
crc32: same here os: NT4SP6. did you send the bug report to Olly or should I ? :)
crc32
11-21-2002, 04:12 AM
TBD: i'm hoping you would send the bug report as you seem to have a direct communication link to Olly :)
thanks for the help and many thanks as well for this excellent forum.
TBD
11-21-2002, 07:09 AM
crc32: Olly said: "Yes, unfortunately. This error was also introduced during this long debugging session :-[ Anyway, I will not wait till 1.09 to fix this."


[ODF] OllyDbg Stuph page update list

RCE Messageboard's Regroupment > Announcements > [ODF] OllyDbg Stuph page update list
TBD
11-21-2002, 04:34 AM
i've made a page with all plugins that i know (6 great plugins by gigapede and one by me) ...
link:OllyDbg Stuph (http://ollydbg.win32asmcommunity.net/stuph/)

btw ODF = OllyDbg Forum

[EDiT 30.apr] fixed link. oops.
TBD
11-25-2002, 03:04 AM
25.Nov.2oo2 update:
[+] plugin::mapconv - imports .map files
[!] plugin::cmdbar - 1.00b6 fixes win98 problem
[+] tools::oa2h - converts to .htm disassembly dump
TBD
11-28-2002, 03:23 AM
28.Nov.2oo2 update
[+] plugin::debugplugin - update for 1.08b. thanks gigapede.

as debugplugin is using a hardcoded breakpoint i need to update the plugin everytime a new version of OllyDbg is released or Olly is adding my request to plugin APi.
TBD
11-29-2002, 02:44 AM
28.Nov.2oo2 update:
[!] plugin::cmdbar - 1.00 released
TBD
12-02-2002, 02:43 AM
02.Dec.2002 update:
[+] plugin::stayontop - individual MDI client windows to stay on top
[+] tools::plugin107 - OllyDbg Plugin SDK 1.07 for C-- (thanks gigapede)
[+] tools::plugSDK - OllyDbg Plugin SDK 1.07 for Visual Studio (thanks bigglass)
TBD
12-09-2002, 04:20 AM
09.Dec.2oo2 update:
[+] plugin::cmdbar - BPX, BPD added
TBD
12-16-2002, 07:21 AM
16.Dec.2oo2 update:
[+] general::added tutorials section
[+] tutorial::luucorp tutorial on reversing [v0!d] crackme v0.02

if you want to write a tutorial for OllyDbg (only on crackmes allowed) use the this tutorial_template.htm (http://www.rohanpall.com/ollydbg/files/tutorial_template.htm) and then send it to me.
TBD
12-17-2002, 07:26 AM
17.Dec.2oo2 update:
[+] tutorial::luucorp tutorial on reversing zeronetus crackme3 - name/serial delphi program

nice tutorial by luucorp using program SEH to fish inside
TBD
12-19-2002, 03:43 AM
19.Dec.2oo2 update:
[!] plugin::mapconv - update for 1.08 and some bugfixes
TBD
01-06-2003, 04:52 AM
06.Jan.2oo3 update:
[+] tutorial::luucorp tutorial on reversing Kmos crackme - unpacking aspack compressed programs
TBD
03-05-2003, 09:26 AM
05.Mar.2oo3 update:
[+] plugin::ollydump - update to support IAT rebuilding and finding OEP using trace
TBD
03-11-2003, 11:42 AM
11.Mar.2oo3 update:
[+] plugin::ollydump 2.01.108 - no rebIT.dll anymore
[+] plugin::labeler - support for plugin dir feature of OD 1.09
[+] plugin::cleanupex - support for plugin & udd dir feature of OD 1.09
TBD
04-29-2003, 03:58 AM
29.Apr.2003 update:
[+] plugin::windowinfos - get window handle based on mouse position
TBD
04-30-2003, 11:14 AM
30.Apr.2003 update:
[+] fixed link to the stuph page on first post
TBD
06-10-2003, 05:46 AM
10.Jun.2003 update:
[+] plugin::mapconv - address of the code section is now read dynamically
TBD
06-12-2003, 08:54 AM
12.Jun.2003 update:
[+] plugin::isdebug - hide debugger from IsDebuggerPresent Windows API
TBD
06-23-2003, 05:44 AM
23.Jun.2003 update:
[+] plugin::isdebug - update to 1.3
TBD
06-30-2003, 01:06 PM
30.Jun.2003 update:
[+] plugin::isdebug - update to 1.4
[+] plugin::extracopy - copy portions of code inside OllyDbg
TBD
07-01-2003, 03:34 AM
01.Jul.2003 update:
[+] plugin::extracopy - update to 0.9 (bugfix and copy to clipboard)
TBD
10-16-2003, 07:26 AM
16.Oct.2003 update:
[+] plugin::DeJunk - find/remove junkcode from packers. also customizable.
TBD
10-21-2003, 03:23 AM
21.Oct.2003 update:
[+] tool::masm_plugininc.zip - SDK for MASM32 (sorry for the big delay on uploading)
TBD
12-12-2003, 05:50 AM
12.Dec.2003 update:
[+] plugin::g_ollydump221b.zip - update

sorry for the 8 months delay [auch!]
TBD
01-13-2004, 04:10 AM
13.Jan.2004 update:
[+] plugin::Labelmaster - import/export user-defined labels and comments
TBD
01-15-2004, 04:52 AM
15.Jan.2004 update:
[+] plugin::OllyScript - automate OllyDbg by writing scripts in an assembly-like language
TBD
02-06-2004, 04:05 AM
06.Feb.2004 update:
[+] plugin::CommandBar 3.00.108 - update: macro function, interface
TBD
02-25-2004, 09:59 AM
25.Feb.2004 update:
[+] plugin [link]::WindowJuggler 0.06 - enable/disable/click/close windows

as usual, late :)
TBD
06-10-2004, 11:35 AM
10.Jun.2004 update:
[+] PDK :: Plugin PDK for Delphi by TQN, also an example plugin for starting Calc, Explorer, Command Prompt and Notepad
TBD
07-26-2004, 09:47 AM
26.Jul.2004 update:
[+] GoDup :: IDA signature loader/map loader/resource viewer/process info
TBD
08-09-2004, 04:53 AM
09.Aug.2004 update:
[+] GoDup 1.2:: Update: view dialogs, version info and Delphi/BorlandC forms
TBD
03-18-2005, 04:24 PM
18.Mar.2005 update:
[+] PE Dumper 3.01 :: PE dumper by FKMA
TBD
04-06-2005, 03:33 AM
06.Apr.2005 update:
[+]Olly Breakpoint Manager :: breakpoint exporting, importing and automatic loading
TBD
04-08-2005, 10:25 AM
08.Apr.2005:
[+]Asm2Clipboard :: copy asm code to clipboard
TBD
06-07-2005, 07:40 PM
07.Jun.2005:
[+] Olly Heap Vis :: display a list of allocated memory blocks
Epsylon3
11-15-2005, 07:31 PM
You can link OllyScript to http://e3.epsylon.org/olly/

OllyScript SHaG's page no longer exists...

will be the future official page for ODbgScript...


bug exception handler

RCE Messageboard's Regroupment > Bugs > bug exception handler
Anonymous
11-21-2002, 05:32 AM
In this crackme this code
http://www.southernlabs.com/gameroom/Decoding/Win32/Tutorials/CrackedP ad.zip
(http://www.southernlabs.com/gameroom/Decoding/Win32/Tutorials/CrackedPad.zip
)

0040C042 > B8 00C04000 MOV EAX,CRAKPAD.0040C000
0040C047 68 9A7C4000 PUSH CRAKPAD.00407C9A
0040C04C 64:FF35 00000000 PUSH DWORD PTR FS:[0]
0040C053 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
0040C05A 66:9C PUSHFW
0040C05C 60 PUSHAD

install a exception handler,

here

0040C0F5 A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]

the program produce the exception and OLLY loose and if you press SHIFT + F7 go to error in trw2000 and sice, go to 407c9a

I think in

0040C05A 66:9C PUSHFW
0040C05C 60 PUSHAD

in tis sentences OLLY loose the exception handler and if there are and exception is not handle for Shift + f7 .

Ricardo Narvaja
TBD
11-21-2002, 11:10 AM
Ricardo Narvaja: Olly's response:
"I don't understand the problem. MOVSB command above produces an exception, that's clear. User wants the program to process this exception and presses Shift+F7 - a shortcut for "Step into passing exception to handler". When I try this under NT 4.0 SP5, OllyDbg executes exactly one command of KiUserExceptionDispatcher and correctly pauses on the next command. Then I set breakpoint on the custom dispatcher (407c9A) and run program (F9). As expected, this breakpoint is immediately hit."
ricnar456
11-21-2002, 01:02 PM
Sorry the error is here
for the value in Fs:[22]

00407DA6 66:64:8B35 1C0>MOV SI,WORD PTR FS:[1C]
00407DAE 66:0FBAF6 00 BTR SI,0
00407DB3 66:64:0335 220>ADD SI,WORD PTR FS:[22]

encripts and produce an error for Fs:[22] this is other problem and confuse me

Sorry
Ricardo Narvaja
TBD
11-22-2002, 03:11 AM
ricnar456: i dont see the problem. here are my steps:
F9, SHIFT+F7, CTRL+G (406231), F4, CTRL+A (analyze SMC), CTRL+G(401000 - real OEP), New origin here

or if you have an NT based OS, breakpoint on kernel32.GetLocalTime, ALT+K (see who called this APi), F4, CTRL+G(401000 - real OEP), New origin here
Anonymous
11-22-2002, 04:19 AM
In w98, F[22] isn't 0 9 (zero) and with this value encripts in

00407DB3 66:64:0335 220>ADD SI,WORD PTR FS:[22]

and dont run if dont nop this sentence, thanks .

Ricardo


Hightlighting plugin

RCE Messageboard's Regroupment > Plugins > Hightlighting plugin
Jond
11-21-2002, 09:44 AM
Hey

i was wonder if someone can code a plugin that will let you highlight a specific block of code or a specific line(s)... that will really be a great thing (unless this option is already availble but i didnt see it :) )

Jond

oh and btw there is a prob in CmdBar plugin with win98 (makes Kernel32 crash) :)
TBD
11-21-2002, 10:06 AM
Jond: you can use hit trace/add selection to highlight a specific block of code.
also use label (shortcut ":") and then you can use Search for/User-defined label

btw, on my win98 system OD 1.08 doesnt work at all (crash at startup)
Jond
11-21-2002, 02:18 PM
10x for the info and it wont crash if u will delete CmdBar.dll (which i guess u have in the same directory ;)
TBD
11-22-2002, 02:32 AM
Jond: nope, it is not CmdBar.dll problem ... it wont start even if it is alone in a dir ... anyway i plan to upgrade my comp :)
Gigapede
11-22-2002, 03:24 AM
Maybe, I've found the cause of the error.
It's a silly but big mistake.

I linked "cmdexec.obj" to the plugin dll, though I included "cmdexec.c" in order to use cmdlist[] in CmdBar.c.
And I realize CmdBar cause exception.

I divided cmdexec.c to an include file named "cmdexec.h" and rebuild it, then no exception.

hope this would correct the error.

Win98 problem seems different.
Gigapede
11-22-2002, 09:06 AM
Ooooops! It doesn't work...
Jond
11-22-2002, 09:47 AM
well m8 i hope u can fix that little bug cause this plugin will really be usful on 98 :)


BP on value?

RCE Messageboard's Regroupment > General > BP on value?
Anonymous
11-21-2002, 11:03 AM
can you set a breakpoint that activates when a register points to a specified value, like eax="abc" ?
TBD
11-21-2002, 11:09 AM
psyCK0: forgot to login ? :)

nope, it is not possible because OD must check the registers on every instruction -> slow.
you can use conditional breakpoint on a specific API to break when [EAX]=="abc"
Cvx
11-21-2002, 03:24 PM
This may sound stupid, but what exactly would be the difference between register and memory breakpoints, speedwise?
Anonymous
11-21-2002, 03:35 PM
Memory breakpoints can be done in hardware (ollydbg does not interfere until breakpoint is reached). Register breakpoints must be done in software at the end of every instruction execution.


Search and modify

RCE Messageboard's Regroupment > General > Search and modify
Cvx
11-21-2002, 03:33 PM
I'm missing a feature to let OllyDbg automatically do repetive stuff, like "Search for binary string 'xyz' and replace it with 'zyx'" or "Search and set Conditional BP on each occurrence".

I haven't looked into the Plugin SDK -- would it be possible to implement this functionality in a Plugin?
TBD
11-22-2002, 02:36 AM
Cvx: yes it is possible, check cmdline plugin by Olly for more information


How to use hit trace???

RCE Messageboard's Regroupment > General > How to use hit trace???
yaa
11-21-2002, 07:34 PM
Hello,

could anyone explain how the hit trace feature should/can be used???
Thx.

Regards,
yaa
TBD
11-22-2002, 02:49 AM
yaa:
- hit trace is used to see if the code you selected is run. for example you have a portion of code that goes wrong and you dont know why - then use hittrace or run trace for more detailed info
- can be used also for highlighting blocks of code (explain in another post)
yaa
11-22-2002, 12:44 PM
How do you use it??? I mean how do you "trace" (or see) the executed code???
Thx.

Regards,
yaa
_Servil_
11-22-2002, 03:09 PM
go view | run trace and you see here all traced ops, and all registers that are changed.
you can turn on logging to file (right mous click on top of the window)

you start either with trace into (ctrl-f11) or trace over(ctrl-f21).
you can set up a condition to break tracing (ctrl-t), this is useful when finding OEP of some less aggresive packed proggies
yaa
11-22-2002, 08:24 PM
_Servil_ I got lost. What is the relationship between hit trace and run trace???
Thx.

Regards,
yaa
TBD
11-23-2002, 04:30 AM
yaa: hit trace records only that a instruction was executed and run trace records what registers modifies that instruction
_Servil_
11-23-2002, 04:59 AM
i was talking about something other
sorry
yaa
11-23-2002, 07:23 AM
TBD where is it that you see instructions executed??? Also, how do you start hit trace??? I see how I can set an instruction to be "hit traced" but where is it that you start the tracing and where is it that you see the results???
Thx.

Regards,
yaa
TBD
11-23-2002, 07:37 AM
yaa: please read the ollydbg.hlp and try and will see the difference. as english is not my native language is hard to explain
yaa
11-23-2002, 09:00 AM
TBD I have read the help file on the subject more than once before posting and did not find the answer to my question. I wouldn't have asked my questions here otherwise.
English isn't my first language either.

Regards,
yaa
TBD
11-24-2002, 04:15 AM
yaa: "how do you start hit trace?" - select instructions to be "hit traced" and run program. to see the result look for some colors near the hex dump
gfplus
11-24-2002, 05:08 PM
Little help to old TBD ;-)
Hit trace you can use very nice if you wan't to see which part of program is executed and which is not.
So what that means:
1. Before your break point - or from begining of procedure select code
2. use pop up menu hit-trace-add selection to add this selection in hit trace
3. When your program NEXT time stop on break point you will see which line he really execute and which not.
(if you have standard olly schema then this parts have red colors)
- this metod is really good when you really want find your 'execution path'
TBD
11-25-2002, 02:37 AM
gfplus: thanks & welcome back ! ... everything ok on your side ?
i hope so :)


CmdBar betas

RCE Messageboard's Regroupment > Plugins > CmdBar betas
psyCK0
11-22-2002, 10:19 AM
Hey Giga! =)

Please post info on changes in your plugin here or
add a whatsnew file to your archives? As it is there is
a new version every day and sometimes you have to read the
sources to know the difference!

BTW, great work mate!
Gigapede
11-25-2002, 02:08 AM
I may fix the win9x problem.

the cause of error may be hook proc.
I quit to use hook proc and make subclass the OD main proc to get WM_SIZE message.

Please try cmdbar beta6
http://dd.x-eye.net/file/cmdbar100b6.zip

thanks psyCK0.
ricnar456
11-25-2002, 03:26 PM
Now there are not kernel error in W98 but the BP in apis says UNABLE TO SET BREAKPOINT when i type

bp MessageBoxA

o any api in this same form the response is UNABLE TO SET BREAKPOINTS, in WXP in the beta 5 this fuction well.

Ricardo Narvaja
ricnar456
11-25-2002, 03:29 PM
In mi program

Names in SXEA163, item 272
Address=00479AD0
Section=.idata
Type=Import (Known)
Name=USER32.MessageBoxA

i type

bp MessageBoxA

and say Unable to set breakpoints

Ricardo
TBD
11-25-2002, 03:36 PM
have you tried bp user32.MessageBoxA ? OllyDbg must know in which module do you want a breakpoint ...
ricnar456
11-25-2002, 06:28 PM
Yes I try

bp user32.MessageBoxA

and says UNABLE TO SET BREAKPOINT in W98 and in XP in beta 5 only with

bp MessageBoxA function well.

Ricardo Narvaja
Gigapede
11-25-2002, 08:53 PM
when you use "BP label(symbolic name)", OD set bp directly on the API function in system DLL.
but win9x doesn't accept it.

you should use "BPX label" command to set bp on every calls to the API function.
but CmdBar haven't support "BPX" yet, because it is based on the old cmdline plugin.
new cmdline which is included in OD 1.08x can use new pluginSDK functions.
I don't know how to use them.

please wait until the new pluginSDK released.
it may include new cmdline as sample.
Gigapede
11-28-2002, 10:27 PM
I release CmdBar v1.00.
this plugin is almost same as cmdline except for UI.

differences with an original cmdline except UI are as follows:

+inform command candidate or syntax on output area.
+modify expression("?"/"CALC"/number without command) command's result, it shows HEX, DEC and ASCIIs ; thx psyCK0
+some commands are added.
"ASM" :show assemble on info line (without change memory) ; thx Wayne
"DASM":show disassemble on info line (without change memory)
"FR" :find reference to selected command/address (open "References" window)
"AC" :analyse code
"SN" :search for Name(label) in current module (open "Names" window)
"SOB" :scan object files (open "Scan object files" window)

i thank the all who cooperated.


debug info import?

RCE Messageboard's Regroupment > General > debug info import?
_Servil_
11-23-2002, 07:52 AM
is it possible to import a debug info, like produced by ms products (idb) or better from ida disassembler into ollydbg? i think importing .map files woul be sufficient...

and about the analysis, i encountered it must be done again whenever i change the debugged file, and this is not good cause all the labels/breakpoints/... are discarded. does ollydbg offer feature to save&restore all infos contained in the analysis file?
TBD
11-24-2002, 04:12 AM
for .map importing use mapconv plugin (oops i forgot to add it to plugin page)
i will upload tomorrow.

about save&restore user info - maybe a plugin would be nice. i will investigate
TBD
11-25-2002, 04:26 AM
on a second thought ... save&restore user info is not possible because if the program is changed that all labels/comments/breakpoint are no more valid (the addresses are changed)
_Servil_
11-25-2002, 02:58 PM
hi, i thought not rebuilding the whol program just a little change so all offsets remain the same...

thanks for mapconv, i'd like put my filthy hands on it, is there a download availble?
TBD
11-25-2002, 03:34 PM
it is hard to implement what you say because Olly must check what is the difference between last exe and new compiled exe -> greater loading time and also the old version must be save somewhere ... so dont be lazy and make them again :) or better use debug info or map file for variables/routines/...

mapconv is available on ollydbg stuph page ... the link is in annoucements area


CmdBar problem on win98

RCE Messageboard's Regroupment > Plugins > CmdBar problem on win98
TBD
11-24-2002, 07:29 AM
i traced down the problem in cmdbar plugin by gigapede to CreateCmdbarWindow routine ... after creating edit control with history list it stacks overflow.

i will dwelve deeper to see where is the problem.

anyone playing with this too ?
mfn
11-24-2002, 01:02 PM
yea, I traced this.

However, i could NOT hunt the bug.
I've already given up to fix that.

anyway, I hope anyone catch the bug ;)
Gigapede
11-25-2002, 02:03 AM
I've got.

hook procedure is the cause of the error.
I dont (wanna) remember why I use hook proc ;-P

now, I use subclass to get WM_SIZE message form OD main window proc.


[new] 1.08b released

RCE Messageboard's Regroupment > Announcements > [new] 1.08b released
TBD
11-25-2002, 03:06 AM
http://home.t-online.de/home/Ollydbg/odbg108b.zip

Olly: "run trace saved invalid values of registers EAX and ECX. Due to importance of run trace in program analysis, I was forced to replace 1.08a with 1.08b. Another small correction removes possible GPF in heap window."


[ideea] scripting plugin

RCE Messageboard's Regroupment > Plugins > [ideea] scripting plugin
TBD
11-25-2002, 04:37 AM
how about a scripting plugin, something like ProcDump script extension.
the ideea is to have cmdbar like commands available from a text file that can be run by user request.

it is good for repeating tasks, unpacking, ...

feel free to post your ideeas, requests, needs related to this plugin
bigglass
11-25-2002, 11:46 PM
"SeeR is a free multipurpose C-like scripting library." from
http://home.elka.pw.edu.pl/~ppodsiad/seer/
TBD
11-26-2002, 02:49 AM
bigglass: thanks ... but i think is too much for our little plugin. we want to use only cmdbar commands because it is easy to translate/debug. but is good to keep in mind
Anonymous
12-29-2002, 03:40 PM
hi i'm interested in this scripting plugin.

how would a script look like?
can you give an example or ideas on how a script would look like?

i think the cmdbar functions cant do much for scripting now, and the current available plugin functions are limited as well..
Anonymous
01-08-2003, 04:32 PM
Greets,

as i mentioned in some thread earlier, i'm working on a plugin that incorporates a full blown open source C/C++ Interpreter. It covers about 80-90% on K&R-C, ANSI-C and C++ language constructs. (Multiple inheritance, virtual function, function overloading, operator overloading, default parameter, template, etc..).
Currently it supports a limited win32 api and most of Ollydbg API via precompiled libraries.

However to be more usable as "true" scripting plugin, it needs more support from the ollydbg plugin api.

What is completely missing is an asynchronous notification api (via callbacks) to help synchronizing plugins to certain states of the debugger and debuggee.
The present ODBG_Pluginmainloop( DEBUG_EVENT...) is just a notification callback from the main debug thread. It only delivers the standard debug API events - which is not sufficient.

Consider the following simple example (all steps are should be done automagically via script):

load target application
search for signatures (memory/imports/exports)
set temporary breakpoints
go/trace
break due to breakpoints
search for signatures (memory/imports/exports)
set temporary breakpoints
go/trace
do some stuff/patching/dumping
...

With the current implementation of the plugin api, even synchronizing to the first step doesnt work: to find out, when the target application has been loaded completely and ollydbg stopped at system/entry point (NOTE: ODBG_Pluginmainloop PROCESS_CREATE event comes too early, any action, e.g. setting breakpoints wont work).

I suggest to expand plugin API for use of true event notifictions (via callback mechanism) which allow the synchronization to all asynchronous actions:

- all debugger breaks due finish of certain actions (OpenEXEFile, Animate, (Run)Trace, Go API, ...)

To let the debugger stay stable as possible (if plugin misbehaves) i suggest decoupling of event callbacks using
1. firing callbacks in a separate notifier thread or
2. decouple callbacks using internal (hidden) window and PostMessage() API

The plugin should be given the possibility to register callback for certain events (event mask).
If some condition is reached all registered callbacks from the plugins are called using events filter (in a separate context)...

additionally the plugin API (header file) can be improved by:

- using include guards (plugin.h)
- plausible naming convention (why "addtolist()" when "Log( SEVERITY, FACILITY, ...)" is more descriptive?)
- let all API functions return an error code (enumeration, see later) if possible (void Tempbreakpoint(..) - how i know it failed?)
- make more use of "const" modifier (current format string specifiers make casting to "char*" necessary for const format strings)
- immediate return values are used inconsistently, use of bool and enumeration types return types makes code alot more type-safe and readable (keywords like "true"/"false" and enums like ERROR_SUCCESS are better suited than return 0, 1, -1 ...)
- plugin entry point names should defined via preprocessor macros for people who are using other compiler vendors than borland (borland's linker only allows "DllEntryPoint", MS is using "DllMain"/custom one, this imposes several problems for generated executables: to get CRT init and static global ctor/dtor stuff to work, predefined entry points other than "DllEntryPoint" must be used)
- exporting with "cdecl" imposes linkage name problems (which are already fixed in plugin.h using quick hacks). DLL API export convention is usually "stdcall" (like win32)
- most preprocessor #define's should be better symbolic constants (enums), they add alot of type safety (function parameters) and are better to incorporate (#define's ignore namespaces, stresses interpreter preprocessor...)
- alignment directives like #pragma pack(1) should be used with #pragma push/pop together on plugin structs only (not global) (possible performance loss due to global byte-alignment on our internal data manipulation)

This is my feedback + suggestions.

Regards,

Anastasius Focht

PS: Ollydbg is the best user mode debugger i've seen so far. Keep up the good work :)
TBD
01-09-2003, 02:46 AM
Anastasius Focht: please contact me (tbd@despammed.com) ASAP :)

thanks for the work for OD !


SAL dissasembly

RCE Messageboard's Regroupment > Bugs > SAL dissasembly
bundy
11-25-2002, 06:38 AM
I understand that assembler replaces SAL with SHL, since they have exactly the same functionality, but it's bad to see something like this:

C0 ??? (unknown command?)
F2:00 ??? (prefix?)
(I don't know if disassembler says something different, because I write this from my memory).

Is it so hard to disassemble SAL instruction?
TBD
11-25-2002, 06:44 AM
bundy: do you have an example for this ? a small program would be nice ...

i think there are some "not very often used" opcodes that are poorly recognized but i need some example/documentation before bugging Olly about.

anyway, thanks for the report
bundy
11-25-2002, 09:30 AM
I protected one of my project with PELock (search on protools.cjb.net), and my file crashed. Since I didn't know if it was my fault or PELock's, I traced it a little bit and saw many of this fragmets above. Strange Olly can't debug it. It always displays an exception box or something very familiar.

Later I discovered my file crashed anyway ... a programmer mistake :)
TBD
11-25-2002, 09:55 AM
bundy: if i activate OllyDbg SFX extractor it find OEP in notime :) as PELock use a lot of anti-disassembling tricks of course that you will get garbage.
bundy
11-25-2002, 10:51 AM
of course that you will get garbage
I know ... this is the purpose of anti-disassembling tricks :) ... but try to trace it ..
or simply follow the jumps ... there you soon will find something similiar like this
I already posted ....

Simply -> Olly is unable to disassemble SAL instruction
TBD
11-25-2002, 11:17 AM
bundy: can you provide the opcodes for SAL ? to see where is difference
bundy
11-25-2002, 01:05 PM
-- code --
format PE GUI 4.0
entry start

section '.code' code readable writeable executable

start:
mov eax,34h
mov ebx,var1
mov ecx,5
sal dword [ebx],cl
sal eax,1
sal edx,5
sal ebx,7
sal eax,cl
sal edx,cl
sal ebx,cl
ret

var1 dd 'OLLY'
-- /code --

Okay, it's quite useless example, but try to compile it (with FASM) and see it under Olly :((

And about the opcodes .. the same example (listing from Hiew):
.00401000: B834000000 mov eax,000000034
.00401005: BB20104000 mov ebx,000401020
.0040100A: B905000000 mov ecx,000000005
.0040100F: D333 sal d,[ebx],cl
.00401011: D1F0 sal eax,1
.00401013: C1F205 sal edx,005 ;"."
.00401016: C1F307 sal ebx,007 ;"."
.00401019: D3F0 sal eax,cl
.0040101B: D3F2 sal edx,cl
.0040101D: D3F3 sal ebx,cl
.0040101F: C3 retn

There are of course not all possible opcodes ..
Hope this example shows the problem!
TBD
11-26-2002, 02:45 AM
bundy: excelent bug report, thanks. i had reported to Olly, now waiting for response
TBD
12-02-2002, 12:00 PM
Olly's response: According to Intel's documentation, opcode C0 /6 and similar are reserved, valid opcode for SAL is same as for SHL (C0 /4), so it wasn't implemented.


Can't Resume Thread

RCE Messageboard's Regroupment > General > Can't Resume Thread
Anonymous
11-25-2002, 12:23 PM
Background:
I am writing a Mod for the Game DungeonSiege which supports replacing game functions via "dsdlls". I am currently trying to find which function is called when a screenshot is taken during the game using OllyDbg and IDA.

Problem:
I run the game and start playing then I tell OllyDbg to attach to the exe which it does but then all of the threads except for the current one (usually ntdll) get suspended and I can't resume them. After ntdll finishes all threads are suspended and right clicking on them and selecting resume does not resume them.

Does anyone have any idea why something like this would happen? I am new to Olly and it seems like a very good program and I would like to continue using it.
TBD
11-25-2002, 03:45 PM
have you tried running the program (F9) instead resuming threads ? also if the game has an APi i think the name of desired function it is easy to spot, something like TakeScreenshot or something like this.

if this is not possible then a dead listing (disassembling with IDA for example) is needed to seek the desired function (look for CreateFile & WriteFile)


LINK problem?!

RCE Messageboard's Regroupment > Bugs > LINK problem?!
The_Philosopher
11-25-2002, 01:44 PM
Hi

I don't know where is this problem...in olly's debugger or maybe in my system. Here is the problem. I make a program in RadASm. I compile it, and then link it without a problem. Then i run my program in debugger, execute it step by step and check it for errors. Then i press F9 to continue executing my program. Exit from program and press ALT+F2 (Close) in debugger. I fix problems in source, compile it again and then try to link. But here is the problem. I always receive error LINK : fatal error LNK1104: cannot open file x. When i quit debugger with ALT+X i can again link my program without problem. I email olly twice with this problem. First time he told me that there is no problem, and for second email i didn't receive reply. Maybe he think that i am fooling him. But this problem is still here. This is happening on win2k and on win95 (this 2 os's i test). Maybe TBD you can tell him about this or someone else can try something similar. Maybe this is only the problem with my system. I don't know.

Thanks

The_Philosopher
TBD
11-25-2002, 03:38 PM
yup, the problem is there in win98 too. you must exit OD to free all file handles and restart OD. i will talk with Olly about this problem
The_Philosopher
11-25-2002, 03:52 PM
Thanks TBD!
TBD
12-02-2002, 12:03 PM
The_Philosopher: Olly's response: "I have looked through the sources, and it looks like I free all allocated handles. If anybody has checked build of NT/2000 or some kind of API tracer, he can run OllyDbg and tell me which handles remain locked. Otherwise I have no ideas..."

i tested on NT and it frees all handles, i can delete the file after close.

can you try on win98 and prepare a bug report.
The_Philosopher
12-03-2002, 12:43 PM
I can't try it on win98. I try this on win95 (1st version) and same problem. Did he try with above explanation that i post (make an example in radasm, compile it, link it, run it with debugger, close debugged program, and then try again to link it....FAILUREEEEEEEE!!). But np...i can live with this problem.

The_Philosopher
Alienripper
01-11-2003, 03:40 PM
Did you just shut down your program ? Or did you press Alt+F2 in OllyDbg to remove it from memory completely? I'm using WinME, and linking my programs works if I 'Close program' in OllyDbg..
oh me anon
01-31-2003, 10:39 AM
well i use windows 2000 (5.00.2195) and i too face this problem i link or buildall some asm(+res) with masm(hutchs package) then run olly on the exe find some problem so alt+f2 correct it and want to relink or rebuildall but link failure i have to shut down olly compleately to relink or rebuild

but i also noticed today that after copy to exe file then alt+f2 and then if i tried to delete the bak file it creates it does not let me delete it i have to close the olly compleatly to delete it i got a screen shot but

in windows 2000 it is damn annoying as you have to use runas everytime
so click +press shift+rightclick+ press runas+enter password+click ok
focht
02-01-2003, 06:56 AM
Greets,

well i guess it depends how the application (debuggee) works.
Without looking deeper in ollydbg code i assume ollydbg calls "TerminateProcess()" API right away on "alt+f2".

Sometimes this has nasty side effects. As i mentionioned earlier in the thread "How do debuggers terminate the debuggee process?" the "TerminateProcess" API should only be used as *last* resort - when all other fails.

- it leaves named kernel synchronization objects like semaphores, mutexes in abandoned state - makes restart if application impossible if depends on (they will timeout after some time)
- kernel/user space object reference counts may not be decremented (=resource leaks)
- ...

There are occurrences where TerminateProcess() fails (process remains locked in memory) but win32 API returns errorcode "success" (subsequent requests with GetExitCodeProcess() fail with "access denied").

likely cause:

Pending i/o requests (file operations, sound (mci) output, ...)

This may be due to the nature how i/o requests are handled in kernel mode (IRPs) and user mode (APCs).

The issue that the process is unlocked when debugger terminates:

As i stated earlier in other thread, the termination of user mode debugger (namely its debug thread) terminates the debuggee as well. This behavior is by OS design and involves other steps than plain "TerminateProcess" API.

Advice: Use the termination procedures as decribed in "How do debuggers terminate the debuggee process?".

Regards,

Anastasius Focht
oh me anon
02-01-2003, 07:59 AM
hi focht,
i read that post(how to terminate) and this nice little explanation and probably oleh will read it too
by the way i started using 1.06 for this kind of jugglery (no admin warning so
the mind rests :) in peace close the debugger and restart(no right click no runas ;) ;)


Exports for an exe???

RCE Messageboard's Regroupment > General > Exports for an exe???
yaa
11-25-2002, 02:52 PM
Hello,

in looking at the symbolic names in a given executable I see exports and imports. Now while imports are clear to me in what they mean, imports are not. What does it mean that an exe shows exports??? How would for example have to be a C program to show exports??? For a DLL to have exports it is normal but an why an exe???

How can symbols exported from an exe be used by other programs??? Is it like for DLL where you need an import library to link those public symbols???

Regards,
yaa
TBD
11-25-2002, 03:40 PM
EXE files can be loaded as DLL (to be more exact - as libraries). a good example is OllyDbg. it exports functions needed by plugins but also used inside the program.
yaa
11-25-2002, 04:59 PM
How do you link them (or their exported functions) in your own programs???

Regards,
yaa
TBD
11-26-2002, 02:23 AM
yaa: check OllyDbg plugin zip for a example (bookmark plugin). you can do it by using libraries or you can do it yourself (LoadLibrary/GetProcAddress)
yaa
11-26-2002, 06:50 AM
Ok, I've seen that an import library is provided just like for normal DLL.

Regards,
yaa


ollydbg unable to load the program!

RCE Messageboard's Regroupment > Bugs > ollydbg unable to load the program!
Anonymous
11-25-2002, 10:57 PM
http://tongtian.net/pediy/usr/2/2_1394.rar
sometime load it success but unable to pass the exception.
the notepad is packed with dbpe2.1.1.
TBD
11-26-2002, 02:57 AM
it is protected ? can it be runned normaly ? because on NT it doesnt start at all.
Anonymous
11-26-2002, 03:12 AM
not run at your computer?it's run on my computer but ollydbg not able to pass the exception
or you try this one.(maybe the languge problem)
http://tongtian.net/pediy/usr/2/2_1394_5.rar
TBD
11-26-2002, 04:40 AM
same problem ... it exits doing nothing. it is a virus ? :)

please login. it takes 3 seconds <eg>
Zer0
11-26-2002, 05:59 AM
mm,make me crazy.
you can have a look at the webpage of the packer.
http://dbpe.allite.net. the author is D.boy

must type the name and password every time when post or reply a post?
Zer0
11-26-2002, 06:01 AM
correct the link
http://dbpe.allit.net/
Zer0
11-26-2002, 06:06 AM
http://dbpe.allit.net/down/dbpe210.exe
the download link.
maybe your system is not support chinese(double word)
the second button is pack,sorry for my poor english.
TBD
11-26-2002, 06:07 AM
Zer0: it is cookie based messageboard, so it expires after some time but usualy you dont have to login everytime.
also each post has an Edit link to correct posts.

btw, why it is so big ? 1mb for a packer ?
[EDIT] it doesnt work on NT even the packer. so no luck.
Zer0
11-26-2002, 06:56 AM
i was use win2k,it's runing.
maybe it test the run everment(not run in if it is run in english windows?)
so bad.
but it's really the ollydbg don't pass the exeption.
any advice to avoid it?maybe some anti-debug code make the problem.
my mean is how to pass it mannully.
sorry for my poor english twice.
TBD
11-26-2002, 07:25 AM
Zer0: when an exception occurs press SHIFT+F7 to enter in windows exception handling routine and then breakpoint on the SE handler and take look there.
Zer0
11-26-2002, 09:30 PM
when press shift+f7 it come in the ntdll and raise the exception.
press shift+f9 ollydbg don't pass the exception.
TBD
11-27-2002, 04:24 AM
Zer0: you must not shift+f9, you must go into the exception handler and watch for the return value, if must return 0 for the program to continue.

check Comrade's SEH example (http://comrade.ownz.com/work/seh.zip) and try first to debug this example.
oh me anon
01-30-2003, 07:30 AM
dunno very old thread probably useless info still my two cents
there is a call near ecx in ntdll.dll (w2k,ep=77f81000)at 77f92536 bookmark it
that calls destination(second time) is always the seh handler as far as i have noticed
Squidge
01-30-2003, 07:54 PM
Why don't you just look in the stack for the exception frame? That'll point you direct to where the program will end up - put breakpoint here and SHIFT+F9 to break in the exception handling routine.

Always done this and it always seems to work.

Saves messing around in the kernel libs.


Path to source files

RCE Messageboard's Regroupment > General > Path to source files
Anonymous
11-26-2002, 08:59 AM
Hi,

is it possible to select the path where the source files are located. At the moment I have no choice (or maybe not found a way) to change the source path already defined in the debug info. When the source files are located now somewhere else I cant point Ollydbg to this new location to take the sources from. Is there a way to achieve this with Ollydbg?

Thanx in advance!
TBD
11-26-2002, 10:07 AM
nope, you must put the source files in the directory needed by debug.
it is really necessary to modify the location from the debug info ?
Anonymous
11-26-2002, 11:05 AM
Thanx for the fast answer. It just would be more comfortable if Ollydbg would act like the Visual Studio Debugger is doing in this case. There the source file name will be presented and I can lead him to the path I want.
TBD
11-26-2002, 11:29 AM
i will point this to Olly and if he decide to implement it than you will see it in the next version, 1.09 in January (we hope) :)


WM_COMMAND HELP !!!

RCE Messageboard's Regroupment > General > WM_COMMAND HELP !!!
wallis
11-26-2002, 01:03 PM
Hi,
New user of ollyDbg... a very great one !
Just a problem for me little newbie... To set a breakpoint wm_lbuttonup (for example...)
Is there anybody can help me ?
ricnar456
11-26-2002, 01:27 PM
The best for me is in CPU window, right click, search for names in this module,look for the api, TRANSLATE MESSAGE, mark, right click, SET LOG BREAKPOINT in every reference, in the window put

in CONDITION

MSG==202

and

mark in PAUSE PROGRAM - ON CONDITION and RUN

if you put

MSG==201

is for BUTTONDOWN and stop when you press the button is more util for me.

Ricardo Narvaja
wallis
11-27-2002, 02:35 AM
many thanks for your help RICNAR !
Wallis
TBD
11-27-2002, 03:04 AM
wallis: or you could use MSG==WM_LBUTTONDOWN :) it is easy to remember
Anonymous
11-30-2002, 04:35 AM
really easiest to remember !!! thanks.


Plugin request 3!

RCE Messageboard's Regroupment > Plugins > Plugin request 3!
Wayne
11-26-2002, 10:51 PM
Here's an idea for a plugin that I'd find extremely valuable (would probably use it every day!), possibly about as useful as a plugin could get I think! ...

The plugin, when run, should simply ask "What file to load from?" - you then point it at a text file that has a list of instructions and comments. The plugin then reads the textfile, and if it finds any of the instructions from the textfile in the program disassembly, it automatically adds the comment from the textfile.

For example, imagine the text file just has this one line in it...
31C0 eax = 0
the plugin would know to scan for the 31C0 instruction (which happens to be XOR EAX, EAX, but thats irrelevant), and it would then automatically add my comment "eax = 0", just as if I'd pressed ; and manually entered them. It would be especially useful for automatically commenting CALLs.
Anyone? :)
TBD
11-27-2002, 03:23 AM
Wayne: nice ideea ... but we need to wait for the next plugin SDK because we dont have information for binary search function. or maybe there is another way to do this ? i will have a look
Wayne
11-27-2002, 03:32 AM
That's ok, I'm a patient person! :D


OFFSET to CPU

RCE Messageboard's Regroupment > General > OFFSET to CPU
ricnar456
11-27-2002, 04:40 AM
In OLLYBG if you are in CPU window, you easy go to offset with right click- VIEW- EXECUTABLE FILE, but if you in the offset window, you work here and look a interesting line, no existe the commando to view this line in dissassembler window (CPU), only searching for the sequence of the bytes hexa y can detect this line in CPU pane.

CPU to OFFSET is EASY
OFFSET to CPU is very difficult

Ricardo Narvaja
TBD
11-27-2002, 06:08 AM
ricnar456: can you give an example where is really needed this feature ? because you can browse in CPU window perfectly
ricnar456
11-27-2002, 11:02 AM
I compare two files with file compare and the results of the differences is in offset, well, open the file, view executalble and GO TO OFFSET put the result and i found the sentence with the difference, but for found the same sentence in the CPU window and if not is in the same section is very difficult, i go to VIEW-MEMORY and search in all memory for the bytes and is very slow, if the results of FILE COMPARE are 35, is very slow use this metod for view in CPU pane the differences one for one and serching for chains of bytes.

Ricardo Narvaja
TBD
11-27-2002, 11:35 AM
ricnar456: why dont you add to the modified offset the base address (from PE header) and follow the changes in CPU window ?
Anonymous
11-27-2002, 12:58 PM
Well the image base of this crackem is 400000, PeEditor says.

In OLLY this sentence

00401318 > $ /EB 10 JMP SHORT SXEA163.0040132A

is go to VIEW - EXECUTABLE FILE is

00000918 EB 10 JMP SHORT 0000092A

How i add this and in other sections is worst.

In all crackmes and programs isnt Imagebase + offset= RVA

if the sections are not aligned (FIX DUMP) and if i aligne dont function more.

Ricardo


Just an idea ... let me know what you think

RCE Messageboard's Regroupment > General > Just an idea ... let me know what you think
yaa
11-27-2002, 05:26 AM
Hello all,

it would be nice to "cut out" all the tips and trick (that most of the time are not really tips or tricks but simply the result of a documentation that most of the time takes too much for already known) and place them in a few very "practical" pages. If the thing is of interest I'll willing to do the job.

Regards,
yaa
TBD
11-27-2002, 06:10 AM
yaa: you read my mind. today i wanted to ask you, if you have time, to do this :) ... also i want to start a FAQ section, so i need feedback from users what information is needed in there.
yaa
11-27-2002, 07:38 AM
I'll start it ASAP.

Regards,
yaa


Olly, cracking tutorials and manuals.

RCE Messageboard's Regroupment > General > Olly, cracking tutorials and manuals.
ollybility
11-27-2002, 11:39 AM
Hi to all!

I am looking for some crack tutorials using olly on the net.
and I don't find none.
could somebody tell me where to get some?
where????

Thank you.
yaa
11-27-2002, 01:16 PM
Use google and search these three words toghether: HOOF ARTED OLLYDBG

Regards,
yaa
AcidCool
11-27-2002, 01:58 PM
http://AcidCool.cjb.net also works.
http://reboot.at/k23
http://New2cracking.cjb.net

Acid_Cool_178
Darus
11-29-2002, 06:15 PM
www.darus.fr.fm (http://www.darus.fr.fm) too
TBD
11-30-2002, 02:30 AM
Darus: very nice with screenshots. can you make a translation in english ?
Darus
11-30-2002, 08:35 AM
thx TBD, a translation ? i will try but my english is very poor, if someone speaks french and could translate my tuts, it will be better

to contact me : darusweb@free.fr
TBD
12-01-2002, 12:56 PM
Darus: i think your english is better than my french, but i can have a look if you are starting translation
luucorp
12-10-2002, 11:27 PM
hi, Darus
You need remember Olly is only tools.
Olly do many works than only crack.
TBD
12-11-2002, 02:33 AM
luucorp: <smile> Olly is the author (Oleh) and OllyDbg is the tool. and i agree, OllyDbg is a great tool for debugging also your code <hehe>
Anonymous
12-11-2002, 02:48 AM
tutorial with OllyDbg and Command Bar 1.08.02 by HackeRMaN
target (http://crackmes.de/download.php/CuTedEvil%20CrackMe%201.zip?Crackme=250&CrackmesSession=CrackmeSessiond7aeaca2452127310048 ab2088861652)::solution (http://crackmes.de/download.php/solution.zip?Solution=550&CrackmesSession=CrackmeSessiond7aeaca2452127310048 ab2088861652)

<edited by TBD - wrong url formatting>
Darus
12-13-2002, 02:43 PM
luucorp: i agree with you, ollydbg is a tools but my "hooby" is reverse engineering also i use this tool in consequence (My English is comprehensible?)

else my tutos (cracking topic) are available in english on my website www.darus.fr.fm (http://www.darus.fr.fm)
olly4all
12-13-2002, 03:14 PM
Thx Darus for translation the tut :)
luucorp
12-13-2002, 11:56 PM
Hi,all of you.
Today, i post 2 tut in oder to use Olly for cracking 2 crackmes at http://crackmes.de.

no.1:
target: Crackme#5 for duelist@beer.com
dowload here:
Click (http://crackmes.de/download.php/due-cm5.zip?Crackme=428&CrackmesSession=CrackmeSession4b1695a087144c338f5f c9001781b58b)

no.2:
target: Crackme#2 for [v0!d]
dowload here:
Click here (http://crackmes.de/download.php/vcrkme02.zip?Crackme=201&CrackmesSession=CrackmeSession4b1695a087144c338f5f c9001781b58b)

And no.1 as following:
<pre>
======================
Only use OllyDbg v1.08b
=======================

OllyDbg is a 32-bit assembler-level analyzing Degugger with intuitive interface.
OllyDbg is very friendly debugger.
OllyDbg run any WINDOWS (with chip intel x86).
...
OllyDbg can use for crack :)
------------------------------------------------------------------------------
This my no.1 crack for me in OllyDbg.

Target: Duelist's Crackme #5
Author: duelist@beer.com

Crack it by: luucorp@yahoo.com

Crackme#5 is packed,so we must find Origin Point (OP).
And Crackme#5 have 2 goals:
1.Remove Nag
2.Box "Unregistered" -> box "Registered"

We load due-cm5.exe in OllyDbg (F3 -> Open)
-->warning: Entry Point Alert -->OK.

In window "CPU-main..." we are staying Entry point:
Disassembler as:
00406600 > 53 PUSH EBX
00406601 51 PUSH ECX
00406602 52 PUSH EDX
00406603 56 PUSH ESI
00406604 57 PUSH EDI
00406605 55 PUSH EBP

A program_Packed before unpacking, it usually saves register (EBP,ESI,EDI,..) into Stack by using intruction push, as we see above.
Of course, When unpacking to finish then program_Packed will restore value that saved in Stack by using pop, So we will use OllyDbg:

Ctrl+S
type:
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
click button Find.

OllyDbg leads us to the followings:

0040665D 5D POP EBP <-------restore value in Stack
0040665E 5F POP EDI
0040665F 5E POP ESI
00406660 5A POP EDX
00406661 59 POP ECX
00406662 5B POP EBX
00406663 FFE0 JMP EAX <-----EAX= Original Point (1)

We set breakpoint at 00406663 ( line (1) )
And press F9 for program_Packed to unpack itseft, wait until program Paused at line(1).
Remove breakpoint at line(1) by press F2.
And now, EAX=401000=Original Point(OP) we go to OP by F7.
EIP are staying at 401000, but we don't understand any instruction, why?
because Olly doesn't analyze this para code before, So we tell OllyDbg that please analyze it :)
Let OllyDbg do: We press Ctrl+A

We have code as the following:

004010C1 > 68 00200000 PUSH 2000 ; /Style = MB_OK|MB_TASKMODAL
004010C6 . 68 5C204000 PUSH DUE-CM5.0040205C ; |Title = "Unregistered"
004010CB . 68 17204000 PUSH DUE-CM5.00402017 ; |Text "Please..."
004010D0 . 6A 00 PUSH 0 ; |hOwner = NULL
004010D2 . E8 94010000 CALL DUE-CM5.0040126B ; \MessageBoxA
004010D7 . 6A 00 PUSH 0 ; /lParam = NULL
004010D9 . 68 B8104000 PUSH DUE-CM5.004010B8 ; |DlgProc = DUE-CM5.004010B8
004010DE . 6A 00 PUSH 0 ; |hOwner = NULL
004010E0 . 6A 01 PUSH 1 ; |pTemplate = 1
004010E2 . FF35 0F214000 PUSH DWORD PTR DS:[40210F] ; |hInst = NULL
004010E8 . E8 12010000 CALL DUE-CM5.004011FF ; \DialogBoxParamA
004010ED .^EB C2 JMP SHORT DUE-CM5.004010B1

For printing nag then the code begins from 004010C1 to 4010D2.
we see ">" at 004010C1:
004010C1 >
so we click left mouse on this instruction, press Ctrl+R , Olly will goto window "Ref...."
We see in this window first line:

0040105C|jmp short ..

click double mouse on this lines, olly return "CPU-MAIN.."
That means jmp to prinf(" Unregistered"), so we will fix it don't printf.
Do it, we jump to after MessageBoxA -> must jmp to address 004010D7.

On this line:
0040105C . EB 63 JMP SHORT DUE-CM5.004010C1
you press Space,
you type "JMP SHORT 004010D7"
Click Assemble
click Cancel

As NAG removed.

Next, we can goto this code:
00401130 > 68 5C204000 PUSH DUE-CM5.0040205C
; /lParam = 40205C " Unregistered"
00401135 . 6A 00 PUSH 0 ; |wParam = 0
00401137 . 6A 0C PUSH 0C ; |Message = WM_SETTEXT
00401139 . 6A 03 PUSH 3 ; |ControlID = 3
0040113B . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
0040113E . E8 3A010000 CALL DUE-CM5.0040127D ; \SendDlgItemMessageA

How to find para above code:(click right mouse+Search for+All ref -> click double mouse on line " Unregistered" order 2)

Now, We must find string as :" Registered"
We press Shift+Tab (twice)
Ctrl+B
in box lable ASCII, we type " Registered" (no colon)
Enter

OllyDbg goto address 40204F, here have string " Registered",0
As What Do you know fix on line 00401130 ??????????

press Tab (twice)
this on line:
00401130 > 68 5C204000 PUSH DUE-CM5.0040205C
; /lParam = 40205C " Unregistered"
press Space
type : "push 40204F"
Click Assemble
Click Cancel

As you replace from " Unregistered" to " Registered" :)
Finish goals 2.
==================>PRESS F9.
</pre>

If you want patcher for this crackme#5 then tell me.

Greets to: Oleh Yuschuk, TBD and u:)

thx
luucorp
luucorp@yahoo.com

See you again with tut no.2

<::TBD::edit> added bbcode code for formatting
Anonymous
12-14-2002, 03:28 AM
Great work, thanks :D
olly4all
12-14-2002, 03:05 PM
Thx luucorp
Great tut :)

Put how we can patch it ? as u know it's a program_Packed :(
And how to Unpacker it ?

with thx
psyCK0
12-14-2002, 04:46 PM
How about writing a short tut on OllyDump?? Use an UPXed notepad or something... Coz I cant get the dumped exe to run, but it does if I dump with ProcDump.
TBD
12-15-2002, 02:20 AM
luucorp thanks for sharing. i want to add your tutorial, converted in html, to the OllyDbg stuph page in the soon to be created Tutorials part.

please for the next tut part, to send it by email to me, because it looks "funky" on the messageboard. you can find my email here (http://rohanpall.com/ollydbg/index.php?action=userinfo&user=1)
luucorp
12-15-2002, 05:54 AM
olly4all:For patch it:
At address 00406663:JMP EAX ; (don't jmp to OP here)
You fix it as(use HIEW):
00406663:mov dword ptr [0040105D],79h ;Remove Nag
mov dword ptr [00401131],4Fh ;Status box become " Registered"
jmp eax
TBD
Thanks, tut is "funky". I will mail to you for next tut(no.2).
olly4all
12-15-2002, 01:45 PM
Thanks luucorp ..clear :)
Anonymous
12-16-2002, 12:47 AM
THANKYOU! Crackmes may seem useless to some people, but I find that theyre the best way to learn - there's no bloat code to sift through ... :)
luucorp
12-16-2002, 02:19 AM
thank you.
here it is clear.
how to patch Duelist's Crackme #5, that don't need unpack.
after my tut No.1, we patch it (very easy):
Remove Nag:
===========

old: 0040105C EB 63 JMP SHORT DUE-CM5.004010C1
fix to: 0040105C EB 79 JMP SHORT DUE-CM5.004010D7

Status box become " Registered":
==============================

old: 00401130 68 5C204000 PUSH DUE-CM5.0040205C ;" Unregistered"
fix to: 00401130 68 4F204000 PUSH DUE-CM5.0040204F ;" Registered"

As, we must fix:

byte at [0040105D]=79
byte at [00401131]=4F

Next,We patch as:
After program unpacked, then we will fix 2 byte at [40105D], [401131]
and go to OP.
That mean is: we must add 3 instruction after:
mov byte ptr [0040105D],79
mov byte ptr [00401131],4f
jmp eax

but where do we add 3 instruction?
we find some space that program doesn't never use, find it simple this:
above EP (entry point), we see many byte have value=0, that is space
that we need.

I chosse space at address 004065EC and add 3 above intruction as:

004065EC C605 5D104000 79 MOV BYTE PTR DS:[40105D],79
004065F3 C605 31114000 4F MOV BYTE PTR DS:[401131],4F
004065FA FFE0 JMP EAX (goto OP)

Ofcourse, we must replace instruction at address 00406663:

From: 00406663 FFE0 JMP EAX
to: 00406663 ^EB 87 JMP SHORT DUE-CM5.004065EC

As, if you use Hex Editor then we will patch as:

Offset in file .exe:

000027EC: C6 05 5D 10 40 00 79 C6 05 31 11 40 00 4F FF E0
00002863: EB 87

Done patch.

If you don't have Hex Editor,You can do a program for patch as (use Pascal):

const
fix1:array[1..16] of byte=($C6,$05,$5D,$10,$40,$00,$79,$C6,$05,$31,$11, $40,$00,$4F,$FF,$E0);
fix2:array[1..2] of byte=($EB,$87);
var
f : file of byte;
i,j : byte;
begin
assign(f,'due-cm5.exe');
reset(f);

seek(f,$27EC);
for i:=1 to 16 do write(f,fix1[i]);
seek(f,$2863);
for i:=1 to 2 do write(f,fix2[i]);

close(f);
end.

Greets: OD, TBD and you.

See you with no.2 (TBD?)
Anonymous
12-16-2002, 11:38 PM
Note - above download URLs for the crackmes dont work. The correct URLs are:

Crackme #5 - <a href="http://crackmes.de./crackmeinfo.php?ID=428
" target="_new">http://crackmes.de./crackmeinfo.php?ID=428
</a>
Crackme #2 - <a href="http://crackmes.de./crackmeinfo.php?ID=425
" target="_new">http://crackmes.de./crackmeinfo.php?ID=425
</a>
(I just went to crackmes.de and searched under D for Duelist)
luucorp
12-17-2002, 06:00 AM
Anonymous: thanks for correct links.
you also find my solution (Only use OllyDdb to crack) here that.

if anybody want nice tutorial then you can view here:
Tutorials -=thanks TBD=- (http://www.rohanpall.com/ollydbg/files)

thx, luucorp
luucorp
12-18-2002, 05:09 AM
if you have any question about tut no.2 please tell me
thank you very much.
Tacman
12-18-2002, 12:38 PM
Nice tut mate thank you
luucorp
12-19-2002, 06:13 AM
hi, all of you.
----
you also use method (same tut no.2) for crack FireWork's crackme#10 (at crackmes.de)

but you note: in 2 box don't fill anything at begin (for SEH works).

thx, luucorp
Anonymous
12-19-2002, 11:23 PM
luucorp - youve mentioned a magic word, SEH :)
Id love to read a tutorial about SEH -- how it is used as a protection, and how to defeat it, but there doesnt seem to be anything for it - at least not with OllyDbg. *subtle hint* ... :)
luucorp
12-20-2002, 03:19 AM
Anonymous:thanks you for question about SEH.
now, we talk about SEH:)

1 : SEH
The idea of exception handling (often called "Structured Exception Handling") is that your application instals one or more callback routines called "exception handlers" at run-time and then, if an exception occurs, the system will call the routine to let the application deal with the exception. The hope would be that the exception handler may be able to repair the exception and continue running either from the same area of code where the exception occurred, or from a "safe place" in the code as if nothing had happened. No closure message box would then be displayed and the user would be done the wiser. As part of this repair it may be necessary to close handles, close temporary files, free device contexts, free memory areas, inform other threads, then unwind the stack or close down the offending thread. During this process the exception handler may make a record of what it is doing and save this to a file for later analysis.

If a repair cannot be achieved, exception handling allows your application to close gracefully, having done as much clearing up, saving of data, and apologising as it can.

thanks, yado.

2 : Example about SEH
I have two example, i hope you read it you will understand :)
<pre>
DOS:
===========
;
;tasm sehd
;tlink /t sehd
;
.model tiny
.code
org 100h
start:
xor bx, bx
mov es,bx
mov dx,offset @fixerror

push word ptr es:[bx] ;save old int0
push word ptr es:[bx+2]

mov word ptr es:[bx], dx ;new int0 --> @fixerror
mov word ptr es:[bx+2], cs

mov ax,1982
xor bx,bx
div bx ;<-- error here

jmp @ok

@fixerror:
xor bx, bx
pop word ptr es:[bx+2] ;retore old int0
pop word ptr es:[bx]

call msg
_title db 'by luucorp',13,10
_error db 'Divide 0',36
msg:
pop dx
mov ah, 9
int 21h
xor ah,ah
int 16h
jmp @terminate
@ok:
xor bx, bx
pop word ptr es:[bx+2] ;retore old int0
pop word ptr es:[bx]

@terminate:
int 20h
end start

WIN:
==========;
;tasm32 /ml /m3 /z seh
;tlink32 -x /Tpe /aa /c /V4.0 /o seh,seh,, d:\c\tasm\import32.lib
;
.386
.model flat, stdcall
extern MessageBoxA:Proc
.data
_error db 'Divide 0',0
_title db 'by luucorp',0
.code
start:
xor ebx, ebx
push ebp
push offset @fixerror
push dword ptr fs:[ebx]
mov dword ptr fs:[ebx], esp

mov eax,29121982
xor ebx,ebx
idiv ebx ;<-- error here

jmp @ok

@fixerror:
xor ebx, ebx
mov eax, dword ptr fs:[ebx]
mov esp, dword ptr [eax]
pop dword ptr fs:[ebx]
call MessageBoxA, 0, offset _error, offset _title, 0
jmp @terminate
@ok:
sub ebx, ebx
pop dword ptr fs:[ebx]
@terminate:
pop eax
pop ebp
ret
end start
</pre>
Anonymous
12-20-2002, 09:20 AM
What does fs: mean ? I've seen things like ds: and cs: and assume these mean data segment and code segment, but what does fs: mean ? I'm assuming it's something do with SEH or system structure how you used it, but can you explain?
Anonymous
12-21-2002, 02:13 AM
luucorp - thank you sooooooo much! I dont have any time to sit down and properly go through it yet, but hopefully later this weekend with any luck :)
Anonymous
12-21-2002, 03:57 PM
very interesting...how do people use SEH as a protection/anti-debug method?
luucorp
12-22-2002, 04:54 AM
hi, all of you.
i hope people like tut3

thx, luucorp
Anonymous
12-22-2002, 08:49 AM
... which begs the question - where is tutorial 3? :)
Anonymous
12-22-2002, 03:08 PM
I would imagine it would be done by creating an exception handler, then causing that exception, with the exception handling code being the rest of the program. The debugger wouldn't know where to go.
luucorp
12-22-2002, 11:27 PM
TBD : tut3?
....


ANTI ATTACH ?

RCE Messageboard's Regroupment > General > ANTI ATTACH ?
ricnar456
11-27-2002, 06:48 PM
I have various programs i open in OLLY and RUN perfect and no error at all never but if i attach this program, exception 80000004, errors in kernel32 and very strange things ocurrs, no in all programs only in some programs.

For example WEB PROTECTOR 2.0 is a little program 500 k.
http://www.protecthtml.com/

in w98 if you attach the errors ocurr, if open normally not
and others

is there a anti attach protection?

Ricardo Narvaja
TBD
11-28-2002, 02:05 PM
hmm, never heard about this. i will try to see on my machine too.
Anonymous
11-29-2002, 01:29 PM
It's due to the detection of debugger by the debugged program.
It's a protection :o)
Darus
11-29-2002, 02:21 PM
The soft is packed with UPX, unpack with upx with -d option in command line
ricnar456
11-29-2002, 08:01 PM
Anoymous: if is a detection of the debugger why not detect the debugger when open a program normallly with OLLY and make errors only when ataching, I dont look any protection only two jmps and a ret and when execute the ret the error apears.
I know antidebugging protection here it is not any protection antidebugger.

Darus, the UPX isn't the problema is easy remove and the error are equal in the dumped executable.

Ricardo
Darus
11-30-2002, 08:33 AM
hmm i've said upx because when open the program normally there is no problem with antidebugging
luucorp
12-10-2002, 11:01 PM
hi,ricnar456
you want crack it that don't want buy it?
if TBD agree, i will post crack it.
too smile.
luucorp@yahoo.com
TBD
12-11-2002, 02:31 AM
luucorp: if Ricardo wants it please use the email exchange information or use fraviamb.
... but if you have something generic, please post it :)
Jond
12-11-2002, 02:35 AM
unpack the app and get rid of the api: IsDebuggerPresent or somethinglike that
ricnar456
12-12-2002, 06:41 PM
I modify the kernel 32 this api always return 0 in my machine,this isnt the truble, why any try the program the link is in the first post.

Ricardo
TBD
12-13-2002, 02:32 AM
this thread is locked due specific program antidebugging code.


api SetProcessWorkingSetSize

RCE Messageboard's Regroupment > Bugs > api SetProcessWorkingSetSize
ricnar456
11-27-2002, 07:39 PM
In winapis32 the api SetProcessWorkingSetSize is defined

The SetProcessWorkingSetSize function sets the minimum and maximum working set sizes for a specified process.

The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The size of the working set of a process is specified in bytes. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process.

in OLLY this api not exist, in a program is used and OLLY dont show in names nothing, in view executables, kernel32, view names , dont exist in the list of exports functions.

is a bug?

Ricardo Narvaja
TBD
11-28-2002, 03:11 AM
ricnar456: according to MSDN
Windows NT/2000/XP: Included in Windows NT 3.5 and later.
Windows 95/98/Me: Unsupported.

and as you told before you are working on Win98, so it is not available
ricnar456
11-28-2002, 08:39 AM
but im softice in w98 i put bpx SetProcessWorkingSetSize
and stop in that api.

Ricardo Narvaja
TBD
11-28-2002, 09:49 AM
ricnar456: weird ... do you have a small example so i can take a look ?
ricnar456
11-28-2002, 11:12 AM
yes i have an armadillo 2.61 use that api in w98, with trw2000 and softice i put bpx in that api and stops, and in olly i not work in this more later, i send a link of this now i am in work.

Ricardo
ricnar456
11-28-2002, 01:11 PM
http://www.lottomania.ch/

the program is A DREAM LOTTO 1.4, the demo is in this page.

is an armadillo 2.61 protected program, and use this api.

Ricardo Narvaja
TBD
11-28-2002, 01:54 PM
ricnar456: a smaller download please :)
ricnar456
11-28-2002, 04:23 PM
well is the one i am working, and in this is the problem and in any armadillo 2.61 y guess, but i dont know other armadillo same version, more little.

Ricardo


Lock-up when debugging

RCE Messageboard's Regroupment > General > Lock-up when debugging
gliptic
11-28-2002, 03:06 AM
I know this isn't actually a OllyDbg problem, it happends with the Visual C++ debugger also.
When I start a debugging section in OllyDbg and run the application and does some things in it, OllyDbg freezes and drags all other apps down with it. I can only force it down if I press Ctrl+Alt+Delete and picks Log out. The same happends when I try to JIT debug an application. It doesn't matter which program I debug. Does anybody else have this problem?
This is my comp.:

Windows 2000 Pro SP2
P4 2.4 Ghz
512 MB DDR
Soyo motherboard (built-in sound and LAN)
GeForce 4 TI4200 with latest Detonator drivers
TBD
11-28-2002, 03:12 AM
gliptic: it happends everytime or randomly ? have you tried with different OS ?
Anonymous
11-28-2002, 08:10 AM
Hi, I have WinXP Pro SP1 and have simular but not same problems.

When I debug an application and application is paused windows shell locks up. All other apps continue running, but taskbar and some shell related services don't (for example if application uses ShellExecute() the program do not run). If I press F9 to resume debugged application everything resumes too. The shell operates and runs applications that were not run while it was locked and so on.
The lock hapens at random, it might depend on where in program is debugger (for example breakpoint in shell function).

This must be Windows shell code bug because I experience same lock with VC++ 6.0 debugger with latest service pack.
gliptic
11-28-2002, 11:34 AM
It happends every time I tried to do JIT debugging. It seems to happend when the app calls some particular APIs when I run an app in debug mode from Olly.

Anonymous, it sounds quite similar to my problem. Probably IS the same problem.


How I can fix the Sections after OllyDump

RCE Messageboard's Regroupment > General > How I can fix the Sections after OllyDump
Olly2All
11-28-2002, 11:52 AM
Hello..

After I use OllyDump to Dump a packer program..How I can fix the Sections of this program to run it.
And Is there any tutorial to show us how to unpack any program using OllyDbg.

Thx
Anonymous
11-28-2002, 05:41 PM
Use LordPE, available from most tools sites. Depending on section offset in the pe header, you might be able to simply set VOffset and VSize to ROffset and RSize.
Gigapede
11-28-2002, 08:37 PM
OllyDump fixes RawSize and RawOffset of a section in a value the same as VirtualSize and VirtualOffset by default.
you can see the checkbox "Fix Raw Size & Offset of Dump Image" is checked.
if you remove the check mark, RawSize and RawOffset back to the original value.
you can edit section detail by right clicking on a section you want and select "Edit Section" menu (or double click).
then new dialogbox appears, edit section name, VSize, VOffset, RSize, ROffset and Charactaristics.

though you fix the sections, you can't get a right executable.
you must fix the import table.
"revirgin" or "Import REConstructor" do this.

does anyone show the usage of these apps?
it is difficult for me.
Olly2All
11-28-2002, 09:58 PM
Hi..

Many Thx

Regard


Scrolling data window

RCE Messageboard's Regroupment > General > Scrolling data window
Anonymous
11-28-2002, 05:43 PM
In the data dump display window, you can scroll the addresses up and down by 16 bytes at a time with the up/down cursor keys - is there a similar key combination to scroll by 1 byte? This would help aligning the start of a structure as the first byte seen.
TBD
11-29-2002, 02:31 AM
CTRL+UP/DOWN


Viewing exports

RCE Messageboard's Regroupment > General > Viewing exports
Anonymous
11-28-2002, 05:45 PM
Is it possible to view the exports of a DLL that an EXE has loaded, so I can set a breakpoint on some of the exports? I can't use the "Search for all intermodular references" as the library is used by LoadLibrary/GetProcAddress.
TBD
11-29-2002, 02:33 AM
View/Executables modules(ALT+E)/rightclick on your DLL/View Names


[ODF] get the latest discussions on your desktop

RCE Messageboard's Regroupment > Announcements > [ODF] get the latest discussions on your desktop
TBD
11-29-2002, 09:50 AM
::great news
you can get the latest discussions from this forum by downloading this slim client, KlipFolio (http://www.klipfarm.com)(300kb) and then add OllyDbg Klip (http://www.klipfarm.com/farm.php?page=info&klip=952)

tell me what da ya think.
Anonymous
11-30-2002, 03:14 AM
yep it sure is kool, with a kapital K.

Nice icon too.
gorshing
12-02-2002, 04:35 PM
That is pretty neat, Now I have another thing to play with :)

Put my stock stuff on there too

Thanks for mentioning it
TBD
12-03-2002, 03:18 AM
gorshing: you socks stuff ? :)
btw, if you have a page from where you get the info in realtime it is possible by using klipscript. this is what i did for the first version of OllyDbgKlip, then i made a php script to make a .food resource.
gorshing
12-03-2002, 11:39 AM
Well yes ... I thought everybody has socks. But yes I also have a few stocks. I watch the stocks that I have 401k in and also a few companies. Mainly oil related companies.

This is the firsttime that I have heard of klip, I am going to have to figure out how to write one of those :)
TBD
12-03-2002, 12:35 PM
gorshing: if you find the companies on yahoo.finance than you can use ActiveStocks (http://www.klipfarm.com/farm.php?page=info&klip=958) for example.
if not, you must parse the page with klipscript [tutorial] (http://www.serence.com/provider.php?page=kscript_overview_home)
gorshing
12-04-2002, 12:04 PM
TBD, I read the tutorial( well I tried ), but it hurt my head :)

It was explaining what a comment is, what a function is and all the basic stuff. It gave me a head ache

I couldn't get it to work with the assembly board, but I am going to try again later
TBD
12-04-2002, 12:10 PM
gorshing: you could look at weather klip to see how the parsing of http pages is done.


about links

RCE Messageboard's Regroupment > General > about links
TBD
11-29-2002, 12:07 PM
TBD how about adding a few links to the forum page: one to OllyDbg's site, one to the plugins page, one to http://zor.org/yaa/, etc.

Regards,
yaa

[TBD::edit] i moved the post here because i want to keep annoucements only for annoucements :)
TBD
11-29-2002, 12:11 PM
i will make some changes on the front page but till then is ... _work in progress_

i plan to make a FAQ page where will be all the links, ... but will be a wiki page - so that anyone can add there

yaa: how is the FAQ doing ?
yaa
11-29-2002, 12:18 PM
Well, at the moment I'm making more a "hands-on" or "tips and tricks" site. There haven't really been recurring questions up to now on the forum. I'll be putting something up in the next few days also with the possibility for visitors to contribute/correct/improve the published tips and tricks (luckily PHP is very much like C ... :-))

Regards,
yaa
TBD
11-29-2002, 12:29 PM
yaa: why not use wiki that is already written ?
did you tried the KlipFolio ... it rocks :)
yaa
11-29-2002, 12:31 PM
Yup, I donwloaded it. What do you mean by "use it"??? Use it for what?? I suppose I could a klip for my site too. Is that what you mean?

Regards,
yaa
TBD
11-29-2002, 12:50 PM
i mean to use the klip to see the latest discussion from this forum :)
yaa
11-29-2002, 12:57 PM
I do use it. What it is wiki???

Regards,
yaa
TBD
11-29-2002, 01:03 PM
wiki = easy changeable web pages, example (http://www.allmyfaqs.com/cgi-bin/wiki.pl?PHP_FAQs)
rohan
11-29-2002, 06:06 PM
Hey dudes, I'm glad to see that the forum is working out well and that the ollydbg community is having a great time ;)

What more can I do to help you out? TBD, let me know, I get backlogged from time to time so I prolly forgot what you asked me ;}

Take care dudes,
Ro
TBD
11-30-2002, 02:33 AM
Ro: i've sent you a php wiki package to see if it can be put here. i want to have a FAQ section where anyone can contribute.

also i will send you monday some minor modifications for the first page (add some links)

did you checked KlipFolio ? (this is my new toy nowdays) :)


stayontop plugin

RCE Messageboard's Regroupment > Plugins > stayontop plugin
matthijsln
11-30-2002, 07:29 AM
I've put a plugin I made some months ago up for download here:

http://www.xs4all.nl/~walterln/ollydbg/stayontop-1_0.zip

It can be used to make individual MDI client windows to stay on top, for example as in a screenshot here:

http://www.xs4all.nl/~walterln/ollydbg/screenshot1.png

It has got a few bugs as it is implemented in quite a hackish way but for me it works OK.

It was coded with Microsoft Visual C++ 6, the source is included.
Darus
11-30-2002, 08:39 AM
cool plugin, thx ;)
TBD
11-30-2002, 08:42 AM
matthijsln: great ! can i host i here ?
matthijsln
11-30-2002, 08:52 AM
great ! can i host i here ?
sure, that's ok
Anonymous
01-29-2003, 02:59 PM
Very handy, tnx for this plugin!

Greetz,
B-Man


TBD!

RCE Messageboard's Regroupment > Bugs > TBD!
The_Philosopher
12-01-2002, 05:08 AM
Did you contact olly about that closing handle problem? Any news?

The_Philosopher
TBD
12-01-2002, 10:09 AM
i've sent i mail but no response till now, i will try tomorrow. maybe he is on holiday :)


Hardware breakpoints

RCE Messageboard's Regroupment > General > Hardware breakpoints
ricnar456
12-01-2002, 12:21 PM
I install Wxp today and i see OLLY here is better, the question is how i manage the hardware breakpoints, i have 4 but i put 4, and where i can look the list of this breakpoints, how i can clean all hardware breakpoints?. how i can clen one only i want, is this possible, in the cmndbar i wiew HD but i put HD adreess, but the harwdawre breakpoint is active asnd continue stopping.

Ricardo Narvaja
TBD
12-01-2002, 12:54 PM
you must remember where you put them and if you want them removed then right click on that address and you have remove hardware breakpoint
ricnar456
12-01-2002, 04:36 PM
i dont remember jeje, in the list of breakpoints, could not list the hardware breakpoints jeje.

Ricardo
TBD
12-02-2002, 02:20 AM
i mean in CPU memory dump, not in breakpoints list
ricnar456
12-02-2002, 08:54 AM
Yes i suggest only, the posibility of hardware bpx apears in the bpx list only for when not remember where was.

Ricardo
TBD
12-02-2002, 12:10 PM
ricnar456: request sent to Olly. i, too, forget where i put the HW bpx :)
TBD
12-02-2002, 12:35 PM
[TIP] view hardware breakpoints: Debug | Hardware breakpoints | Follow.
ricnar456
12-03-2002, 08:02 AM
Thanks.

Ricardo


hardware breakpoints on IO ?

RCE Messageboard's Regroupment > General > hardware breakpoints on IO ?
Anonymous
12-01-2002, 09:04 PM
Hi,

Is it possible to set hardware bp on a port IO ?

Thanks
Daniel
TBD
12-02-2002, 02:18 AM
nope, it is not possible because OllyDbg is not a kernel debugger.


breakpoints get removed when DLL is unloaded

RCE Messageboard's Regroupment > General > breakpoints get removed when DLL is unloaded
dsula
12-01-2002, 09:31 PM
Hi,

I've been using Olly 1.07b and I liked the fact that breakpoints
set in a DLL stay even when the DLL gets unloaded and reloaded again.
Olly 1.08b doesn't seem to do that anymore. All breakpoint get permanently
removed when the DLL gets unloaded. Am I missing something ?
Please advice.
Thank you very much
Daniel
cryingfox
12-20-2002, 07:53 PM
I wanna know the answer too.
I often use ollydbg to debug my dll. And set the breakpoint every time you reload the application is so inconvenient.
Anonymous
12-21-2002, 06:46 AM
If you bind your dll to your exe file instead of using LoadLibrary/GetProcAddress, Ollydbg keeps the breakpoints. For debugging, maybe this is a better option, and then using the GetProcAddress option when your DLL works.
Anonymous
12-31-2002, 06:17 PM
Yes please can you put back this option in OllyDbg.
To put everytime all breakpoint in dll when the dll gets unloaded is very heavy.

Thanks in advance


bundy: you are infected with WORM_KLEZ.H virus

RCE Messageboard's Regroupment > The Heap > bundy: you are infected with WORM_KLEZ.H virus
TBD
12-02-2002, 09:56 AM
please run an antivirus. thanks.


re: Ollydbg & Cracking

RCE Messageboard's Regroupment > General > re: Ollydbg & Cracking
Anonymous
12-04-2002, 04:22 PM
Ollydbg is a very professional debugger for all versions of Windows, and is very actively developed. Because of it's advanced features, some people use it for removal of protection from programs. That's fine, but try not the advertise the fact on public boards eh?

As soon as Ollydbg becomes "Yet another cracking tool, along with the cracking tutorials to help you" all that'll happen is that Olly will start receiving cease and desist letters, the development will dry up and you'll only find old versions on certain tools sites.

Can we please cut down the amount of "How do I crack with Ollydbg" messages on this messageboard before it's too late ? Try to ask more generic questions, like "How do I set a breakpoint here" etc
TBD
12-05-2002, 02:37 AM
Anonymous: you read my mind ... i was just wanted to post this.
from now on all cracking request will be deleted as i dont want to have problems.
rohan
12-05-2002, 01:32 PM
Yeah TBD, wield that Lawmaker with style!
Darus
12-06-2002, 09:01 AM
Hello, i've wrote some tutos on how to crack with ollydbg but my tut are not on a specific protection. My tutos explain how to set breakpoint, how to use ollydbg the first time.
I considered that my tut are centered on the tool and no on the crack

heu my english is very bad sorry
TBD
12-06-2002, 09:23 AM
Darus: i think the best approach is to use a small program (w/ source) and work on it (set breakpoints, trace, ...) and explain step by step.

your tutorials (1&3) are made in this manner but i will like instead of a crackme with serial/protection/... to have a simple program, something like Olly's example of runtrace.
Darus
12-06-2002, 09:35 PM
oki doki ;) i will try to do a "normal" tut
luucorp
12-13-2002, 03:10 AM
Ollydbg is a very professional debugger.(true)
But if Anyone wants detect you debugging their program in Olly is very easy.

<font color="#FF0000">::TBD:: removed due the fact that was a specific target</font>

Thanks to (olly)Oleh, rarsoft, my girlfriend, and you.

if you have any question or comment please mail to me.
luucorp
luucorp@yahoo.com
The_Philosopher
12-13-2002, 12:38 PM
I use WinDBG from beloved MS for cracking. Nice. Maybe then someone will fuck up this company. What do you think about this?

The_Philosopher
TBD
12-13-2002, 01:53 PM
The_Philosopher: this doesnt help at all. btw, this is a OllyDbg Users Forum, not a WinDbg or anything else, so please keep the posts OD related.
The_Philosopher
12-13-2002, 03:00 PM
Really TBD?! I didn't know that. Thanks for info.


Feature Request

RCE Messageboard's Regroupment > General > Feature Request
Anonymous
12-05-2002, 05:54 PM
Hello

I will debug code for Intel P4 with SSE2/MMX2-Code, but this is not implemented.
The best would a complete Support for P4 but 2 little improvements would the debugging made easier:
- show the xmm-register as hex
- no total refuse to stepping over unknown opcodes
is this possible for a new version ?

JensN


[new] Plugin Development Kit 1.08 beta released

RCE Messageboard's Regroupment > Announcements > [new] Plugin Development Kit 1.08 beta released
Gigapede
12-06-2002, 12:58 AM
it includs 2 sample source, "Bookmark" and "Cmdline".
TBD
12-06-2002, 02:32 AM
this is the correct link (http://home.t-online.de/home/Ollydbg/plug108.zip) to the Plugin Development Kit 1.08 as the link from pdk.htm is wrong.

enjoy.
Anonymous
01-01-2003, 05:15 PM
If i recompile the commandline plugin in Visual Studio the plugin fails to read and write to the ini with Pluginwriteinttoini and Pluginreadintfromini alike functions. maybe a bug in this PDK?

Or am i the only one having this problem?


a plugin idea

RCE Messageboard's Regroupment > Plugins > a plugin idea
Anonymous
12-06-2002, 08:52 PM
ive had this idea for a plugin since the early days of olly, but i never get around to it. maybe someone here has the skills to do it... i'd be willing to collaborate when i get some time.

idea is as follows:
the plugin would be used to save a log of a hit/run trace of the app, and then compare 2 hit/run traces to identify instructions that get executed in one run and not another.

so the concept is simple:
you would run the app once in one condition (normal or registered or unexpired), and then once again when the app is expired, etc.

and then a util would be used to show which instructions are encountered in one run and not another. probably the most useful thing would be to see discrepencies hit earliest in the trace.

well, that's the idea - maybe we can talk about whether this is feasible, and what pieces would be needed to make this work.

-flying raichu

[olly is king.]


Debug registers?

RCE Messageboard's Regroupment > General > Debug registers?
psyCK0
12-06-2002, 09:41 PM
Is there any way to see those in Olly???
Anonymous
12-08-2002, 05:24 AM
I don't see the point ?
psyCK0
12-09-2002, 08:58 AM
They can be used in a program... To encrypt something...

For example, if you use them while generating a serial for a name, then
the serial would be different if the code is debugged then if its not...
Anonymous
12-09-2002, 06:56 PM
Well, yes, but under Olly, the debug registers are going to contain pretty much known values - so I don't see the point of displaying them. Now showing code that references the debug registers I can understand would be useful, but only for things that should not be discussed on this forum.


SEH and Olly

RCE Messageboard's Regroupment > Bugs > SEH and Olly
psyCK0
12-06-2002, 09:58 PM
Post deleted. /me is being stupid =)
psyCK0
12-06-2002, 10:00 PM
And one more issue: this forum engine's way to remove leading spaces and tabs makes pasting readeable code impossible. =)
Anonymous
12-09-2002, 06:16 AM
Most forums have a tag for code ... wonder if this forum does? *test* :)


[plugin] Command Bar 1.08.02

RCE Messageboard's Regroupment > Plugins > [plugin] Command Bar 1.08.02
Gigapede
12-07-2002, 03:12 AM
update Command Bar.
i compile it with PDK1.08.
"BPX" and "BPD" commands are available.

i change the version number.
"1.08" means PDK version and "02" is this plugin version.

download:
http://dd.x-eye.net/file/cmdbar10802.zip
Anonymous
12-07-2002, 01:08 PM
thanks
Anonymous
01-29-2003, 02:55 PM
Cool, thnx. This is very handy!

Greetz,
B-Man


Copy a block of strings...

RCE Messageboard's Regroupment > General > Copy a block of strings...
Jond
12-07-2002, 03:53 PM
Hey

i was wondering why Olly doesnt add this simple feature to mark number of strings and then copy from them only the text or everything... for now i seems to be able only to copy the whole table or specfic lines :\

Jond
TBD
12-09-2002, 04:27 AM
Jond: do you mean in CPU window ?

[TIP] to copy only one column from the windows, drag the other columns to have no width and the copy selection/whole table. to go back right-click/Appeareance/Default columns
Jond
12-09-2002, 09:36 AM
no i mean the list of strings u get when u do right click and Search for---> all referenced text strings... and a new window popups with all the strings and i want to mark number of them and copy by holding shit or somehting but i cant do it
Anonymous
12-09-2002, 06:58 PM
It's fairly easy to write a plug-in to do it however, all you need do is send a few windows messages to the control the string list is in and you can get all the strings in ASCII form and do whatever you want with them.
Jond
12-11-2002, 02:36 AM
m8 i dont know how to code plugins :( is there a chance u can help me with thaT?


code test

RCE Messageboard's Regroupment > The Heap > code test
rohan
12-10-2002, 09:03 AM
Code test!<pre>
if {$i_rock} {
puts "booya!"
} else {
# there is no else
# TBD edit test
}</pre>
rohan
12-10-2002, 09:39 AM
Hey!

<pre>
foreach line $lines {
if {[string match {[0-9]*} $line]} {
if {[regexp {^[0-9]*,} $line match ] } {
regexp {([0-9]*),([0-9]*).*} $line matchvar s1 s2
} else {
regexp {([0-9]*).*} $line matchvar s1
set s2 $s1
}

lappend g(diff3l) $s1
for {set i $s1} {$i <= $s2} {incr i} {
set g(diff3l$i) 1
}
}
}

</pre>


[ODF] [code][/code] available to post code snippet

RCE Messageboard's Regroupment > The Heap > [ODF] [code][/code] available to post code snippet
TBD
12-10-2002, 11:05 AM
you can use the "..." button to enter code snippets(it preserves the spaces of the entered text between).
hope it helps to add your code snippets.
<pre>
cmp eax, 1
jne _getout
mov eax, 0
_getout:
push 1
call kernel32.ExitProcess
</pre>


Kernel32.LockResource Import

RCE Messageboard's Regroupment > Bugs > Kernel32.LockResource Import
Blazde
12-10-2002, 11:07 AM
I notice when my prog is calling Kernel32.LockResource OllyDbg thinks it's calling SetHandleCount (an obsolete Win16 function). I don't know how OllyDbg figures out which function is being called, but if it's by ordinal then this one has probably changed. As I understand it Microsoft reserve the right to be stingy with ordinals and reuse them, move them about, etc... So maybe OllyDbg should be using a more portable method of locating the api functions. Or maybe it's just a bug with this one function. Using OllyDbg 1.08b on Win XP btw.
TBD
12-10-2002, 11:18 AM
Blazde: here is the FASM code that i use for testing and it works ok on my NT4SP6, OllyDbg 1.08b
<pre>format PE GUI 4.0
include 'include\macro\import.inc'
start:
push 0
push 0
call [LoadResource]
push 0
call [ExitProcess]
data import
library kernel,'KERNEL32.DLL'
kernel:

import ExitProcess,'ExitProcess',\
LoadResource, 'LoadResource'
end data

data fixups
end data
</pre>
Blazde
12-14-2002, 05:50 AM
It's LockResource tho, not LoadResource. When I try either LockResource or SetHandleCount in your FASM test, this same address in kernel32.dll gets called:

.text:77E7E351 ; Exported entry 590. LockResource
.text:77E7E351 ; Exported entry 777. SetHandleCount
.text:77E7E351
.text:77E7E351 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:77E7E351
.text:77E7E351
.text:77E7E351 ; UINT __stdcall LockResource(UINT uNumber)
.text:77E7E351 public _LockResource@4
.text:77E7E351 _LockResource@4 proc near ; CODE XREF: GetStringTableEntry(x,x,x,x,x)+69p
.text:77E7E351 ; EnumLangsFunc(void *,ushort *,ushort *,ushort,long)+C2p
.text:77E7E351 ; DATA XREF: ...
.text:77E7E351
.text:77E7E351 uNumber = dword ptr 4
.text:77E7E351
.text:77E7E351 mov eax, [esp+uNumber] ; LockResource
.text:77E7E355 retn 4
.text:77E7E355 _LockResource@4 endp

Two exports, one function. It looks like a kind of transitional phaze. SetHandleCount and LockResource both do nothing, but there's a place holder for them. You can bet there's going to be some real headaches in the future about this. Old apps that think they're getting SetHandleCount will start faulting in the middle of LockResource code when it arrives.

So I guess OllyDbg isn't wrong just yet. Btw, the code I had calling LockResource was explorer.exe. Microsoft getting ahead of themselves a bit there.
Blazde
12-14-2002, 05:56 AM
Or... they have different names, /and/ different ordinal numbers so maybe this is just some weird compiler optimization that recognises both functions do the same thing and lumps them together. Perhaps they'll become two again when LockResource is implemented.


just another lame idea ;p

RCE Messageboard's Regroupment > Plugins > just another lame idea ;p
dion
12-15-2002, 09:53 AM
hi all, i dont know if someone has post this idea. but maybe someone can make plugin that change ollydbg screen to be softice or trw2000 like screen, it must be great for users that neva or missing debugging days with softice. of course not using display driver, but using desktop handle to draw the character one-by-one, or manually. yes, just like conventional ownerdraw window. it same concept like skin/theme. well, i dont know if it can be applied as plugin or not.

btw, honestly i dont like ollydbg screen, because the font is so small. and to many nasty color ;p

regards
TBD
12-16-2002, 03:48 AM
dion: you can always change your appearence (you can try OEM Fixed Font) and also the colors you can change :)

and for the plugin to change the appearence it is tedious process(subclassing and hacking into strucres) and all this for little reward, IMHO
xxxxx
12-16-2002, 05:34 AM
For what reason???
xxxxx
12-16-2002, 05:38 AM
BTW look at olly debug main site - find schemes (http://home.t-online.de/home/Ollydbg/schemes.htm)I hope that this will satisfy you.
Anonymous
12-16-2002, 09:04 AM
really! so, that's old idea, eh... sorry

regards


Column sizes reset all the time

RCE Messageboard's Regroupment > Bugs > Column sizes reset all the time
dELTA
12-15-2002, 09:09 PM
Every time I restart OllyDbg (1.08b) the column sizes in all the windows are reset, even though I have the "Restore windows positions and appearance" setting active. This is very annoying. :-( Is it the same for everyone, or just me?
TBD
12-16-2002, 03:52 AM
dELTA: for me only in CPU dump, but it is not annoying. in other windows are the same as i set them, or i use "good" column size :)


Problems with symbols in OllyDbg, please help

RCE Messageboard's Regroupment > General > Problems with symbols in OllyDbg, please help
dELTA
12-16-2002, 01:01 PM
I'm having trouble getting OllyDbg to display my MASM symbols correctly. :(

At this location (http://board.win32asmcommunity.net/attachment.php?s=&postid=71248) I have uploaded a very simple example program that demonstrates this problem (a RadASM project file is also included, where all compile/link switches can be seen).

The main procedure looks like this:

<pre>
main proc
jmp example_label
nop
nop
example_label:
invoke MessageBox, 0, ADDR mbMessageText, ADDR mbTitleText, MB_OK
jmp another_label
nop
nop
another_label:
ret
main endp

</pre>

What I want is to get the labels "example_label" and
"another_label" to be displayed in the debugger,
but it refuses to do this. Some other labels are
displayed though, e.g. the "main" symbol, and the
"mbMessageText" and "mbTitleText" symbols in the
data section. Does anyone have any idea about how
to get the debugger to display the two other labels
too?

It would be really nice if someone would take a look and explain if I'm doing something wrong (or confirm that you get the same problem in OllyDbg).

Thanks a lot!
TBD
12-16-2002, 01:23 PM
dELTA: i look tomorrow, but in the meantime - question: why do you need for ?
below CPU disassm you have the line from the source file where it shows "jmp another_label". if you want more you can export map file and then import using mapconv plugin (not so nice though)
dELTA
12-17-2002, 12:03 PM
The problem with the single source line below the disasm window is that I don't think it gives any good overview at all. It is very inefficient and inconvenient to have to take my eyes off the disasm window after every single instruction step when tracing the program, just to see if the source line has changed, and what it is (most often only to see the exact same instruction that is listed in the disasm).

I have tried to bring up the source window in parallel with the disasm window when single stepping, and this is quite ok, except for the very annoying fact that it does not scroll automatically when the execution point jumps outside of the current viewed area. :( This makes me having to scroll manually in the source all the time, which in equally inconvenient and impractical as the single source line, if not worse. :( I have already mailed Oleh about making the source window scroll to follow the execution point automatically, so I'm really hoping for the best with that one.

Anyway, having the labels inside the actual code can be better and more efficient than viewing the source code in many situations too, so I'd really like to get all the memory adresses show their labels in this one too, and not just some of them.

Anyway, very nice of you to take a look at it TBD, I'm looking forward to hear about what you find!

Thanks!
TBD
12-17-2002, 12:14 PM
dELTA: i cannot find a way to include the labels in the disasm window. i think is how the OllyDbg uses the pdb info because the info is inside.

did you stress Olly in the mail with this problem, or should i send him too ? :)
dELTA
12-19-2002, 08:17 AM
I haven't mailed him about this yet, so you are very welcome to do so. ;) You know him better too, so hopefully it will have a better effect if you mail him. ;) Anyway, it should not be very hard for him to fix this I think, because the functionality to mark memory positions with labels is already fully in the program (it can be done manually), it just seems like he doesn't extract the labels from the pdb data right now, just as you say.

Thanks!


OllyDbg Tutorials

RCE Messageboard's Regroupment > General > OllyDbg Tutorials
TBD
12-17-2002, 03:11 AM
i was trying something and i managed to hide the [old thread] (http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=1&topic=64) on OllyDbg tutorials
also, dont forget to check [OllyDbg Stuph Page] (http://www.rohanpall.com/ollydbg/files) for more tutorials
luucorp
12-17-2002, 05:53 AM
----
TBDThank you very much for part tutorial.[b]
----

You can view many tutorial here:
http://www.rohanpall.com/ollydbg/files/#tutorials
or you click here:OllyDbg Stuph Page (http://www.rohanpall.com/ollydbg/files)
Here that, you find: plugins, tutorials, tools, and ..

thx, luucorp


Where can I find OllyDbg plugins?

RCE Messageboard's Regroupment > General > Where can I find OllyDbg plugins?
dELTA
12-17-2002, 12:05 PM
Is there any central collection where I can find OllyDbg plugins? I often see people say things like "simply use this plugin or that plugin" on this board, but I cannot find these plugins anywhere. :(
TBD
12-17-2002, 12:08 PM
dELTA: you can find them at OllyDbg Users Stuph (http://www.rohanpall.com/ollydbg/files).
i will put a link sometimes on the first page ... sometimes :)
Darus
12-17-2002, 05:55 PM
TBD >> a links section will be good


Memory breakpoint with condittion on EIP

RCE Messageboard's Regroupment > General > Memory breakpoint with condittion on EIP
Anonymous
12-19-2002, 06:32 AM
Hi all,

I'm trying to set a memory breakpoint with the condition that EIP > some address
so with the commandline plugin i'll set the following breakpoint
mw b43881 eip>b43700
the problem is olly also breaks when the eip<b43700
Can someone tell me what's wrong?

Lownoise
TBD
12-19-2002, 06:58 AM
according to plugin 1.08 help, Setmembreakpoint does not support conditional breakpoint, the expression 1,2 must resolve to an address.

e.g. mw 401000,401002
lownoise
12-19-2002, 08:19 AM
Tbd,

Thanks for your quick reply.
Maybee it's something for the next version?
in the meantime back to Softice for this kind of breakpoints

Lownoise
Anonymous
01-03-2003, 09:17 PM
Yes Yes Yes
It could be nice superb if we can have all command like Softice in OllyDbg.
I believe, it's a lot of work but it's a must.

I am waiting to have some news regarding this request.

SoftIce has actually at around 140 commands.


anyone who can use the ollydbg debug the pelock?

RCE Messageboard's Regroupment > Bugs > anyone who can use the ollydbg debug the pelock?
Anonymous
12-20-2002, 12:35 AM
mmmmmm It is a dream?
Squidge
01-09-2003, 05:09 PM
Certainly seems that way. Due to the way pelock works, you need something like SoftIce rather than Ollydbg.
luucorp
01-10-2003, 12:30 AM
hi, how do you think newest crackme?

http://www.crackmes.de/download.php/Antisocial1.zip?C rackme=532
Tittle:AntiSice AntiDsasm AntiDebug AntiOlly

this is good example , if anybody like i will update to tut4.

according TDB?
----------

with ollydbg 2.0 , i want :):
*.OD is still free with me (i don;t want crack thing that i like:)
1.no error with API : FreeLib..
2.become standard about a Debugger:) (as Turbo Debbger -TD of Bordland)

thanks;
-------------
Anonymous
01-10-2003, 03:05 AM
luucorp, your URL above is broken, the correct URL is http://www.crackmes.de/crackmeinfo.php?ID=532
Best regards,
Wayne
Wayne
01-10-2003, 03:06 AM
sorry about anonymous post, thought I was logged in
TBD
01-10-2003, 05:51 AM
Wayne: after some time you must re-login.
when you post always look for "logged as: " under the post editbox

luucorp: any tutorial is welcomed ... anytime :)


How to get the real entry with ollydbg?

RCE Messageboard's Regroupment > General > How to get the real entry with ollydbg?
cryingfox
12-20-2002, 08:13 PM
I read the help file several times about the Self-extracting file. I choice "Trace real entry bytewise (very slow)" option,but the application runs as usual. I dont know how to get the entry from ollydbg. Does anybody have some idea about this?
Anonymous
12-21-2002, 06:44 AM
Sure the application is not using some kind of anti-debugger tactics to fool ollydbg ? All that would really be needed is some kind of SEH fiddler...

Find out the packer using PEID, then read up on how to upack it.
luucorp
12-21-2002, 07:17 AM
best way is attach.
cryingfox
12-22-2002, 05:06 PM
I find it works when with PECompact and aspack(low version).
But not working for upx case.
Anonymous
12-22-2002, 05:36 PM
For UPX just download UPX itself and tell it to decompress the file. If that fails (because header is modified) then use ollydbg to find the upx oep signature, set a breakpoint there, run and when the breakpoint is hit, dump it with LordPE to have a working image. You'd be suprised the number of shareware apps compressed with UPX but not protected, so can decompressed by the packer itself...
luucorp
12-22-2002, 11:22 PM
if program compress by UPX any version, you eseay find OEP as:
>Ctrl+S
>type 'popa'
and breakpoint at there(by F2).
>run (F9)
>press F8 (times)
----> will to OEP.

thx, luucorp
mfn
12-23-2002, 11:23 AM
Fix BaseOfCode of packed exe to correct value(1000h or such ..).
Then, Olly's SFX analysis works fine.


Merry XMAS

RCE Messageboard's Regroupment > The Heap > Merry XMAS
TBD
12-23-2002, 03:43 AM
Merry XMAS and every wish may come true.

as i am going on holiday i will not have internet access for 2 weeks, so have phun till there without me :)

luucorp: tut3 only after 6.jan. sorry.
gotta run ...
luucorp
12-23-2002, 05:30 AM
==================================
Many happy to TBD, and your family.
Happy new year.
==================================

==================================
gorshing
12-23-2002, 02:10 PM
Merry Christmas to you too TBD
TBD
12-19-2003, 06:50 AM
... and another year passed away.

Merry Christmas and a Happy New Year (the OllyDbg 2.0 year ;) to Olly and all OD users.

have phun!
aka
12-19-2003, 02:46 PM
Noel and Happy New Year Everybody :)))


ollydbg106 copy to exe file

RCE Messageboard's Regroupment > General > ollydbg106 copy to exe file
Anonymous
12-25-2002, 09:41 AM
well i have been using odbg 1.06 for quite some time now i find this debugger great in fact i uninstalled sice after fiddling with its installation problem in w2k (dont know was breaking hither and thither and the black little box with luminous text was looking scary enough olly has got a nice interface i havent yet entered the holy ring 0 as some call it so olly is fine for me)

till now i have just been tracing with it but an app i traced required lot of code addition (adding funct) well i found using the assemble feature in olly great but i face a small problem here

1) you assemble say push 0
2) you select copy to exe file-----> save file
3) does it fine for first time
4) you again assemble push dword ptr ds:
5) if you repeat the above process olly says it cant do it
6) it cant do it because it has created a backup file of the same name viz(test.exe)---->(test.bak) and it cannot create another backup file in the same name
7) so what i do is 1)assemble 2)copy to exe file 3)save file 4)close olly 5)delete the backup file 6)restart olly 7)assemble and repeat the process

IT DOES NOT LET ME DELETE THE BACKUP WITHOUT CLOSING OLLY PROBABLY COZ ITS OPEN IN MEMORY SOME WHERE

8) it can also be done like this 1)assemble 2)copy-->save on different name viz(test1.exe) 3)close olly 4)delete test.exe 5)rename test1.exe --> to test.exe
6)restart olly and repeat the process

9) what i want to know is whether this covoluted process can be avoided i hate closing and restarting it disturbs the flow of thinking

10) well you may say use the new origin here and repeat the test till you are satisfied and then copy it finally but you know better

i came across this forum today only and have read almost all the posts seen the stuph page seen the bug page seen the announcement page seen the tuts by luucorp
a [b]GREAT FORUM FOR A GREAT APPLICTION <u>I LOVE OLLY</u>

any hints would be welcome
Anonymous
12-25-2002, 02:56 PM
Have you tried upgrading to 1.08 to see if it solves your problem ?
Vitaly
12-26-2002, 01:44 AM
The 1.08 has the same problem!
Anonymous
12-26-2002, 02:00 PM
so 1.08 also has that problem so has some one found out some nifty way to this problem please do hint well it seems gotta register answers are coming will register by next post
tx for views vitaly and lo my mate(anonymus who else)


Feature request - disassemble mode (no debug)

RCE Messageboard's Regroupment > General > Feature request - disassemble mode (no debug)
Anonymous
12-28-2002, 05:32 AM
I need to analyse an export from inside ntoskrnl.exe. Unfortunately, as OllyDbg tries to open the file for debugging, it's unable to disassemble it - all I get is an error message from OllyDbg saying "Unable to open file for debugging".

It would be soooo good if OllyDbg had modes, eg. "Disassemble" and "Debug". In the disassemble mode, the debugging capabilities wouldn't be available, but disassembly/analysis still is. This would allow me to at least see what is going on, even if I can't debug it. :) I know OllyDbg is a debugger, but its disassembly and code-analysis features are superb on their own!
Anonymous
12-30-2002, 09:29 AM
If you just want to analyse an export, a far better tool would be IDA. The current version is 4.30, but 4.17 has been leaked to hundreds of websites and is still very capable (much better than ollydbg) for analysing disassembled listings. In fact that's all it was made for - it can't do any kind of debugging.

Actually, for just analysing a small amount of code, downloading the demo version of 4.30 may well be enough on it's own.
Anonymous
12-31-2002, 03:38 AM
But OllyDbg _is_ probably already capable of doing this :)
The only reason it can't at the moment is that it tries to load the process. If it didn't do that - and just disassembled - it would be able to disassemble ntoskrnl, dlls, vxds, etc etc ... :)
Anonymous
01-01-2003, 04:14 PM
Yes, Olly is already capable of doing what you ask, but it's a case of the wrong tool for the job. The right tool would be one built for disassembling a file, rather than debugging it. I've already mentioned such a tool. Most of Olly's intelligence depends on what the state the current registers are in, and of course it knows this info because it's debugging the program. It would require a lot of work to do the same to a dead-listing. That's why disassemblers and debuggers are kept completely seperate from each other.

(Actually the best approach would be to built a brilliant disassembler, such as IDA, and then lay your debugger on top of that )
Anonymous
01-03-2003, 02:07 PM
Well man did you ever try to download DEMO version of ida 4.30? If you success my respect.
Anonymous
01-04-2003, 07:36 AM
It's very easy to download demo version of 4.30, both the "original" version and the hacked version that has many of the features re-enabled. Google is your friend :)


plugin.inc for masm?

RCE Messageboard's Regroupment > Plugins > plugin.inc for masm?
Guybrush
12-28-2002, 11:26 AM
is there a plugin.inc available for masm ?
Eviloid
03-14-2003, 12:12 AM
It's beta version =)
not tested totally
if You found any bugs please post here...
plugin.zip (http://www.popug.narod.ru/eviloid/ftp/plugin.zip)
TBD
03-14-2003, 06:01 AM
Eviloid: nice work! when will see a plugin written in masm ? :)
Eviloid
03-16-2003, 08:37 AM
not soon :(

in present time I trying to rewrite Sample plugin on C to MASM
and I have troubles with this... and I can't solve this ;(

Please, help me if You can...

problem: if bookmarks great than 1 - bookmarks window do redraw not correctly =(

and other
size of C type long double = 10 or 8 ?
MSVC returned 8, it is correct? It's need to structures size fixed.

sample plugin on MASM (not complete yet) (http://www.popug.narod.ru/eviloid/ftp/sample.zip)

PS: sorry for my English, but I really hope to You understand me =)
PPS: if You know any free FTP hosting, please, give me URL =)
TBD
03-17-2003, 08:09 AM
from Olly:
---
float = 4 bytes
double = 8 bytes
long double = 10 byte

That's trivial, Watson: Bookmarkgettext() should be declared as C. I wonder why it doesn't instantly crash...
By the way, there is yet another small error in Bookmarksortfunc, ECX should be initially 0.
---

hope it helps.
Eviloid
03-17-2003, 07:29 PM
It helps !!! =)
Thank You very much !
Darus
04-30-2003, 04:00 AM
http://www.free.fr provides a free web hosting without popup
Anonymous
06-02-2003, 10:30 AM
Hi
Thanks a lot Eviloid for your work !
Just a little miss at :
Findthread proto C threadid:dword
C was missing ^

Perhaprs it's already corrected ;)

SV
Cip
09-01-2003, 12:09 PM
Eviloid: I'm interested in your plugin.inc and your sample, but I'm not able to download the two zip files linked above.

Could you, or someone that has the correct links/files, help me?

Thank you.
TBD
09-02-2003, 03:44 AM
Cip: masm_inc.zip (http://ollydbg.win32asmcommunity.net/stuph/masm_inc.zip)

here ya go. now we are waiting for a plugin :)
Cip
09-02-2003, 07:20 AM
TBD: Thank you very much!

Now I can start working...
EsseEmme
09-02-2003, 08:02 AM
Nice to see people willing to write plugins for Olly.

Cya,
EsseEmme


[greetings] Happy New Year

RCE Messageboard's Regroupment > The Heap > [greetings] Happy New Year
TBD
12-31-2002, 09:18 AM
Happy New Year OllyDbg Users !
... and party on tonite :)

ps. still no updating
Anonymous
01-01-2003, 01:03 AM
bear ok?


How can use Microsoft Visual Studio .NET Documenta

RCE Messageboard's Regroupment > General > How can use Microsoft Visual Studio .NET Documenta
Anonymous
01-03-2003, 09:29 PM
Sometime the win32 programmer's Reference do not find the API.
In OllyDbg in Select API help file I can put WIN32.HLP.

But Microsoft Visual Studio .NET Documentation they use another kind of file:

"C:\Program Files\Common Files\Microsoft Shared\Help\dexplore.exe" /helpcol ms-help://ms.vscc

any idea are welcome
Anonymous
01-04-2003, 06:04 AM
just make plug-in ;)
Anonymous
01-04-2003, 10:49 AM
Well, just some hints if someone really needs to:

Use the MSDN Help COM object that the MS document explorer (dexplore.exe) exports. This way you wont have any (future) version conflicts.
The corresponding type library ships in
"C:\Program Files\Common Files\Microsoft Shared\MSEnv\vshelp.tlb".

Here is some short example how i would do it (VC++ using ATL):

<pre>
// generate C++ wrappers for COM interfaces
#import <vshelp.tlb> no_namespace

// filescope MSDN automation interface instance
HelpPtr g_pHelp;

// initialization somewhere (plugin entry)
::CoInitialize( 0);

...

void some_shortcut_handler_method( const char* keyword)
{
try
{
if( g_pHelp == 0)
{
// instanciate the generated wrappers via COM smart ptr
HelpPtr ptr( __uuidof(DExploreAppObj));
g_pHelp = ptr;
}
// use the interface (e.g. we have a keyword and want api doc on it)
g_pHelp->DisplayTopicFromKeyword( _bstr_t( keyword));
}
catch( _com_error& ex)
{
// handle any com errors, e.g. log to ollydbg whatever
Addtolist( 0,0, "Plugin COM error: %s", ex.ErrorMessage());
}
}

...

// deinitialization somewhere (plugin unload...)
if( g_pHelp != 0)
{
// release instance
g_pHelp.Release();
}

// deinit COM
::CoUninitialize();

...

</pre>

Regards,

Anastasius Focht

PS: Im working on a C/C++ interpreter (scripting) plugin using open source interpreter which covers about 95% of ANSI C and 85% of C++. Even ollydbg api can be accessed from the interpreter. Due to limitations in the ollydbg plugin api (and limited spare time) the progess is not so fast. Expect something in a few weeks.
Anonymous
01-04-2003, 09:16 PM
We should also have an option in OllDbg to go directly to MSDN web site by selecting the right API.
This should be part of the version 1.09.


Using SEH handlers for protection (Eg. Anti-SICE,

RCE Messageboard's Regroupment > General > Using SEH handlers for protection (Eg. Anti-SICE,
Anonymous
01-04-2003, 07:47 AM
Noticed this on one of the RE boards: It seems to be well commented and descriptive of what it's doing, and certain easy enough to understand.

TASM ASM

.386p
.MODEL FLAT,STDCALL
locals
jumps
UNICODE=0
include w32.inc
include PELOCK.INC
extrn GetProcAddress :PROC

.data

msg1 db "PELock 1.05 check 'IceDump' test",0
msg2 db "SEH triggered ok....Did NOT detect IceDump.... ",0
msg3 db "*** I C E D U M P *** D E T E C T E D ",0
mark db 0
iKern db "Kernel32",0
iExit db "ExitProcess",0

.code

Start:

xor eax,eax ;zero to EAX for setting xhandler
push offset SEH_handler ;address our new SEH handler
push dword ptr fs:[eax] ;save previous handler address
mov dword ptr fs:[eax],esp ;set our new xhandler
call GetModuleHandle, offset iKern
call GetProcAddress , EAX, offset iExit ; get 'ExitProcess' memory location
add dword ptr [eax],00 ;try and write to it....SEH if no IceDump else

push eax ;just ExitProcess...should NEVER GET HERE !!!]
call MessageBoxA,0, offset msg3, offset msg1,0
ret ; this will ret into ExitProcess and your gone !!!

;DEMO_START This is how EASY pelock programming-in-source-code is (see pelock.inc)

;place here some ' registered user only ' bit of code blah blah blah

;DEMO_END but i disabled it ( for my example
; and included a bit of home made crypto

iNop: db 05Eh,06Ah,087h,0C4h,07Fh,02Eh,03Dh,04Eh ; for phun.......

pop dword ptr fs:[0] ;set previous handler
add esp,4 ;clear stack
cmp mark, 1
jnz jump

call MessageBoxA,0, offset msg2, offset msg1,0
call ExitProcess, -1 ;end program

jump:

call MessageBoxA,0, offset msg3, offset msg1,0
call ExitProcess, -1 ;end program

;+++++++++++++++++++++

SEH_handler:

mov eax, [esp+04] ;set EAX to address with exception #
mov ecx, [esp+0Ch] ;read to ECX address start of context structure
mov dword ptr [ecx+0b8h], offset iNop ;return EIP
mov eax, [eax] ;read exception number
sub eax, 0C0000005 ;ACCESS_VIOLATION error value
jnz SEH_handler_end ;if it isn't Exception Breakpoint jump (not our exception call)
inc mark ;set mark because xhandler ran
xor dword ptr [iNop+4],0DEADBEEFh ;decrypt running code with DeadBeef+ShitFace ...hmmm
xor dword ptr [iNop+0],05417FACEh

SEH_handler_end:

ret ;back to program ..we hope

ends
end Start


Using SEH handlers for protection (Eg. Anti-SICE,

RCE Messageboard's Regroupment > General > Using SEH handlers for protection (Eg. Anti-SICE,
Anonymous
01-04-2003, 07:50 AM
Noticed this on one of the RE boards: It seems to be well commented and descriptive of what it's doing, and certain easy enough to understand.

TASM ASM

.386p
.MODEL FLAT,STDCALL
locals
jumps
UNICODE=0
include w32.inc
include PELOCK.INC
extrn GetProcAddress :PROC

.data

msg1 db "PELock 1.05 check 'IceDump' test",0
msg2 db "SEH triggered ok....Did NOT detect IceDump.... ",0
msg3 db "*** I C E D U M P *** D E T E C T E D ",0
mark db 0
iKern db "Kernel32",0
iExit db "ExitProcess",0

.code

Start:

xor eax,eax ;zero to EAX for setting xhandler
push offset SEH_handler ;address our new SEH handler
push dword ptr fs:[eax] ;save previous handler address
mov dword ptr fs:[eax],esp ;set our new xhandler
call GetModuleHandle, offset iKern
call GetProcAddress , EAX, offset iExit ; get 'ExitProcess' memory location
add dword ptr [eax],00 ;try and write to it....SEH if no IceDump else

push eax ;just ExitProcess...should NEVER GET HERE !!!]
call MessageBoxA,0, offset msg3, offset msg1,0
ret ; this will ret into ExitProcess and your gone !!!

;DEMO_START This is how EASY pelock programming-in-source-code is (see pelock.inc)

;place here some ' registered user only ' bit of code blah blah blah

;DEMO_END but i disabled it ( for my example
; and included a bit of home made crypto

iNop: db 05Eh,06Ah,087h,0C4h,07Fh,02Eh,03Dh,04Eh ; for phun.......

pop dword ptr fs:[0] ;set previous handler
add esp,4 ;clear stack
cmp mark, 1
jnz jump

call MessageBoxA,0, offset msg2, offset msg1,0
call ExitProcess, -1 ;end program

jump:

call MessageBoxA,0, offset msg3, offset msg1,0
call ExitProcess, -1 ;end program

;+++++++++++++++++++++

SEH_handler:

mov eax, [esp+04] ;set EAX to address with exception #
mov ecx, [esp+0Ch] ;read to ECX address start of context structure
mov dword ptr [ecx+0b8h], offset iNop ;return EIP
mov eax, [eax] ;read exception number
sub eax, 0C0000005 ;ACCESS_VIOLATION error value
jnz SEH_handler_end ;if it isn't Exception Breakpoint jump (not our exception call)
inc mark ;set mark because xhandler ran
xor dword ptr [iNop+4],0DEADBEEFh ;decrypt running code with DeadBeef+ShitFace ...hmmm
xor dword ptr [iNop+0],05417FACEh

SEH_handler_end:

ret ;back to program ..we hope

ends
end Start


I would like to compare the run trace list with an

RCE Messageboard's Regroupment > General > I would like to compare the run trace list with an
Anonymous
01-04-2003, 10:19 PM
I would like to compare the run trace list with another one (two different actions)

This is what I did
I run the tracer
Right click > run tracer > Global profile
On profile of whole memory window > Right click > find in run trace

Then I have a very nice list that I would like to save.
Right click I have the option 'Log to file' but this option do not save this list.

Do you know a way to do it?

I would like to check or compare the run trace list with another one (two different actions)
Anonymous
01-05-2003, 08:54 AM
Use "Log To File" before running the tracer, then when you close the file, it'll be saved.
Anonymous
01-05-2003, 11:39 AM
But when select
Run trace --> Add procedure (or other)
I can't at this stage activate the Log To File option.

I find a solution.
I press F7 and then this option is accessible.

But it should be cool if this 'Log To File' option appear as soon as we select 'Add procedure' (or other)


Conditional Breakpoint

RCE Messageboard's Regroupment > General > Conditional Breakpoint
Anonymous
01-05-2003, 07:29 AM
Hi all,

I'm trying to set a breakpoint; the breakpoint must activate only when ECX is set to 00A88F60 so I write the condition "ECX = 00A88F60" but it doesn't work. The breakpoint works always.

Where is my error?

Thanks,
cabal
Anonymous
01-05-2003, 09:39 AM
Greets,

i guess u wanted comparison ... ollydbg uses C operator style syntax.
The comparison operator is "==".
The assignment operator is "=".
So in your example the condition to be evaluated is "ecx == <memaddr>".

Regards,

Anastasius Focht
Anonymous
01-05-2003, 03:16 PM
Thank you,
cabal
Anonymous
01-24-2003, 08:09 PM
Please make help file to this syntax features
itsme
01-25-2003, 02:08 PM
Just look at a C programming manual - there's plenty to download on the net. There's for too much you can do to describe it here.
focht
01-27-2003, 03:06 PM
Greets again,

no need for C manual ...
Supported expressions are already documented.
Just look for "Evaluation of expressions" in ollydbg.hlp file.
You find the C-style operator syntax at bottom.

Regards,
Anastasius Focht
youth
01-27-2003, 09:39 PM


[READ THIS] no more cracking related questions !!!

RCE Messageboard's Regroupment > General > [READ THIS] no more cracking related questions !!!
Anonymous
01-05-2003, 11:04 AM
Hi everybody,

I'm just moving from SI to Ollydbg and have a small problem. I try to write a no-cd patch for my 'Noone lives forever 2 v1.2' but there seems to be some anti-debugger tricks. When I start the file lithtech.exe by double clicking on it, it gives me a messagebox saying that there is no CD. But when I start it from ollydbg (no breakpoints set) it breaks with 'access violation event' and when I disable that (under debugging options) with 'single breakpoint event' and finally 'hardware breakpoint'.
Are this anti-debugging tricks or is it me ?
If people are interested I could post lithtech.exe (1.2M), but I don't know to attach binary files at this forum.

Any ideas ?

MrSmith
TBD
01-06-2003, 03:18 AM
MrSmith: you cannt attach files in this forum :)
... and also this forum is not about cracking, it is only about OllyDbg.

till i will made the FAQ section i will made this kind of warnings about posting
cracking related question, even if it involves OllyDbg. after that all "bad" posts will be deleted without notice!

please, do not post anymore cracking questions !!! remember, this is a free service -> DO NOT ABUSE IT
Anonymous
01-06-2003, 05:00 AM
I agree, cracking threads (such as "help me keygen this commercial program") should just be deleted, or locked. However, I think "crackmes" should be allowed though, as they're an excellent way to learn reverse engineering, analysis, and debugging, and no harm is caused by cracking them.
TBD
01-06-2003, 05:33 AM
Anonymous: crackmes are allowed, as all tutorials from OD Stuph page are dealing with, but no commercial programs. there are other forums that deal with this...
Anonymous
01-06-2003, 05:46 AM
TBD: sounds fair enough to me :)


debug dll'?

RCE Messageboard's Regroupment > General > debug dll'?
Anonymous
01-05-2003, 08:43 PM
hello,

i'm quite new to debugging. i try to find out how a dll in an exe process load's up an other dll. it uses a custom funktion or things lige this and i need the params of that funktion. the debugprogramm doesn't jump into the mdoules of that exe file. it debug the system dll like mfc42.dll or things like that, but not the dll's of the programm i debug.
how can i force the debugger to jump into the dll's??

regards
ngc
Anonymous
01-06-2003, 06:43 PM
Greets,

depends how the dll is bound/loaded.

If the dll is loaded explictly (via LoadLibrary) or on demand (DelayLoad feature) you just can use "Break on new module" under debugging options -> events. Wait for your dll to break. Go to "executable modules" view and browse imports/exports "view names".

If you only want to trace a known specific dll export, set a breakpoint in that list. Go and it will break on the first byte of the function prolog. You can then evaluate the call stack to get the caller. Using the disassembly you can now identify the parameters and the calling convention (cdecl, stdcall etc.).

If the dll is early bound, use the "debugging options" -> "events" -> "system breakpoint" feature to break loader at very early stage.

Usually dlls have an entry point to initialize instance data (C-runtime init/startup stuff which in turn calls user supplied (main) routines). Ollydbg displays it as <ModuleEntryPoint>. If you place a breakpoint at this entry you can trace dll initialization stuff (or breakpoints on all exports if you dont know which one). The main/entry function of the application is called later.

Hope this helps...

Regards,
Anastasius Focht
Anonymous
01-06-2003, 08:18 PM
Are there cases when "Break on new module" would not work even when DLL is loaded by getprocaddress?
Anonymous
01-07-2003, 06:50 AM
GetProcAddress can't load a new DLL, it can only get address of function inside a dll you already have the handle off.

The win32 debugging specs also indicate that any DLL load will generate a dll load event, which will trigger Ollydbg's "Break on new module".
Anonymous
01-07-2003, 07:52 AM
Oops, I meant "LoadLibrary" of course.


Functions API is not the same the first time?

RCE Messageboard's Regroupment > General > Functions API is not the same the first time?
Anonymous
01-06-2003, 04:53 AM
Hi everybody!
At first I loaded a program, all API functions was showed full of their parameters. I traced something and exited. Next time, I loaded that program and
found out that all API functions was not showed full of their parameters,
Eg: with MessageBoxA function I saw only two parameters???
I don't know why, I did every things to find out the reason, event I deleted the bak file was created by OD.
I need your help!
TBD
01-06-2003, 05:31 AM
in CPU window, on the header bar do you have "Comment" text showned ?
if not press on the bar to get it back.
solarwindvn
01-06-2003, 09:51 PM
Yes, the comment colunm is still in it's position.
luucorp_
01-07-2003, 01:57 AM
I had the same trouble,I don't know why
TBD
01-07-2003, 03:03 AM
solarwindvn: have u tried deleting the udd ? i never encouter this problem. btw, what OS do you have?


Sorry guys

RCE Messageboard's Regroupment > General > Sorry guys
Anonymous
01-06-2003, 03:40 PM
Hi,

sorry about my last posting which seemed to be cracking related.
But actually it was no request for a crack, it was a question about a strange behaviour of Ollydbg. Let me try again:

If a program runs normal without Ollydbg, but generates exceptions if run under Ollydbg (access violation, single step event, hardware breakpoint), what could be the problem ? Are there some debugging options that I can set within Ollydbg that could avoid this type of problem ?

Thanks,
MrSmith
TBD
01-07-2003, 02:40 AM
MrSmith: the problem can be that the program uses SEH to control program execution; to be more exact it raises an exception so that SEH gets control and have a different path.

for this you can configure in Options/Exceptions what to ignore.

ps. also please have a more detailed title to the post :)
Anonymous
01-07-2003, 07:02 AM
I've seen this when a program is encrypted and only decrypts a small part of the program into memory - it then uses exceptions based on INT 3 and the like to trigger loads of the other parts of the program into memory. Of course, once this kind of program is run under a debugger, you only get the first part, hit the exception and Ollydbg gets it. You can't pass the exception to the program as Ollydbg is debugging it and the "program patcher" process that decrypts each section is also waiting on a WaitDebugEvent call. With these types of programs, you simply can't use a debugger on them as they are debugging themselves upon startup. It also means you can't attach to the process whilst it's running.


Scripting - Doing stuff on a breakpoint.

RCE Messageboard's Regroupment > General > Scripting - Doing stuff on a breakpoint.
Anonymous
01-06-2003, 07:19 PM
Hi, is it possible to make ollydbg for example break on certain adress and logging a string pointed by EAX to text file?

Would this need a plugin? Is there such a plugin already?

Thx in advance. :)
TBD
01-07-2003, 02:44 AM
RTFM :)
hint:: conditional breakpoints (SHIFT+F4), expression: [EAX], decode as: pointer to ASCII/UNICODE string
Anonymous
01-07-2003, 07:51 AM
Eh, I'm a bit slow today. :)

-Where is the logfile? How do I set change/read it?
-Do I need those square brackets around EAX?
TBD
01-07-2003, 01:29 PM
i see that you didnt read the help throughly ...

logfile-there is a window called ... "Log window"
[EAX] = address pointed by EAX content
EAX = value of EAX register
Anonymous
01-07-2003, 07:30 PM
Oh, dumb me! I browsed through the site not knowing there was a help file included. :D
Got it working now.


I want to inform to TBD

RCE Messageboard's Regroupment > Announcements > I want to inform to TBD
Anonymous
01-06-2003, 10:02 PM
If the forum have a bug, how I can contact with TBD? Post it for public? No!
I counld't find your mail, TBD!
TBD
01-07-2003, 03:06 AM
it is hidden :) deep deep inside OllyDbg Stuph (http://www.rohanpall.com/ollydbg/files) page or if you click in the left pane on 'Admin'
Anonymous
01-14-2003, 06:05 AM
Good Tut 3.
Clear at the beginning but not really at the end.
But the Fix PE header are really inclear.
Can you give more explanation about the way you found the address 00400128?
TBD
01-14-2003, 08:27 AM
it is not my tutorial, but luucorp's ...
address 00400128 it is in PE header and it is found, as written in tutorial,
---
In CPU window, you click left mouse in pane Dump and goto address of
PE header:
>Ctrl+G
>type 400000 ->enter
>click right this pane Dump: chosse 'Special' -> chosse 'PE header'
---

for more information contact luucorp or post your questions here
helloword
01-14-2003, 04:36 PM
I really appreciate the effort and imagination of luucorp's in all tut.
Good job :-)


How do debuggers terminate the debuggee process?

RCE Messageboard's Regroupment > General > How do debuggers terminate the debuggee process?
Anonymous
01-07-2003, 12:45 AM
What's the recommended way that debuggers terminate the currently-debugged process? TerminateProcess? or ContinueDebugEvent DBG_TERMINATE_PROCESS? Or ... ?
MSDN and Google wont give me an answer to that :( so hopefully somebody here will know. Many thanks in advance!
Anonymous
01-07-2003, 06:57 AM
Well, I'd say DBG_TERMINATE_PROCESS as TerminateProcess() should really only be used in extreme circumstances and doesn't allow notification to DLL's that the target may have loaded. However, since DBG_TERMINATE_PROCESS is undocumented by Microsoft, there's only the TerminateProcess() left to use.
Anonymous
01-07-2003, 07:19 AM
Yeah, I havent been able to find any info on DBG_TERMINATE_PROCESS either :(
I wonder how Oleh does it?

I need to find out because Ive written a small debugger simply to list the DLLs that get loaded - you couldn't even call it a debugger, but it does use a couple of the debug APIs, but I cant find any information on terminating the debuggee, which to me seems like a simple enough thing!
Anonymous
01-07-2003, 03:03 PM
Well, I loaded Ollydbg into itself to find this out :-)

Ollydbg debugging Ollydbg debugging hello.exe (simple asm "Hello world" I wrote)
Then I asked the Ollydbg debugging hello.exe to close the debug session whilst I had breakpoints on the useful debugging functions in the first ollydbg.

This is what it broke on:

0046E00B |> 6A 00 PUSH 0 ; /ExitCode = 0
0046E00D |. 8B0D 70404C00 MOV ECX,DWORD PTR DS:[4C4070] ; |
0046E013 |. 51 PUSH ECX ; |hProcess => 00000124 (window)
0046E014 |. E8 F11D0300 CALL <JMP.&KERNEL32.TerminateProcess> ; \TerminateProcess

interesting eh?
Anonymous
01-07-2003, 03:36 PM
Many thanks! :) I also tried OllyDbg'ing OllyDbg but didn't get as far as you got :), but your understanding of assembly is obviously better than mine!

I had tried using TerminateProcess but it didn't seem to work, but as OllyDbg is using it, it must work, as it works fine in OllyDbg so obviously I'm just not calling TerminateProcess correctly. I'll try again in the morning (3:30am here, time for sleep!)

Once again, _many_ kind thanks - your help is very much appreciated, as unfortunately I simply cannot proceed with my current project until I can terminate the debuggee! It'd be nice to hear from the author of OllyDbg regarding this matter, but your analysis will hopefully solve my problem :) :) :)
Anonymous
01-07-2003, 03:49 PM
Greets,

there are several ways to close a debuggee.

The natural way is, that win32 app should cleanup before closing. For instance closing files, handles and freeing memory, unloading DLLs, writing registry or ini file whatever...

I would suggest the following steps for windows applications:

1. use PostMessage() to post WM_QUIT to main application window

if that fails (no message processing, hung whatever), the debugger should:

2. try to call the ExitProcess API on the debuggee's behalf
2.1. create a thread in the debuggee (CreateRemoteThread) and call ExitProcess
2.2. use SetThreadContext to let the target process/thread call ExitProcess()
(both are clean ways, 2.2. maybe a bit tricky)

if that fails, the debugger should:

3. Terminate its debugging thread - which will in turn close the debuggee's main thread.
(this behavior is by OS design)

if that fails, the debugger should:

4. TerminateProcess() - extreme brutal and should only be used as last resort

For console apps (no message queue), step 1. can be omitted :).

Hope this helps...

Regards,

Anastasius Focht
Anonymous
01-07-2003, 10:41 PM
Thanks! :)
Im using your #3 technique -- doing the debugging in a seperate thread, and closing that thread when Im done which is also taking out the debuggee, its working well so far!


[POLL] what features do you want in OllyDbg 2.0

RCE Messageboard's Regroupment > General > [POLL] what features do you want in OllyDbg 2.0
TBD
01-07-2003, 05:58 AM
this thread will contain features wanted by user that want to be implemented in OD 2.0

so ppl, let your imagination go wild (but reasonable, as no system debugger a la SoftICE, to make coffee, ...).

for example i want:
- an user customizable interface
- start Analyzer from anywere in the code (for "weird" packed programs)
Anonymous
01-07-2003, 07:05 AM
Signatures would be nice. As in, you could present Ollydbg a piece of ASM code with wildcards for the arguments/addresses that get changed/relocated/etc each time the program is loaded, and Ollydbg will search the program and mark these sections with user definable text.
Anonymous
01-07-2003, 09:04 AM
Posibility to change the path to the source files would be great. At the moment the source files have to be located at their original place at compile time.
Anonymous
01-07-2003, 12:21 PM
Ability to disassemble DLLs directly, without requiring a host EXE! Also ability to disassemble without debugging, which would allow OllyDbg to disassemble ntoskrnl.exe, and more :)
Anonymous
01-07-2003, 12:27 PM
Less errors!!!!!
TBD
01-07-2003, 01:27 PM
Anonymous - "Less errors!!!!!" doesnt help at all ... please specify what errors
Anonymous
01-07-2003, 01:38 PM
I've noticed Ollydbg 1.8b doesn't seem to disassemble some opcodes produced by Borland C++ builder 5, and they obviously are not data as I can single step through them.

TBD: I'll try and get an distributable EXE so you can see it in action, or at least screenshot of Ollydbg's screen where it happens.
Anonymous
01-07-2003, 01:45 PM
one of the trends in software these days is to add skins and other bloated stuff. my main wish for ollydbg is for it to remain lean and efficient.
Anonymous
01-07-2003, 01:46 PM
in case my last post wasnt clear - please do *not* add skin support to ollydbg.
Anonymous
01-07-2003, 01:49 PM
I agree - OllyDbg's current GUI/structure is perfect for a debugger/disassembler. I hope it doesn't change, but rather just gets added to :) (if it aint broke, dont fix it!)
Anonymous
01-07-2003, 06:22 PM
From what I understood the version 1.09 should be ready at the end of January.
Frist can you list all new functionality of this version.
Why you are taking about version 2 and not version 1.10.
I am sure that there is in OllyDbg creator mind a very nice list of news features, why don't propose this list first them wait our feedback ?
Anonymous
01-08-2003, 02:47 AM
create a dir for plugins
TBD
01-08-2003, 06:16 AM
> Why you are taking about version 2 and not version 1.10.
because i have information that 1.10 will be the last version of
1.xx series and only bug fixes, no added features

[spoiler]
Olly already started working on OllyDbg 2.0 ... so that's why i
started this poll. PLEASE DO NOT bug Olly about 2.0 version,
post your requests here !
[end spoiler]

ps. a lot of Anonymous posts ... why are you so lazy to login ?
Anonymous
01-08-2003, 06:19 AM
what would be nice is the ability to explicitly save a "project" file containing the bpx's and comments for a file you are debugging, and then reload it at any time on a separate executable. (maybe this could written as a plugin?) this would be very useful when commenting and setting bpx's on an executable that dynamically unpacks itself at runtime, as it would let us comment and set bpx's after unpacking, and reloard these on the next run after the app unpacks. while we are asking for the moon: if ollydbg could automatically load and save these based on the initial self-unpacking warning that olly already gives, that would be heaven.
Anonymous
01-08-2003, 10:20 AM
Select a procedure enter some value of eax,ebx, .... and have a quick watch of possible result at the end of the procedure
Anonymous
01-08-2003, 12:22 PM
I already specified them...
Anonymous
01-08-2003, 01:04 PM
show the symbols of masm32
Anonymous
01-08-2003, 01:12 PM
and show the source code will helpfull
ricnar456
01-08-2003, 06:38 PM
For me:

1)in the offset window, jump to the same sentence in disassemble window (CPU)
2)The size of the windows isn't predictable it changes and put in every size, the option in appearence RESTORE SIZE etc etc don't function.
3)The option of dissasemble only of dlls
4)BPXS in dlls dont erase in RESTART
5)EXECUTE SAL instruction
6)Run in more packed programs (PELOCK, etc)
7)trace into options (MORE SLOW - MORE QUICK - VERY SLOW) and in the very slow case, this options trace for use in very short portions of the code tracing and storings ALL sentences in ALL sections, DLLS etc.
8)Option for jmp to other section stops OLLY (for packers)
9)Option for Breakpoint in memory acess only read, only execute and only write.

Ricardo Narvaja
Anonymous
01-08-2003, 06:59 PM
Would be useful if the logger view when you are setting log breakpoints that if Olly think the value in a register wrote to the logger points to a string, to log that string to the file too, and not just the address of it. Also, if the data is short (say, under 20 bytes) add optional possibility of dumping that too, or a portion of it if it's too much data.

This would make the logs far more useful, as having a file full of pointers all pointing to the same data that has been over-writen afterwards is kinda pointless.
Anonymous
01-09-2003, 12:27 AM
seems not able to debug pelock！！
TBD
01-09-2003, 02:50 AM
> show the symbols of masm32
> and show the source code will helpfull

already available :) see here (http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=1&topic=40)
Wayne
01-09-2003, 05:50 AM
Add a "Search for text" capability to the right-click menu in Resource Strings :)
Wayne
01-09-2003, 09:41 AM
In the Breakpoints window, a Delete All would be very handy, I had about 200 or more breakpoints set and its taking a while to delete them using the delete key on my keyboard 8)
Wayne
01-09-2003, 09:45 AM
Also, in Resources Strings, you can double-click on a string and it'll take you to that string in the CPU/code window (which is excellent!), but that only seems to work if its from the EXE - it doesnt seem to work if the Resources Strings are from a DLL - itd be excellent if it could do that also
Anonymous
01-09-2003, 01:35 PM
Compilation programs name, version ,....
Packed programs name, version,....
Ini file to add new unpacker
Set macro record senario
ex: run--> bp messagebox --> d eax --> if eax == xxx --> bp API --> ....
Convertor hex-->dec-->ascii on right click or Ctlr right click or ...
More option in watch ex:
all address in a procedure
watch expression
when the value of .. is true
when the value of .. change
....
Anonymous
01-09-2003, 01:41 PM
MSDN API help on Ctrl+...
Anonymous
01-09-2003, 01:46 PM
A function like view tree but more graphical there we can navigate throught one procedure to sub-procedure and vis-versa
Guybrush
01-09-2003, 01:49 PM
-An option in de mdi child windows to make it ontop of others, maybe a checkstate in the systemmenu of all the child windows.

it's annoying because i always like the CPU window maximized. and if i for example open a log window, it will minimize the main window...

-make it look for plugins in the directory ./plugins instead of the current dir

-maybe an option to customize the right click menu of the CPU window and maybe others, it has TOO MUCH options, i usually spent most of the time clicking and searching in the menus.
Wouldnt it be alot easier if you can just add the ones you almost use everytime and put the other ones in a submenu's like advanced, dump, other or something.
Anonymous
01-09-2003, 03:27 PM
View resources of executable files (*.exe, *.dll, ...) and display
like Borland Resource Workshop , eXeScope, Resource Hacker

What I would like the most is when you open a dialog box, the possibility to select a buttom, whole form or ... and put a breakpoint onclick, on load on mouse up down,.....

Or select select a buttom and display all api called after the click.
helloword
01-09-2003, 04:04 PM
Shortcuts maintenace
Anonymous
01-09-2003, 04:35 PM
Wizard builder for coditional search, breackpoint,....
Anonymous
01-10-2003, 08:49 AM
The powerful ATTACK fuction. If you can attack eveything at anytime, OllyDbg can work like TRW 2000 and softice. That means you can not be troubled by the anti-debugg examination.
TBD
01-10-2003, 09:25 AM
ATTACK? could you expand on this subject a bit ... some examples would be nice
Anonymous
01-10-2003, 10:20 AM
Sorry it is ATTACH, not attack.
Anonymous
01-10-2003, 04:39 PM
"Attach to process" can be disabled very easily however for certain applications, and once it is disabled, Ollydbg can't do anything to get it disabled unless you terminate it and restart it at OEP.

So really I don't see how it can be improved ? Ollydbg needs to be attached to the process to find any information about it, so "attach when EIP between these ranges" and the like are out, if that's what your thinking of.
Anonymous
01-10-2003, 08:36 PM
The talk is what features do you want in OllyDbg 2.0, you see.
_Servil_
01-10-2003, 09:11 PM
1. more power to survive some compressed applications' trick (invalid opcodes, SEH, clearing debug registers, int 2Eh...).

2. feature to load/save analysis info to preserve labels etc. on program change (not offsets only replace some code)

3. when i debug MASM32 application with debug info present and change the code sometimes the changed part isn't disassembled, even if I reanalyze the code (respective udd file must be deleted).

4. if i trace with F8 thru a call it sometimes lose the control of the debugger (setting bpt on next opcode and preforming run execute immediatelly). caused by recursive calling?

5. Set Real SFX entry here... either dosn't work or I don't know to use it. Tried on some packed programs, even easy (UPX), and it never didn't start at the opcode I assigned new OEP (always NEP).

6. Other wishez I forgot to meant ;=)
_Servil_
01-10-2003, 09:14 PM
7. resouce strings dereferencer? (the way w32dasm does)

To authors: keep up the work olly has bugs but it's the best debugger working on my XP at this time.
_Servil_
01-10-2003, 09:17 PM
8. and yes, /tracex <loeip> <hieip>
ricnar456
01-11-2003, 04:51 PM
the posibility of MODIFY EIP in registers

Ricardo
luucorp
01-12-2003, 02:51 AM
OD 1.08b has error with API: FreeLibraryA while free 1 .dll but program doesn't finish.

--.od 2.0 will fix it
lylu
01-12-2003, 04:40 AM
1.AutoSave when making analysis.
2.Replace [local.1] with user defined string as [lpstr]
3.Support hiding procedure.
4.Recognize user defined function with it's arguments.
ricnar456
01-12-2003, 06:40 AM
The posibility of modify EIP in the register window, is this possible?

Ricardo
Anonymous
01-12-2003, 12:29 PM
in CPU window, Ctrl-G, enter new EIP. On the line with new selection right-click, Set new origin here, done...
ricnar456
01-14-2003, 04:27 AM
Tracex low eip high eip exists.

In SET CONDITION in EIP IS IN RANGE put in the first box the low eip anf in the other box the HIGH EIP and check the box, goto DEBUG -TRACE INTO and OLLY trace and stops when EIP>low and EIP<high.

Ricardo
Anonymous
01-14-2003, 05:11 PM
the posibility of insert some extra lines of code in especific locations.

like the amazing tool: TOPO

Microman
_Servil_
01-15-2003, 04:13 PM
9. Context menu item "Copy selected line(s)" in run trace
Anonymous
01-16-2003, 06:51 PM
Ability to dump memory from range X - Y to file.
Squidge
01-16-2003, 07:01 PM
You can dump memory in a variety of file formats already with 1.08 - what format do you actually want ?
Anonymous
01-16-2003, 09:02 PM
I want to select exact starting address and length, then just dump as binary.
Squidge
01-17-2003, 09:29 AM
see what you mean. if this is to dump a packed program, try OllyDump, otherwise select "backup -> save to file" and trim the file produced with ultraedit or similar
Anonymous
01-17-2003, 10:42 AM
I would like to see a "Search for ASCII" in the cPU window.
Anonymous
01-20-2003, 05:44 AM
What is ollydump?
helloword
01-22-2003, 04:48 PM
More options in ressources
Dialog: Details, Dump, structure, the form,…
Bitmap: Details, Dump, image
…..
also possibility to add breakpoint
TBD
01-23-2003, 03:04 AM
helloword: breakpoint when accessing the resources ?

OllyDump is a plugin, you could find it on ODF (hint: use the forum search)

"Search for ASCII" - use binary search (CTRL+B) or Search for/All referenced text strings
ффффф
01-23-2003, 11:33 PM
ффффффф
F7
01-23-2003, 11:44 PM
Oopss Sorry :)

1. Jump to code adress in stack segment...
Simple
xxxxx: aaaaaa retn to kernel32 aaaaaaaa
Double click on addr goes here in code window
Double click on jmp xxxxx goes to this addr.... Esc return back...aka IDA
Breakpoints sometimes not saving :(
Bookmarks shortkeys move to Ctrl+Shift+NUM
Settings to shortkeys....
Very slow but HIGH quality analys....
Button clear all *.udd and temp files
Nice Breakpoints on condition... EAX and ECX > 40000 and Addr =55555
Simple ANTI RIng 3 debug codes... and option to turn this feature....
In win 2000 sp3 after program loaded OllyDbg sees exeption....And program colud not be debugged :(
Small lagss :(((

Forgive me my mistakes....and my bad ENG...

WRT:F
TBD
01-24-2003, 02:41 AM
ффффф or F7 :) ... "Button clear all *.udd and temp files" it is possible with gigapede's cleanupex plugin
oh me anon
01-26-2003, 12:53 PM
hi tbd tx for responding to my heap post
well i have made 3 posts so far two anon and one with oh me anon

the first post concerned with copy to exe file and it seems there are no solutions to it if possible that could be taken up

now as to new feature a search AND REPLACE facility would be great if possible

say i got a garbage structure in the application i find its signature
now i ctrl+ b with the bytes and ctrl+l shows it is being repeated 25 times in the application
replacing each occurances by a jmp is tedious suppose it is 50 bytes all i have to do now is like this

ctrl + b (my bytes) ok <----- it points to the bytes
select
ctrl + e (my replace bytes) ok
select all you changed exactly(this is also a problem some times what you changed is in the middle of opcode no alt+u like ida is possible)
right click
binary copy
ctrl +l<----- points to next place
select arbitarily some bytes (must be more than required other wise the next operation will paste only some bytes)
binary paste
ctrl +l
boooh (you might say why dont you use hiew or hexwork or blah blah but you know better)
F7
01-27-2003, 12:30 AM
No in plugin sux....in app :))
ФФФ - Power :) Speak RU?
oh me anon
01-28-2003, 05:33 AM
oops it seeems some thing has been done before have to see the cmdline
havent used it yet
Posted: Nov 21, 2002 22:36:58
Quote

Cvx: yes it is possible, check cmdline plugin by Olly for more information
TBD
01-28-2003, 06:02 AM
> the first post concerned with copy to exe file and it seems there are
> no solutions to it if possible that could be taken up

could you post the link of your previous post or repost the question again
in bugs area ?
oh me anon
01-28-2003, 07:00 AM
hi tbd

here is the link to the query
http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=1& amp;topic=100
(http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=1&topic=100
)
one more way to do it is copy to exefile in diffname and reload the file that has diffname

but i came back here again today second time was to query about the cmdline plugin search and replace facility i dont see any thing that remotely resembles some thing like search and replace in that plugin
A---> at,a,asm,ac B----> bp,bpx,bpd,bc,brk c----->calc,c.cpu,close,cs
D--->d,dump,da,db,dc,dd,du,dasm,dw E---->exit F--->follow,fr G---->g,ge
H--->hr,hw,he,hd,help,h I,J,K,N,U,V,X,Y,Z---> no valid command exists L--->l,log M--->mr,mw,md,mod,mem O--->orig,opt,open P-->pause Q--->Quit R---> run,rst S--->stk,stop,s,si,so,sn,sob T-->t,ti,to,tc,toc,tr,tu W--->watch,w

what did you mean by check cmdline plug in for more info
TBD
01-29-2003, 09:26 AM
oh me anon:there is no way to do search&replace now. but you are free to implement in a plugin :)

i found no problem with multiple assembling(assemble copy to exefile, save, another assemble, copy to exefile, save different name). i think this is good way to do patching.
oh me anon
01-29-2003, 10:27 AM
i am free to implement it in a plugin :) well thats a positive answer i was looking for a toy and you suggest me to make one :-{}
-(\_/)
(0'.'0)
{ }
(")_(")

well here is a weird bear

by the way i never said i had any problems with saving in a different name

i wanted to save it in the same name

just plain save and continue without reloding from the same place

just like using notepad scribble save ,delete save,

rescribble save,delete all save look at the blank page and draw a teddy bear

and save that is what it is not doing

anyway thanks for reply
TBD
01-29-2003, 11:46 AM
oh me anon: not possible. sorry.
Sungazer
01-31-2003, 06:42 AM
Maybe it´s mentioned before, but i think it would be cool, if Ollydbg would be able to dereference Resource Strings and and show them in the assembly window like W32dasms "Possibly String reference to...".

Show possible dialog references like W32dasm does and be able to jump to possible location of these dialogs in the assembly listing.

and last i´d like to be able to store those udd and bak files in a seperate directory, because the main directory get´s crowded very fast ;)

PS. Ollydbg realy rockz :)
_Servil_
02-02-2003, 12:37 PM
feature request:

- consideration of recursive calls handling on step_over,
- consideration of recursive calls handling on trace_over,
- highlighting trace log lines of function body on the same level of nesting?
Anonymous
02-03-2003, 12:42 AM
In the "BREAKPOINTS" window, it would be very nice if you could select more than one breakpoint to delete\enable\disable. For example shift+select and ctrl+select to add\remove selections. Also in the breakpoints window, in the right click popup menu an option to "add comment" to any of the breakpoints for visual reference.

Another think that i think would be an awesome feature in olly would be a window, perhaps called "patches". Then you could add patch bytes to a PATCHES window just like you do with breakpoints. Then in this PATCHES window you would be able to enable\disable the modified code "patches". If you dont understand what i mean please post and i will try to elaborate more :)

Thats all i can think of now, other than that GREAT APP :)

Peace,
Mikelo2k
Anonymous
02-07-2003, 03:31 AM
my feature suggestions for the next major release:

- include this (http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=1&topic=40) in the help file ;-)
- tree view of procs for small/medium programs
- network debugging for using a monitor attached to another computer for
i.e. fullscreen apps or just extending workspace across computers
- option to lock the current EIP highlight bar in the center
(text scrolls instead of bar)

And finally: Keep up the excellent work. OllyDbg gets continously better.

fxcb
TBD
02-07-2003, 10:59 AM
Olly:
"Yeah, I read it periodically. Most of ideas are just small improvements.
What I need is global changes, like: display all handles owned by process (this idea is so good, I'll definitely add it to 1.10)"

so ppl, let your mind get wild and think of MAJOR changes that you want it implemented in OD 2.0

anyway, thanks for ideeas. togheter we can make a *excellent* tool !
Sungazer
02-12-2003, 05:00 AM
P-Code debuging would be nice... ;)
But i don´t know if it´s not a bit exaggerated, because i don´t really know how
OD internal works. Maybe it´s just about extending some opcode tables and recognition procedures, and maybe it would mean to rewrite large part´s of the programm.

Another nice addon would be the possibility to save all patched bytes to an Executable, not just the ones which are selected, because sometimes the patch locations are far away from another.
Anonymous
02-12-2003, 07:29 AM
fix the bug where you reload a file and for some reason (the file is not packed) it says "some breakpoints are outside..." and then disables all your breakpoints.
Anonymous
02-19-2003, 07:53 PM
Acelerator for "Search for - All referenced text strings" and "Search for text" inside this, could be usefull.
Anonymous
02-20-2003, 04:11 AM
Selection printing in all windows, especially in dissasembly

Better analysis like mfc ordinals

Intelligent disasm searching, like search for procs that call mfc or sys, for procs that have case sequence, all I/O, disk read/writes etc.

Dialog always on top settings for watches, bp and other windows

Context menu or hot tip on registers to investigate pointed data

A stable 2.0 release ASAP :)

thanks
Anonymous
02-24-2003, 01:14 PM
New little tricks :

Backinp up a snapshot of a process at a time to be able to reload latter the snapshot and continuing the debugging ...

o-o-o
helloword
02-28-2003, 08:32 AM
I will be nice to have some features like the DeDe software by DaFixer.
And also the way that it’s organise the info by
Classes Info
Units Info
Froms
Procedures

In the Procedures you have the Class Name column and by clicking one Class Name the system display all Events or Controls related to this class.
And by clicking in the event the system land you directly to entry point of the procedure that call the event of the class.
This can some you a lot of time.

In Ollydbg we have the Memory Map and possibility to dump the resources of the module.
In Ollydbg we can also set-up on the dump a breakpoint on memory access.

In my opinion, Ollydbg should from the recourses add some options to extract the class, the events of the class and the most important to make the relationship between the event and the code procedure of the program.
Anonymous
02-28-2003, 12:07 PM
why not just run dede and export the output to ollydbg ?
helloword
03-01-2003, 10:08 AM
Add in the trace feature an option that logs only the API that have been called by the procedure or branche
squire
03-01-2003, 01:05 PM
when can we expect 2.0 ?
Anonymous
03-02-2003, 06:58 PM
Remember Winscope? I think OllyDbg2 should have different levels. One such level, macroscopic in nature, should just give a trace of all the APIs and functions executed up to a point. Then if a more detailed analysis is needed one could zero in on a more detailed listing.
tno
03-03-2003, 04:54 PM
First large praise to the programmers of ollydbg, it has some feature, which makes some more understandable.

Here my suggestions:

1. a freely configurable window layout, with several, over shortcuts switchable screens. In principle, the implied functionality of the plugins StayOnTop and HideCaption, additionally with the extension to make scroll main window left/right and down/up over shortcuts.

2. It should be able to switch between different, before stored window layouts.

3. more than one dump window, which remains keeping constant in the layout. So far the additionally opened dump windows are not longer opened automatically after a restart of the program.

4. The width of the columns in the CPU window should be stored and loaded with the program start again. It could store into the configuration of the window layout.

5. A search for all contents in the cpu window, as if it would be a text, like wdasm32.

thx+cu
tno
Anonymous
03-03-2003, 11:47 PM
idea: Olly using LoadLibrary to scan .dlls :)
Anonymous
03-04-2003, 09:33 AM
It is nice to have lastbreakfromip where it shows last ip before break
Darus
03-04-2003, 05:42 PM
Yop everybody, for the future release of olly i would like to have .lng files to traduce the soft, it's possible ?
fr
03-05-2003, 03:38 PM
the binary search feature is extremely useful. what would be amazing would be ability to use wildcards in the search.
[thEpOpE]
03-05-2003, 09:13 PM
Please... Search in binary is very useful... but search&replace in a block of memory would be much better ;)
Anonymous
03-06-2003, 10:54 AM
[bfr[/b]

Binary string (Ctrl+B) - displays dialog allowing to specify search pattern. Maximal size of search pattern is 256 bytes. You can exclude some bytes or nibbles from the comparison. For example, if you specify pattern 12 ?? ?6 78, it will match both 12 34 56 78 and 12 00 06 78, but not 12 34 55 78. You can also ignore case of ASCII/UNICODE characters.

HEX control allows you to exclude single nibbles or bytes from the comparison. Type question mark (?) in HEX control to mark nibbles as masked. If you paste to the HEX control, OllyDbg scans text on clipboard and extracts hexadecimal digits (0..9, A..F, a..f) and question marks (?), ignoring all other symbols. Additionally, you can make search case-insensitive.

Sometimes you may need to locate some piece of code in the different version of debugged program. If code contains no relocations, you can select it, make binary copy to clipboard, open another version and paste the contents of clipboard to the HEX control of search window. Another option (binary copy with masked fixups) replaces fixups with question marks, creating search patterns that are insensitive to the load address.
oh me anon
03-06-2003, 11:05 AM
oops forgot to sign sorry
Anonymous
03-12-2003, 09:06 AM
Hi,
it would be nice if ollydbg could show the last eip before break point.
Regards.
Anonymous
03-12-2003, 12:08 PM
A good feature will be a deattach from the debugee app.
helloword
03-16-2003, 12:42 PM
Possibility to patch the file in another way

ex: the API ShowWindow:
00401796 push 1 ; /ShowState = SW_SHOWNORMAL
00401798 push dword ptr ds:[403017] ; |hWnd = NULL
0040179E call <jmp.&USER32.ShowWindow> ; \ShowWindow

By double clicking on ShowState, Ollydbg should display the list of ShowState of this API means:
SW_HIDE
SW_MAXIMIZE
SW_MINIMIZE
SW_RESTORE
SW_SHOW
SW_SHOWDEFAULT
SW_SHOWMAXIMIZED
SW_SHOWNORMAL
....

and if we select another ShowState ex: SW_HIDE, then Ollydbg modify automaticly
push 1
by
push 0
Anonymous
03-18-2003, 08:46 PM
We should have an additional tracer but this time more API oriented then asm.

This tracer should display info on Functions called, API call , thread , window and dialog messages , object , event and procedure add to that possible income and return value

SmartCheck is an excellent example.

Ollybdg do an excellent relationship job between the asm an API but can improve the relationship between asm and dialog messages , object , event ,...
Anonymous
03-25-2003, 09:29 AM
Showing Masm32's symbols (and source).

Adding support for the great x86-64 platform. Pb is : which OS should one choose.
oh me anon
03-28-2003, 04:44 AM
004012F9 Main MOV DX, WORD PTR DS:[EBX] ; EDX=77ED0009
004012FC Main MOVZX EDX, DX ; EDX=00000009
*** blah blah *******
004012F6 Main JNZ Breakpoint at oRdiNarY.004012F8
004012F8 Main POPAD ; ECX=B133C53E, 004012F9 Main MOV DX, WORD PTR DS:[EBX] ; EDX=77ED000A
this is a short clip of runtrace log
that popad and loop is executed 823 times

as you can see in profile below

Profile of oRdiNarY
Count Address First command Comment
14752. 004012F4 OR CL, CL
13929. 004012DE MOV EBX, DWORD PTR SS:[EBP-4]
824. 00401373 CMP DWORD PTR DS:[4031D3], 0
823. 004012C8 MOV EAX, DWORD PTR DS:[ESI]
823. 004012F8 POPAD
823. 00401367 DEC DWORD PTR DS:[4031D3]
822. 0040132D CMP ECX, DWORD PTR DS:[4030A4]
821. 0040134B CMP ECX, DWORD PTR DS:[4030A8]

and iam interested only in the value of ecx register in popad

as these commands show
004012EE |. 895D FC ||MOV DWORD PTR SS:[EBP-4], EBX ; KERNEL32.77ED77B2
******
0040130C |. 8B4D FC |MOV ECX, DWORD PTR SS:[EBP-4]
0040130F |. 3B0D 9C304000 |CMP ECX, DWORD PTR DS:[40309C]

now option to log specifically something like this this to rtrace.txt would be usefull in analysing situation

some thing like log ecx when command is popad at 4012f8 or similar

i hope i am clear if not do ask
oh me anon
03-28-2003, 04:54 AM
hi tbd
really do you read this post and convey those mutterings to oleh ;}
i hope so ;}}
Anonymous
03-29-2003, 05:13 PM
oh me anon olly checks this thread. also i found a bug that will be fixed in 1.09c sometime in the future (regarding bad PE header)

keep the ideeas coming guys.

TBD

ps. i forgot the password :)
Anonymous
03-29-2003, 09:18 PM
i think this may have been posted before, but i still get the occasional : "some breakpoints were outside..." and then olly disables all breakpoints when the app restarts. its not a big deal, since we can view break point windor and re-enable them, but its an inconvenience and seems to happen at unpredictable times (note this is not a packed app).
oh me anon
03-30-2003, 11:30 AM
ooh tx for reply tbd,;}}} no answers by you in this page (page no 4) so thought let me bait a question

apart from logging there is no way to copy a selection in rtrace and rtrace log required to be enabled before runtrancing else if you rtrace and then want to save something it wont be possible hope this can also be by passed (just like adding copy to clipboard in stack which seems to be pretty usefull)

and then ms excel type auto filter if possible in rtrace will be an added advantage so in the above situation i apply auto filter and select popad which shows all popads one below one ( profile does it but shows only one instruction

and marking and using + or minus to navigate makes it possible for me to view all the popads still making it kind of spreadsheet will be making it more convinient
( i got this idea when i exported the rtrace.txt as rtrace.csv to excel and
used auto filter (success % 75 % file not loaded completly)

and tbd you can put your nick in box and post even if you dont remember password
hahahahaha isnt kind of teaching the teacher ;}}}}}}
Anonymous
04-02-2003, 04:29 PM
the ability to directly load a dll for simple dissasembly would be nice, without having to attach to a specific application.
Anonymous
04-03-2003, 07:51 PM
Possible Reference to String Resources "BLABLA"
Exist already

but not
Possible Reference to Menu Resources MenuID_xxx: "BLABLA"
Possible Reference to Dialog DialogID_xxx, CONTROLE_ID: yyy "BLABLA"
and all other ressources

those feature exist in W32Dasm
Anonymous
04-23-2003, 09:31 AM
Trw2000-like interface option with pmodule option would be great!!
Anonymous
04-25-2003, 09:11 AM
Would be nice with "Copy code only"
oh me anon
05-05-2003, 08:15 AM
well hiding one of the default colums by clicking or some thing else would be great for copying dissembly and comments now we have to drag the colums and hide them and copy
ENLIL58
05-05-2003, 09:24 AM
How about saving/loading comments/labels and un-losable comements. My one and only annoyance with OD is that after spending days debugging a prog, adding a mountain of useful comment and label so that it is easier to understand how the prog works and then you go and alter the prog - 'PUFF' - OD now interpretates to prog as being new and re-analyses it and you LOSE ALL THOSE NICE COMMENTS AND LABELS - this is well out of order. OD should have some option for it to scan the prog and identify where the comments should now be offset to !!

This would be great and would save a few heartattacks, and the smashing of a computer or 2 :)))
Anonymous
07-16-2003, 04:03 PM
i don´t known if this is crazy, but could be possible to make olly to run in a virtual machine (i heard something like that for java) so if something goes wrong you don´t have to restart the pc, because the problem is not in your computer is in a process that can be finished without affecting the session.
Teerayoot
07-17-2003, 03:35 AM
no more bugs!
Teerayoot
07-17-2003, 05:00 AM
Thread analyser .
Anonymous
07-17-2003, 10:30 AM
to do a virtual machine would mean writing a complete processor emulator, which would be a complete nightmare. plus someone would always find a to detect your emulator by using undocumented opcodes/options and see if the result is different on your emulator and the real cpu.

emulators/virtual machines do exist however, but only for dos - check out "TR".
Anonymous
07-17-2003, 10:31 AM
be able to break into any running app like softice
silver
07-19-2003, 08:14 PM
file analyzer-compression, compilers
comrade
07-20-2003, 11:46 PM
Multiple data dump windows please. I know you can use +/- to switch between locations, but still it would be nice to watch two or more sets of data at once.
Anonymous
07-25-2003, 06:50 PM
It would be interesting to have debugger with some kind of simple script language.
IDA has script language support, something similar in debugger would be very useful to automate different complex tasks.
Anonymous
07-29-2003, 03:35 PM
"SAVE POINT": save datas(registers,stack and ......) in harddisk,so we can begin from the save point by loading data from harddisk in the next time and also we can go back without restarting
Anonymous
07-30-2003, 05:46 AM
Ability to break on one place when some event occured in anothor place. Something like break on 402000h when ecx==2h on the 401FF00h. Remember ecx value on 401FF00h and if we break on 402000h check ecx and continue if FALSE.
Anonymous
08-01-2003, 10:40 PM
My most important wish is a user interface that is customizable as close to softice as possible (my permanent typos are starting to wear my nerves thin ;-)).
Anonymous
08-02-2003, 12:58 AM
Anonymous - Posted: Mar 25, 2003 05:29:20

Adding support for the great x86-64 platform. Pb is : which OS should one choose.

WindowsXP 64 seams to be a good choice...

Teerayoot - Posted: Jul 16, 2003 23:35:57

no more bugs!

What about no more moron so you can leave now?
Anonymous
09-15-2003, 12:07 AM
The ability to run a code analysis on *any* code in the disassembler
window, not just code marked as being in the executable segment.
Anonymous
09-15-2003, 10:03 AM
flirt technology, ala IDA
Anonymous
09-25-2003, 02:05 PM
I'm new to debugging, so please forgive any newbie misunderstandings. I'd like to add that Olly is a really superb tool and full of power even for new users - thanks to all involved.

1. Stepping / trace ranges. I debug programs which have frequent calls to external modules (mfc700, ntdll, etc), yet I'm hardly ever interested in stepping through external functions. When I'm stepping through long lists of instructions with F7, I often fall into another module and have to bring myself out with Ctrl-F9 etc. What I want is a feature that behaves like 'step into' *but only for specified modules* (e.g. 'never step into ntdll'). This differs from 'step over' because I need to 'step into' a function within the current module (or other specified modules).

2. An easier way to switch between loaded modules. The only way I've found is to open up the 'modules' window (Alt-E) and double-click a module name.

3. A simple, one-click method of committing changes to the file being debugged.

4. Maybe this is too basic for the average user, but an ASM instruction reference for newbies would be a really useful resource; something along the lines of right-clicking or hovering over an instruction name will bring up a small explanation of its function and any parameters it can take.
helloword
09-26-2003, 02:02 PM
Possibility to translate piece of asm to language programing code.
For example
If we identify a portion of asm as being an if condition in Visul basic for example.
Olly should change this asm

mov eax,..
mov edx,...
cmp eax, edx
jne 023213

to

If eax > edx then jne 023213
Anonymous
09-26-2003, 02:07 PM
mov eax,..
mov edx,...
add eax, 50
inc edx
cmp eax, edx
jne 023213

to

eax = eax + 50
edx = edx + 1
If eax > edx then jne 023213
Anonymous
10-03-2003, 04:22 PM
a wizard to generate function descriptions in common.arg
Anonymous
10-06-2003, 07:56 PM
DrCOM Monitor http://www.ddevel.com/

Object name/clsid.
The object reference count.
The time of creation.
The objects interface name/iid.
The reference count.
The memory address of the object.
Automation supporting ( in which case the objects methods may be invoked ).
Object creation type e.g. singleton or not
spongebob
11-02-2003, 04:56 PM
I would really like a Memory Searcher!

You search for a value in memory, and then you can filter your search results by saying 'value has changed' or 'value has increased', and you will eventually get the location of your value. Then have another search that finds the pointer to the value you just found.

It's annoying to have to use an extra program to do this, that's why I think it would be great if it was integrated into Olly.
bboitano
11-04-2003, 02:39 PM
A comprehensive manual for us Newbies would be good ;)
Epsylon3
12-27-2003, 08:27 PM
TreeView of Hierarchy of calls in Run trace !
comrade
12-29-2003, 02:53 AM
TreeView of Hierarchy of calls in Run trace !

Not just for Run Trace, perhaps while manually debugging and stepping as well :)
Its very easy to get lost in complex code.
Lord_Looser
02-26-2004, 03:35 PM
disassembling running processes without debugging it
prejker
04-22-2004, 11:57 AM
It would be nice to have a function to allocate user defined ammount of space in the debugged app where u can inject your code. (sth like ADump or DumpFX)
It would be also nice to have a function to copy data from a file to a
user defined memory address because 'binary edit' has got a limited editbox and sometimes i must paste data 3 times.

thx and keep up the good work with olly its superb:)
Ziyi
04-28-2004, 01:49 PM
-Toggle-switch on child window
-Can customize the child window opacity
-A window dock bar
-Supply language file for localization
-.chm support
j_petrucci
04-28-2004, 08:08 PM
Hey TBD, did you remember to send all our suggestions to Olly? ;p

bye
TBD
04-29-2004, 04:10 AM
j_petrucci: Olly is checking this thread periodically and he will try to add the features as he can.

after he finishes the documentation for 1.10c and plugin architecture he will go back to 2.x development. till then - use 1.10c :)
seven757
05-08-2004, 01:20 AM
ring 0, with sysinternal's DLL, like windbg
ShadowDark
05-11-2004, 05:31 PM
some of Cript APIs and others interpretations... of ADVAPI32.dll...
bytes...

P.D: only comentary of parameters...
Lord_Looser
05-13-2004, 12:15 PM
demangle symbolic names similar to MS C++ Name Undecorator/Dependency Walker x86’s undecorated function names.
example:
?set_terminate@@YAP6AXXZP6AXXZ@Z --> void (*set_terminate(void (*)(void)))(void)
focht
05-13-2004, 04:36 PM
demangle symbolic names similar to MS C++ Name Undecorator/Dependency Walker x86’s undecorated function names.

Hi,

its already does that stuff... it exports that kind of functionality (to be used in plugins) too:

extc int cdecl Demanglename(char *name,int type,char *undecorated);

Example where ollydbg uses image/dbg helper API to undecorate stuff:

Call stack of main thread

Address Stack Procedure / arguments Called from Frame
0012C974 00462A13 IMAGEHLP.UnDecorateSymbolName OLLYDBG._Demanglename+101 0012C9B4
0012C9B8 0046348A OLLYDBG._Demanglename OLLYDBG._Quickinsertname+1D1 0012C9B4
0012C9BC 0012D03C Arg1 = 0012D03C ASCII "MSVCP71.??0?$basic_istringstream@DU?$char_traits@D @std@@V?$allocator@ D@2@@std@@QA
0012C9C0 00000033 Arg2 = 00000033
0012C9C4 0012C9D4 Arg3 = 0012C9D4 ASCII "MSVCP71.std::basic_istringstream<char,std::char_traits<char>,std::all ocator<char>
0012CBD8 0045C6AC OLLYDBG._Quickinsertname OLLYDBG.0045C6A7 0012CBD4
0012CBDC 00459210 Arg1 = 00459210
0012CBE0 00000033 Arg2 = 00000033
0012CBE4 0012D03C Arg3 = 0012D03C ASCII "MSVCP71.??0?$basic_istringstream@DU?$char_traits@D @std@@V?$allocator@ D@2@@std@@QA
0012D2C8 0045E833 OLLYDBG.0045B434 OLLYDBG.0045E82E 0012D2C4
0012D2CC 01FE0000 Arg1 = 01FE0000
0012DA8C 0042EDE5 OLLYDBG.0045E3B4 OLLYDBG.0042EDE0
0012F5AC 00438B03 ? OLLYDBG.0042E1E0 OLLYDBG.00438AFE
0012F5B0 0012FF34 Arg1 = 0012FF34
0012FF8C 004ABAF3 OLLYDBG.00434F0C OLLYDBG.004ABAF0 0012FF88
0012FF90 00400000 Arg1 = 00400000 ASCII "MZP"
0012FF94 00000000 Arg2 = 00000000
0012FF98 00551F0F Arg3 = 00551F0F
0012FF9C 0000000A Arg4 = 0000000A

Maybe you have an old version of debug helper library or ollydbg is not setup correctly...

Regards,

A. Focht
Lord_Looser
05-13-2004, 09:48 PM
Thanks for your detailed replaying.

But OllyDbg is cutting away functions’ return value type and parameters. It returns just [scope::]name.
basic_istringstream is only a template and all type statements between ‘<’ and ‘>’ are no function parameters.
compare to undname 0x1000 ....

The complete demangled function name – better say function prototype (?) – should be ...
"public: ?? ?? std::basic_istringstream<char,struct std::char_traits<char>,class std::allocator<char> >::basic_istringstream<char,struct std::char_traits<char>,class std::allocator<char> >( ?? ) throw( ?? )"

compare this function pointer with no scope (using namespace std)
mangled: ?set_terminate@@YAP6AXXZP6AXXZ@Z
OllyDbg: set_terminate
undname: void (*set_terminate(void (*)(void)))(void)

---------

C:\>undname.exe /show_flags
Usage: undname [flags] fname [fname...]
or: undname [flags] file

where flags are the following OR'd together:

0x0001 Remove leading underscores from Microsoft extended keywords
0x0002 Disable expansion of Microsoft extended keywords
0x0004 Disable expansion of return type for primary declaration
0x0008 Disable expansion of the declaration model
0x0010 Disable expansion of the declaration language specifier
0x0060 Disable all modifiers on the 'this' type
0x0080 Disable expansion of access specifiers for members
0x0100 Disable expansion of 'throw-signatures' for functions and pointers to functions
0x0200 Disable expansion of 'static' or 'virtual'ness of members
0x0400 Disable expansion of Microsoft model for UDT returns
0x0800 Undecorate 32-bit decorated names
0x1000 Crack only the name for primary declaration; return just [scope::]name. Does expand template params
0x2000 Input is just a type encoding; compose an abstract declarator
0x8000 Disable enum/class/struct/union prefix
0x20000 Disable expansion of __ptr64 keyword
focht
05-14-2004, 04:34 AM
Hi again,

yes the flags given by ollydbg to the image helper API are preset in that way (cutting the interesting info for some ppl away).

Maybe there can be some configuration option added to control this behaviour..

While comparing this behaviour to VS.NET 2003 debugger (my primary choice for _any_ source level stuff) i noticed ollydbg doesnt walk the callstack to its top... (only a limted set of stack frames are displayed)

As i stated some times before ... i think the way, symbolic debugging is handled by ollydbg needs some rework..

Regards
Goudaman
05-16-2004, 07:00 PM
I may be dense and this might already be there but, can you add a way of automatically logging function return values? What i do now is use the search thing to find all the "mov EAX, R32 \n RET"s and "mov EAX, CONST \n RET"s and put conditional log breakpoints on them to log the value of EAX , which is really tedious. Also can you make the "Watch" window auto find string addresses like the Registers pane? Great job though! It already kicks WinDbg's ass for normal user mode applications. Also about focht's post: Why wouldn't you just use the debugger that came with your high-level language? Isn't the whole point of OllyDbg to debug stuff where you dont have the source or that is coded in asm?
prejker
07-16-2004, 06:05 AM
it would be nice to have an option to ignore breakpoints that we set for certain adresses. for ex. you set a breakpoint on GetWindowTextA and the app that you are debugging calls this api in a loop in some threads - that makes it hard to find what you are looking for so if there could be an option to exclude some addresses from the breakpoint it would be much easier to find what you are looking for.
oh me anon
07-18-2004, 07:15 AM
prejiker may be what you are looking for is already implememted
have you tried going to break points window and disabling the specific break point if not try it and see
well but a hot key would be fine though to disable and enable it again


Difference between SoftIce & Ollydbg ? (was so

RCE Messageboard's Regroupment > General > Difference between SoftIce & Ollydbg ? (was so
Anonymous
01-08-2003, 05:24 AM
Hi,

What are the principle differences in the debugging approaches taken by Softice and Ollydbg ?
There are programs that can't be debugged by Ollydbg because they generate exceptions if run under Ollydbg (access violation, single step event, hardware breakpoint). However, SI has no such problems.
How can that be ?

MrSmith

P.S. Is there a special trick how to create a user account? Everytime I try it I get the error: "Unable to register new user. Possibly username or email already taken, or admininistrator info isn`t filled, yet."
Anonymous
01-08-2003, 05:34 AM
There are basically two different classes of debugger - system-level, and application-level.

SoftICE is a 'system-level' debugger that starts even before Windows starts loading, so you can actually use it to debug the Windows loader. It's about as low-level as a debugger can possibly get.

OllyDbg, like Win32dasm, Visual Studio's debugger, and nearly all other debuggers, is 'application-level', so you can use it to debug applications but not the system, but unless you're working with the Windows kernel or Windows loader or drivers or other such low-level things you probably won't need SoftICE, as OllyDbg should be able to do everything you need in regards to debugging applications
luucorp
01-08-2003, 07:03 AM
with me:
softice: alway crash
ollydbg: never crach
---------------
what do you use?
ofcourse: ollydbg.
-----------------
ollydbg do anything.
Anonymous
01-08-2003, 07:31 AM
yeah that's another problem with SoftICE -- because it's so low-level, a lot of people frequently experience problems with it such as system hangs and crashes (at which stage you have no choice but to reboot!). If OllyDbg ever crashes (although, I've never seen it crash), all you have to do is restart OllyDbg :)

Also, SoftICE is console-based, whereas OllyDbg has an excellent graphical user interface that makes it not only easier to use, but also easier to navigate around the program and quickly do what you want. It also analyses your code and adds intelligent comments, something SoftICE doesn't do
Mikelo2k
02-03-2003, 12:52 AM
I've had olly crash a few times, and i've found that if you leave it on a breakpoint too long without execution (paused), in 30 mins or so it will slow ur PC down to a crawl (eats all CPU power for some reason). But thats no matter, i love it ;)

Especially since i can still debug and make notes in notepad etc... :P
Anonymous
02-03-2003, 08:58 AM
What about the software URSoft W32Dasm?
No new version since the version 8.93.
No Web site.
What's happen to this guys, did he rename his software , or ??
If someone has real news related to this question, please posted here.
Anonymous
02-03-2003, 09:04 AM
W32Dasm is obsolete and discontinued.


Crash on call stack.

RCE Messageboard's Regroupment > Bugs > Crash on call stack.
Anonymous
01-08-2003, 08:15 AM
Always when I open call stack window, ollydbg crashes. How could I gather more info to help fix this?
Anonymous
01-08-2003, 08:32 AM
Exactly when does it crash - as soon as you press Alt+K (or View menu | Call Stack)? -- ive never had any problems with Call Stack
What version of OllyDbg are you using? -- im using 1.08b
What OS are you using? -- im using Win2K
Does it crash on just some processes, or all?
mstr
01-11-2003, 08:21 AM
Ollydbg hangs, when Call stack window appears on the screen. I use winxp and 1.08b. Callstack works fine with some processes.


[ODF] for the lazy ones that dont want to register

RCE Messageboard's Regroupment > The Heap > [ODF] for the lazy ones that dont want to register
TBD
01-08-2003, 09:08 AM
lately a lot of you dont want to register.

i understand that - why the heck must I enter my nick/email and press two buttons when I can just enter my question and press 'Post', no ? and then relogin from time to time ?

for that lazy ones this messageboard has great feature:
- when you post just enter your nick in the login editbox and leave the password editbox blank to post with your nick. cool, nah ?

[IMPORTANT]
<font color="#FF0000">
if the anonymous posting will continue i will make this forum private, so
that only registered users can view/post. and of course no one wants this !

till then i will not respond to Anonymous posts. as this service is free for
you, at least sign your post with your nick/name.
</font>
Anonymous
01-08-2003, 09:17 AM
Personally i don't think any anonymous posts should be made, and I think all people should be made to register before posting.

Reasons:
1) it's free
2) itll help reduce abuse of this valuable forum
3) it'll make it easier to see who's saying what (it gets a bit confusing when Anonymous responds to Anonymous - almost looks like theyre talking to themself)
4) nearly all other forums require registration anyway :)

I dont see any advantage in allowing anonymous posts ... (like this one) :)
Anonymous
01-08-2003, 09:27 AM
Incidently, I only made the above post an anonymous post simple due to ease-of-use, not reasons of anonymity. :) (i dont care if people see a nickname instead of 'anonymous', it doesnt invade my privacy or defeat my anonymity in any way, which is another reason why I think all posts should require registration)
Squidge
01-08-2003, 09:30 AM
Ok, I've registered :) Like a lot of people here, I'm a coder, and as you know, we are extremely idle and want to find the easiest way to do everything :)
TBD
01-08-2003, 09:44 AM
[message deleted due highly offensive language]
Anonymous
01-08-2003, 10:11 AM
You ban him just because he posted two anonymous messages? Without even warning people that they'll be banned for anonymous posting? All you said was "till then i will not respond to Anonymous posts", you said nothing about banning. Geez talk about harsh - I take it you don't want people to post here then. If youre going to ban people at least tell people beforehand why they might be banned so that they dont post anonymously - seems like its your fault TBD, not his.
TBD
01-08-2003, 10:33 AM
to Anonymous from xxx.xxx.xxx.145
You ban him just because he posted two anonymous messages?

it was "so you are banned :)" that means joke ! i dont plan
to ban anonymous posts, but i think i will ban YOU because you dont
like me and also post anonymously !!!

i dont know why is so hard to enter you nick 2 lines below the message
editbox or even in the post ?

---

of course i didnt banned anyone :) but this will be the last response to anonymous posts
Anonymous
01-08-2003, 11:02 AM
TBD, its not "I dont like you" -- I never said that, and I think you do an excellent service just by running this forum, but it didnt sound like you were joking about banning him. If you allow anonymous posts then its only natural that people will post anonymously dont you think? I dont see that as any grounds to ban people, and unless Im misunderstanding what that guy said, to me it seemed like he was on your side anyway? I dont find anything offensive about his post, it seemed he just has the best interests of this forum in his heart, as we all do? I kinda agree with him though in that people should be made to register before posting - I dont have any problems with that either. So "Anonymous", I think your heart was in the right place.

PS. I always use anonymous proxies to post to forums (not just this one), so banning by IP won't work, but if you enforced registration then you could ban me more easily :)
But I also don't think its very polite to publish peoples IPs who post here, it makes posting here very unattractive as I dont know anybody who wants their IP revealed, even those who post when logged in.

Anyway, thats just my two cents. Please just take this as constructive criticism - I think this is an excellent forum for an excellent debugger and I too just want the best for this forum :)
Peace,
Steve
Wayne
01-08-2003, 11:12 AM
TBD, I'm the person who made the first two Anonymous posts. I apologise if you were offended.

Anonymous, I agree, this is a great forum that supports a superb debugger, that can't be forgotten. but I also agree that it's very impolite to publish IP addresses.

Best regards,
Wayne
TBD
01-08-2003, 11:27 AM
Wayne: bad, bad boy ... making those anon posts ;)
i published the IP just to make a difference between different Anonymous posts.
sorry for "banning" you :]

Steve: i dont care if ppl register or not, but why is so hard to sign the post (as you did or by typing the nick in the login box) ? replying to Anonymous is like talking to a wall (especially in a thread with multiple anon posts)

i will remove the IPs, happy ? btw, you two share the same proxy ? or have double personality :)

ps. if a sentence end with a smily than it is a joke ... just for the record
Wayne
01-08-2003, 11:37 AM
TBD, no hard feelings! :) Like I said in my original post I only posted anonymously out of convenience - it's just easier, even if it only means typing in the username instead of password (I wasnt even aware of that up till now), plus it didn't seem to matter if my username was Wayne or Anonymous, the only difference is a few letters. *shrug* :)
But I think if youre going to allow people to post anonymously, then you shouldnt get angry with them just for doing that. If you dont want them to post anonymously, you know how to stop that. :) and registering is free, so I dont think youll get any complaints. I dont see any advantages in allowing people to post anonymously, but it seems there are several advantages in enforcing people to register... ? :) Anyway its your call, you do everyone an excellent service by running this forum and all I wish for is whats in the best interests of the forum :)

Best,
Wayne
TBD
01-08-2003, 11:55 AM
i like messageboards that have the possibility to post without register,
but to have a possibility to enter my nick to make a difference from other
anon posts.

so this forum has this facility, but as it is not documented till now, i
dont have motive to argue/ban/kick/...

so, i think i will modify the board to "force" the user to state his/her nick
before posting :) (sometime in the future as i dont have access/time/bla bla
to do it now)

anyway, enjoy the forum, share your knowledge to make a better OllyDbg and have fun
Wayne
01-08-2003, 12:30 PM
Excellent idea! :) - if you still want to allow anonymous posts, then if you at least enforce the user to provide some kind of nickname then it will prevent everyone posting as Anonymous so that will at least help end that confusion :) :)
But even if you did enforce registration-before-posting I dont think you'll get many complaints, most forums on the internet seem to require that these days anyway ... :)

Yours faithfully,
Wayne
mstr
01-09-2003, 07:40 PM
I previously made some anonymous posts because I didn't know that I can just use my nick without registering. I'll do that from now on. :)
oh me anon
01-23-2003, 02:07 PM
i could post with my nick but without registering let me try once sorry tbd if it annoys you its just this one time
TBD
01-24-2003, 02:38 AM
oh me anon: it annoys me when i respond to anonymous questions. imagine if there are 3 anon posts, i will respond something like:

..."anon1: bla bla
anon2: bla bla" ...

btw, it wont bother anymore ... i will respond only to signed/registered posts :)
Hiroshimator
01-25-2003, 10:52 AM
I had the other board on anonymous access a while as well.

it gives a lot more trouble to admins/moderators to clear away crap and you'll have a lot more annoyancies in terms of spam, verbal abuse, etc...

Right now we even require a working e-mail addresses (but we no longer have the spam and other related issues :) ). All due to annoying people in the past who abused the service. I personally see no advantage in having anonymous people post when registering at a board only takes about 5 minutes (if even). People with too much to hide are usually up to something.

My advise is to force registration, if they can't be bothered to take 5 minutes of their time, why should you be bothered to provide any service to them? It's not like their info is not known already, things like IPs and time get locked anyway.

my 2c.

BTW TBD I sent you a PM on the ASM board. I hope it's what you wanted this klipfolio thing is weird :/
ddion
04-26-2003, 06:45 AM
well, i agree with Hiro tho, we must be forced sometimes ;)
TBD: i've been worked since 2 mth ago ;)


FAO: TBD. - Just wondering...

RCE Messageboard's Regroupment > The Heap > FAO: TBD. - Just wondering...
Anonymous
01-08-2003, 07:18 PM
TBD: How come you are using this (whatever it's called) board software instead of the more commonly used VBulletin ? Is it easier to install and configure, or does it use up less disk space/etc ?

(I'm looking for some software for my own board, see. But I want the easiest to install and maintain :-)

(BTW, This is by no means a complaint about the board software. It works, and that's what matters.)
squidgey
01-08-2003, 07:19 PM
Oops, forget to login. Please take this as the signature of the previous message :)
Wayne
01-08-2003, 10:12 PM
VBulletin is good but fairly expensive and if i recall correctly they only let you run it for 1 year before you have to pay again
TBD
01-09-2003, 02:48 AM
squidgey: yup, Wayne pointed the reasons that i didnt choose VBulletin. also this msgb soft is free, small, fast and i liked the interface.

and also to be different :)
Hiroshimator
01-25-2003, 10:56 AM
no your right to free updates expires after a year. Think of it as a subscription to service packs :/

It's pretty expensive though IMO, since I find it hard to impossible to neatly use it in anything. As a stand-alone board it's fine but don't try to integrate it into anything.

For those looking for vbulletin like software that is gratis: http://www.phpbb.org

you could now truly say that they're on par with vbulletin, so it would make a better choice economically speaking :)
blue
01-25-2003, 04:25 PM
For another free (and interesting) alternative, you can also try Invision.


OllyDbg UDD file

RCE Messageboard's Regroupment > General > OllyDbg UDD file
Squidge
01-09-2003, 02:57 PM
Is Olly going to release the format of the UDD file ? I can think of some interesting add-on's if he could release the specs of this file.
TBD
01-10-2003, 02:42 AM
Squidge: i have an old UDD specification ... mail me with your ideeas and i will send it over :)
Squidge
01-10-2003, 04:50 PM
Done !
Squidge
01-11-2003, 09:59 AM
Did you receive the email? I sent it to the one specified in your user profile.
TBD
01-11-2003, 10:15 AM
<pre>
.UDD (User-Defined Data) file consists of unaligned variable-length records.
Each record has the following format:

#define MI_SIGNATURE 0x00646F4DL // Module info signature
#define MI_FILENAME 0x6C69460AL // Record with full path of executable
#define MI_FILESIZE 0x7A69530AL // Record with file size
#define MI_TIMESTAMP 0x7473540AL // Record with timestamp file data
#define MI_USER 0x0073550AL // User data record (ORed with NM_xxx)
#define MI_INT3BREAK 0x7470420AL // Record with breakpoint data
#define MI_INT3BRKC 0x6370420AL // Record with checked breakpoint data
#define MI_ANALYSIS 0x616E410AL // Record with analysis data
#define MI_ANALPACK 0x636E410AL // Record with compressed analysis data
#define MI_CODECRC 0x7263430AL // Record with CRC of code for analysis
#define MI_SAVEAREA 0x6176530AL // Record with general-purpose save area
#define MI_END 0x646E450AL // End of module info data

struct t_record {
long tag; // Unique tag (MI_xxx) identifying record type
long size; // Size of data, bytes (may be 0)
char data[size]; // Data itself
};

(Try to read tags as ASCII text). File must begin with MI_SIGNATURE record
containing 22-byte string "Module info file v1.1\0". All other records are
optional. If OllyDbg doesn't know the meaning of the record, it simply ignores
it. This assures backward compatibility: breakpoints set by v1.02, for example,
will appear in OllyDbg v1.00.

MI_FILENAME contains full path to the file.

MI_FILESIZE contains 32-bit file size. (I haven't heard yet about .exe or .dll
that is longer than 4G bytes).

MI_TIMESTAMP is formed as follows:

FILETIME tlastwrite;
// Get timestamp (time of last update) and size of executable file.
hf=CreateFile(pmod->path,0,FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
if (hf==INVALID_HANDLE_VALUE)
return; // Unable to query executable file
GetFileTime(hf,NULL,NULL,&tlastwrite);
filesize=GetFileSize(hf,NULL); // Here you has file size for MI_FILESIZE
CloseHandle(hf);
Saverecord(f,MI_TIMESTAMP,sizeof(tlastwrite),&tlastwrite);

For you, the most important record is MI_USER. I use it to save all types of
user data that are text. Size of data in MI_USER+xx records never exceeds 260
bytes (including terminal '\0'). I don't use MI_USER directly; instead, it is
ORed with type of user data (NM_XXX) shifted 24 bits to the left (so NM_XXX
comes into the most significant byte of the tag).

#define NM_LABEL 0x31 // User-defined label
#define NM_EXPORT 0x32 // Exported (global) name
#define NM_IMPORT 0x33 // Imported name
#define NM_LIBRARY 0x34 // Name from library or object file
#define NM_CONST 0x35 // User-defined constant
#define NM_COMMENT 0x36 // User-defined comment
#define NM_LIBCOMM 0x37 // Comment from library or object file
#define NM_BREAK 0x38 // Condition related with breakpoint
#define NM_ARG 0x39 // Arguments decoded by analyser
#define NM_ANALYSE 0x3A // Comment added by analyser
#define NM_BREAKEXPR 0x3B // Expression related with breakpoint
#define NM_BREAKEXPL 0x3C // Explanation related with breakpoint
#define NM_INSPECT 0x40 // Several last inspect expressions
#define NM_WATCH 0x41 // Watch expressions
#define NM_ASM 0x42 // Several last assembled strings
#define NM_FINDASM 0x43 // Several last find assembler strings
#define NM_LASTWATCH 0x48 // Several last watch expressions
#define NM_SOURCE 0x49 // Several last source search strings

#define NMHISTORY 0x40 // Converts NM_xxx to type of init list

struct t_midata {
long offset; // Offset of symbol from the beginning of the module
char sztext[size-4]; // Zero-terminated symbolic name, 256 bytes max
};

Following user data types are associated with some module and can appear in any
.udd file:

NM_LABEL, // User-defined label
NM_LIBRARY, // Name extracted by object scanner
NM_COMMENT, // User-defined comment
NM_LIBCOMM, // Comment generated by object scanner
NM_BREAK, // Condition related with breakpoint
NM_BREAKEXPR, // Expression related with breakpoint
NM_BREAKEXPL, // Explanation related with breakpoint
NM_ANALYSE, // Comment added by analyser
NM_ARG // Decoding of known function

.udd file of main module (.exe) also keeps watch expressions and history lists
(they appear if you open pull-down window of the combobox). For this data,
offset field is simply a 1-based ordinal:

NM_LABEL | NMHISTORY, // List of last entered labels
NM_COMMENT | NMHISTORY, // List of last entered comments
NM_BREAK | NMHISTORY, // List of last entered break conditions
NM_BREAKEXPR | NMHISTORY, // List of last break expressions
NM_BREAKEXPL | NMHISTORY, // List of last break explanations
NM_INSPECT, // Inspect expressions
NM_WATCH, // Watch expressions
NM_ASM, // Several last assembled strings
NM_FINDASM, // Several last find assembler strings
NM_LASTWATCH, // Several last watch expressions
NM_SOURCE // Several last source search strings

When OllyDbg encounters MI_END, it stops file processing.
</pre>
TBD
01-11-2003, 10:17 AM
it is a bit outdated ... i think from 1.04.
i cannot read my email till monday ... sorry
Squidge
01-11-2003, 01:57 PM
No Problem. Thanks, I can just reverse engineer the rest if I need too, now that I have a starting point.
TBD
01-13-2003, 02:38 AM
Squidge: have u looked inside mapconv plugin ? it imports labels from .map file made from IDA/Softice
Squidge
01-13-2003, 06:38 AM
No, I didn't even know it existed. Thanks, I'll look into that.

Edit: Dang, wheres the plug-in page again?
TBD
01-14-2003, 02:50 AM
Squidge: look for [ODF] posts or directly
<u>http://rohanpal.com/ollydbg/files</u> (http://rohanpal.com/ollydbg/files)


define your own functions

RCE Messageboard's Regroupment > General > define your own functions
helloword
01-09-2003, 04:47 PM
Who define his own functions in the <OllyDbg directory>\<Application>.arg file?
TBD
01-10-2003, 02:43 AM
helloword: i tried some time ago ... and it worked :)
do you have problems ? please post your findings
blue
01-19-2003, 06:44 PM
I'm having a little problem with this. I'm working on an executable, and I'm mainly interested in two of the dlls it uses. One of these DLLs contains a function I want to define and which is referenced as ordinal #10005. I'm trying to make the calls from the other DLL to this exported function look a little bit cooler :) The Analyzer doesn't recognize this as the start of a function though, I don't know if it is a problem.

<pre>6FAAD3EA |. E8 85260B00 CALL <JMP.&D2Net.#10005></pre>

So well, it's not working as predicted, meaning it shows nothing. If I use Assume Arguments on the exported function to tell OllyDbg it has 3 arguments, it shows as

<pre>6FAAD3EA |. E8 85260B00 CALL <JMP.&D2Net.#10005> ; \Assumed StdFunc3</pre>

I have tried to put 3 .arg files, named after the executable, the first DLL and the second DLL, and inside those .arg files, I have tried the following possibilities :

<pre>FUNCTION <JMP.&D2Net.#10005>
"unknown" INT
"pPacket" PTR
"nLength" UINT
END
FUNCTION D2Net.#10005
"unknown" INT
"pPacket" PTR
"nLength" UINT
END
FUNCTION #10005
"unknown" INT
"pPacket" PTR
"nLength" UINT
END</pre>

Any clue to what I'm doing wrong ?


SFX

RCE Messageboard's Regroupment > General > SFX
Wayne
01-10-2003, 03:58 AM
The SFX options in OllyDbg seem excellent - I just loaded an ASPack'd file and it took me to the original (unpacked) entry point. However, what I'd like to do is breakpoint just before the program makes the call to the unpacked original entry point. Is there any way to do this?
TBD
01-10-2003, 05:55 AM
Wayne: i dont think this is possible :(
Wayne
01-10-2003, 06:33 AM
Actually, I did find one trick to use :) :)
With the SFX options turned on (i used the "Trace real entry bytewise" option), when Olly shows you the unpacked code, just right-click on the first line of code and select "Find references for | Selected command". Then, low and behold I saw "push address" - double-clicking on that took me straight to that line, and immediately after the push instruction was a ret, so that did the trick nicely (and I dont think you can do that with any other debuggers! :))
Anonymous
01-10-2003, 06:48 AM
I don't see why you need to do this? For dumping, just pause/suspend the proc from Olly and dump.
Wayne
01-10-2003, 07:37 AM
I don't need to dump the process (otherwise yes I'd just dump it when Olly's smart SFX handler stopped at the unpacked OEP) - I needed it for analysis reasons and to see the code going on before the call to the OEP. Not worth explaining why, but it was necessary. But yes if I just needed to dump it, then OllyDbg's 'Trace real entry bytewise' works perfectly, as soon as it shows the unpacked code, just dump the process, and voila :)
TBD
01-10-2003, 08:28 AM
Wayne: i was thinking the same, but i understood your question as "automatically breakpoint before jmp OEP call" :) - so that is not possible
Wayne
01-10-2003, 09:54 AM
:) I didnt think it would be possible either, but was just guessing that maybe somebody had a trick up their sleeves I didnt know about. Maybe its possible for Oleh to add such an option to the Options | SFX window:
- Break on Original Entry Point (default)
- Break on call to Original Entry Point
I for one would find that very handy :)

Either way, Im extremely impressed with the SFX options and capabilities, OllyDbg seems to be the only debugger/disassembler that takes 'packed' executables into account, which I find somewhat strange considering how prevalant packers are these days - thumbs up to Oleh for that!

Maybe somebody with good OllyDbg experience (and a bit of spare time!) should write some sort of tutorial on OllyDbg's SFX capabilities, as I don't think many people are aware of it (like most of OllyDbg's capabilities, they're hidden away behind a menu or options dialog!). So Im sure there's a lot of people who aren't even aware of this powerful capability of OllyDbg. People often talk about SoftICE having advantages over OllyDbg simply because it's a system-level debugger, but as I only do application-level debugging, I find OllyDbg much more useful/helpful/easier to use/more informative, and unlike SoftICE, OllyDbg gives me smart analysis and SFX options, neither of which SoftICE have. In other words, I can't praise Oleh enough, so I'll stop trying to find words to express my gratitude. :)

Thanks anyway, and enjoy your weekend! :)
ricnar456
01-10-2003, 10:03 AM
and when you pause in entry point if you go to call stack (k) dont look the call?

Ricardo
Wayne
01-10-2003, 10:17 AM
No, call stack is empty ... ?
ricnar456
01-10-2003, 11:14 AM
The only form is with trace into, in set condution put stops in EIP>XXX y EIP > YYY

XXX start of first section (code)
yyy end of first section (code)

when olly stops in entry point go to RUN TRCE window and look, you will see the lines befores the entry point, and if you press the key - (minus) you go back to this line.
If olly stops before of the entry point, for ecxception SHIFT +F7 and trace into again.

Try this is slow but the best form

Ricardo
ricnar456
01-10-2003, 11:15 AM
Sorry eip >xxxx and eip <yyyy
In set condition
Ricardo
Wayne
01-10-2003, 12:45 PM
Thanks! I've never used that feature before, its nearly 1am here so Im about to hit the sack but Ill have a play around with that tomorrow :)


Whats your favourite feature of OllyDbg?

RCE Messageboard's Regroupment > General > Whats your favourite feature of OllyDbg?
Wayne
01-10-2003, 09:57 AM
Almost every day that Im working it seems Im discovering something new and very cool about OllyDbg that I didn't realise even existed, and as there are a lot of features I still haven't had time to play with, I know there's a hell of a lot of features and capabilities I'm still unaware of.

My question to this forum is -- what is your favourite feature of this excellent debugger, and why? :)
Squidge
01-10-2003, 04:57 PM
My favourite feature? The single step function :-)

Other than that, I find the "Log breakpoint" feature extremely useful too.
FR
01-10-2003, 05:19 PM
wayne, i have same exact feeling all the time. ollydbg seems to have an endless list of wonderful surprises for us :) one of my fav is the ability to bring up a box with a list of all references in the program to a specific address. but of course that just reminds me that another favorite feature is how ollydbg shows you search results in windows where you can easily set breakboints.
CYDONIA
01-10-2003, 09:22 PM
Hi All Friends :)

This my first message,

- Realtime thread debugging,
- Copy current code disasm or hex to file (or clipboard)
- UDD file! nice idea!
- and more nice functions

a little idea for plug-in coders. My old dos debugger support "macro log" capality. I think for ollydebug very compality for macrolog.

Example macro log:

401000 EIP point
401000 10xF8key ; trace 10x
401010 01xF7key ; trace into call
5a4da1 GetEAX ; EAX = ?
....

like

have nice days

(Excuse me my bad English,)
Squidge
01-11-2003, 05:55 PM
Can you expand on your explanation of "macro log" ?
CYDONIA
01-11-2003, 11:56 PM
Hi,

Just a idea. I guess usefull packet, crpty or modified files. Like keypress or mouse activity recording. For examples 10 times F8 key press:

<pre>10x[f8]</pre>

or mouse leftclick and modify reg.eax value :
<pre> mod[eax] </pre>

My old dos debugger was TRdos. TRDos script macro example :

<pre>
reload
BPXB F3 A4
G
R GS CX
BP 100
G
R CX GS
N example.com
W
</pre>

have nice days,
TBD
01-13-2003, 02:41 AM
CYDONIA: Anastasius Focht is working on a scripting plugin that will do this kind of stuph ... also me and gigapede were thinking at the same ideea :)
Squidge
01-13-2003, 06:37 AM
yup, same here. Would be useful for packed programs to get back to the a certain state in the code without having to do all the crap usually involved in unpacking.


How do debuggers restore the breakpoint?

RCE Messageboard's Regroupment > General > How do debuggers restore the breakpoint?
Wayne
01-13-2003, 12:49 AM
Consider the following code ...
<pre>50 PUSH EAX
51 PUSH ECX
56 PUSH ESI</pre>
When a debugger sets a breakpoint on the first instruction, it replaces 50 with CC, and the debugger when it gets there then breaks at that instruction. When the user presses Step Into to go to the next instruction (api ContinueDebugEvent), it replaces CC with the original instruction - 50 (push eax). However, wouldnt the call to ContinueDebugEvent immediately go to the next instruction (51 PUSH ECX) and skip over the first instruction? Because if it didnt do that, it seems the debugger would get stuck in a loop? But if it does skip over the instruction, then wouldn't I need to decrement the EIP register?

Any help would be much appreciated!
focht
01-13-2003, 03:18 AM
Greets,

well the break event (EXCEPTION_BREAKPOINT) reports an ExceptionAddress.
This is the return address where the exception occurred.
Restore the original opcode with WriteProcessMemory(). Then you just contine with EXCEPTION_CONTINUE_EXECUTION (OS continues just from where execption occurred - it executes the real instruction).

If you want to keep existing breakpoints you need to do more:

Set the trace flag and SetThreadContext() to continue to execute from last exception.
Wait for the incoming trace exception event.
Restore the original breakpoint (WriteProcessMemory) and disable tracing by resetting the trace flag (again using SetThreadContext()).

Regards,

Anastasius Focht
Wayne
01-13-2003, 03:25 AM
Thankyou very much! thats an excellent description of how it works :)
Ive read a lot on the subject over the last few days, including MSDN tips, but nothing really hit on the subject of 'breakpoint restoration' as well as your description does :)
Thanks very much again
Wayne
01-13-2003, 11:40 PM
Last question - how do I "just continue with EXCEPTION_CONTINUE_EXECUTION"? Im not using C or C++ and im not using SEH - Im just catching EXCEPTION_BREAKPOINT in the main debugger loop
focht
01-14-2003, 03:15 AM
Greets,

your exception filter/main loop returns with EXCEPTION_CONTINUE_EXECUTION.
This forces the OS to restore the thread context from the EXCEPTION_POINTERS context record and continue executing where the exception occurred (the thread executes the real instruction).

Regards,

Anastasius Focht
Wayne
01-14-2003, 03:50 AM
Thankyou so much for your help with this focht, this is something I need to get working, its not optional! :( but nobody seems to know other than you! :)
Here's what Ive got so far (its working perfectly so far and it's restoring the breakpoint, all it's not doing is the EXCEPTION_CONTINUE_EXECUTION bit to go back to the restored breakpoint -- instead, because Im not doing that, its just continuing to the next instruction, skipping over my restored instruction) ...
<pre>DO
WaitForDebugEvent DE, %INFINITE
SELECT CASE DE.dwDebugEventCode
CASE %EXCEPTION_DEBUG_EVENT
SELECT CASE DE.u.deuException.ExceptionRecord.ExceptionCode
CASE 2147483651: ' &h80000003:
STDOUT "STATUS_BREAKPOINT, address 0x" & HEX$(DE.u.deuException.ExceptionRecord.ExceptionAd dress,8)
DIM Patch AS BYTE, PatchPtr AS DWORD, lpBytes AS DWORD
hThread = OpenThread(0,0, DE.dwThreadid)
Patch = &h40
PatchPtr = VARPTR(Patch)
WriteProcessMemory hProc, BYVAL DE.u.deuException.ExceptionRecord.ExceptionAddress , BYVAL PatchPtr, BYVAL LEN(Patch), lpBytes
Patch = 0
ReadProcessMemory hProc, BYVAL DE.u.deuException.ExceptionRecord.ExceptionAddress , BYVAL PatchPtr, BYVAL LEN(Patch), lpBytes
IF Patch = &h40 THEN: STDOUT "Wrote ok!": ELSE: STDOUT "Write failed, byte=" & HEX$(Patch)
/* Need to somehow call EXCEPTION_CONTINUE_EXECUTION at this stage!! */
CASE ELSE
STDOUT "Other exception: 0x" & HEX$(DE.u.deuException.ExceptionRecord.ExceptionCo de)
END SELECT
END SELECT
ContinueDebugEvent DE.dwProcessId, DE.dwThreadId, %DBG_CONTINUE
LOOP</pre>
focht
01-14-2003, 03:57 PM
Greets again...

Wow first time i see someone using debugger loop in Visual Basic (looks like) :|

Well i missed the part about the "main debugger loop" so this is how it should work (pseudo C-Code):

<pre>

case EXCEPTION_DEBUG_EVENT:

if( exceptRec.ExceptionCode == EXCEPTION_BREAKPOINT)
{
...
byte opcode;
if( get_patch_byte_from_bpt_list( exceptRec.ExceptionAddress, &opcode))
{
// WriteProcessMemory( ...)
restore_original_instruction( exceptRec.ExceptionAddress, opcode)

// get thread context for the thread that actually hit the BP
CONTEXT context;
context.ContextFlags = CONTEXT_FULL;

if( GetThreadContext( hExceptionThread, &context))
{
// The EIP in the context structure points past the breakpoint, so
// decrement EIP to point at the original instruction
context.Eip = context.Eip-1;

// set the new context
SetThreadContext( hExceptionThread, &context);

// ContinueDebugEvent with DBG_CONTINUE will the thread
// execute original instruction
}
}
...
}

...
ContinueDebugEvent( ..., DBG_CONTINUE);

</pre>

Regards,

Anastasius Focht
Wayne
01-14-2003, 10:57 PM
Anastasius, bingo! That's exactly what I needed to see :)
Thankyou so very, very much with this - it's an area of programming that not many people seem to have much experience with so it's hard finding somebody who's both willing and able to help. You're a gentleman!


Bad or unknown format of 32 bit excutable error me

RCE Messageboard's Regroupment > General > Bad or unknown format of 32 bit excutable error me
helloword
01-13-2003, 05:33 AM
Bad or unknown format of 32 bit excutable error message box

Soft name: Hunter Stone Web.Config Editor

Problem happen with some dll's:
system.xml.dll
infragisticx.shared.dll
interop.shdocvw.dll
....
focht
01-13-2003, 03:46 PM
Greets,

well you just stumbled upon your first .NET application :).

Though the "hull" seems to be a valid PE executable but in fact it contains intermediate language (MSIL) code. However, it is a binary format and not easily read by humans. Theoretically, IL is not specific to any particular CPU. Instead, it is portable across any CPU that the compiler might target.
At run time, the .NET JIT compiler takes the IL and generates real code in dynamically allocated memory. If you want to know more about .NET, specifically IL, CLI/CLR i suggest MSDN...

If no additional steps are taken, IL code for these assemblies can be easily reversed (metadata/reflection) with the help of some decompilers that generate pretty good VB .NET/C# Code. Even the standard IL disassembler (ILDASM, comes with .NET Framework SDK) should give a good intro how the .NET assembly is organized. Google for decompilers...

Most .NET enabled commercial software/shareware use obfuscators.
These tools renames all possible symbols (class, interface, field and method identifiers) to render them meaningless, and strips all unnecessary information (local variable, method parameter names, debug information and some metadata) from your .NET assemblies. In that case you need some experience ...

If you see applications, that reference mscorlib.dll (which contains portions of the System namespace, as well as namespaces such as System.Collections, System.IO, System.Reflection, and System.Threading) there is a great chance that it is a .NET enabled app.

Your "problem" DLLs are just .NET/interop assemblies:

system.xml.dll - implements system.xml namespace (see .NET Framework SDK)
infragistics.shared.dll - seems the app uses some .NET bases controls from infragistics
interop.shdocvw.dll - interop assembly for browser/explorer control

Disassembly of these assemblies which is far beyond the context of ollydbg.
My advice: use .NET tools to reverse/debug such applications.

Hope this helps.

Regards,
Anastasius Focht.


inspector

RCE Messageboard's Regroupment > General > inspector
Anonymous
01-13-2003, 04:28 PM
Without code source the feature inspector can't be used ?
If yes, I will appreciate an explanation and practical example


Breakpoint examples

RCE Messageboard's Regroupment > General > Breakpoint examples
Anonymous
01-13-2003, 05:05 PM
OllyDbg offer a large pallet of breakpoint
Ordinary breakpoint
Conditional breakpoint
Conditional logging breakpoint
Message breakpoint
Trace breakpoint
Memory breakpoint
….
If someone discovers a nice combination of action by using one of then, please post it here.
This can help to understand the great potential of those breakpoint.


Klipfolio

RCE Messageboard's Regroupment > General > Klipfolio
helloword
01-14-2003, 12:02 PM
Hey Guys.
Look at this tool is very nice and even support OllyDbg Forum
http://www.klipfarm.com/farm.php?page=search
TBD
01-14-2003, 12:24 PM
helloword: hehe, look here (http://www.rohanpall.com/ollydbg/index.php?action=vthread&forum=4&topic=71)

i made the klip some time ago(november.2oo2) ... i think i must put some
some links on the first page for new users

... btw, always use search function :)
helloword
01-14-2003, 12:55 PM
:-O
Oops I didn't see it.
TBD
01-14-2003, 01:04 PM
helloword: no problemo ... if you find a vBulletin msgb general parsing klip, please let me know


Very strange behaviour

RCE Messageboard's Regroupment > Bugs > Very strange behaviour
Firestream
01-14-2003, 07:16 PM
Hello,

I'm dealing with a very strange problem when I'm working with the latest version of OllyDbg. The executable that I'm trying to load all of a sudden won't load even without OllyDbg. I try to execute the file and I get a GPF right away before even getting into the program. It's almost as if some system file got changed or corrupted.

My OS is Windows XP without SP1.

Here's what I've done to try and get this executable functioning again:
1. I've replaced the file in question with a backup.
2. I've done a repair install of Windows XP
3. I've deleted OllyDbg from my system.
4. I've deleted anything in c:\windows\prefetch

Nothing works except doing a clean install of XP.

Anyways does anyone know if OllyDbg changes any system files. Any ideas?

TIA
TBD
01-15-2003, 02:40 AM
Firestream: OllyDbg doesnt change any system file, nor registry. Everything it creates in his directory (.ini,.udd & .bak)

maybe your program has a timeout routine, have you tried tracing the program
and see where it exits ?
Firestream
01-15-2003, 11:23 AM
It's actually a program that we are writing in C++ and we needed OllyDbg to try and find the cause of a GPF while running a routine in the executable. Now OllyDbg reports the error on startup on an API called DuplicateHandle while setting up stout, stin, sterror. This occurs while trying to load the program before we ever get into the main loop. This has happened twice now while trying to find a GPF much further in the program.

I'm stumped and just about ready to repave this machine again. I really like OllyDbg so I'd like to prove to myself that this behaviour isn't caused by it so that I can feel comfident using it on othet projects.

I've also looked for any locked or corrupted files that our program uses and replaced them just in case. The new error occurs way before these files ever get touched though so I wasn't too hopeful this was the cause and sure enough, it wasn't.

I'm still hoping that XP caches executable somewhere that I'm not aware of or maybe OllyDbg does also and that is what I have to find and clean up. That's why I first thought to clean out c:\windows\prefetch
focht
01-15-2003, 02:34 PM
Greets,

- does the startup error happen only with ollydbg or does it happen too in your development environment (debug program)/other debugger (windbg)?
- does it happen both in release and debug version?
- post the complete call stack (source level) of the thread where the exception occurred

So long...

Anastasius Focht


option

RCE Messageboard's Regroupment > General > option
Anonymous
01-15-2003, 03:18 PM
option
Tacman
01-15-2003, 06:47 PM
yes ;)


Import .nms files

RCE Messageboard's Regroupment > Plugins > Import .nms files
psyCK0
01-18-2003, 09:01 PM
Well, SIce can use .nms files to use names for code locations like procs etc..

Is there a way to use them with olly? Some plugin?
focht
01-27-2003, 03:37 PM
Greets,

softice .nms files are used for kernel mode driver (primary) and user mode application debugging. Input file formats are .dbg/.pdb and .sym files.

Its a proprietary file format with no "standard" tools/api supplement like microsofts dbghelp API. There is no use *outside* of softice.
The whole debug helper api that most user mode debugger use is centered around .dbg and (much more) .pdb file format.

Why in the world whould someone use numegas .nms files for a user mode debugger like ollydbg when .pdb (.dbg is deprecated) is the native symbol information format?

input .dbg/.pdb/.sym -> conversion -> intermediate .nms -> conversion/emulation -> debug helper api (which needs .dbg/.pdb information)
= pretty much useless.

Regards,

Anastasius Focht


Where to begin?

RCE Messageboard's Regroupment > General > Where to begin?
balt
01-19-2003, 09:24 PM
I'm new to debugging "hardcore" style, and I'm stuck with an interesting challenge: I need to find out what parameters are passed to a DLL function with neither source code to that DLL nor the calling app. Is there a tutorial that shows how such a chore could be accomplished?

cheers

- Balt
Wayne
01-19-2003, 11:18 PM
Breakpoint on the DLL function and press Ctrl+A, OllyDbg will analyse the parameters for you
balt
01-20-2003, 01:12 PM
Thanks. Is this PB Wayne btw?


removing JIT debugger

RCE Messageboard's Regroupment > General > removing JIT debugger
tweedle
01-23-2003, 08:11 AM
I figure you can remove the JIT debugger by deleting the entire Aedebug key, but wouldn't it be nice if there was a button for that in ollydbg's JIT options?


List of bugs and my propositions

RCE Messageboard's Regroupment > Bugs > List of bugs and my propositions
Anonymous
01-24-2003, 08:52 PM
Breakpoints in dll not saving :(
Small bug with sizing registers window

Move Shortkeys to standart shortkeys...F3(file open) Ctrl O;
Maybe Settings for shortkeys;
Button Clear *.temporary files
NEW submenu "Show in code" on Stack window
Enabling\Disabling breakpoints....
ADD Very Slow but very hi-quality code analyse...
IDA style navigating (Jxx)

My English is very bad?? Yeah...i'm know this...but Мой Русский :) Более менее...:)))


Why Memory breakpoint are not listed in the breack

RCE Messageboard's Regroupment > General > Why Memory breakpoint are not listed in the breack
Anonymous
01-28-2003, 08:18 PM
Why Memory breakpoint are not listed in the breackpoint list (Alt+B) ?


HMEMCPY o POINT H in XP for OLLYDBG

RCE Messageboard's Regroupment > General > HMEMCPY o POINT H in XP for OLLYDBG
ricnar456
01-29-2003, 04:10 PM
I have a tutorial in spanish named HMEMCPY POINT for XP or POINT H and one friend is traducing to english i think is very interersting, Hmemcpy point or POINT H is a point in a XP what is similar to hmemcpy in Window 98, in five minutes you discover that point and forever you put BP xxxxxxx this direccion in the command bar and is similar to hmemcpy, stops when you enter a serial in a window or a name, and is similar to the hmemcpy in w98, you can view the point of the memory, where this serial or name or key is stored to work with this.
I can put a tutorial in the tutorial list and how?
I put the spanish version or waits to the traduction to english to put in there.

Ricardo Narvaja
TBD
01-30-2003, 02:36 AM
ricnar456: send me the tutorial formated as the others and i hapilly put it there
ricnar456
01-30-2003, 04:40 AM
Well, i put in format and wait for de traslation to english for make this better.

Thanks
Ricardo
peterg70
02-02-2003, 06:07 PM
Why not just run it through babelfish (altavista) translation engine. It will convert it 95% accurate and this should give you a good idea what it is on about

peterg70
ricnar456
02-04-2003, 10:21 AM
I send to TBD in Spanish, and now the trslation to english is ending, tomorrow i think ahh, first i can put in format of the tutorial, a couple of days more.

Ricardo


Proc names in IDA and Olly

RCE Messageboard's Regroupment > General > Proc names in IDA and Olly
psyCK0
01-30-2003, 06:31 AM
Is there any way to somehow export function names etc from IDA and get them into OllyDbg? As it is now i get this in IDA:
<pre>
.text:0041C030 push esi ; int
.text:0041C031 push eax ; int
.text:0041C032 call __isctype
</pre>
and this in olly:
<pre>
0041C030 |. 56 PUSH ESI
0041C031 |. 50 PUSH EAX
0041C032 |. E8 343B0000 CALL XXX.0041FB6B
</pre>

I'd like the call in Olly to also be named __isctype :)
TBD
01-30-2003, 06:52 AM
psyCK0: export as .map and use mapconv plugin


Attach

RCE Messageboard's Regroupment > General > Attach
Anonymous
01-31-2003, 08:54 PM
1- File
2- Attach
3- I select an exe file from the list of the windows ‘Select process to attach’
4- PROBLEM the exe file is not running and accecible any more.

In Fact I have a file protected by EXE PROTECTOR and I did’nt manage to make it running when I open it even with F9.

The advantage with ‘attach’ option is that I can by-pass the protection and display the assembler code the drawback the program is not running anymore and not accessible.

Any idea or best practice to solve this issue are welcome.
Anonymous
01-31-2003, 09:17 PM
Not EXE PROTOTOR but ASPROTECT :)
Norb
02-01-2003, 08:59 PM
Once you attach, the program is paused. To run it, you need to use F9.

Ensure you don't attach whilst in AsProtect code, or strange things will start happening.

A much easier approach is to strip the AsProtect stub from the code, and view the original, unprotected code. It only takes about 10 minutes to completely remove AsProtect.
Anonymous
02-01-2003, 11:23 PM
May I ask you to write the big lines on How to unprotect an exe file from AsProtect in 10 minutes?
peterg70
02-02-2003, 06:03 PM
How about picking a nickname so we don't have to call you AnonXXX

Removing AsProtect in 10 minutes is quite possible but as the old proverb goes "its better to teach a man to fish than to keep giving him fish".

So firstly learn how to use a search engine. There are tutorials adnausiam on the net regarding unpacking asprotect. Also there are tools that will do the job for you if your lazy enough.

My 2 cents worth
Peterg70
Norb
02-02-2003, 08:12 PM
My preferred method is to learn how to unpack AsPack manually, then use a pre-written unpacker. When the unpacker fails (and it will) you can manually unpack the target.
Anonymous
02-19-2003, 08:24 PM
to attach to a file
1. open you exe protected file (make sure to open it first)
2. open ollydbg - attach your process
3. once its paused, select View - Memory
4. look for "code" in "Contains" column. (make sure its on same row as your exe)
5. right-click - Set memory breakpoint on memory access
6. now press Run and select you exe from taskmanager
7. ollydbg will stop on assembler code, and finally Remove memory breakpoint

KarL


Show SEH handlers on stack frame?

RCE Messageboard's Regroupment > General > Show SEH handlers on stack frame?
Norb
02-01-2003, 09:05 PM
Is there any plug-ins available for showing the current SEH structures that are stored on the stack frame? It would make it much easier than searching the stack each time manually to find such handlers.

Possible future version feature could be that when Olly puts up the "Exception blah blah - Press Shift-F9 to pass exception to program" to allow viewing of the address the program would branch to in order to process that exception.

And while I'm here - is it possible to show references to segment FS: in another colour than default?


Project Files

RCE Messageboard's Regroupment > General > Project Files
peterg70
02-02-2003, 06:10 PM
Here is a simple one.

Is it possible to save project files *.udd etc to a directory under Ollydbg like Projects (..\ollydbg\projects).

I don't believe this could be done via a plugin. Maybe a new version of ollydbg.

peterg70


Access violation when writing to [00000000]

RCE Messageboard's Regroupment > General > Access violation when writing to [00000000]
helloword
02-03-2003, 04:00 PM
By debbuging some packed software I have must of the time this error message:
Access violation when writing to [00000000]
in the Log data windows and OllyDbg break.
With some SHIFT+F8 and everything is OK.
Is there an option to disable this issue.
By the way sometime this even are welcome to have some nice info in the Log data window.
helloword
02-04-2003, 09:06 AM
Oops This options exist in Ollydbg.
It's ready a very good debugger


Changing EIP

RCE Messageboard's Regroupment > General > Changing EIP
homunculus
02-03-2003, 06:40 PM
Hello all, is there a way to change the EIP of the debugged application???

H.
TBD
02-04-2003, 02:45 AM
homunculus: right click in CPU window, new origin here


Exceptions when debugging???

RCE Messageboard's Regroupment > General > Exceptions when debugging???
homunculus
02-03-2003, 06:48 PM
Hello, I have been wondering why when debugging a given application I sometimes get an exception. It doesn't happen all the times but it does happen sometimes. It seems a non deterministic behavior: going thru an application with a number of breakpoints set I sometimes see an exception and other times everything goes fine (without having added or removed any of the breakpoints).

H.
TBD
02-04-2003, 02:46 AM
homunculus: depends on the application. if it has SEH, then maybe it has
a protection that uses exception to pass execution to the exception handler
homunculus
02-04-2003, 05:58 AM
No protections, I'm pretty sure. If it were a protection it would fire everytime ... while what I see is it firing once and not the following WITHOUT HAVING ADDED OR REMOVED ANY BREAKPOINT from one pass of code to the following.

H.
Norm
02-04-2003, 09:10 AM
Could still be protection - they don't occur every time, some only trigger every so often.


Jump analysis

RCE Messageboard's Regroupment > Plugins > Jump analysis
peterg70
02-04-2003, 01:18 AM
Would like to see a plugin that scans slightly ahead for JE JNE statements while the current instruction is being analysed (CMP or TEST etc)

Then it would turn on the jump path that the current test would result.

i.e.
instructions are
mov eax,01
test ax,ax
JE +2 instructions

When the EIP is a test command this would then scan forward for the next JE/JNE/etc and show in ollydbg where this would lead to.

Currently ollydbg only shows the jump details when your actually on the jump.
You might have to turn this option on in Options/CPU/Show Jump path.

Any thoughts
peterg70
TBD
02-04-2003, 02:55 AM
peterg70: you are free to make one ;)
::hint - use _ODBG_Pluginmainloop, but be aware that your code must be very quick or else it will slow down OD to a crawl.

anyway, a nice ideea. a pitty that i dont have time to experiment :(
peterg70
02-04-2003, 08:08 AM
If we are single stepping through the code this shouldn't need to slow down Ollydbg at all as it is only performed if single stepping through code and once per instruction Or is some parameter is changed.

Wish I had time to create one. Just offerred the idea to someone who has the time and effort to do it.
Anonymous
02-11-2003, 04:36 AM
Ah yeah, and that olly crack program for you alone :-(
peterg70
02-13-2003, 07:04 AM
Sorry what the hell do you mean by

Olly Crack program ?????????

How about using a nickname rather than anonymous

peterg70
TBD
02-13-2003, 08:47 AM
peterg70: he meant, that Olly plugin will crack the program for you :)
peterg70
02-14-2003, 12:56 AM
@TBD

Did I miss something I said. I never mentioned cracking.

I jsut have a hard time trying to predict the what the next jump instruction is going to do.

so if I am on a CMP ax,01 and the next instruction is JLE x02 I thought that the plugin would look at the current instruction and work out what the answer will be and then go to the JLE and show where its going to branch too.

Maybe using the internet has reduced the amount of typing I do but I still don't understand what he meant.

The olly plugin is a display only plugin for analysis. I.e. On the fly analysis.

My 2 cents worth
peterg
TBD
02-14-2003, 02:57 AM
peterg70: i think everyone becamed too lazy to write plugins (including me), it is better to wait for OD 2.0 and then complain that this features is not included, ...

.zZ


Jumping to an address in the disassembler pane

RCE Messageboard's Regroupment > General > Jumping to an address in the disassembler pane
homunculus
02-04-2003, 06:40 AM
Is there a way to jump in the disassembler pane to an address loaded on the stack? For example debugging the CallWindowProc function called with the GWL_WNDPROC parameter I'd like to be able to easily jump to the address of the new window procedure. Also I noticed that using the GO TO EXPRESSION in the disassembler pane and typing an address starting with an hexadecimal letter and for example missing the leading zeros I get and INVALID EXPRESSION notify. This does not happen if the address begins with a number. This is a bug that should be notified to Oleh.

H.
Norm
02-04-2003, 09:15 AM
"Also I noticed that using the GO TO EXPRESSION in the disassembler pane and typing an address starting with an hexadecimal letter and for example missing the leading zeros I get and INVALID EXPRESSION notify. This does not happen if the address begins with a number. This is a bug that should be notified to Oleh."

Nope. Not a bug. If it starts with a number, it's assumed to be an address.

If it starts with a letter, it could be a symbol, hexadecimal value, or whatever.

To go to address DEADBEEF, simply prepend 0 or 0x.
homunculus
02-04-2003, 11:36 AM
No one answered to my question ... :-(

H.
TBD
02-05-2003, 04:52 AM
homunculus: if the address is in the stack then you press ENTER in stack window and CPU window will go to that address.


Returning from a function call???

RCE Messageboard's Regroupment > General > Returning from a function call???
homunculus
02-04-2003, 10:21 AM
Hello,

is there a way once I mistakenly follow the code inside a library call to jump to the line code just after the return from such a function call????

H.
TBD
02-04-2003, 10:30 AM
homunculus: ALT+F9 if u enter in win32api calls or you can use -/+ to navigate through OD history
homunculus
02-04-2003, 10:40 AM
I remember a menu item somewhere ...

H.
oh me anon
02-05-2003, 07:18 AM
if i understand you correctly you press f7 on any api call call like getmodulehandle a and you end up in library and have to trace through it to return to the next line of command in app

if that is the case once you mistakenly go inside press -(minus sign) to return to the original instruction then navigate to the next line by down arrow and set a breakpoint there and press f9 you return to the next line without tracing through the lib call

by the way you can also play with set conditon on runtrace (eip option)and use ctrl + f12 to achieve the same result
homunculus
02-05-2003, 09:17 AM
oh me anon would you say something more on playing with set conditons on runtrace? How would you obtain the same result?

H.
oh me anon
02-05-2003, 09:50 AM
homunculuswell when you are using debugger you have to try something for yourself too ;)

anyway here is how you can do it
00401000 > $ 6A 00 PUSH 0 ; /pModule = NULL
00401002 . E8 DF010000 CALL 004011E6 ; \GetModuleHandleA f7 here
00401007 . A3 A0314000 MOV DWORD PTR DS:[4031A0], EAX come here

and end up here

004011E6 FF25 14204000 JMP NEAR DWORD PTR DS:[402014];KERNEL32.GetModuleHandleA

now click debug or use CTRL+T
check mark the EIP is in Range CheckBox
enter 401005 in the from edit box |<----- dont ask me where is from or to edit
enter 401010 in the to edit box | box i have named them so
press ok
press CTRL+F12
the debugger stops at 401007 with the message
conditional pause: EIP in range 401005...401010

this debugger is a great tool devote some time and learn the intricacies of it
it will be very very usefull just shooting out questions wont help (dont misunderstand me i say this as a matter of fact)
oh me anon
02-05-2003, 10:23 AM
sorry i hate to post cosecutive mails but had to do this
all the above described jugglery i did in ollydbg 1.06 which did not have the alt+f9 hotkey as TBD rightly pointed out pressing alt+f9 in 1.08 does the job of returning you to usercode when you are in a librarycall

for TBD

if you have seh in the application and you pass exception by shift+f7 and press alt+f9 it should stop at the user code at sehhandler isnt it doesnt seem to do it returns to the result of seh any ideas why so
TBD
02-05-2003, 10:54 AM
oh me anon: i didnt understand fully how SEH works. usually i ALT+F9 to bypass the exception if the SEH handler treats the exception.

:mental note: study SEH :)
homunculus
02-05-2003, 11:43 AM
oh me anon you are right, but apart learning to use the debugger's features what I sometimes feel missing is a general knowledge of how things work behind the curtain ... and I'm talking of things such as the PE format, the IAT, and so on.
But I do dedicate it time ... and a lot in fact :-)

H.
homunculus
02-05-2003, 11:48 AM
Sorry guys, but does someone know if alt+F7, alt+F8 and alt+F9 are equivalent in passing the exception on?

H.
Anonymous
02-06-2003, 11:18 AM
normally I just use the "pass on exception to program" and see what happens. However, if the exception seems to do something interesting (Eg. carying on execution of the main flow of the program), I then search the stack for the last seh handler (which Ollydbg nicely marks for us), put a breakpoint there and then execute the "pass on exception to program" function which lands yet nicley into the first opcode of the exception handler.
Norm
02-06-2003, 11:19 AM
forgot to sign above post. sorry.

TBD: Can you please disable anonymous posts so I stop doing this? It's too easy to click "Post message" and forget to type in login name. Sometimes login name is there, sometimes it's not.
TBD
02-07-2003, 11:19 AM
Norm: i also sometimes post as anonymous.

i always loved msgb that have the anon posts - if i have a question, i post and wait an answer and disappear in web darkness. :)

so the solution is to look everytime before "Post a message" if you have a "Logged as: " or you have your name in the Login box :) so dont be lazy


Calls and jumps to imported functions???

RCE Messageboard's Regroupment > General > Calls and jumps to imported functions???
homunculus
02-04-2003, 10:37 AM
Hello,

I recall at least 2 ways of calling functions referenced in the address table. One is by using a call and the other (I believe) by using a jump (????). Finding calls to the said function is easy but how should I find the jumps??? Also are there other ways of calling imported functions???

H.
TBD
02-04-2003, 10:44 AM
homunculus: in the same way, CTRL+R - Find references
another way to call a function is to push on stack and do a ret
homunculus
02-04-2003, 11:06 AM
What is it that you push on the stack?

H.
TBD
02-04-2003, 11:12 AM
homunculus: the address where you want to go :) ... the address of function to be called
homunculus
02-04-2003, 01:15 PM
And what do after pushing the address? Do a ret?

H.
TBD
02-05-2003, 04:50 AM
homunculus: yup


From code to data???

RCE Messageboard's Regroupment > General > From code to data???
homunculus
02-04-2003, 11:05 AM
Hello,

how can I change a memory area from data to code???

H.
TBD
02-04-2003, 11:11 AM
homunculus: if it is not detected by analyzer as code than you cannot :(

btw, H. do you want to break the record of questions/minute ? :))
homunculus
02-04-2003, 11:34 AM
Am I near breaking it??? :-)

H.
homunculus
02-04-2003, 11:35 AM
What about playing around with the PE headers???

H.
TBD
02-05-2003, 02:46 AM
homunculus: what about PE headers ? you can view the PE headers from memory window if you dump it ... nice formatted
homunculus
02-05-2003, 04:19 AM
Playing with PE headers would accomplish what I was asking for?

H.
TBD
02-05-2003, 04:56 AM
homunculus: usually yes :)


Tracing to log file??

RCE Messageboard's Regroupment > General > Tracing to log file??
homunculus
02-04-2003, 06:55 PM
What does ollydbg provides in terms of logging to file??? For example can it log jumps to a log file? Can the trace be thrown on file?

H.
TBD
02-05-2003, 04:53 AM
homunculus: i suggest you try that out and see what comes out.
a lot of things are not descriebed in help but you should try it out.

i figured all OD without reading the manual (i love explore things).
i only checked for expressions parsing and not-so-obvious things.


Ollydbg handle leak (solves LINK problem?)

RCE Messageboard's Regroupment > Bugs > Ollydbg handle leak (solves LINK problem?)
focht
02-04-2003, 07:18 PM
Greetings,

i got same problem as reported earlier by some people (LINK, locked exe) and spent some time investigating it.

First to detect kernel/user object handle leaks you should use decent utilities:

www.sysinternals.com (http://www.sysinternals.com) -> ProcessViewer (the former HandleEx) or
www.smidgeonsoft.com (http://www.smidgeonsoft.com) -> NTObjects

Both will show you that ollydbg leaks 2 handles, a file object and a thread object after you "close" the debuggee. (internally 2 more handles, unnamed objects, are leaked from the OS debug subsystem too but this not the case here).

Well i'd say both handles returned by CreateProcess( ... DEBUG_PROCESS) in the PROCESS_INFORMATION structure must be closed by the debugger, e.g.:

processInfo.hProcess
processInfo.hThread

Every handle delivered in the xxx_DEBUG_EVENT structures must be closed or it will leak too (will go away after debuggee terminates but its cleaner programming style). The only exception is the thread handle stored in CREATE_THREAD_DEBUG_EVENT (if i read guru Matt Pietrek right).

I hope this information helps ...

Regards,

Anastasius Focht.
TBD
02-05-2003, 04:57 AM
focht: thanks.
how is your scripting plugin goin' btw ? :)


functions imported twice

RCE Messageboard's Regroupment > General > functions imported twice
homunculus
02-05-2003, 04:41 AM
Hello, I was wondering why sometimes I see the same function listed twice in the import table at different addresses. This isn't something ollydbg specific but still was wondering ....

H.


Can I set bp to every reference to a speific API c

RCE Messageboard's Regroupment > General > Can I set bp to every reference to a speific API c
Anonymous
02-05-2003, 05:17 AM
I want to know how to set breakpoints on every reference to a specific API
call from DLL.

If I want to set breakpoints on every reference to a specific API call
in case of exe debugging, I'm doing like this:

[ method 1 ]
1) Search for Name(Label)
2) Set breakpoints on every reference

But in case of dll debugging, I don't know what to do.
Now I'm doing like this:

[ method 2 ]
1) Find Refernce to a specific function exported by a target dll(Search for Name)
2) Set breakpoints on 1)
3) Run App and, if it breaks at 2), step into DLL
4) Search for Name(Label) -> Find reference to import
# But I cannnot set breakpoints on every reference by this method
# And at this point, method 1 does not work.

I want do "method 1" like thing, in case of dll debugging.
I will appreciate your help.

# I'm sorry for my poor English.


Logging to file ... again

RCE Messageboard's Regroupment > General > Logging to file ... again
homunculus
02-05-2003, 10:00 AM
Sorry for kind of repeting myself but I remember once having seen the possibility of sending logging to a file but looking thru ollydbg's menus and command and also the help file I found nothing at all. Did I only imagine it?????

H.
TBD
02-05-2003, 10:35 AM
homunculus: you mean the Log window ? if yes, right click on the Log window, Log to file

the same for the Run trace


Point H o hmemcpy point in XP

RCE Messageboard's Regroupment > General > Point H o hmemcpy point in XP
ricnar456
02-05-2003, 05:32 PM
I send to TBD the english version of this tute.

Ricardo Narvaja
TBD
02-06-2003, 02:46 AM
hmm, didnt received yet ... did you send it to tbd@despammed.com ?
ricnar456
02-06-2003, 07:09 AM
Yes, i send the tute, to this direction and three o four days ago y send the spanish version too.

I copy de direction of this page section files, and send with no response for some bad transmition or any bad.
The tute has 400 k

Ricardo Narvaja
ricnar456
02-06-2003, 08:35 AM
Well, in the yahoo briefcase is the tute here is the spanish version and the english version, and a old curso is here dont download this.

Punto_H Español.rar

y

Punto_H_english.rar

TBD if you want y send again you not have other mail?

Ricardo Narvaja
TBD
02-07-2003, 11:51 AM
ricnar456: it is too big for hosting here, can you please remove the pictures ?

and use this template (http://www.rohanpall.com/ollydbg/files/tutorial_template.htm) and remove information about InternetDesk or replace with another crackme (no real life programs allowed)

anyway, nice tutorial and i will happily host it ... next week, i hope :)

my alternative email: tbd.odf@mailnull.com
ricnar456
02-11-2003, 09:10 AM
If i quit the pictures the tute loose all, but i put the link for download, for any who want, is more easy and no troubles for you, sorry.

Thanks
Ricardo
TBD
02-11-2003, 09:27 AM
ricnar456: if you have a host to put your files i will happilly put a link here.
Anonymous
02-18-2003, 09:09 AM
Come on...publish that tutor!

Greetz,
CADZzz
ricnar456
02-18-2003, 04:34 PM
is published

http://briefcase.yahoo.com/

user:ricnar457 password:cursos

here is the spanish and english version

Ricardo
Anonymous
08-20-2003, 10:34 PM
Please Ricardo can you send the English Tut/Link to me at flame10@hotpop.com ("flame10@hotpop.com"). Thanks
en0n
08-28-2003, 09:38 PM
what's about that point.h tutorial???
can't find it anywhere...

give a link, please!
Ricrado Narvaja
08-29-2003, 04:07 AM
mail me and i send you ricnar22@millic.com.ar

Ricardo Narvaja


Breakpoint issue

RCE Messageboard's Regroupment > General > Breakpoint issue
helloword
02-05-2003, 07:25 PM
I load an exe file via attach option.(file A for example)
In this file I put some breakpoints lile bp MeassageBoxA.
I re-load ollydbg and I decided to attach another file for the first time.
I has been suprised to see that all previous breackpoints that coming from the file A are list in my breackpoint window.

Is it normal or it's a small bug?
TBD
02-07-2003, 11:55 AM
helloword: i never encountered. i tried with two different programs and everything worked okay. hmmm, strange.


how to hide ollydbg from debuger detection?

RCE Messageboard's Regroupment > General > how to hide ollydbg from debuger detection?
Anonymous
02-07-2003, 05:59 PM
hello!
how to hide ollydbg from debuger detection?
so,i can't crack a proggy once debuging it.
it seems to be packed by armadillo and has a antixxx.
Norb
02-09-2003, 11:29 AM
then you need to disable anti-debugger detection in your target app.
Anonymous
03-31-2003, 04:31 PM
How can i do that?
Ricrado Narvaja
03-31-2003, 07:18 PM
Armadillo only detect in XP OLLYDBG using the API
IsDebuggerPresent if you in XP put a BP in this api and trace three lines to the RET and put EAX to 0 armadillo dont detect olly.

Ricardo


Code Injection Errors

RCE Messageboard's Regroupment > General > Code Injection Errors
mark_E
02-08-2003, 05:52 PM
Why do I get code injection errors debugging certain applications in NT4?
oh me anon
02-09-2003, 07:04 AM
yep i too have seen this message box pop up some times (mostly when it encounters a breakpoint where it is doing some thing with memory createfilemapping etc
Text strings referenced in OLLYDBG:.text, item 1420
Address=00430A6A
Disassembly=PUSH OLLYDBG.004A7113
Text string=ASCII 004A7113 In order to perform action that is not supported by OS, OllyDbg
004A7153 has injected short piece of code into the debugged application,
004A7193 but received no response within 5 seconds. Do you want to wait f
004A71D3 or another 5 seconds? (If you answer No, the consistency and sta
004A7213 bility of program is not guaranteed and you should restart it as
004A7253 soon as possible).

you answer yes and it pops one more time ( i have made it popup more than ten times and at last had to answer no )

well when you answer no it pops up a msgbox
saying
004A7293 Debugged program may get unstable, pl
004A72D3 ease reload it as soon as possible.

well dont know what it is
focht
02-09-2003, 08:57 AM
Greets,

well there exist different hooking/code injection techniques..
The most common are:

- Registry AppInit_DLLs
- System-wide Hooks (SetWindowsHookEx)
- Injection DLL using CreateRemoteThread()

For Ollydbg case i assume its another approach (quick check he isnt using DLL injection in his _Injectcode export).

Hes writing small chuncks of code into enemy address space but with the exception that all code sections are guarded with INT3's.

This has the effect of automagically synchronizing the entry and exit points of the injection code with the debuggers main event loop.
Normally code injections have to use some "signal" mechanism like mutexes and shared memory to communicate from the injected proxy code with the injector process.

In this case the "Breakpoints" have the effect of causing DEBUG_EVENTs in the debuggers event main loop to appear. Now he can modify opcodes or transfer data, because all the debuggees threads are suspended. When ollydbg resumes the thread his "helper" code is executed.

Without looking deeper in the latter i assume that for some (unknown) reason the thread that the injected code belongs to got suspended due to some OS waitable objects. Then ollydbg main debugger loop detects this "timeout" (5 sec) and the message pops up.

Regards,

Anastasius Focht.
oh me anon
02-09-2003, 09:38 AM
hi focht
it seems you have got a deep understanding of olly and its procs and it seems that oleh has corrected (he says so ive not tried) the alt+f2 link problem in 1.09

any way ill give you a piece of action where i encountered the above problem most (this app is a piece of garbage remover from code )

its simple it getmodulehandles then creates openfilename struct then getopenfilenames cmp eax,1 you break point at that cmp eax,1 and this msgbox pops up

the code uptill the cmp eax is as follows

PUSH 0 ; /pModule = NULL
CALL <JMP.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
MOV DWORD PTR DS:[403558], EAX
MOV DWORD PTR DS:[403000], 4C
MOV DWORD PTR DS:[40300C], clean.00403385 ; ASCII "Executable Files"
MOV DWORD PTR DS:[40301C], clean.0040339D ; ASCII "C:\.EXE"
MOV DWORD PTR DS:[403020], 200
MOV DWORD PTR DS:[403034], 281804 ; UNICODE "hor"
MOV DWORD PTR DS:[403030], clean.004034A1 ; ASCII "Choose to open"
PUSH clean.00403000 /pOpenFileName = clean.00403000
CALL <JMP.&comdlg32.GetOpenFileNameA> ; \GetOpenFileNameA
CMP EAX, 1 <----- you break point here and the msgbox pops up

well you try to restart it pops up another message box saying

read the text :);););)

ollydbg requested termination of the debugged process but recieved no confirmation within 5 seconds WANNA WAIT( if ans == no ,stability not guarenteed
you may want to restart which is exactly what i was doing anyway

bye and greets focht
mark_E
02-09-2003, 06:38 PM
Hi oh me anon,
Hi focht,

Well, what can I say! You lost me a bit there.

However, in saying that, ollydbg seems a bit erratic in when it decides to do it. With only 'Break on Winmain' option set, and no other breakpoints, it sometimes generates the code injection error on entry and sometimes doesn't. I would have thought it should be a consistent 'problem.'

When it doesn't generate the error here, it will later, when resizing the window with BP set on'DefWindowsProc' but none of the multiple previous calls to this.

mark_E

P.S. Don't have the exact details with me at the mo' so please excuse me if my terminology isn't quite correct. I'm sure you can guess at my meaning if incorrect.
focht
02-09-2003, 07:10 PM
Greets again,

it seems that both of you (oh me anon, mark_e) share something - there are gui threads in your apps.
I can only guess that the message pump (which feeds default window proc) of the debuggees main gui thread doesnt run at the time ollydbg detects the timeout. This may be due to halt on breakpoint in the thread (suspended) or message deadlock.

In the latter of oh me anon:

"GetOpenFileName" calls shell browser helper objects which in turn create internal threads (timeout worker thread + rpc + additional gui thread). Maybe the main gui thread (which called GetOpenFileName) is waiting for messages from additional gui workers. If one or more of the gui threads get suspended in synchronous message call there may be a message deadlock.

I can look into the matter if the author of ollydbg publishes details of the small code pieces that get injected (and which thread context are they executed).

Regards,

Anastasius Focht
mark_E
02-10-2003, 01:02 AM
You are certainly barking up the right tree there!

The 'DefWindowsProc' problem occurs when a Kernel32 thread is created (Error_Sucess = 0)

The code injection problem on start up hasn't occured yet using 1.09

mark_E
oh me anon
12-13-2003, 12:47 PM
well its an old thread and its same old problem
i have this same "in order" message popping up in one app i am tracing

it pops up if and only if i use break point any where in the app
after the proggy creates a thread

0063FB74 004015F8 /CALL to CreateThread from blah.004015F3
0063FB78 00000000 |pSecurity = NULL
0063FB7C 00000000 |StackSize = 0
0063FB80 00401774 |ThreadFunction = blah.00401774
0063FB84 0000094C |pThreadParm = 0000094C
0063FB88 00000020 |CreationFlags = NORMAL_PRIORITY_CLASS
0063FB8C 004052A4 \pThreadId = blah.004052A4

i used w98 tracing this app

i break point any where in the thread function this message pops up
any ideas any one any ideas
focht are you there what am i supposed to do to eliminate this popup
focht
12-23-2003, 05:34 PM
Greetings!

Well the same applies as i said (ages ago).
The injected code might be "talking back" to the debugger.
If the code doesnt answer in a given time interval (5 secs), the debugger assumes something goes wrong.

I can only speculate what happens ... maybe the author of the debugger can shed any light on this:

- what kind of code is injected (some kind of SetWindowsHook(ex)/SetWindowLong equivalent?)
- under which thread context is the code executed (which of the debuggee's threads)
- state of all other debuggee threads during injection/communication stuff (suspended?)

If all of the debuggee's other threads are suspended, there might be a synchronization/message problem on the (single) running (message processing) thread if it depends on another thread to signal some sync object or process a message (which cant be fullfilled because the dependant thread is suspended -> deadlock/timeout).

Regards,

A. Focht
oh me anon
12-24-2003, 02:13 PM
well the same app when traced on w2k does NOT produce that "in order" warning
and neither hangs ollydbg and it breaks on the thread function
when it gets an input for WaitForSingleObject from SetEvent

00401B56 > \FF35 C4524000 PUSH DWORD PTR [4052C4] ; /hEvent = NULL
00401B5C . E8 970F0000 CALL 00402AF8 ; \SetEvent

some kind of lockout
focht
12-26-2003, 08:15 PM
Hello again,

>well the same app when traced on w2k does NOT produce that "in order" warning
Maybe ollydbg doesnt need to inject any helper code on NT-based OS (win9X = inject code to work around some missing functionality)?

Maybe you can produce/extract a _tiny_ example app (with C source code) where the "hangup" effect can be clearly shown on win9X based OSes.

Regards,

A. Focht
oh me anon
01-26-2004, 12:26 PM
oops i got this in w2k too this time in one app so thought ill debug olly on olly with the proggie that causes this problem as a debuggee

well the _injectcode seems to write to the dos header address of the proc
address for writeprocmem is 400000

and it writes these instruction it seems

0012CAE0 0045DECE /CALL to WriteProcessMemory from blingo.0045DEC9 <---blingo is ollydbg i renamed it as i cuoldnt have two ollys in one dir lame maybe ;) tell me if it can create probs (
0012CAE4 000000C0 |hProcess = 000000C0 (window)
0012CAE8 00400000 |Address = 400000
0012CAEC 00491778 |Buffer = blingo.00491778
0012CAF0 00000028 |BytesToWrite = 28 (40.)
0012CAF4 00000000 \pBytesWritten = NULL

00491778 CC INT3
00491779 0F2906 MOVAPS DQWORD PTR DS:[ESI], XMM0
0049177C 0F294E 10 MOVAPS DQWORD PTR DS:[ESI+10], XMM1
00491780 0F2956 20 MOVAPS DQWORD PTR DS:[ESI+20], XMM2
00491784 0F295E 30 MOVAPS DQWORD PTR DS:[ESI+30], XMM3
00491788 0F2966 40 MOVAPS DQWORD PTR DS:[ESI+40], XMM4
0049178C 0F296E 50 MOVAPS DQWORD PTR DS:[ESI+50], XMM5
00491790 0F2976 60 MOVAPS DQWORD PTR DS:[ESI+60], XMM6
00491794 0F297E 70 MOVAPS DQWORD PTR DS:[ESI+70], XMM7
00491798 0FAE9E 800000>STMXCSR DWORD PTR DS:[ESI+80]
0049179F CC INT3
004917A0 2800 SUB BYTE PTR DS:[EAX], AL

what the hell it is writing it seems i gotta google for xmm instructions stmxcsr ???

i post here just so that i dont loos this info

p.s
focht how can i contact you
oh me anon
01-28-2004, 08:54 AM
and here is this infinite loop that goes on and on
msdn says postthreadmsg will fail if there is no msg queue
is this is the problem how can i find it if my debuggee has the msg que or not

0043250A /PUSH 64 ; /Timeout = 100. ms
0043250C |LEA EDX, DWORD PTR SS:[EBP-1B64] ; |
00432512 |PUSH EDX ; |pDebugEvent = FFFFFFFF
00432513 |CALL <JMP.&KERNEL32.WaitForDebugEvent> ; \WaitForDebugEvent -------->this always returns ERROR_SEM_TIMEOUT (00000079)
00432518 |MOV EBX, EAX
0043251A |TEST EBX, EBX
0043251C |JNZ SHORT blingo.00432558
0043251E |PUSH 0 ; /lParam = 0
00432520 |PUSH 0 ; |wParam = 0
00432522 |PUSH 0 ; |Message = WM_NULL
00432524 |MOV EAX, DWORD PTR SS:[EBP+8] ; |
00432527 |PUSH EAX ; |ThreadId = 0
00432528 |CALL <JMP.&USER32.PostThreadMessageA> ; \PostThreadMessageA --------> this always fails with this ERROR_INVALID_THREAD_ID (000005A4)If the function fails, the return value is zero. To get extended error information, call GetLastError. GetLastError returns ERROR_INVALID_THREAD_ID if idThread is not a valid thread identifier, or if the thread specified by idThread does not have a message queue.
0043252D |MOV EDX, DWORD PTR DS:[4CC480]
00432533 |PUSH EDX ; /hCursor = FFFFFFFF
00432534 |CALL <JMP.&USER32.SetCursor> ; \SetCursor
00432539 |MOV DWORD PTR SS:[EBP-20], EAX
0043253C |PUSH 1356 ; /Timeout = 4950. ms
00432541 |LEA ECX, DWORD PTR SS:[EBP-1B64] ; |
00432547 |PUSH ECX ; |pDebugEvent = 01010101
00432548 |CALL <JMP.&KERNEL32.WaitForDebugEvent> ; \WaitForDebugEvent----> this again returns ERROR_SEM_TIMEOUT (00000079)
0043254D |MOV EBX, EAX
0043254F |MOV EAX, DWORD PTR SS:[EBP-20]
00432552 |PUSH EAX ; /hCursor = NULL
00432553 |CALL <JMP.&USER32.SetCursor> ; \SetCursor
00432558 |TEST EBX, EBX
0043255A |JNZ SHORT blingo.0043258F
0043255C |PUSH 2024 ; /Style = MB_YESNO|MB_ICONQUESTION|MB_TASKMODAL
00432561 |PUSH blingo.004AE54B ; |Title = "No response from injected code"
00432566 |PUSH blingo.004AE3F7 ; |Text = "In order to perform action that is not supported by OS, OllyDbg has injected short piece of code into the debugged application, but received no response within 5 seconds. Do you want to wait for another 5 seconds? (If you answer No, th"...
0043256B |MOV EDX, DWORD PTR DS:[4CAB2C] ; |
00432571 |PUSH EDX ; |hOwner = FFFFFFFF
00432572 |CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00432577 |MOV EBX, EAX
00432579 |CMP EBX, 6
0043257C |JE SHORT blingo.0043250A
focht
01-28-2004, 04:50 PM
Hello again...

<pre>
0043250A /PUSH 64 ; /Timeout = 100. ms
0043250C |LEA EDX, DWORD PTR SS:[EBP-1B64] ; |
00432512 |PUSH EDX ; |pDebugEvent = FFFFFFFF
00432513 |CALL <JMP.&KERNEL32.WaitForDebugEvent> ; \WaitForDebugEvent -------->this always returns ERROR_SEM_TIMEOUT (00000079)
</pre>

....
The function returned FALSE (error).
Because the signalling mechanism didnt work or some race condition (debuggee didnt generate any event within 100 ms)

<pre>
00432527 |PUSH EAX ; |ThreadId = 0
00432528 |CALL <JMP.&USER32.PostThreadMessageA> ; \PostThreadMessageA --------> this always fails with this ERROR_INVALID_THREAD_ID (000005A4)
</pre>

Can be anything ;)

The target thread never existed (wrong tid, wrong thread handle) or terminated before (no more valid).
The target thread indeed may not have a message queue created yet.
The target belongs to a different windowstation or desktop (different locally unique identifier (LUID))

Generally speaking:

Any worker thread can become a gui thread if it calls any XXXMessage() based APIs (SendMessage, PostMessage, PeekMessage, ...)
That is if the target thread calls PeekMessage(&msg, NULL, WM_USER, WM_USER, PM_NOREMOVE) it will force the operating system to create the message queue.

The interesting information is missing :(

* Code snippet which gets injected.

* What target thread is addressed by Postthreadmessage().
Please stop before Postthreadmessage() call, get the thread id of the target thread.
Verify that the target thread exists (thread view).
Try to find out who created the thread: the debuggee itself on normal program flow or by debugger using implicit API calls on injected code.

If you post ollydbg code, please collect it block-by-block, every disassembly block copied immediately _before_ the API function call.
Reason: I'd like to see the 'real' caller parameters - before registers and stack frame gets modified -> wrong "comment hints".

Put bp before each:

CALL OLLYDBG._Writememory
CALL OLLYDBG._Runsinglethread
CALL <JMP.&USER32.PostThreadMessageA>

in _InjectCode.
Run. Break. Copy the snippet with _intact_ and _valid_ parameters to text file.

And tell which ollydbg version you use (hopefully latest) ... ;)

Regards,

A. Focht
oh me anon
01-29-2004, 01:47 PM
well i am using 1.09b
i have those details in .txt
and it is too big to post here

that is why i asked you how can i contact you in one of the above posts
i used sysinternals process explorer to see if those threads exists

Process: blingo.exe Pid: 956

Type Name Handle Access

Thread Duck.exe(940): 696 0xBC 0x0002005B <--- hex 2b8
Process Duck.exe(940) 0xC0 0x0002047B
Thread Duck.exe(940): 1008 0xEC 0x0002005B <--- hex 3f0

0042C571 |CALL blingo._Injectcode ; \_Injectcode

arguments to this call
0012F790 |Arg1 = 000002B8 <--- see 2b8
0012F794 |Arg2 = 00491768
0012F798 |Arg3 = 0012F7AC
0012F79C |Arg4 = 00000084
0012F7A0 |Arg5 = 00000000
0012F7A4 |Arg6 = 04CA02EC
0012F7A8 \Arg7 = 00000000

here wait for debug event reports int3 (8000003)
so olly again uses injectcode

0042C571 |CALL blingo._Injectcode ; \_Injectcode

0012F790 |Arg1 = 000003F0
0012F794 |Arg2 = 00491768
0012F798 |Arg3 = 0012F7AC
0012F79C |Arg4 = 00000084
0012F7A0 |Arg5 = 00000000
0012F7A4 |Arg6 = 04CA0958
0012F7A8 \Arg7 = 00000000

here wait for debug event fails with error_sem_timeout

so it posts thread message
00432528 |CALL <JMP.&USER32.PostThreadMessageA>; \PostThreadMessageA

0012D924 |ThreadId = 3F0
0012D928 |Message = WM_NULL
0012D92C |wParam = 0
0012D930 \lParam = 0
this fails
ERROR_INVALID_THREAD_ID (000005A4)

so it waits for 5 more seconds and if i click yes it keeps on waiting
or if i say no it hangs

this may seem consistent behaviour but does this mean i cant debug multi threaded exes properly
one thread is waiting for single object in my debuggees(olly) debuggee(duck) iirc
oh me anon
01-29-2004, 02:27 PM
greets and thanks for taking pains to analyse and reply to my stupid quetions
you greet every time and i havent even in one

regards
there is no edit facility so i had to post one more time
focht
01-29-2004, 06:08 PM
Hi,

ok i agree there is much information which would fill this thread up :)

>focht how can i contact you

Here is how...

Simply create a text file, call it whatever and paste the following code:

<pre>
e 100 EB 10 42 4B 47 4C 50 64 43 49 5C 0A 4A 41 50 29
e 110 2E 00 BE 02 01 89 F7 B3 24 AC 30 D8 AA 3C 24 75
e 120 F8 31 C0 B4 09 BA 02 01 CD 21 B8 4C 00 CD 21
g =100
q
</pre>

Pipe that file to debug.exe

<pre>
debug.exe < thefile
</pre>

Dont worry. No harm ... just reminisce about old DOS times. That was fun ;)

--------

It would be extremly usefull if you can supply a small executable which show this behaviour and some setup instructions (send as .zip archive).

Regards,

A. Focht.
focht
01-29-2004, 08:07 PM
Greetings,

i think i can trigger ollydbg's code injection by myself now.
While i was reading another thread "SSE/SSE2" registers i noticed the comment "ollydbg injects code to read the registers due to lack of OS support".
So i turned SSE stuff on and - voila - it injected code.

Here is how ollydbg's code injection technique works (IMHO):

(stuff pretty simplified/shortened)

1. Have a good chunk of target memory. Save it.
In this case it is the PE header itself, starting at base address.
Read sufficient bytes of memory to ollydbg internal save area.

2. Modify page protection.
Because some of the bytes later get executed and writes data, the initial page bits must be adjusted to PAGE_EXECUTE_READWRITE.

3. Suspend main thread. Write the injector code to target area (starting at base address).

code snippet for this case:

00000000 CC INT3
00000001 0F2906 MOVAPS DQWORD PTR DS:[ESI],XMM0
00000004 0F294E 10 MOVAPS DQWORD PTR DS:[ESI+10],XMM1
00000008 0F2956 20 MOVAPS DQWORD PTR DS:[ESI+20],XMM2
0000000C 0F295E 30 MOVAPS DQWORD PTR DS:[ESI+30],XMM3
00000010 0F2966 40 MOVAPS DQWORD PTR DS:[ESI+40],XMM4
00000014 0F296E 50 MOVAPS DQWORD PTR DS:[ESI+50],XMM5
00000018 0F2976 60 MOVAPS DQWORD PTR DS:[ESI+60],XMM6
0000001C 0F297E 70 MOVAPS DQWORD PTR DS:[ESI+70],XMM7
00000020 0FAE9E 80000000 STMXCSR DWORD PTR DS:[ESI+80]
00000027 CC INT3
00000028 0000 ADD BYTE PTR DS:[EAX],AL
0000002A 0000 ADD BYTE PTR DS:[EAX],AL
0000002C 0000 ADD BYTE PTR DS:[EAX],AL
0000002E 0000 ADD BYTE PTR DS:[EAX],AL
.....
"local data area"
...

4. Adjust the target thread's context structure to appropriate values so the injector code gets executed next time, the thread resumes.
This means setting the register values to match injector code (esi offsets).

5. Set the targets thread context and resume the thread.

6. The thread will now run and execute INT3 instruction.
This is on purpose because it helps to synchronize execution with the debugger itself.

7. Ollydbg uses WaitForDebugEvent() to synchronize with the injectors code starting INT3 "ENTER" and ending INT3 "LEAVE".
Both debug events will occur if target thread executes the injector code.
After second event, the debugger knows the injector code has been "completed". The target thread is now suspended state.

8. The Debugger reads the targets process memory, especially the pseudo "data" area, where the injected code wrote the floating point register data (offset+0x30).

9. Time to restore. The debugger writes the old memory chunk back, restoring PE header. The page flags are restored to PAGE_READONLY.

10. The target thread context itself is adjusted to old state before the injection and then resumed.

Thats all so far.

If you encounter the injection errors, please could you bp on ResumeThread() and check the return value (suspend count). It might be possible that the target thread's suspend count prevents it from being scheduled.

Regards,

A. Focht
oh me anon
01-30-2004, 02:48 AM
greets
yep you are on dot and dos is fun and tr252 is even funnier to use
set source index(si) and destination index(di) to this
FHQBBAVdWMB].GKI

btw you have an accurate description of the inject code process
only thing you havent mentioned is it flushes the instruction cache before it sets the thread context in fact i have the dump of context registers content
before the setthread

k ill let you know
oh me anon
02-01-2004, 01:18 PM
greets focht,

resume thread happens four times inside the inject
here are the details
================================================== ====
retn values are 1 to both and they are different hThreads

0045E010 |CALL <JMP.&KERNEL32.ResumeThread> ; \ResumeThread
0012CAF4 000000EC \hThread = 000000EC (window)
return value when single stepped=00000001

0045E010 |CALL <JMP.&KERNEL32.ResumeThread> ; \ResumeThread
0012CAF4 000000BC \hThread = 000000BC (window)
retn value= 00000001
================================================== ======

================================================== ============
hThreads are same here and both times it returns 0

004746A9 ||CALL <JMP.&KERNEL32.ResumeThread> ; \ResumeThread
0012D910 000000EC \hThread = 000000EC (window)
retn value = 00000000

004746A9 ||CALL <JMP.&KERNEL32.ResumeThread> ; \ResumeThread
0012D8EC 000000EC \hThread = 000000EC (window)
retn value = 00000000
================================================== ====

from here it goes here
0042F3C8 CALL <JMP.&KERNEL32.ContinueDebugEven>; \ContinueDebugEvent

btw did you get the .txts
thanks and regards
focht
02-01-2004, 01:58 PM
Hi again,

well i reviewed the part just to notice the loop over ResumeThread().

In this case i think its not related.
We need a way (some application) to simulate the "injection timeout" problem every time not just randomly...

>btw did you get the .txts

Nope. Seems my inbound (server side) spam filter did its job too good ;)
I usually let the server automagically move "spam" marked mail into some dump folder. I never review/download them, they get recycled once a day ...

Maybe you can resend the stuff.
Dont use obvious words like money, p0rn and the like in header/body .. Ok, that was a joke ;)

Regards,

A. Focht
focht
02-01-2004, 02:37 PM
Some annotation... skip my previous statement "not related".

I could provoke the injection timeout by debugging in chain of 3 ollydbg instances itself.
Its a lot confusing having all the duplicate stuff (rename the ollydbg instances would be - of course - a way).

It happended when i paused a debugger instance in the middle of the chain.
From what i can see, ollydbg uses _not_ the main thread to run the injected code in this case.

That is _Runsinglethread() is not called on main ollydbg thread but on the mapped debugger thread of the debugged ollydbg instance (confusing ey ;))

I spyed the thread's call stack with external process monitor just to see it was waiting in WaitForMultiple() call.

And that is the root cause of the problem.
You can't in fact externally force a thread to run via ResumeThread() if it is waiting for some user/kernel synchronization object.
That is ResumeThread() can't change the lock state of any synchronization object to let the thread wake up.

"Restarting" a thread if it was suspended using SuspendThread() or the debuggers event loop works as proposed.

Now the question is how does ollydbg determine which thread to run the injected code on.

Regards,

A. Focht
oh me anon
02-01-2004, 02:50 PM
i have forwarded that again from my sent mail
subject is as below
Fwd refer olly dbg forum these are the files you wanted to see regarding inject process

body is below
greets focht

i have attached some six .txt in that zip
please read the readmefirst.txt first before reading any other files

hope it helps
if you feel it looks rubbish then mail me back
ill try to send you a cleaner version without those registers cluttering

thanks and regards

and one attachment in .zip which contains 8 nos .txt files

just one minute before posting this
focht
02-01-2004, 03:50 PM
Greetings,

ok i have your stuff now ;)

I used both versions of ollydbg (1.09d and 1.10b), they show same behaviour.
The executable you supplied shows the "anomalies" thats for sure.

From what i've seen so far i can say the following:

The problem only appears if the application is multithreaded and at least one thread is suspended due to call to an OS synchronization API, like:

SleepEx
WaitForSingleObjectEx
WaitForMultipleObjectsEx
SignalObjectAndWait
MsgWaitForMultipleObjectsEx

It seems the thread where the injector code is run on differ from time to time.
Example: target has two application created threads

------------------

thread id: 2708 (this is the main gui thread of the application)
It just pumps messages.

Duck.exe+0x13d3
USER32.dll!InternalCallWinProc+0x1b
USER32.dll!UserCallDlgProcCheckWow+0x146
USER32.dll!DefDlgProcWorker+0xa6
USER32.dll!DefDlgProcA+0x21
USER32.dll!InternalCallWinProc+0x1b
USER32.dll!UserCallWinProcCheckWow+0x150
USER32.dll!SendMessageWorker+0x4a3
USER32.dll!SendMessageW+0x7d
USER32.dll!xxxButtonNotifyParent+0x3e
USER32.dll!xxxBNReleaseCapture+0xf5
USER32.dll!ButtonWndProcWorker+0x6ba
USER32.dll!ButtonWndProcA+0x4a
USER32.dll!InternalCallWinProc+0x1b
USER32.dll!UserCallWinProcCheckWow+0x150
USER32.dll!DispatchMessageWorker+0x306
USER32.dll!DispatchMessageW+0xb
USER32.dll!IsDialogMessageW+0x570
USER32.dll!DialogBox2+0x142
USER32.dll!InternalDialogBox+0xce
USER32.dll!DialogBoxIndirectParamAorW+0x35
USER32.dll!DialogBoxParamA+0x4a
Duck.exe+0x1315

------------------

thread id: 2792 (this is a worker thread, waiting for some event to be signaled)

ntdll.dll+0x8090304
ntdll.dll!NtWaitForSingleObject+0xc
kernel32.dll!WaitForSingleObjectEx+0xa8
kernel32.dll!WaitForSingleObject+0xf
Duck.exe+0x17ad
kernel32.dll!BaseThreadStart+0x37

One time, ollydbg did the following, trying to run the injector code:

...
RunSingleThread( 2708)
...

This worked, because the thread itself wasnt in any waitable/alertable state.

Some time later:

...
RunsingleThread( 2792)
...

This causes the infamous "Injection timeout" message.
The reason is clear (i told in my last message).
You can't wake up thread using ResumeThread() if it is in any Waitable/Alertable state. This behaviour is by OS design.

So the question remains ... why does ollydbg try to run the injector code on a thread which is in alertable state while another non-alertable thread is available?

I think that can only answer the author of ollydbg itself...

Of course there is an extremly clever way (first introduced by Jeffrey Richter) to circuumvent this and wake up even threads in alertable state.
The magic is called QueueUserAPC().

Regards,

A. Focht
j_petrucci
02-02-2004, 07:29 PM
Hi Focht!
I'm really astonished about your knowledge about OS internals.. :-) congratulations
Regarding that code-injection behaviour, sure the Jeffrey Richter solution is better.. why don't you tell about it to Olly? it could be nice to suggest him some feature requests before 1.10.. ;-)

*guido*
focht
02-03-2004, 06:38 AM
Greets,

>Hi Focht!
>I'm really astonished about your knowledge about OS internals.. :-) congratulations

Well i code for a living. About 10 years experience with NT based systems kernel/usermode ;)

>Regarding that code-injection behaviour, sure the Jeffrey Richter solution is better..
>why don't you tell about it to Olly?
>it could be nice to suggest him some feature requests before 1.10.. ;-)

The reasons why i kept this discussion public was:

- share knowledge
- develop possible solutions before contacting the autor
- the author might be reading this too...

After some thinking about this problem i can offer two possible solutions - both with drawbacks.

1)

Ollydbg detects the "injection timeout".
It is very likely that the target thread is in alertable state

The alertable state itself can't be detected easily without additional work:

- QueueUserAPC (needs additional target thread to run on)
- a helper kernel driver which reads the appropriate kernel ETHREAD structure flags
- walk the stack frame of the target thread, checking for one of the WaitXXX functions

If the timeout occurs ollydbg should abort the attempt to run the injector code on this "alertable" thread.
Restore stuff/cleanup (Memory, context).

Select the next thread in debuggee's process space.
Try the run the injector stuff again until success or no more threads available.

Drawback: If all the debuggee's threads are in alertable state this method fails.

2)

QueueUserAPC() is a possible solution but it needs a thread to be called on.
If all threads in target process are in alertable state, an additional thread must be created.
This can be done using:

- CreateRemoteThread() - drawback: only supported on NT based systems
- global hook (loading custom dll which creates the helper thread)

If a helper thread needs to be created to execute QueueUserAPC() - why to use QueueUserAPC() at all when the injector code itself can be run in the context of the helper thread ;)

So QueueUserAPC() can be dropped for this case.
(It has some nasty side effects if the target application doesnt handle waitable function results properly).

So the solution is to create the additional helper thread in target process just for the task of running injector code or waiting for debuggers requests.

Careful: Dont use events to implement passive wait - the thread must _not_ enter alertable state!

One solution is to fake a gui worker thread.
Just create a message queue and pump messages with to wait for event using PeekMessage(&msg, NULL, WM_USER, WM_USER, PM_NOREMOVE) API.

Take care if the application main thread terminates.
The helper thread must be terminated then by debugger too.
The debugger could communicate with the helper thread using PostThreadMessage( custom message) to exit it.

Any additional ideas are welcome.

Regards,

A. Focht
oh me anon
02-03-2004, 01:38 PM
It seems the thread where the injector code is run on differ from time to time.
Example: target has two application created threads

yep and one thread is waiting for single object so its stall and stall only
for the time being it seems

so do you have any ideas how olly chooses it or where
i can try tracing it out
(leaving the scenerio where all threads are in waitable state
where it is going to fail for sure we can atleast find
why it changes behaviour even where there is one
thread not in alertable state )
does my query sound stupid if not tell me some work
to do with the combo i have so that i can trace it and post it here

and this question has been bugging me for more than one year
i hate to see this happen and let olly hang coz it detected a time out and
i have to pull the lever
focht
02-03-2004, 02:52 PM
Hello again,

>so do you have any ideas how olly chooses it or where i can try tracing it out

Nope ... and to be honest: i would not invest more time in it ;)
The task to identify the cause was challenging.
I like tasks that demand knowledge of internal workings or require to learn something new.
I refreshed some my knowledge on the usermode APCs.

But now its no more than finding an explanation for the "strange thread selection" behaviour.
It can be a time consuming task which is IMHO not worth it.
The author of ollydbg could find/explain it much faster and might fix it using some of my suggestions.

Just send the author a message with a link to this message board thread (pointing at the last posts) asking him for an explanation or a time line for a fix.

Regards,

A. Focht
oh me anon
02-04-2004, 07:00 AM
greets,
and first of all thank you very much for taking time to analyze and suggest solutions and thanks very much for sharing your knowledge where i also learned many things that are tangible as well as intangible and as you rightly said it maybe not a challenge any more just asked you what i thought could be hair splitting approch

ok ill post the author a letter (hehe :) with the filled registration form he sent with the package asking me to register from version 1.06)

ps:
for all who reads this thread any additional info or ideas are welcome ;)

regards
oh me anon
oh me anon
02-06-2004, 02:07 PM
k posted a letter to author with a link to this topic lets wait and see ill post here if he replies or if he does some thing about it
thanks and regards
oh me anon
oh me anon
02-13-2004, 05:33 AM
i got a reply from oleh but there isnt an iota of trace or any comment regarding the link in that reply i think it was auto generated reply
;( dont know
anyway ill wait for some more time

Quoting Ollydbg@t-online.de:

thank you very much for the registration. I will keep you informed about new OllyDbg releases. Do not hesitate to ask questions, report all found bugs and propose improvements, even small. Without your feedback, I will be unable to improve my (hopefully useful) product.
Sincerely,
Oleh Yuschuk
oh me anon
02-23-2004, 02:29 PM
well i told ill post if olly replies some thing on this problem
here is his reply

and yes he will do some thing about it in v2 sincerly ;)

so topic closed for now till v2 is released

>thanks very much for this reply is this reply auto generated
> i dont see even a hint of whether you have read the problem i posted along
> with that registration letter and whether you have visited the link i
posted
> in ollydbg forum and what are your comments on that problems

There is no way to generate answers automatically. Some of registrations are
even in .BMP format (printed and scanned). The problem is with my free time
(or, rather, with the lack of it). Yes, I have seen your deep and thorough
analysis on the forum and will try to do something. Still, the best solution
would be to avoid injection by all means. Maybe I'll implement it differently in

v2.0 (DLL injection + extra thread?)

Sincerely,

Olly
Bob
12-03-2004, 06:47 AM
I'm getting this "lack of OS support" injection error in a lot of C programs, a few programs I cannot debug at all due to crash, keys and buttons on olly do nothing.. Then when I exit Olly, I get the "waiting for thread" error, which yes just repeats the question

Is there some option (I have looked :) that I've missed to turn the cause of this annoying error off? I'd rather not see some register than crash all the time.

Cheers ~BoB~
in frustration
12-04-2004, 01:16 AM
Very confused guys...Please help!!!!!....Ok so im trying to make a code cave and i copy an adress

" 0046AFB9 8B86 AC000000 MOV EAX,DWORD PTR DS:[ESI+AC] "

but when i try to assemble " MOV EAX,DWORD PTR DS:[ESI+AC] " to create an exact copy of it but in the code cave it gives me the error "Unknown identifier".....im a newb at this so can you please help
oh me anon
12-04-2004, 06:59 AM
bob

are you having this problem in mundane programs too or it happens in some apps which have one of the Wait Function and all the threads are paused

if it is first then you can turn off
1) options --->debugging options--->security--->allow code injection to get the address of winproc
2)options -->debugging options ---> registers--->automatical fpu/mmx/3d now registers and decode sse registers

both these use code injection to perform the task

but if it latter (hanging in one of the wait functions then i would suggest you to read the whole thread (i am not aware of any solutions as yet and oleh replied that he would look into the matter in v 2.0)

in frustration
" 0046AFB9 8B86 AC000000 MOV EAX,DWORD PTR DS:[ESI+AC] "

this topic is no way connected with the problem you are facing please post in appropriate threads to avoid confusion and or create a new topic
any way the answer to your question is very simple any hex numbers that you refer should be implicitly defined as hex (what will any app yhink if it see AC
is it air conditioner ?? or all cracked ?? or ahhh crap !!!?? or absolutely crude ??? or just string AC or is it 0xAC
if you add a 0 in front of AC ollydbg will happily accept it and will assemble it properly as
00401417 8B86 AC000000 MOV EAX, DWORD PTR DS:[ESI+AC]
have fun
Bob
12-14-2004, 11:27 AM
Oh me Anon,
Thanks for the tips, I did read the whole thread before, but I'm getting this 'error' all the time in any kind of app except Asm (so far). I tried turning off the options, but still I get the 'injected small piece of code' blah blah
Following from my original post, I get this in not just C# programs as I originally thought, I've since got this error (increasingly frequently) in C++, Delphi and VB apps.

I'm not entirely convinced that this isn't to do with plugins, I'm going to remove them all, one by one, and see if that changes anything, failing that I'll downgrade olly versions, failing that? Return to Softice until V2 maybe..

This has really become a problem, but it's only in last 2 months. I didn't ever have this error before I downloaded plugins.

~BoB~


Can we unpack with ollydbg?

RCE Messageboard's Regroupment > General > Can we unpack with ollydbg?
Anonymous
02-08-2003, 07:19 PM
Can we unpack with ollydbg?
i'm a newbie in unpacking:with softice is ok.help me please how to proceed?
Norb
02-09-2003, 11:30 AM
Yes you can unpack with ollydbg. No you can't unpack most protection schemes, as it's an app debugger, not a system debugger. So you can't unpack ASProtect for example.
ricnar456
02-09-2003, 12:07 PM
I unpack asprotect with OLLYDBG, dump and recosntruct the table with revirgin in the same form i unpack with softice.

Softice for unpack asprotect

Go to entry point (oep)
Dump with ICEDUMP
repair with PEEDITOR
reconstruc with revirgin

OLLYDBG for unpack asprotect

Go to entry point
Dump with Memory dumper
repair with peeditor
reconstruct with revirgin

The same unpack you can make with softice you can make with olly the exception is pelock but this packer not RUN in olly 1.08 for a trouble with the SAL instruction the other packer is the same thing.

Ricardo Narvaja
Norb
02-09-2003, 01:43 PM
but how do you find the entry point using Ollydbg?
Anonymous
02-09-2003, 07:36 PM
thanks ricnar456.
but how do you find the entry point using Ollydbg?
with softice :symbolloader will do the trick and breacks on entry point.and we trace untill find something like :popad...signatures then OEP
appears and then with procdump we fix the oep +dump+rebuild with revergin
that all.so please can you explain us all that with a tut in the forum or attach it to:yano65@hotmail.com
i will be so gratful thanks.
ricnar456
02-09-2003, 08:26 PM
For any packer go to SET CONTIDTION and put EIP entre the low and the high value of the first section, and TRACE INTO, is slow but stops in the EIP.
For asprotect this is not possible for the exceptiosns the method is :
on DEBUGGER-EXCEPTIONS only the first box is checked.

Go with run and copy the positions of the exceptions, when stops in one, SHIFT + F7 y RUN again copy one to one this positions of the exceptions, there are one last execption after the program start.
copy in a paper this last exception.

restart repeat and go to this last exception, shift + f7, NOT RUN, if you run the program start, and go to VIEW-MEMORY and in the fisrt section put a BPM on access, RUN again and stops in the entry point.Quit the BPM and dump with memory dumper, and the process is similar to sice.

Ricardo
ricnar456
02-09-2003, 11:18 PM
I have many tutes of unpack asprotect 1.23 with olly with programs and examples but this are in spanish, and you dont understand this and i dont speak english, the traslation is very difficult for me.

Ricardo Narvaja
Squidge
02-10-2003, 05:57 AM
If you can email me one of the documents, I will attempt to translate it into english and post it to this group.

paulc@ibiblio.org
Anonymous
02-10-2003, 02:06 PM
Ricnar you can help yourself with English-Spanish Interpreter Pro from Word Magic Software. I manage to translate some of Karpoff tuts about that.

The_Philosopher
Anonymous
02-10-2003, 05:43 PM
thanks a lot ricnar456 for all!
in fact i speak spanish good.nOT VERY GOOD!!
but the idea suggested by Squidje seems to be very good(thanks Squidje)
so once translated into english every one hier in the forum can understand easilly .thanks ++.
i begin to "love" ollydbg.i think softice is no longer the only debuger in matter of cracking.bye
ricnar456
02-10-2003, 07:27 PM
If you want my tutes is here

http://www.hackemate.com.ar/cracking/cursos/ccr.rar

is in spanish and has 36 leson of theory, and 36 challenges with various levels and the solutions of all, and the programs and crackmes for practice, is 30 megas all the zip complete.

Ricardo
Squidge
02-11-2003, 11:16 AM
can you split it up? Only manage to get about 400kb, then it disconnects me :(
ricnar456
02-11-2003, 02:28 PM
Is not my page, is the page of PROF X.

Ricardo
Anonymous
02-12-2003, 11:34 AM
Use some d/l manager. It works ok then and speed is not under 5.5KB/s.

The_Philosopher
HackeR MaN
02-13-2003, 04:45 AM
there is nice website can translate different languages
http://freetranslation.com/

ricnar456
http://www.hackemate.com.ar/cracking/cursos/ccr.rar
the website is having very poor connection so i can't download it because it cuts off

but thanks for your tuts :)
ricnar456
02-13-2003, 03:11 PM
Here there are mirrors

primera addres: http://www.hackemate.com.ar/cracking/

segunda addres: http://www.crackmanworld.com/~cracking/

tercera addres: http://www.unmanarc.com/cracking/

Ricardo Narvaja
Anonymous
02-13-2003, 08:12 PM
Thanks ricnar456 for your tuts and your efforts thanks++++again
psyCK0
02-13-2003, 09:24 PM
I just wish I knew Spanish... Those essays seem really well done :/


version 1.09

RCE Messageboard's Regroupment > Announcements > version 1.09
oh me anon
02-09-2003, 06:36 AM
oops it seems ollydbg 1.09 has been released hey tbd where are you
TBD
02-10-2003, 02:30 AM
oh me anon: thanks :) ... as in the weekend i have no internet access and this week i am full busy i will not be so much involved. sorry.
FR
02-10-2003, 02:51 AM
every time a new version of ollydbg comes out, its like a wonderful miracle. It makes me very happy to see, and I hope it will never stop. i was teaching a grasshopper the art of reverse engineering the other day and of course i was teaching him to use ollydbg. after he had a few lessons, i made him load up softice and ida just so he could see and realize how amazing ollydbg really was and not take it for granted. it was only then that he could truely appreciate the power of ollydbg. then we both had a moment of silence on irc to pay our thanks to ollydbg.


Thanks Olly

RCE Messageboard's Regroupment > Bugs > Thanks Olly
Anonymous
02-09-2003, 11:19 AM
"Bugfixes:

- If you close debugged program (Alt+F2), OllyDbg now correctly closes all associated handles. Open handles made recompilation of executable file impossible;"

for this bug fix. And don't tell me next time that i am not right....because i am. :)

The_Philosopher


Attach process doesnt work after previous debug se

RCE Messageboard's Regroupment > Bugs > Attach process doesnt work after previous debug se
focht
02-09-2003, 11:27 AM
Greets,

maybe im missing something but it seems ollydbg 1.09 has problems to resume processes when using "attach" second time (or first time if program was started/debugged from within ollydbg).

Steps:

Start a program with ollydbg, let it execute + terminate gracefully.
Now start the program outside of ollydbg and use "attach".
You see the debugger successfully attaching but all the debuggees threads are suspended. Even manual "resume" doesnt work.

If you close ollydbg and use "attach" first - it works. The second time it fails again.

Can someone verify this behavior?

Regards,
Anastaius Focht.
ricnar456
02-09-2003, 01:01 PM
In 1.08 this bugs exist too.

Ricardo Narvaja


Code Analyse bug?

RCE Messageboard's Regroupment > General > Code Analyse bug?
Norb
02-09-2003, 01:44 PM
Trying to debug a program I've written using MASM32, but Olly doesn't seem to like it with analyse turned on.

With analyse on/active ollydbg outputs this:

0064A638 . 8B0424 MOV EAX,DWORD PTR SS:[ESP]
0064A63B . 50 PUSH EAX
0064A63C . 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20]
0064A640 > . 8B5A 08 MOV EBX,DWORD PTR DS:[EDX+8]
0064A643 . 53 PUSH EBX
0064A644 . 6A 0C PUSH 0C
0064A646 . 83C0 04 ADD EAX,4
0064A649 . 50 PUSH EAX
0064A64A . 83C2 0C ADD EDX,0C
0064A64D . 52 PUSH EDX
0064A64E 83 DB 83
0064A64F C0 DB C0
0064A650 > . 1150 E8 ADC DWORD PTR DS:[EAX-18],EDX
0064A653 . 92 XCHG EAX,EDX
0064A654 . 60 PUSHAD
0064A655 . 04 00 ADD AL,0
0064A657 . C3 RETN
0064A658 90 NOP

With analyse turned off / inactive, it outputs the correct code:

0064A638 8B0424 MOV EAX,DWORD PTR SS:[ESP]
0064A63B 50 PUSH EAX
0064A63C 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20]
0064A640 > 8B5A 08 MOV EBX,DWORD PTR DS:[EDX+8]
0064A643 53 PUSH EBX
0064A644 6A 0C PUSH 0C
0064A646 83C0 04 ADD EAX,4
0064A649 50 PUSH EAX
0064A64A 83C2 0C ADD EDX,0C
0064A64D 52 PUSH EDX
0064A64E 83C0 11 ADD EAX,11
0064A651 50 PUSH EAX
0064A652 E8 92600400 CALL <emumain.ComputeChallengeResponse>
0064A657 C3 RETN
0064A658 90 NOP

Any ideas why? I know I forgot to fix the stack after the call, but this shouldn't screw up Ollydbg's disassembly
output, should it?
_Servil_
02-11-2003, 03:15 PM
do you produce a debug info along with da code?
I have similar issue with undisassembled parts od images compiled with dbg info.
Norb
02-12-2003, 09:17 AM
yes, think it's related?
_Servil_
02-13-2003, 04:28 PM
related...

try to compile w/out dbginfo or remove the analysis.


Dumping in XP with ollydmp or others dumpers

RCE Messageboard's Regroupment > General > Dumping in XP with ollydmp or others dumpers
ricnar456
02-10-2003, 01:47 AM
I dump for years in Windows 98, manually, with procdump, lordpe, memory dumper, pupe,ollydmp and many manual dumpers, all create a dump and i in W98 fix the new entry point, load a dump in olly and stops in the new entry point correctly, now i fix the dump with revirgin or other reconstructor for repair de IT, in W98 dont problem and work fine this system.
In XP when i dump with any dumper of this list, the dump noy only not function and say this error The application failed to initialize properly (0xc0000005), close etc etc, in OLLYDBG the exceptions are before of the start on the entry points, out of olly is the same and the exception is the same

The application failed to initialize properly (0xc0000005)

I know is not a trouble with ollydmp, and not a OLLY trouble, in same unpackers in 98 function well in xp say the same error, i think is a trouble with XP for dumping unpacking, but i don't how unpack how in W98, now.

Ricardo
ricnar456
02-10-2003, 01:58 AM
Sorry i discover how, after dum with the lord PE, INTELLIDUMP OPTION,and next rebuild and starts in olly perfectly in the same for in W98, sorry.

Ricardo
_Servil_
02-10-2003, 02:11 PM
hello, just a thought, thos truble caused by VirtualProtect(Ex), wchch imo on Win9x crap (sorry ;o)) has no effect on avoiding to dump. (?)

the intellidump, i didn't tried yet as i prefere usual ways, will try it next time having trouble to dump.
ricnar456
02-10-2003, 06:48 PM
I try and all dumpers are the same error, and all repair with the option of lord PE rebuilder, i try and dump with ollydmp, lorde or any packer and the error is the same and with the option rebuilder this error desapear and run equal W98.

Ricardo
ricnar456
02-10-2003, 07:31 PM
The true is i try and with all dumpers the error C0000005, the solution is repair with the option of LORD PE, rebuilder,this is if the dump is made for LORD PE or OLLYDMP, or any unpacker this error is solved with this .

Ricardo Narvaja


downtime -- not anymore

RCE Messageboard's Regroupment > The Heap > downtime -- not anymore
rohan
02-10-2003, 02:29 PM
My provider had a problem with the db. Its fixed now.


Conditonal Breaks + Expression

RCE Messageboard's Regroupment > General > Conditonal Breaks + Expression
Mikelo2k
02-12-2003, 06:15 PM
Hello, i have a quick question :) I would like to break when a dialog button is pressed on a Dialog (obviously :P). Anyways, it sends the WM_COMMAND message with "BN_CLICKED" in the HIWORD of wParam (i beleive) and the dialog identifer in the LOWORD of wParam. I'm trying to check the LOWORD of wParam for a numeric value (ID of the button i want to break when pressed on).

How would i set this up on the TranslateMessage API? I read your "tip" about the MSG==WM_COMMAND, but im not sure how i would structure an expression that would work for what i am trying to do.

Any help is appreciated ;)

Thanx,
Mikelo2k


Bug in interface 1.09

RCE Messageboard's Regroupment > Bugs > Bug in interface 1.09
bigglass
02-13-2003, 05:25 AM
In CPU\Register window:
In pop-up menu don't exist menu for FPU register,
and don't rotate to debug register by clicking on bar button
Anonymous
03-05-2003, 09:04 PM
hehe, first....

Doesn't exist menu for FPU registers, because is the default view, your are watching at them in the register window.

If you turn with the bar to MMX, mmx menu will chage to FPU ;)

You are right, clicking on bar doesn't appear the debug registers... hmm.. why couldn't change the DRx values?? it would be a good chance ;)


automatic delete *.udd

RCE Messageboard's Regroupment > General > automatic delete *.udd
Anonymous
02-14-2003, 07:08 AM
can i set automatic deletion *.udd files?
by 2 days i have 150 udd files! I do not want to do this manual - this too tiring.
äåëàòü ðóêàìè.

sorry for my bad eng...
oh me anon
02-14-2003, 09:11 AM
hi get the udd cleaner plugin it lets you delete all *.udd and *.bak files with your confirmation or automatically see the plugin page

by the way i dont understand how it can be too tiring
dont let me imagine that you are selecting every file individually and right click and delete and then cofirm yes send it to recycle(i assume windows here)
then open recycle bin then empty recycle bin (or select each of the file individually again and delete them again from recycle bin )and so on and so forth
well here are some tips to lessen your tiredness

open the ollydebug folder and right click check view details so that clicking on the header (the one which has the name path etc) you can sort them
now you can select all the *.udd files by clicking on at the top of stack and then pressing shift+down arrow and then using shift+delete

or you can write one small little batfile remember dos (disk operating system)
by using copycon whatever.bat commands ctrl + Z

or by using the holy notepad and type in the following commands and saving it as whatever.bat and running it (this is equivalent to running the plugin if you remove all those pauses)

cd tc\ollydbg108 <-this is my path you have to substitute this
pause <-- you can remove this
dir/p *.udd <---- ditto
pause <----- "
del *.udd REQUIRED
pause <-- removable
dir/p *.bak <--- removable
pause <---"
del *.bak REQUIRED
pause <--- removable

hope i gave you some information
Anonymous
02-18-2003, 11:08 AM
> right click and delete
:) i know, how i can delete files and how i can write bat's for delete files (but thank you for your time). Understand, i work from the some IDE and bind keys for special operations, i.e. Compile, Build, etc. And i have key for start ollydbg, but ollydng is windows program and i do not want to have else window, that will erase all files, what created by olly. (i have many windows ~40 and do not want more one). It's all not so important, it's problem on comfort, because i like comfort programming.

PS: i have read, what can check 'Options/Debugger options/Securite/Ignore path and extension' and i'll have only one udd file. It's satisfy me. thanks again...
Anonymous
02-18-2003, 11:10 AM
PS. sorry, forget: I'll check plugins page.


New UDD file every time???

RCE Messageboard's Regroupment > General > New UDD file every time???
psyCK0
02-14-2003, 07:48 AM
Hi all!

I just noticed that every time i restart the debugged app i get a new UDD file!
They are named test.udd test_1.udd etc... So my breakpoints etc are never loaded! Why????
TBD
02-14-2003, 07:51 AM
psyCK0: according to 1.09 help
"To avoid mixing of .udd files in cases when main file and DLL have same name, or if program uses DLLs with same name that reside in different directories, OllyDbg adds _1, _2 etc. to names of .udd files. This feature is active if option "Security|Ignore path and extention" is unchecked;"

hope it helps.
psyCK0
02-14-2003, 11:38 AM
Allright, I just unchecked the "Keep analysis between sessions" and checked it again and it works now. Seem to be some settings problem? =)


Symbols from MAP files

RCE Messageboard's Regroupment > General > Symbols from MAP files
S300
02-14-2003, 10:08 AM
How can I use IDA-generated MAP files in OD?
When I convert it to SYM file (either with MS mapsym.exe or idasym) OD doesn't load it.
What an I doing wrong?
is there any way to convert MAP or SYM to DBG or PDB?
Thanks
TBD
02-14-2003, 10:33 AM
S300: have you tried mapconv plugin ? it is on the OllyDbg Stuph page (/ollydbg/files/)
S300
02-14-2003, 11:50 AM
Yeah, I've got one.
3 problems
1) It wouldn't process any labels from sections other than 0001 (my OEP is in section 0006)
2) It assumes codebase=1000 and ImageBase=00400000

Still, why OD doesn't load .SYM files as stated in help? SoftIce translates and loads the same file correctly.
TBD
02-17-2003, 04:47 AM
if someone has time, maybe the mapconv can be changed to use custom sections and imagebase.

as i dont have any .sym file i cannot check :(


idea

RCE Messageboard's Regroupment > Plugins > idea
HackeR MaN
02-15-2003, 04:24 AM
hi....

why there are no plugins like making bpx's from the memory, same as softice
example:
bpx hmemcpy <= we can't use them in olly...and more

thanks
Anonymous
02-15-2003, 09:12 AM
search for plugins, there's one handling commandline syntax.

servil
Norb
02-16-2003, 04:32 PM
Really, hmemcpy shouldn't be used any more - there's are plenty of alternatives, and most can be found using "Search / All Intermodular calls" and setting breakpoints that way.


How to find the jump???

RCE Messageboard's Regroupment > General > How to find the jump???
homunculus
02-16-2003, 10:57 AM
Hello,

while debugging an application I get to an instruction to which the program jumps but nowhere I can find any reference to that instruction. I was wondering how something like that could be accomplished in assembler and if there is a simple way of finding the point in the program where the jump occurs.

I suppose instructions like the following would do the job:

pop ecx ; exc contains the instruction address
retn

or

jmp exc ; exc contains the instruction address

I'd like to hear from someone who understand more about assembler and ollydbg. Are there other ways to accomplish a jump to an instruction without having the address of that instruction hardcoded??? Thanks.

H.
oh me anon
02-16-2003, 12:47 PM
homunculuswell you are not clear any way i answer for what i assume must be(maybe?) your meaning

the instruction pop ecx pops the dword off the top of stack into ecx register
in odbg stack pane is in rightbottom corner and register pane is in righttop corner if you watch (use f7) you will see what ever that was on top of stack will be transferred to ecx register if it is default color ecx register will change color to red so the retn will point to whereever is there now in top of stack (if you want to see what is there in retn address beforehand )you can right click the top of stack and use follow in dump (it will be available if the address is valid)
by the way i have seen push ecx retn (ecx will be loaded beforehand with a valid address and when pushed it becomes the top of stack so the retn will point to the pushed address) but havent seen pop ecx retn

jmp exc ??? i take it as ecx it will point to the address in ecx you can right click ecx and follow in dissambler or dump it will take you to the address if it is valid

you can also enable show jump paths in options --> debugger option (ctrl+o)
this also shows where you will be jumping with a red arrow or if you dont jmp coz of condition will show a grayed arrow

this olly is loaded with hell lot of possibilities you can a surprise option everyday spend some time and watch and play
homunculus
02-16-2003, 02:02 PM
Sorry oh me anon typing and not reading back takes to this. I didn't mean pop but (obviously) push so it was:

push ecx ; exc contains the instruction address to jump to
retn

and yes it was also ecx not exc and so:

jmp ecx ; exc contains the instruction address to jump to

I suppose both of these are good solutions if you don't want a jump destination to be hardcoded, but the point of my post wasn't this: I was curious to know if there is a way in OllyDbg to find how you got to a given instruction (with a jump) if that instruction is not referenced by any jump or call.

H.
Norb
02-16-2003, 04:29 PM
In a way, no. For example, you can do something like this:

JMP [EAX*4+4]

Which is specially useful for jump tables and the like, but a complete nightmare to reverse, as the jump address can be different each time depending on value of eax. All you can do is the maths yourselves and figure out the possible addresses it could jump to.
Anonymous
02-17-2003, 05:30 AM
Shouldn't you be able to use the debuggers run-trace function to find prior values of EIP before the jump?
Norb
02-17-2003, 09:09 AM
Good idea ! I think that would work for all cases apart from custom exceptions, but those can be found in the stack frame of the prog anyway.


BUG in command bar

RCE Messageboard's Regroupment > Bugs > BUG in command bar
ricnar456
02-16-2003, 11:06 AM
If put a comand ? and a hexa value with a letter says UNKNOWN IDENTIFIER

For example

? AA
? D0
? C1

When first is a number is well

? 0A
? 1A

ETC

Ricardo Narvaja
Norb
02-16-2003, 04:31 PM
If start with letter, Ollydbg assumes you mean label. When you start with number, it assumes it's hex as no label can start with a number.

So to do AA, just do ? 0AA instead.
ricnar456
02-16-2003, 08:45 PM
Thanks

Ricardo


Showing jump path???

RCE Messageboard's Regroupment > General > Showing jump path???
homunculus
02-17-2003, 11:23 AM
Hello,

has anyone enabled the show jump path option under the CPU tab for the "Debugging Options" menu item??? I though (in fact I read it somewhere) that graphical arrows should be displayed showing jumps paths but when selecting it I only see the hex dump column in the disassembler pane shift right to gain space on its left but NO arrows of sort appear. I though it could be because of the colors I use but even playing around with colors nothing appears. Can anyone help out?

H.
Norb
02-17-2003, 04:51 PM
Have this turned on, and when positioned over a jump call, a thin red line appears to the left of the pain indicating where the jump will end up. Drawn from the jump to the destination address. Can be quite useful at times, specially for calculated jumps.
homunculus
02-17-2003, 05:11 PM
Thx Norb I though the arrows had to be show always and not only when selecting a jump statement.


Bad or unknown format

RCE Messageboard's Regroupment > General > Bad or unknown format
mong
02-17-2003, 08:56 PM
What causes error:
Bad or unknown format of 32-bit executable file "C:\foobar.exe" ?
TBD
02-18-2003, 02:19 AM
mong: a lot of things ... but usually if it is a DOS or NE file, and sometimes a too customized PE header(i know coz' i bugged Olly a lot of time for this)
mong
02-18-2003, 04:26 AM
Yep, it's a packed target. But how do I get over this problem, or do I just use softice?
Norb
02-18-2003, 06:35 AM
Try a pe rebuilder and if the file still works afterwards, you can load it into Ollydbg. Else, you need softice.
mong
02-18-2003, 08:30 PM
I solved the problem by updating to 1.09 and setting some ignore exception checkboxes. Now the target runs without any problems.


[URGENT] - i need a host for the forum

RCE Messageboard's Regroupment > The Heap > [URGENT] - i need a host for the forum
TBD
02-18-2003, 02:25 AM
as the forum growed bigger it needs more bandwidth than the one that is provided by my friend ro.

so if anyone knows someone, that knows another one that can provide a reliable host, no banners, 20mb space, SQL & PHP, let me know at tbd@despammed.com

thanks, and we hope to find one quick :)
homunculus
02-18-2003, 06:11 AM
How much monthly bandwidth???

H.
TBD
02-18-2003, 06:25 AM
homunculus: i dont know for sure, i must ask ro.

nowdays there are 116 users x 50 requests/day x ~20k/request x 30 days = ~3GB/month

this is a max because not all users are accesing the site 50 times/day :)
homunculus
02-18-2003, 06:30 AM
Please do ask and let me know.

H.
Norb
02-18-2003, 06:38 AM
Ever thought about turning it into a mailing list instead?
TBD
02-18-2003, 06:55 AM
Norb: mailing list is nice but it is not searchable if you do not have an web based archive. also what to do with new users or anonymous ones ?

i did this forum to have a place where you can put a question, share experience and everything to do quick and anonymously.

i will try f2o.org to see how it is working.
Norb
02-18-2003, 09:14 AM
I don't want to see the site die, so would be willing to host it on a Linux box with good connectivity and no bandwidth or size restrictions. Of course, if the site started to take up serious amounts of disk space (say, 500mb+) or bandwidth in excess of 3-4gb/month, then I would have to do something to reduce these, but it's certainly not a problem giving the figures you have quoted above.
TBD
02-19-2003, 03:19 AM
Norb: thanks. the forum takes something like 10mb/day bandwidth, space occupied it is very small(max. 20mb with all plugins) the problem is with mySQL queries that increase (forum & klipfolio script).

i created an f2o.org account but i cannot access it because the corporate proxy doesnt allow ftp access (i have no inet access at home)
Norb
02-19-2003, 09:13 AM
well, let me know.
faf
02-19-2003, 10:57 AM
Glad to read you made it to f2o.org
Regarding the proxy check this:
http://www.2113.ch/phplab/mbs.php3?num=1045604899&thread=104003083 9
(http://www.2113.ch/phplab/mbs.php3?num=1045604899&thread=1040030839
)

;-)
msavci
09-01-2004, 08:56 PM
I am working with technolojik internet solitions. and I think they are so good becouse they are very cheap and they have got prestige all of the world. in the world they have got 52.000 customers.
they gives
php
perl
pyton
cgi
asp
asp.net
coldfusion
tomcat
and olny $2.66 per month. and also they gives unlimited spaces and 400 mbit speed and 7/24/365 mail and phone support


Backwards

RCE Messageboard's Regroupment > General > Backwards
_Servil_
02-18-2003, 01:50 PM
?

- stepping back within current func extents on a limited subset of instructions, no decision trees, no recursive calls etc.

- choose unknown register/memory values at the starting point so odbg would restore the previous register/memory state.

Might sound useless but just similar feature would help me mutch. Think this would be a gr8 improvement.
however don't know exactly if possible.


SYSCALL ???

RCE Messageboard's Regroupment > General > SYSCALL ???
Anonymous
02-19-2003, 07:44 PM
Trying to trace tutorial rtrace.exe and always get illegal instruction
7FFE0307 0F05 SYSCALL <------ here
7FFE0309 C3 RETN
7FFE030A 8AC8 MOV CL,AL
7FFE030C FF15 70464D80 CALL NEAR [804D4670]
7FFE0312 8B45 10 MOV EAX,[EBP+10]
7FFE0315 33C9 XOR ECX,ECX
7FFE0317 66:3908 CMP [EAX],CX
7FFE031A 894D FC MOV [EBP-4],ECX
7FFE031D 0F84 0D000000 JE 7FFE0330
What is this and how can I avoid it ?
I have WinXP sp1 and OllyDbg 1.09.
Ricrado Narvaja
03-06-2003, 01:28 PM
If in OPTIONS-DEBUGGING OPTIONS-TRACE check the box

ALWAYS TRACE OVER SYSTEM DLLS

not produce this error and continue tracing

Ricardo Narvaja


How to breakpoint on menu click?

RCE Messageboard's Regroupment > General > How to breakpoint on menu click?
Wayne
02-20-2003, 11:44 PM
I want to break as soon as a menu in my target is clicked, how can I do this in OllyDbg?
Thanks
Anonymous
02-21-2003, 04:09 AM
Learn the windows message handling functions, and then bpx GetMessage
helloword
02-28-2003, 01:39 PM
1. CPU window right click --> Search For --> All intermodulat Call
2. Look for TranslateMessage API
3. Shift+F4 if only one API or Set a break.... on every call..
4. Condition: MSG==WM_COMMAND
5. Pause Program: On Condition


How does regedt32 save reg values if it doesnt use

RCE Messageboard's Regroupment > General > How does regedt32 save reg values if it doesnt use
Wayne
02-21-2003, 02:45 AM
This is very strange! regedt32 doesnt import RegSetValue or RegSetValueEx -- it doesnt even have those strings in its executable!

So here is a little challenge - to find out how on earth it is able to save registry settings without using those two API calls. Ive got no idea ...
TBD
02-21-2003, 03:08 AM
Wayne: maybe because it uses functions from ureg.dll ? UpdateKeyInfo maybe ?
Anonymous
02-21-2003, 04:12 AM
I'm assuming RegEdt32 is the NT/2000/XP version of RegEdit with all the permissions/etc stuff in, and in which case it most likely uses the kernel functions.


Compare OllDbg and SoftICE for debuging applicatio

RCE Messageboard's Regroupment > General > Compare OllDbg and SoftICE for debuging applicatio
searchsa
02-25-2003, 08:47 AM
Compare OllDbg and SoftICE for debuging applications suhc as NotePad.
TBD
02-25-2003, 09:55 AM
you should use the search function of this messageboard and look for softice or go directly to http://ollydbg.win32asmcommunity.net/index.php?action=vthread&foru m=1&topic=117. (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=117.)


Loading DLL-files???

RCE Messageboard's Regroupment > General > Loading DLL-files???
Anonymous
02-25-2003, 01:55 PM
Is it possible to load and adjust dll-files directly into Olly?

I ask it because i am working on a program that uses DLL-files to run outside the main program...but i am not able to adjust(patch) this dll...

Greetings...
CADZzz
helloword
02-25-2003, 02:05 PM
It's very easy.
1.Load your main exe program.
2.View -->Executable Modules (Alt+E)
3.Right click on your dll in the list
4.view code in CPU (Enter)

For degugging issue, you can also add Break on new module (dll):
1. Options --> Degugging options
2. Events
3. Break on new module (dll) and even Break on module (DLL) unload
Then ollydbg will break in the right place and in the right moment

VOILA
Anonymous
02-26-2003, 06:32 AM
Yep this is helping me!

thnx a lot

Greetz,

CADZzz
Anonymous
02-27-2003, 08:02 AM
Problem 2:

Dll file:
Text strings referenced in wg_meng:.text, item 1489
Address=06F58385
Disassembly=PUSH wg_meng.06F88EF8
Text string=ASCII "Lock is not detected.
Please confirm if the Lock is properly connected to a Parallel Port."

The program pre-loads all the text strings in memory (cause its multilanguage i guess).
I found the dll with all the english text strings in it, but no calls were made to that dll at all (tested by setting bp's).

How can i find the place where the text is stored in memory and more important where its called from!

Regards,
CADZzz
Anonymous
02-27-2003, 06:02 PM
1) search all the memory for text strings

2) place memory access breakpoint at the start of the string you are interested in.

3) run program and it'll breakpoint when it accesses that string.
Anonymous
02-28-2003, 07:27 AM
K...thanks a LOT...got the message...
I managed to find a dll file which handles the strings.

I can now place bp's in the DLL...but every time i rerun the prog, i HAVE to set a LOT bp's all over again...

This is really annoying!
Does anybody know a good way to keep the bp's on the dll without the need to replace them again and again????

Regards,
CADZzz

(btw this is getting a complete tutorial this way :)
Anonymous
02-28-2003, 07:56 AM
yes
When you are in the dll
Cltr+A to analyse the dll
After that the system will save your breackpoint
CADZzz
03-01-2003, 06:01 AM
It works great...all i needed to know...

Thanks To Olly and all u helpfull forumreaders!
naceur
03-09-2003, 06:19 AM
other problem:
is there a way to breack in a specific dll (in momery) and load it to analyse it. (so i load all the dlls in pop menu i don t found to load a specific dll).
Anonymous
03-09-2003, 02:35 PM
yup, just setup options in ollydbg to "break on dll load".


save

RCE Messageboard's Regroupment > General > save
psyCK0
02-26-2003, 01:07 PM
Forgot how to save changes made to an exe (by using "assemble") back to the exe, ie patch it... Anyone remembers?
Gigapede
02-26-2003, 01:57 PM
Select changes -> right click -> [Copy to executable file]
File window open, then right click on it -> [Save file]


which is the current updated site

RCE Messageboard's Regroupment > General > which is the current updated site
oh me anon
02-27-2003, 11:43 AM
hi tbd,

i more or less regularly visit this forum once a day

i saw that you asked not to post at the old address but it seems there are lot of posts and this site is not updated which is your current one

viz today there are 546 posts in general forum on your old ?????? site
but it is less than 500 here

do keep one site updated(say which one) till the glitches are over and your current site becomes the regular site
TBD
02-28-2003, 03:47 AM
oh me anon: sorry, but it is not in my power to do this. i cannot contact rohan to delete the site so that *everyone* should start posting here instead of the old site.

i cannot update this site with the difference from the old site. it takes to much time and it is not worth it.

sorry about this.
homunculus
02-28-2003, 06:37 PM
The old forum isn't working anymore ... a database problem it seems. Hope everyone got the new url saved in their bookmarks.

H.
Anonymous
02-28-2003, 09:41 PM
Sorry about the mess. I was bloody busy, but that is no excuse for the munged move.

I've set it up so that the old site tells you to go to this site, and also that the klip tells you the same thing.

Hope everything goes better.

All the best,

Rohan
rohan@rohanpall.com
oh me anon
03-01-2003, 12:44 PM
now thats good and thanks tbd and rohan for the reply
hope and wish this site continues to be on net for ever
with ollydbg continuing to surprise every day


Just to know if anyone else got this prob when unp

RCE Messageboard's Regroupment > General > Just to know if anyone else got this prob when unp
Anonymous
02-28-2003, 01:01 PM
I unpacked a UPX packed executable with changed headers and screwed up IT, I dumped, fixed everything, it didn't work, at first I was thinking it was my fault, but someone did the exeact same thing and it didn't work here as well.

OS: WinXP pro with all the latest patches/updates
Anonymous
02-28-2003, 02:15 PM
prob bad import.
Anonymous
03-06-2003, 12:31 AM
nah, you didn't understand it
same file, working in personB computer, not working in my computer :(
Anonymous
03-06-2003, 10:28 AM
different os or not?


Setting breakpoints on all references of an import

RCE Messageboard's Regroupment > General > Setting breakpoints on all references of an import
homunculus
02-28-2003, 06:19 PM
Hello,

this is the first time that I debug a program heavily using DLLs. I noticed a "strange" behavior, when after getting the list of imports and exports of a given DLL, I try to set breakpoints on all references of a given API used inside the DLL. When I do so OllyDbg return a "No refering commands" message on the status bar and no bpx has been placed on any of the references. I always have to request the references to be shown and place the bpx manually on all of them. I was wondering about the reason of this behavior. Also what does "No refering commands" mean?????

H.
homunculus
02-28-2003, 06:22 PM
Sorry, the forum cut part of the title of this post ... the complete title was "Setting breakpoints on all references of an import in a DLL".

Regards,
H.
Anonymous
03-01-2003, 08:22 AM
did you enter the dll and ask ollydbg to analyse it first?
homunculus
03-02-2003, 05:00 PM
No, I did not. Could that be it????

H.
Anonymous
03-02-2003, 05:38 PM
yup


the ollydbg stuff doesnt display in ie

RCE Messageboard's Regroupment > The Heap > the ollydbg stuff doesnt display in ie
rohan
02-28-2003, 09:47 PM
something is up with the page, it doesnt get displayed in ie5 on win2kpro, but its downloaded, because I check with view source and its there...

Anyone else, or am I delusional?

This page is what I'm talking about:
http://ollydbg.win32asmcommunity.net/stuph/
squire
03-01-2003, 08:25 AM
Works here on IE6 / WinXP Pro.
TBD
03-03-2003, 04:24 AM
on my IE6/NT4 works too. it uses CSS so i think it works on older versions of IE too. it works also in Opera.
Ricrado Narvaja
03-03-2003, 12:33 PM
If you have a popup supressor program or zone alarm pro, you close popup supressor or in ZA in PRIVACY- AD BLOCKING, put in OFF and reload and you view the page complete.

Ricardo
rohan
03-03-2003, 12:40 PM
Yep Ricardo Narvaja, you are correct. As soon as I disable my proxomitron, everything is dandy.

TBD, you might want to fix this ;)
TBD
03-03-2003, 12:54 PM
rohan: this is strange because i dont have any popup in the page, just some tables and that's it. maybe they dont like hand crafted html. <huh>

could you tell me which action performs proxomitron when you try the page ?
(there is an debug window)
Ricardo Narvaja
03-03-2003, 01:26 PM
In the Zone Alarm PRO in PRIVACY-MEDIUM for block popups, only display the upper tittles, nothing more if I put the level in OFF for not block popup, displays correctly all the page.

Ricardo Narvaja


Breakpoint , comments not save

RCE Messageboard's Regroupment > Bugs > Breakpoint , comments not save
helloword
03-03-2003, 07:30 PM
I notice want I have more then 35 udd files Ollydbg do not save anymore the breakpoints, comments and ...
When I delete all udd files, everything is working.

By debugging the same file Ollydbg create many udd file with the same file name like that:
xx_1.exe
xx_2.exe
xx_3.exe
xx_4.exe
I didn't change a byte in the file.
Is it a normal behavior?
Ricardo Narvaja
03-03-2003, 09:21 PM
Put in DEBUGGING OPTIONS-SECURITY- IGNORE PATH AND EXTENSION, mark this and is solved

Ricardo Narvaja


[plugin] OllyDump 2.00.108 by gigapede

RCE Messageboard's Regroupment > Plugins > [plugin] OllyDump 2.00.108 by gigapede
TBD
03-05-2003, 03:55 AM
heya all,

our plugin guru, gigapede, did it again :)
OllyDump 2.00.108 (http://dd.x-eye.net/file/ollydump200.zip) now released with these new features
- Rebuild IAT using rebIT.dll (by y0da).
- Catch a transition from one section to anather to help you find OEP.

big thanks gigapede and keep up the good work !
ps. soon it will be available on the ODF Stuph page.
Anonymous
03-05-2003, 03:06 PM
Heya,

just a comment, was looking at olly-stuph page, it moved again?

servil
TBD
03-06-2003, 03:35 AM
servil: look on first line on this page :)
Anonymous
03-06-2003, 04:20 PM
you right, didn't notice that.
thanks for the gr8 update.

servil
Anonymous
03-08-2003, 06:19 PM
any tuts for the plugin "ollydump", it looks intersting plugin, thanks
Anonymous
03-08-2003, 06:35 PM
why do you want a tut? the plugin is self-explanatory.
Anonymous
03-09-2003, 01:21 PM
how i cana rebuild the IT?, finding the OEP?
itsme
03-09-2003, 02:37 PM
A lot of packers still don't require rebuilding the IAT (eg. UPX) and finding the OEP is packer specific. Analysing the stack pointer however is a fairly generic way of finding the OEP :)


getting patched file with OD

RCE Messageboard's Regroupment > General > getting patched file with OD
naceur
03-05-2003, 10:32 AM
please what s the method to have a patched file with OD
without patching with hex editor
thx
TBD
03-05-2003, 12:23 PM
naceur: very simple.
1. modify the code using SPACE
2. right click in CPU window, "Copy to executable"
3. right click in Dump window, "Save to file"


Last ip before break piont

RCE Messageboard's Regroupment > General > Last ip before break piont
Anonymous
03-05-2003, 03:52 PM
Is there a way to know the last ip before break piont?

Thanks!
oh me anon
03-06-2003, 11:01 AM
use runtrace with ctrl + F11 (trace into calls) and when olly stops on break point use - (minus) to navigate to the instruction before breakpoint

or you can use Ctrl+f12(trace over calls) also


BP problem in WinXP

RCE Messageboard's Regroupment > General > BP problem in WinXP
Anonymous
03-06-2003, 05:26 PM
When i set a bp on User32.GetWindowTextA in WinXP Olly breaks just when i click the program I'm debuging. If i trace out from user32 i get into "CPU - main thread, module ctagent".
This does not happen on my other computer wich has win2k. The ctagent is not a file that my program is using.

Any sugestions why this is happening?
Anonymous
03-07-2003, 03:11 PM
I just found the solution for my problem. I have no idea why, but i have a process called "CTHELPER.EXE" that uses a dll "ctagent.dll" running on my computer. This program is doing a GetWindowTextA every time i higlight a program.

So the solutin was to kill the process, now it works fine. :)
Anonymous
03-07-2003, 07:42 PM
CTHELPER is a background task that is a plug-in manager for Creative drivers. It first appeared with Creative’s SoundBlaster Live and Audigy soundcards. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities.

CTHELPER is far more trouble than it is a help (it's responsible for stuttering sound, lockups, and 100% cpu usage). Disable it.
Anonymous
03-08-2003, 05:06 AM
Hehe, i deleted CTHELPER.exe, and there is no more errors.
Thanks for the info :)


OLLYDMP 2.0

RCE Messageboard's Regroupment > Plugins > OLLYDMP 2.0
Ricardo Narvaja
03-06-2003, 09:00 PM
I try OLLYDMP 2.0 with a program compressed with EZIP and with the option for found OEP , the program stops in the correct entry point very well.
I try dump with ollydmp and a messages saying VCL50.bpl not found apears, the archive dumped works prefectly.

This messages for VCL50.bpl are normals, in the dumping? In this packer the results are very good and the dumped works well but this not will be trouble for other packers?

Ricardo Narvaja
Anonymous
03-07-2003, 10:04 AM
VCL50.bpl is a file from Borland C++ Builder 5, so either the program your dumping, or Ollydmp needs the file to run properly.
Ricardo Narvaja
03-07-2003, 12:57 PM
I think ollydmp need the programa running dont ask for this file anda run well.

Ricardo
Gigapede
03-07-2003, 11:36 PM
OllyDump v2.0 uses rebIT.dll to rebuild IAT.
This dll is Delphi program, so it may need vcl50.bpl.
Please install the bpl file to use rebIT.dll.

Now I'm trying to translate the dll's source to C.
Anonymous
03-08-2003, 07:35 AM
Where can you find the source to rebIT ?
Ricardo Narvaja
03-08-2003, 01:14 PM
I find 5 archives OLLYDMP 2.0 uses, but DSS50.bpl i not find in Internet, anybody kwow one link to download this file.

Ricardo Narvaja
Anonymous
03-08-2003, 06:32 PM
Puzzling. DSS50.BPL is Borland's Decision Cube Component Package - why would a process dumper require this file ?
Ricardo Narvaja
03-08-2003, 07:11 PM
I dont know, requires many files

VCLDB50.bpl
VCLBDE50.bpl
DSS50.bpl
VCL50.bpl
VCLX.50.bpl

The other files i found but DSS50.bpl not
Ricardo Narvaja
Ricardo Narvaja
03-08-2003, 07:50 PM
I found all files needed thanks.

Ricardo Narvaja


Tuts for olly

RCE Messageboard's Regroupment > General > Tuts for olly
gdvl
03-07-2003, 12:36 PM
I'm just a newbie and i lok for tutorials with olly... Can you help me ?
Anonymous
03-07-2003, 02:36 PM
http://ollydbg.win32asmcommunity.net/stuph/


TBD plz fix your link to OllyDump 2.0

RCE Messageboard's Regroupment > Plugins > TBD plz fix your link to OllyDump 2.0
psyCK0
03-09-2003, 10:38 AM
Right now it points to 1.11 :)
TBD
03-10-2003, 03:35 AM
psyCK0: thanks. fixed now.


1.09a first look/bugs?

RCE Messageboard's Regroupment > Bugs > 1.09a first look/bugs?
Anonymous
03-09-2003, 12:17 PM
Greets,

i just downloaded the new version 1.09a and found the "plugin location" option does not work for me. I've been waiting for this feature some time.

I've specified an existing sub directory but ollydbg doesnt load any plugins.
("Plugin path" in ollydbg.ini contains the path)
If i copy the plugins into same directy ollydbg resides, the plugins are loaded.

Besides, the "udd location" option works. It loads and saves to specified directory.

Well .. one big user interface critique goes to configuration/options dialog.

The new options (tabbed property pages) are now accessed with one additional
button (in left bottom corner of debugging settings) - which violates windows user interface guidelines - it confuses the user.

Additionally the growing number of "configurable" items in ollydbg are accessed through an increasing number of tabbed property pages - which is user interface nighmare.

I suggest the use of a tree control to navigate option property pages for cleaner user interface.
A good example how this looks can be found here:

http://www.codeproject.com/property/TreePropSheet/WinXP.png

Much cleaner and easier to navigate (beside many commercial software uses this ui design to handle its sheer number of configuration options).

Anyway keep up the good work .. looks very promising ;-)

Regards,

A.Focht
TBD
03-10-2003, 03:44 AM
Focht: do you mean 1.09b ?
* the plugins dir works for me, even for long dir name (with spaces too)
* "additional button" left button access the "Appeareance" dialog, which was present in old versions too. it's there for easy configuring all items. i agree with a tree based config option (i suggest it long time ago :) )
focht
03-10-2003, 04:02 AM
Hello,

Focht: do you mean 1.09b ?

of course not ;-)

i just downloaded the new version 1.09a and found the "plugin location" option does not work for me. I've been waiting for this feature some time.

Yesterday i found 1.09a the lastest (and tested it)... now 1.09b - a really fast fix ;-)
The plugin works now in 1.09b.

One possible problem:

I noticed some plugins have now problems with their persistent data (access to ini files ...).
I assume they use GetCurrentDirectory() which of course points to ollydbg base dir. To access the files in plugin dir:

- use the full module load path and strip the plugin name from it
- read the ollydbg plugin path from ollydbg.ini (not preferrable, ini options may change)

Regards,
A. Focht.


debug symbol information support

RCE Messageboard's Regroupment > General > debug symbol information support
focht
03-09-2003, 01:06 PM
Greets,

one feature i'm missing for some time:

More information when symbol information (.dbg, .pdb) gets processed and loaded via "microsoft debug help library".
Just like the windbg/devstudio ...
Add additional "symbols loaded" / "symbols not loaded" / "mismatch" to output.
This information should be available via "modules" view (add another column) too.

I've seen occurrences where the symbol information output of my devstudio was much better than ollydbg (release version of software, symbols stripped into .pdb files, system dlls with .pdb files). I can't see why (because ollydbg omits all the debug symbol processing/results).

Another debug symbols support i'd like to see in ollydbg:

The new symbol server facility from microsoft - makes using debug information way much better - it rocks ;-)

Overview:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug /base/symbol_servers_and_symbol_stores.asp
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/symbol_servers_and_symbol_stores.asp
)

In short: It can detect which system binaries you have to download the necessary symbols on demand from internet or other specified locations (local storage).
No more downloading service packs with symbol information and the need to keep em in sync with ever sp.

311503 INFO: Use the Microsoft Symbol Server to Obtain Debug Symbol Files
http://support.microsoft.com/?id=311503

319037 HOW TO: Use a Symbol Server with the Visual Studio .NET Debugger
http://support.microsoft.com/?id=319037

Basically i did the follwing:

1.) Get the debugging tools from
http://www.microsoft.com/ddk/debugging/symbols.asp

2.) copy the symsrv.dll and the latest dbg*.dll to desired dir.

3.) configure the _NT_SYMBOL_PATH environment variable appropriately.

Mine currently looks like this:

symsrv*symsrv.dll*c:\mssdk\symbols*http://msdl.microsoft.com/download /symbol
s

4.) Start debugging with DevStudio or windbg ... both can now automagically download symbols for each module that gets loaded. Works like a charm ;-)

Regards,

A.Focht


bug (olly 1.9)

RCE Messageboard's Regroupment > Bugs > bug (olly 1.9)
HackeR MaN
03-09-2003, 01:31 PM
hi

i found a bug on the new version of olly 1.9, when im trying to run crackme,olly freezed!
then i used the older version of olly 1.6 and it works fine!!
any help!!
itsme
03-09-2003, 02:32 PM
You will have to explain a LOT more information than just "olly freezed". How did you get it to freeze? What did you actually do? What is name of crackme? etc, etc.

Describe everything you did to make ollydbg freeze and when we can reproduce it, then it can be fixed.
HackeR MaN
03-10-2003, 02:17 PM
here is the crackme,
http://www.geocities.com/hackarman/test.zip

try to run the crackme on olly ver 1.9 and olly will freeze!, try the same thing on the old ver 1.6 and it will runs fine!
Tacman
03-10-2003, 04:21 PM
works ok for me with Ollydbg 1.9b on win xp pro
itsme
03-10-2003, 05:06 PM
same here, works fine.
HackeR MaN
03-11-2003, 04:45 AM
9x doesn't


BUG IN OLLY 1.09 B

RCE Messageboard's Regroupment > Bugs > BUG IN OLLY 1.09 B
Ricardo Narvaja
03-09-2003, 04:28 PM
The window of the STRINGS (r) can't be closed, always stay in the visualization and dont close, minimize, nothing.

Ricardo Narvaja
TBD
03-10-2003, 03:54 AM
Ricardo Narvaja: do you mean the window from "All referenced text strings" ?
it works for me :)
Ricardo Narvaja
03-10-2003, 05:32 AM
Olly repair and a new version is in the page.

Ricardo


update plugins

RCE Messageboard's Regroupment > Plugins > update plugins
Gigapede
03-11-2003, 11:10 AM
OllyDump v2.01.108 : This version doesn't need rebIT.dll any more. (thanx y0da)
CleanupEx v1.12.108 : support plugins and udd folder specified
Labeler v1.32.108 : support plugins folder specified

download from here
http://dokodon.virtualave.net/ollyplugin.html
itsme
03-11-2003, 12:13 PM
any chance you'll be releasing the source to any of these in the future?
TBD
03-11-2003, 12:33 PM
itsme: sources are already present in the zip :)
all gigapede's plugins comes with full sources!
itsme
03-12-2003, 06:26 PM
Cool :)

Thanks TBD / Gigapede :-)))


[BUG]: Lock-up debugging DirectX-Application

RCE Messageboard's Regroupment > Bugs > [BUG]: Lock-up debugging DirectX-Application
Anonymous
03-11-2003, 01:13 PM
Hi,

unfortunately my system completely locks up when I want to debug a DirectX
application and encountered a breakpoint. I am using WinME and Catalyst 3.1.

Anybody else got this problem and/or knows a solution for that?

Thanks in advance
Anonymous
03-11-2003, 01:34 PM
Sorry, I forgot: I am using OllyDBG 1.09b. I have this with every application.

Try it:
Download 'St4rsh1ps Unl1m1ted' from ***p://***.a_p__e__z_o_n__e.com (without underscores),
load 's_t__u_n.exe' (without underscores) into OllyDBG,
set a breakpoint on every 'Kernel32.ReadFile' and run it

On my system I get a blank, black screen and my whole system is locked-up. Even
Num-Lock doesn't work anymore.
Anonymous
03-18-2003, 12:31 PM
Hmm,

am I off-topic here or have I written sth wrong?
itsme
03-18-2003, 08:19 PM
Ollydbg isn't meant for DirectX applications. For that, you should really using something like SoftIce, which is designed for the job.


Can't run program in ollydbg/Access violation

RCE Messageboard's Regroupment > General > Can't run program in ollydbg/Access violation
DebugAll
03-11-2003, 02:19 PM
Hi all,

I'm trying to debug a program in oll 1.09 and when I load it and try to run it, I ge ta message saying that the program tried to illegally access a virtual memory location and it stops. It says I can pass it to the program but when I do it continues the same message. The program does it in W32dasm too. How do I get around this?

Thanks,
VJ
itsme
03-11-2003, 08:29 PM
Prob some kind of debugger check or SEH-type protector (eg. aspr). Unpack first.


How to find a window procedure ?

RCE Messageboard's Regroupment > General > How to find a window procedure ?
MrSmith
03-11-2003, 08:29 PM
Hi,

how can I find out the window procedure that belongs to a specific window handle?
With SI that's easy with "hwnd". But how can I do it with OllyDbg ?

Cheers,

MrSmith
Anonymous
03-12-2003, 03:16 PM
try to open Windows window (View|Windows)

One of the columns displays it

servil.
MrSmith
03-13-2003, 11:38 AM
Great,

Thanks

MrSmith


Handles window displays list of handles owned by d

RCE Messageboard's Regroupment > General > Handles window displays list of handles owned by d
Anonymous
03-12-2003, 10:09 AM
Can someone give the utility of this Handles window displays list new feature ?
TBD
03-12-2003, 11:08 AM
shows all used registry keys, file handles ... good for spying files
Anonymous
03-12-2003, 12:12 PM
Thank you
Yes it's true it's great
Anonymous
03-12-2003, 12:15 PM
We should add some feature ex:
For Key: on double click open regedit in the right registry keys
For File and Directory: on double click open explorer
and so on
Anonymous
03-12-2003, 12:31 PM
As there is no help for this section can someone explain the meaning of the following info in type column:
- KeyedEvent
- Mutant
- Section
- Semaphore
- WindowStation
- ….
The Refs Column?
The T column?
Te Info Column?
The Handle column id ? and there is a relationship with this handle id with another window like task, windows, threats, …
Is the access id has an relationship with ?
Anonymous
03-12-2003, 12:54 PM
We should also add a filter with the feature (Include, exclude and Highlight)
A column displaying the process means the exe or dll files.
A breakpoint on access or ..
A log like tracer
helloword
03-12-2003, 03:15 PM
oops I forget to log on
Anonymous
03-14-2003, 08:47 PM
Sorry for the stupid question .... but what are you all talking about??? What is this handles window???

Frank
Anonymous
03-15-2003, 08:01 AM
Version 1.09b (step 2) is considered intermediate (technical). It was not sufficiently debugged and tested. But, it includes several new interesting features and bugfixes and, in my opinion, stable enough to be released. As always, you are invited to send your opinions, comments and found bugs to Ollydbg@t-online.de.
New features:
.
.
.
- On NT-based systems, Handles window displays list of handles owned by debugged application;
.
.
helloword
03-15-2003, 11:13 AM
Taking about breakpoint:
It should be nice to have the possibility to set-up breakpoint and log on key access ex:

On key: \Registration\4.00\RegCode
Break: On condition
itsme
03-15-2003, 02:41 PM
Errm, isn't Ollydbg supposed to be a program debugger for your own apps, not a cracking tool? I thought it was the earlier, therefore why would it need something like that in it's feature list ?

This program seems to be moving into the later on an almost daily basis.


Stack Analyzer

RCE Messageboard's Regroupment > Bugs > Stack Analyzer
[thEpOpE]
03-12-2003, 08:24 PM
The stack analyzer shows the arguments on the stack when an api is called by direct reference or a direct reference to his jmp.

But the analizer doesn't show this info when the api is called by a call using a register (normally is ESI or EDI), or when it is referenced by a register with an offset (call [ebp+offset]). The stack would be analyzed, because the comment and the register window is updated with the real thunk to the api.


Equivalent of "Hmemcpy" with ollydbg?

RCE Messageboard's Regroupment > General > Equivalent of "Hmemcpy" with ollydbg?
Anonymous
03-13-2003, 04:52 PM
Hello!
I'am a newbie in using ollydbg.
in brief: what is the equivalent of "Hmemcpy" with ollydbg?
Thanks ++ in advance .
Ricrado Narvaja
03-13-2003, 08:15 PM
I make a tutirial of POINT HMEMCPY or POINT H in english for NT/2000/XP and is very similar a HMEMCPY of W98, if you read the old post the link for download is in the post.

Ricardo narvaja
Anonymous
03-14-2003, 06:39 PM
Thank you a lot Ricrardo.i read it but where can i find this tutorial please?
Anonymous
03-14-2003, 07:00 PM
i downloaded your Curso actualizado con programas de ejemplo (excelente)in site

http://www.hackemate.com.ar/cracking/ but no funciona :errors in decompressing with winrar!!
Ricrado Narvaja
03-14-2003, 07:08 PM
You use Winrar up to 3 ? But all friends download good, i see.

Ricardo
Ricrado Narvaja
03-14-2003, 07:13 PM
you can download of my FTP

fxp://curso:curso@ricnar456.no-ip.org/

replace fxp for ftp and download .

user:curso
pass:curso

Ricardo
Ricrado Narvaja
03-14-2003, 07:19 PM
And in mi FTP is the rar of 40 megas in perfect state, and in a carpet NUEVO CURSO - TEORIAS you can download the tutes one only,the Punto H in english, for example.

Ricardo
Ricrado Narvaja
03-14-2003, 07:49 PM
This mirror work best

http://www.crackmanworld.com/~cracking/

Ricardo Narvaja
Anonymous
03-15-2003, 06:18 PM
thanks Ricrado.with winrar 3.xx all work good.by the way the tuts are really intresting and there are no similar site in the net explaining ollydbg such yours.GRACIAS):
Anonymous
04-17-2003, 05:35 PM
hello ricardo!
thanks for your lessons.in fact are very importants.yes amigo:)
bueno,concerning the hmemcpy with win 98 i tried to find it using the cruehead
crackme crue1.exe but no worked:(
i explain :
- i searched the "translatemessage Api" and i have breaked on it with log condition:MSG==201
assumed expession=MSG
on condition (ok)
debug:run
enter a keys & pressed ok
the crackme don't break at translatemessage :(
ok any way i tried an other crackme & in that case it breaks
so in brief what i did:
memory search
find my key yanos..
i set a break on it in acces read but a message of ollydbg is displayed saying me that break on memory acces whould freeze window!!!
i tried any way and don't care:
it breaks on a jump to translatemessage!? not on " REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> " for exemple
ayuda me por favor Ricardo (help me)
Ricardo Narvaja
04-17-2003, 07:11 PM
PUNTO H o POINT H is only for NT/2000 y XP look my first post

I wrote:

I make a tutirial of POINT HMEMCPY or POINT H in english for NT/2000/XP and is very similar a HMEMCPY of W98, if you read the old post the link for download is in the post.

Ricardo narvaja
Anonymous
04-17-2003, 08:46 PM
thanks recardo!
Then with win 98 is very dificult to find hmemcpy or impossible ?
thanks ricnar again.
Ricardo Narvaja
04-17-2003, 10:13 PM
In ollydbg in W98 impossible

If you want hmemcpy in 98 use softice.

Ricardo
oh me anon
04-18-2003, 02:19 AM
well you can try to use conditional pause with runtrace with stepping into calls

stops at dll code i did it some times successfully in w98

but other wise w98 does not let you bpt dlls and it renders f7 useless

just steps over the calls
oh me anon
04-18-2003, 03:01 AM
oops i registerd and runtrace with step into calls short cut is
ctrl+f11
and set condition in debug menu
Anonymous
04-18-2003, 07:57 PM
thanks for all !
can anyone may explain all what 'OH ME ANON'(member) sayed with any exemple ?
thanks!
Anonymous
04-22-2003, 06:49 PM
Thanks for the great tuts ricardo ive learned much from them and they give me new experience.


API parameter

RCE Messageboard's Regroupment > General > API parameter
Anonymous
03-13-2003, 05:14 PM
How to put a conditional bp into lpSubKey of RegOpenKeyEx API ?

Thanks
thEpOpE
03-13-2003, 06:17 PM
use the [esp+offset] as parameter to make de condition. You can see the relative address on the stack doubleclickin on the address column of stack pane. You must set the conditional bp in the call to the api, and set the condition using dword[esp+offset]==value .


ollydbg.has.it

RCE Messageboard's Regroupment > The Heap > ollydbg.has.it
Anonymous
03-14-2003, 09:40 AM
still points to old location
TBD
03-14-2003, 09:52 AM
thanks for reminding. has.it had problems with authentification and now is working.

ollydbg.has.it -> ollydbg.win32asmcommunity.net


DETACH OLLY AND CONTINUE RUNNING

RCE Messageboard's Regroupment > General > DETACH OLLY AND CONTINUE RUNNING
Ricrado Narvaja
03-14-2003, 03:10 PM
In XP in the microsoft pages say the posibiliti of detach any debugger in XP, and continue running the process, and close olly.
The api for this is DebugSetProcessKillOnExit has one only parameter if this is 1, the process is killed and if the parameter is 0, the process continue running, and olly close.
This feature can be very useful i think, why not gice the posibility of choice of continue process or close process in the close of OLLYDBG.

Ricardo Narvaja


DETACH OLLY AND CONTINUE RUNNING

RCE Messageboard's Regroupment > General > DETACH OLLY AND CONTINUE RUNNING
Ricrado Narvaja
03-14-2003, 03:21 PM
In XP in the microsoft pages say the posibiliti of detach any debugger in XP, and continue running the process, and close olly.
The api for this is DebugSetProcessKillOnExit has one only parameter if this is 1, the process is killed and if the parameter is 0, the process continue running, and olly close.
This feature can be very useful i think, why not gice the posibility of choice of continue process or close process in the close of OLLYDBG.

Ricardo Narvaja


How can I debug MS VC++ applications?

RCE Messageboard's Regroupment > General > How can I debug MS VC++ applications?
Vortex
03-15-2003, 07:27 AM
How can I debug my VC++ apps? Which commanline params or
switches I need to add to cl.exe and link.exe?

Regards,

Vortex
Anonymous
03-15-2003, 07:50 AM
try
cl /Gi /c ....
link /debug

make sure .pdb thing is in same directory as the app

servil
Anonymous
03-15-2003, 07:52 AM
sorry should be

cl /Zi /c ...

svl
Anonymous
03-19-2003, 07:02 AM
Thanks for the help Servil,but the swicthes
didn't work for me.
Anonymous
03-20-2003, 02:39 PM
Run cl.exe and link.exe without the params and you will have complete list of params and what they do (at leats i hope :) )
Anonymous
03-20-2003, 07:59 PM
I thought it was "cl /?" for list of params?
Anonymous
03-21-2003, 06:43 PM
I run this cl.exe and i can only say that you will have to run help. cl.exe have this options, but i didn't try it or test it (you can do this):

- OUTPUT FILES -
/Fd[file] name .PDB file
/Fm[file] name map file
...
- LANGUAGE -
/Zi enable debugging information
...
- MISCELLANEOUS -
/Yd put debug info in every .OBJ
...
- LINKING -
/MD link with MSVCRT.LIB /MDd link with MSVCRTD.LIB debug lib
/ML link with LIBC.LIB /MLd link with LIBCD.LIB debug lib
/MT link with LIBCMT.LIB /MTd link with LIBCMTD.LIB debug lib
/LD Create .DLL /F<num> set stack size
/LDd Create .DLL debug libary /link [linker options and libraries]

For link.exe is next 2 switches:

/DEBUG
/DEBUGTYPE:COFF
/SUBSYSTEM:WINDOWS

This 3 for link i use in masm.


ollydbg 109b freeze with watchman

RCE Messageboard's Regroupment > General > ollydbg 109b freeze with watchman
britedream
03-15-2003, 08:46 AM
Hi,
Ollydbg 109b freezes if u try to delete unset watches,using watchamn plugin.
Regards.


MS PDB7 support?

RCE Messageboard's Regroupment > General > MS PDB7 support?
Anonymous
03-15-2003, 01:45 PM
Hello,

On loading a project with MSPDB7 info I can't see proper source lines assigned to their VA,
first line of a subroutine is shown within whole sub.

Is dbg info parsed by OD or external library?
I'd be grateful for adding PDB7 support in some phuture release..

servil


wdasm and ollydb

RCE Messageboard's Regroupment > Plugins > wdasm and ollydb
Anonymous
03-16-2003, 10:20 AM
any plugin for importing wdasm alf and wpj files, i got code section looks normally in wdasm but in olly it gets cut off in bytes, means

in wdasm looks following (ex):
6AFF
6808DE4100

in ollydb (ex):
6A
FF
68
08
DE
41
00

seems like olly break line after each byte , so breakpoints don't work!

anyone know solution for this? or have plugin that can fix it or load wdasm files (alf and wpj).
itsme
03-16-2003, 01:43 PM
olly prob assumes what you are looking at is data, you can force it be assembler, but breakpoints will still work, just place "break on execute" on the address.
oh me anon
03-18-2003, 09:52 AM
place the cursor on 6a and press ctrl+e + ok (binary edit) (dont edit anything just press ok) olly then dissassembles it differently many garbaging code writers use such code it looks different and works dfferent because the eip points to somewhere in the middle of opcode

and placing bpt on starting of opcode dont work

i dont know if this info could help u but i have used ctrl+e + ok on many garbage structures and traced it successfully
Anonymous
03-19-2003, 09:00 AM
thx for tip, i try it, i know i had same problem with asprotect, a jmp pointed to middle of instruction, and olly crash when reached it, hope this works!
Anonymous
03-20-2003, 07:04 AM
to debug asprotected app, just set page protect bits, jump into middle of asprotect code, and then set page protect bits on oep page of app, ollydbg will break on entry point.
Anonymous
03-20-2003, 09:02 AM
hmm not sure really what u mean, but nodoubt it works :)
Tacman
03-20-2003, 09:32 AM
can you elaborate on what is meant by 'set page protect bits'. Better still a walk through on how to find oep of an asprotected file please?
itsme
03-20-2003, 07:58 PM
There are multiple ways of obtaining OEP of AsProtect file in Ollydbg. Here's one:

1) Execute file as normal, counting the number of exceptions. Pass each exception to prog.

2) Restart program, count the number of exceptions - 1.

3) ALT-M, Right click memory address that is app code. Set "break on access".

4) Run prog. Ollydbg will break on OEP.

Note that this only for debugging AsProtect app. It is no use for dumping ASProtect app, as you will not have the stolen bytes needed for recreating the file.
Tacman
03-21-2003, 08:44 AM
thanks thats very useful information


Having the same from last run

RCE Messageboard's Regroupment > General > Having the same from last run
Anonymous
03-16-2003, 09:46 PM
Let's say that I wrote a NOP at address 10002035 of bah.dll, then I restart olly, how can I get the address there withouth having to re-write it every time I restart olly/thread?

withouth writting it to the file itself
TBD
03-17-2003, 04:26 AM
use Patch manager available in 1.09b


ollydbg and vb6

RCE Messageboard's Regroupment > General > ollydbg and vb6
Anonymous
03-18-2003, 12:03 AM
hi,

I've been told that cracking vb apps is a simple task... however I tried a few crackme apps and I found it Very hard compare to delphi apps, I use Olly as the main tool.

what is the best way to work with vb6 Pcode exe files using Olly ?
can i bpx on a commandbutton_click ?
should I use SmartCheck ?

p.s
is it possible to set olly to act as softice Ctrl+D ?
thEpOpE
03-18-2003, 07:48 AM
For PCode progs you must use a decompiler/debugger for this kind of PseudoCode. WkT! had released a good debugger for PCode progs. http://vbdebug.cjb.net

Read all help about on the website to use the debugger, because the policy of it it's quite different to standard debuggers.
Anonymous
03-18-2003, 04:51 PM
many thanks to thEpOpE


vb6 compile to native code

RCE Messageboard's Regroupment > General > vb6 compile to native code
Anonymous
03-19-2003, 12:37 PM
hi,

what is the best app to debug vb6 compile to native code ?

tia

p.s
best regards to thEpOpE !! you've been VERY VERY helpful !!!
TBD
03-20-2003, 04:07 AM
tia: what relation is your post with OllyDbg ?

i also noted that a lot of the posts are cra**ing related. no good.
i know that OD can be used to remove "bugs" but this forum is NOT
for talkin' how to crack.
itsme
03-20-2003, 07:06 AM
if the vb6 compile is into p-code format, then use a p-code decompiler (google, there are plenty around), otherwise use ollydbg and softice / smartcheck.


code opcodes interpreted by OD as data???

RCE Messageboard's Regroupment > General > code opcodes interpreted by OD as data???
Anonymous
03-20-2003, 07:32 AM
Hello,

recently while debugging a program I noticed a weird thing done by OD 1.09 and that is interpreting a opcodes inside a code segment as it they where data. I had to remove the analysis to get the opcodes to be interpreted correctly. Does anyone have any suggestion on what can be done in this cases?

H.
thEpOpE
03-31-2003, 07:30 PM
Hi,

I've got same problem debugging a program I wrote using win32asm. The problem was that I used a weird way for sniffers&crackers, so I included some strings inside the code, and the analyzer is not working properly with some opcodes (usually 'call'). I used some tips like:

Call MyMessageBox
DB 'Title',0,'Message,0

On MyMessageBox I use the "ret" address in the stack to get the offset for the strings... But the analyzers doesn't faults on this call, but in other in linear code snippet uses to show some opcodes as data (grayed).

The program is about 100ks os source code, and the compiled exe is about 20ks, so I could send it to Olly to find where is the problem with OllyDbg.


count of total posts

RCE Messageboard's Regroupment > The Heap > count of total posts
oh me anon
03-20-2003, 02:33 PM
hi tbd ,

it seems your counter of total posts does not count the posts by anonymus posters coz when i last came here today the count was 564 posts in gen topic

now i see it is 565 but there are more than six posts between last time and this time

i many time dont enter inside if your counter hasnt increased then some times wonder how i missed this post afterwards

please correct this if it is so
oh me anon
03-20-2003, 02:39 PM
for the above post the topic count has increased from 137 to 138 but post count hasnt increased remains same as 565 ;)
iam a lazy one who hasnt registered but uses your novel feature of posting with nick ;) ;}
itsme
03-20-2003, 07:45 PM
Just set the ollydbg user forum homepage to "sort by answers" and you can quickly tell if anyone else has visited. It's the method I use and I'm anon too :)

Have registered, but can't be bothered to keep typing password in all the time, so just use this nick instead.
TBD
03-21-2003, 03:57 AM
oh me anon: yup, i use the same method as itsme. sometime ago i used klipfolio to track but it took too much RAM and i disabled it.

in another way, why did you post it in General ? it's more for Heap :)
oh me anon
03-21-2003, 12:02 PM
ok let me try your suggestions by the way i saw the count of gen post not increasing so posted it in general thanks for moving it to heap ;}


Plugin Skeleton

RCE Messageboard's Regroupment > Plugins > Plugin Skeleton
lownoise
03-21-2003, 06:40 AM
Hi,

Does someone have a basic plugin skeleton for vc++?
TBD
03-21-2003, 10:05 AM
PDK 1.08 (http://home.t-online.de/home/Ollydbg/plug108.zip) has support for VC 5.0
lownoise
03-21-2003, 10:30 AM
Tbd,

I know that the PDK 1.08 support has for vc 5.0 but that wasn't what i meant.
In the PDK you've the cmdline and bookmark sources, but do we have a kind of template you can use or do i've got to strip down the cmdline or bookmark sources?

Lownoise
TBD
03-24-2003, 07:17 AM
lownoise: stripdown and fill with your plugin code.
on what plugin do you plan to work ?
lownoise
03-24-2003, 01:28 PM
TBD,

Want to make plugin, thats patched debug detection for api isdebuggerpresent and PEB
itsme
03-24-2003, 08:38 PM
To do something like that, isn't it easier to patch each prog individually, and then use the patch manager to keep it there? You only really need to patch a few bytes (2 lines of asm code).
lownoise
03-25-2003, 07:42 AM
Yep you're right but want to learn some coding, i know where and how to patch the code. I think it will be a plugin for myself, thanks for tip to use patch manager.


Patches window

RCE Messageboard's Regroupment > Bugs > Patches window
helloword
03-21-2003, 04:04 PM
"Patches" window do not log the changes done in the "resources of module" window.
helloword
03-21-2003, 04:08 PM
Detail step description

1. I open a file
2. View --> Memory
3. right click (in the line of my file) --> view all ressources
4. in Dialog right click --> Dump
5. I make my changes
6. F9
7. Ctlr + F2
8. nothing in the patch window
Teerayoot
07-22-2003, 05:50 AM
Yeah,it's save only for modifyed cde in cpu window!.I think olly ,please ,add this (not modifyed code only in cpu window)in new release.


[BUG] CRASH on long arguments length

RCE Messageboard's Regroupment > Bugs > [BUG] CRASH on long arguments length
Anonymous
03-21-2003, 10:58 PM
Thank you for your good work.
When i tested my EXE with long long arguments, The OllyDbg(1.09b) was crashed.
(Maby be argument length is 600 bytes)

Please, fix it up. :)

Best regards.

Shawn
luucorp
06-09-2003, 10:09 PM
it 's true
TBD
06-10-2003, 04:50 AM
it will be fixed in upcoming 1.09c (this week)


memory dumper

RCE Messageboard's Regroupment > General > memory dumper
Anonymous
03-23-2003, 06:45 AM
memory dumper
Anonymous
03-23-2003, 11:13 AM
?


Strange ? in the asm

RCE Messageboard's Regroupment > General > Strange ? in the asm
helloword
03-23-2003, 07:52 AM
This is a sampler of disam by Ollydbg:
0040FDAD . 8242 BC 56 add byte ptr ds:[edx-44], 56
0040FDB1 ? EA 612C58F3 3D0E jmp far 0E3D:F3582C61
0040FDB8 ? 07 pop es
0040FDB9 ? 99 cdq
0040FDBA ? 25 41C3957B and eax, 7B95C341
0040FDBF ? E5 B5 in eax, 0B5
0040FDC1 ? E1 74 loopde short 0040FE37
0040FDC3 ? 2BC3 sub eax, ebx

But the second line should be
0040FDB5 F3:
0040FDB6 3D 0E079925 cmp eax, 2599070E

Can someone give me some explanation regarding this issue ?
itsme
03-23-2003, 11:12 AM
ollydbg doesn't know where the start of the command to disassemble is, so makes a guess, and gets it wrong. CTRL+G and enter the right address. If this happens constantly, it's probably anti-debugging/anti-disassmbler code. Quite simple to do, just put E9 before actual code and then push the address on the stack and return. disassembler will produce garbage result.

eg.

call poop
db e9 ; disassembler/debugger thinks this is jump instruction
push 452a7d ; and screws up this command (hides it from cracker/etc)
retn

poop: pop eax
inc eax
push eax
retn ; return to "push 452a7d" instruction.


Conditional breakpoint on memory read access

RCE Messageboard's Regroupment > General > Conditional breakpoint on memory read access*
ollynewby
03-24-2003, 07:52 AM
Hi,

Can anyone tell me if it's possible to set a conditional breakpoint on memory read access and how that condition would look like?
To clarify, this is what I'd like to do:
I want to keep an eye on an memory address location, but I don't want Ollydbg to pause everytime when this data is being read. I want to exclude the pausing when it's being read by another module or in some parts of the program?(in my case, the data is being read for screenpainting by GDI.EXE, and I'm not interested in that part).

Thanks for your comments and/or suggestions
TBD
03-24-2003, 09:28 AM
ollynewby: as this question is not plugin related, i leave it in "general" and deleted from "plugins"

you cannot put conditional breakpoint on memory only normal breakpoints.
a solution is to find reference to memory location from your program (CTRL+R) and conditional breakpoint on all locations that access your memory address.
ollynewby
03-25-2003, 10:12 AM
Thanks for your proposal, TBD. I do know the exact adress of the location, but when it breaks during read access, the code is always using relative addresses, such as
"CMP BYTE PTR DS:[ECX+EAX], 0D". The references to such a "memory location" are too many to check through (more than 2 pages). I probably have to rethink my strategy and try a completely different approach. The CTRL-R feature can indeed be very useful in many circumstances.


Custom function descriptions

RCE Messageboard's Regroupment > General > Custom function descriptions
helloword
03-26-2003, 09:00 AM
Can someone help me on this issue.
I have an API in VB6 ex:__vbaVarDiv

My assembler code

0041DCDF push edx
0041DCE0 push eax
0041DCE1 call near dword ptr ds:[<&MSVBVM60.__vbaVarDiv>]

TYPE X_V
????????
END
TYPE Y_V
???????
END

STDFUNC __vbaVarDiv
"x value" X_V
"y value" X_V
END

OK this function divide 2 variants (x/y)
At the same time how can I display the result
helloword
03-26-2003, 09:02 AM
Can someone write the whole code that needs to be added in the common.arg file
Thank in advance
TBD
03-26-2003, 10:08 AM
you can use this or can change HEX with INT, UINT, CHAR (unlikely 'coz it is math function):
---
TYPE X_V
HEX
END

TYPE X_V
HEX
END

STDFUNC __vbaVarDiv
"x" X_V
"y" Y_V
END
---
helloword
03-26-2003, 02:29 PM
Thank for the answer TBD
I just update the file common.arg and restart Ollydbg but the Ollydbg do not display anything in plus.
I think there is something wrong somewhere.

I will be nice, if someone post a common.arg file for VB6 or C++ functions description.
TBD
03-27-2003, 04:41 AM
helloword: i tried with a custom DLL and everything worked perfectly.
any error in the Log window ? or other information regarding common.org ?

also redo the analysis to see the changes.


OllyDump v2.11.108 release

RCE Messageboard's Regroupment > Plugins > OllyDump v2.11.108 release
Gigapede
03-27-2003, 12:16 AM
what's new in OllyDump v2.11.108
-- new import rebuild engine can rebuild asprotect,petite (not perfect)
-- tElock's imported API search(cannot rebuild but logging)

Please try various packers or protectors and report it.

download
http://dd.x-eye.net/file/ollydump211.zip
Ricardo Narvaja
03-27-2003, 05:47 AM
There is a bug yesterday i make a tut dumping a simple exe32pack archive with OLLYDMP old version and works fine, and with the new y reach the same OEP dump, and not RUN, this message appear

NO SE ENCUENTRA EL PUNTO DE ENTRADA DEL PROCEDIMIENTO RtlDeleteCriticalSection en la bibioteca de vinculos dinamicos Kernel32.dll

Don't found de entry point of procedure RtlDeleteCriticalSection in Kernel32.dll

And dont RUN and with the old OLLYDMP runs very well maybe OLLYDMP if you try more complex for hard packers maybe a option for simple rebuild for old packers
can be useful,if not i switc in old ollydmp and new ollydmp for every packer

Ricardo Narvaja
Ricardo Narvaja
03-27-2003, 05:58 AM
UPX 1.24 the same error, yesterday i dump a upx 1.24 in old version and go weel, in the new ollydmp the message of error say

NO SE ENCUENTRA EL PUNTO DE ENTRADA DEL PROCEDIMIENTO RtlDeleteCriticalSection en la bibioteca de vinculos dinamicos Kernel32.dll

Don't found de entry point of procedure RtlDeleteCriticalSection in Kernel32.dll

And dont RUN

Ricardo Narvaja
Anonymous
03-27-2003, 10:00 AM
try to rename this function in something what exists in kernel32
Ricardo Narvaja
03-27-2003, 01:50 PM
If in old ollydmp function well in the new has a bug, then i report for correct the bug in the next release.

Ricardo
Gigapede
03-29-2003, 10:56 AM
Thanks Ricardo.

I know it but I have no idea to solve it.
It may be relative with SEH and ntdll.dll's function get into kernel32.dll's thunk block.

Could you give me the both bad and good dumped files?
Ricardo Narvaja
03-29-2003, 12:57 PM
i dont know your mail my mail is ricnar22@millic.com.ar if you mail i send to you the files with the old OLLYDMP and with the new OLLYDMP.

Ricardo
Gigapede
03-29-2003, 02:30 PM
Sorry.

My mail is gigapede@btmo.cjb.net

I may solve this problem.
Please try new one.
http://dd.x-eye.net/file/ollydump212.zip
Tacman
03-29-2003, 03:25 PM
It seems to be working good now. I've only tested on Upx and Fsg, both succesful
Ricardo Narvaja
03-29-2003, 06:28 PM
Now is the same error but with RtlGetLastWinError not found entry point in other API.

Ricardo Narvaja
Gigapede
03-30-2003, 01:31 AM
I can't guess the reason any more.
Please send the files.
Ricardo Narvaja
03-30-2003, 08:04 AM
I send the files yesterday to your mail.

Ricardo
Ricrado Narvaja
03-30-2003, 04:31 PM
The version 2.13 RUNS WELL thanks GIGAPEDE you are great.

Ricardo Narvaja
Anonymous
04-01-2003, 03:57 AM
a newbie question please???

how can i make the dumped exe run-able? Do i need to fix anything?
Ricrado Narvaja
04-01-2003, 05:32 AM
Now i discover a Bug again in version 2.13, in other api, this bug i guess only in W98 and XP spanish versions, in english go well.

Ricardo Narvaja
Anonymous
04-01-2003, 09:31 AM
I got an error in the unpacked file:
the procedure entry point timeGetTime could not be located in the dynamic link library comctl32.dll
Ricardo Narvaja
04-01-2003, 10:14 AM
Well is the same error i have, in different api.

Ricardo Narvaja
Anonymous
04-01-2003, 09:49 PM
aspack 212
windows xp
Don't found de entry point of procedure RtlGetLastWin23Error in Kernel32.dll
Ricardo Narvaja
04-02-2003, 07:43 AM
well in 2.13 version any of this bugs are repared, and others not, i think in the next release will be all repared.

Ricardo
marley
03-23-2004, 07:55 PM
odbg109d
ollydump212

Aspack 2.12
windows XP PRO

Error:

"NO SE ENCUENTRA EL PUNTO DE ENTRADA DEL PROCEDIMIENTO en la bibioteca de vinculos dinamicos WS2_32.dll"
Ricardo Narvaja
03-24-2004, 06:11 AM
The last ollydmps are not full compatible with windows spanish versions, try change the mark tu the METHOD 2 of unpacking in the window of ollydmp and try again.

Si tenes el ollydmp en español calculo que lo hablaras, los vijos ollydmps funcionaban en XP en español, pero los ultimos los cambios de el engine determinaron que no reconstruya bien la tabla, y de siempre errores como esos sobre todo si usas en la ventana del ollydmp el metodo 1.
Proba con el metodo 2 si no bajate de mi FTP las versiones viejas de ollydmp con lo cual por lo menos podras dumpear sin error los packers mas sencillos (aspack, upx, petite, etc)

Ricardo
marley
03-24-2004, 06:21 PM
Hy Ricardo, I speak Portugues(Brasil), you could send me an old version of ollydmp?

which the address of its ftp?

Thanks
Ricardo Narvaja
03-25-2004, 06:10 AM
The portuguese version of XP has the same problems of the spanish version.

mi ftp es

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

en HERRAMIENTAS-PLUGINS PARA OLLY esta el ollydmp y los viejos ollydmp

en ellos puedes desempacar muchos packers sencillos (no piensen en armadillo, asprotect, etc)

Cuando llegas a oep desempacas directo y si te da un error C0000005 vas al LORDPE DELUXE y le haces un REBUILD y queda funcional.

Ricardo
marley
03-25-2004, 10:11 AM
Hy Ricardo,

I Have a problem, I analyzed an archive with the PEiD, the result was EXEStealth 2,5/2,6 - > WebToolMaster.

I analyzed the sections of it and appears the UPX.

How I must proceed first? With ExeStealth or UPX?

Thanks
Ricardo Narvaja
03-25-2004, 05:08 PM
Well i think if peid say exestealth i think is more possible, the names of sections can be changed.

The unpacking of the two packers are very similar (manually found OEP, DUMP, REBUILD IAT) , the diferences are few.

Ricardo


Labeler?

RCE Messageboard's Regroupment > Plugins > Labeler?
Anonymous
03-29-2003, 07:51 AM
Looking at this plugin right now... Don't really understand how it works. Could someone please explain? Thx!
Gigapede
04-15-2003, 01:12 PM
When you find array or struct at constant address, Labeler helps you to set label.

- Show top of array or struct address in CPU dump pane
- Open Labeler dialog
- Set label name, number of array, valiable type
- Push OK button to set label

example 1
Label Name:xxx
Start Address:402000
Number:5
Type:DWORD
Index:HEX

address label
402000 : xxx[0]
402004 : xxx[1]
402008 : xxx[2]
40200C : xxx[3]
402010 : xxx[4]

and in Disasm pane you find the label like this
mov [402000],123 -> mov [xxx[0]],123

example 2
Label Name:rect
Start Address:402000
Number:16
Type:struct RECT
Index:HEX

402000 : rect[0].left
402004 : rect[0].top
402008 : rect[0].right
40200C : rect[0].bottom
.....
4020C0 : rect[F].left
4020C4 : rect[F].top
4020C8 : rect[F].right
4020CC : rect[F].bottom


[help] sorting OD2.0 requests

RCE Messageboard's Regroupment > The Heap > [help] sorting OD2.0 requests
TBD
04-01-2003, 09:54 AM
anyone that has time to sort the features requests from the post
"[POLL] what features do you want in OllyDbg 2.0" in:

::Interface
::Engine
::New features
::Others

... also monitor other similar apps for intresting ideeas ;)
i plan to have a page with all needed features for OD 2.0 so that Olly can see what to implement next.

any voluteers ?
TBD
04-30-2003, 11:11 AM
hmmm, no volunteers ? everyone waits so that maybe, some otherone will do the job, huh ?
Anonymous
05-12-2003, 02:54 PM
I post all requested here, but unsorted :

- an user customizable interface

- start Analyzer from anywere in the code (for "weird" packed programs)

- Signatures For languages and packers etc

- wildcards for the arguments/addresses that get changed/relocated/etc

- change the path to the source files

- disassemble DLLs directly, without requiring a host EXE

- disassemble without debugging

- disassemble some opcodes produced by Borland C++ builder 5

- create a dir for plugins

- save a "project" file containing the bpx's and comments for a file you are debugging

- watch of possible result at the a procedure when enter some value of eax,ebx, ....

- in the offset window, jump to the same sentence in disassemble window (CPU)

- The size of the windows isn't predictable it changes and put in every size, the option in appearence RESTORE SIZE etc etc don't

function.

- The option of dissasemble only of dlls

- BPXS in dlls dont erase in RESTART

- EXECUTE SAL instruction

- Run in more packed programs (PELOCK, etc)

- trace into options (MORE SLOW - MORE QUICK - VERY SLOW) and in the very slow case, this options trace for use in very short

portions of the code tracing and storings ALL sentences in ALL sections, DLLS etc.

- Option for jmp to other section stops OLLY (for packers)

- Option for Breakpoint in memory acess only read, only execute and only write.

- the logger view when you are setting log breakpoints that if Olly think the value in a register wrote to the logger points to a string

- if the data is short (say, under 20 bytes) add optional possibility of dumping that

- Add a "Search for text" capability to the right-click menu in Resource Strings

- 'Delete All' option in the Breakpoints window

- in Resources Strings, you can double-click on a string and it'll take you to that string in the CPU/code window

- Compilation programs name, version ,....

- Packed programs name, version,....

- Ini file to add new unpacker

- Set macro record senario

- Convertor hex-->dec-->ascii on right click or Ctlr right click or ...

- all address in a procedure

- watch expression
when the value of .. is true
when the value of .. change

- MSDN API help on Ctrl+...

- A function like view tree but more graphical there we can navigate throught one procedure to sub-procedure and vis-versa

- An option in de mdi child windows to make it ontop of others, maybe a checkstate in the systemmenu of all the child windows.

- maybe an option to customize the right click menu of the CPU window and maybe others

- View resources of executable files (*.exe, *.dll, ...) and display like Borland Resource Workshop , eXeScope, Resource Hacker

- Shortcuts maintenace

- Wizard builder for coditional search, breackpoint,....

- more power to survive some compressed applications' trick (invalid opcodes, SEH, clearing debug registers, int 2Eh..

- Set Real SFX entry

- MODIFY EIP in registers

- Replace [local.1] with user defined string as [lpstr]

- Support hiding procedure

- Recognize user defined function with it's arguments

- insert some extra lines of code in especific locations

- Context menu item "Copy selected line(s)" in run trace

- Jump to code adress in stack segment...

- Button clear all *.udd and temp files

- Simple ANTI RIng 3 debug codes... and option to turn this feature....

- show STRING in the assembly window like W32dasms "Possibly String reference to...".

- store udd and bak files in a seperate directory

- - consideration of recursive calls handling on step_over,

- consideration of recursive calls handling on trace_over,

- highlighting trace log lines of function body on the same level of nesting

- select more than one breakpoint to delete\enable\disable In the "BREAKPOINTS" window

- right click popup menu an option to "add comment" to any breakpoint in the breakpoints window

- enable\disable the modified code in patches window

- network debugging for using a monitor attached to another computer for i.e. fullscreen apps or just extending workspace across

computers

- option to lock the current EIP highlight bar in the center

- debuging P-Code

- fix the bug where you reload a file and for some reason (the file is not packed) it says "some breakpoints are outside..." and then

disables all your breakpoints.

- Acelerator for "Search for - All referenced text strings" and "Search for text" inside this

- Selection printing in all windows, especially in dissasembly

- Better analysis like mfc ordinals

- Intelligent disasm searching, like search for procs that call mfc or sys, for procs that have case sequence, all I/O, disk read/writes

etc.

- Context menu or hot tip on registers to investigate pointed data

- Backinp up a snapshot of a process at a time to be able to reload latter the snapshot and continuing the debugging ...

- Add in the trace feature an option that logs only the API that have been called by the procedure or branche

- a freely configurable window layout, with several, over shortcuts switchable screens. In principle, the implied functionality of the

plugins StayOnTop and HideCaption, additionally with the extension to make scroll main window left/right and down/up over shortcuts.

- It should be able to switch between different, before stored window layouts

- more than one dump window, which remains keeping constant in the layout.

- lastbreakfromip where it shows last ip before break

- .lng files to traduce the soft

- wildcards in the search

- search&replace in a block of memory

- HEX control allows you to exclude single nibbles or bytes from the comparison

- deattach from the debugee app

- patch the file in another way ( ex: SW_HIDE,SW_MAXIMIZE,SW_MINIMIZE,SW_RESTORE,SW_SHOW when debuging the API

ShowWindow )

- Adding support for the great x86-64 platform. Pb is : which OS should one choose.

- "Copy code only" option

- Other ollydbg.exe TSR-Running that appear by hotkey Like SI's ctrl+D

- New window show all files extracted by debugged exe (ex: InstallShield,Wise)

- creat new Debug project by user, to add/remove procedure,function by copy/paste from process
Anonymous
05-12-2003, 04:45 PM
Great job!

However, I'd like to add a couple of features that aren't in the above summary.

-When assembling code, the chance to choose the format of numbers, as Masm compiler does. Ex:

MOV EAX, 50000 (decimal)
MOV EAX, 50000h (hexadecimal)

-It will be very useful, as well, in order to get more accurate results on Api calls, if you can set more than one expression on conditional log breakpoints. Ex:

EXPRESSION: MSG && HWND
CONDITION: MSG == WM_GETTEXT && HWND == 0406

It's just an idea.
Thanks.
Anonymous
05-12-2003, 04:52 PM
make it open source
Anonymous
05-13-2003, 06:41 AM
open source is not helpful for mainly peple

The third reply post is wondful,i wonder od2 can tune it to reality...
TBD
05-13-2003, 07:00 AM
open source - nope. you have the code of the disassembler. you have the plugin system. i think that is enough. for free.

thanks anon1 for the list. it would be nice to sort them. and remove the one already done (eg. plugin dir)

as i said in other post, Olly is very busy with work job so OD2.0 has low priority. sorry.
Ricardo Narvaja
05-13-2003, 09:10 AM
Pelock and Telock run well in ollydbg, this was repaired, and SAL instruction is well executed in 1.09b version, this points are old requests, and are solutioned.

Ricardo
Anonymous
05-13-2003, 10:44 PM
scrip maybe important,it cloud do a serial things automitic.
Anonymous
05-13-2003, 11:16 PM
can i ask ?

Will O.D 2.0 run on win2k3 ?
Anonymous
05-15-2003, 12:27 AM
prevent the app cleat the hardware breakpoint is important!
at a debug breakpoint is life *_*

CoDe_Inject
Anonymous
05-15-2003, 06:23 AM
I don't think that's possible without ollydbg tracing through the code and checking every line for a possible "bad" instruction. Besides, since Ollydbg is not intended to be a cracking program, clearing hardware breakpoints shouldn't happen anyway.

If you do want to crack, finding the "clear hardware breakpoint" instructions is easy enough.
Anonymous
05-15-2003, 09:14 AM
I would like copy only code, like there is copy only hex
Bob
12-04-2004, 02:28 AM
I do that by collapsing the columns with hex and then when you copy , the hex is not there..

I would really really be thankful for:

1. An option to highlight just api calls, as well as the generic colour for calls, in the apperance window.

2. Options to turn off the "The entrypoint is not in the code section" alert and the "Shall I load into LoadDll" messages.. They get annoying after the first 20,000,000 times.

3. Keystroke and mouse recording, and playback of them.. (I Can dream :)

~BoB~
1bitshort
12-04-2004, 02:45 AM
obviously it's completely Oleh's decision as to whether or not he makes it open source and i respect that, but do you know what his reasons are? open-sourceing it would allow other coders to contribute which would take a load off his plate, it would allow plugin developers to start utilizing literally any part of Ollydbg they wanted etc etc, but on the other hand i cant think of many reasons for keeping it closed source? Think of how good Ollydbg v1 is already yet how much better it could still become if many heads were able to contribute. :) Its also a bit strange due to the nature of the program and the people who use it who can effectively read a disassembly of a file as if it were source anyway 8)

But either way i sure as hell am not complaining, not only is Ollydbg one of the best usermode debuggers out there its pricetag is pretty hard to beat too. Seasons greetings Oleh!
Bob
12-14-2004, 11:41 AM
Why does he need a reason to keep his source private?
He's giving so much already, as tbd said. Open source is not compulsary..

Prob he doesn't want lamer-stamping of his tools, which has happened to me when I released the source to one of my tools, I found it later on the net, unchanged except with some lamers name all over it and not a mention of me.

I agree with your point that many heads are better than one, but is that not what we are doing here ? Contributing ?

~BoB~
littlecode
02-18-2005, 04:32 PM
A language patches for further version ~
So anyone could use there localize menu happily ~

Littlecode
ssb
02-19-2005, 08:06 AM
v2 ETA would be enough for me :)
1bitshort
02-19-2005, 01:23 PM
I'd like to see Ollydbg become a sourceforge (or similar) project so that many talented programmers from around the world could work on it. Oleh has laid the foundations of a superb debugger, but such a powerful program is surely too much for one programmer alone to develop (especially for a freeware program!!!), and by opening it up to other programmers he would not only be lessening his own workload, but also making the program develop faster (as many hands make light work). He would still be credited as being the #1 man behind Ollydbg so he wouldn't lose anything in the way of credit, even if hundreds of programmers were working on it
tigerheart
04-02-2005, 06:05 PM
- Ability to 'Collapse selection' so you don't have to look at it (say if it's alright), and also an option to 'trace over collapsed sections'.
- Ability to 'record macro' so you can go back to say... the next-to-last thing you did if you restart (say if you accidentaly trace over a function when you wanted to trace into... esp. when debugging packed code).
- Ability to Script macros directly in the interface (possibly tying into the record macro function, so you can add loops, and such into the recorded macros) instead of just using plugins. Some things are just too simple to worry about writing a DLL for ;).
- Ability to 'save changes' between sessions for modified code.
- Ability to 'colorize' code so you can color a set of lines for your own purposes.
- Some kind of 'try code' option where you can type in some code, and it will 'test' it using the current registers/info/etc without modifying it from the programs scope (so you can close the 'try code' and continue debugging). This way you can test something to see if this is where your program is causing the error.
- Some sort of 'instruction help' link, so you can figure out what a certain assembly instruction does, maybe link into an Art of Assembly guide somehow... for those of us that don't know what the fyl2xp1 instruction does ;). Perhaps right click -> Instruction Info
- Some sort of 'API help' link, so just as above you can figure out how the selected API works. Perhaps right click -> API Info
- A way to change the window's title, for debugging packed exe's. (yes, I do work with packing my exe's and seeing why they stopped working, sometimes instead of trying to find a different packer, some of them do not like seeing olly running for some reason.).
- Ability to 'track changes' to the file, so as you make updates, you can look at a window to see what you changed, where you changed it, and be able to 'undo' that line from there. (I'd say like the breakpoints window)
- Ability to disable breakpoints from within the code window (perhaps grey them out too instead of not being able to see them at all).
- That's all I can think of right now, but I'm sure I'll come up with more.

-TigerHeart
hell_bird
04-30-2005, 05:35 PM
now there is windows for x86-64 ... maybe v2 will support it?


Where to post tutorial?

RCE Messageboard's Regroupment > General > Where to post tutorial?
Anonymous
04-01-2003, 06:25 PM
Hi,
I've written a tutorial how to use Ollydbg. But I'm not sure how and where to post it since I was using a commercial target :-)
Any advice?
TBD
04-02-2003, 02:42 AM
Anonymous: as i cannot host tutorials on commercial applications, only crackme, i suggest to post it on RCE messageboard.

or you can make a tutorial on a crackme and i will host it here :)


API profile

RCE Messageboard's Regroupment > General > API profile
1bitshort
04-02-2003, 02:25 AM
I'd like to make a profile of all the APIs an exe calls. I can do some of this by right-clicking on the disassembly, then Search For | All Intermodular Calls, then right-clicking on each one and saying Set Log Breakpoint on every call. But, that doesn't seem to work with all calls. For example, OLE32.CoInitialize didn't create any info in the log, despite having a log breakpoint set and it definately being called. So whats the best way to create an 'API log/profile' ?
Many thanks in advance!


msvbvm50.lib ??

RCE Messageboard's Regroupment > General > msvbvm50.lib ??
Anonymous
04-03-2003, 04:58 PM
Hi,
I'm debugging a program that is written in VisualBasic5. Unfortunately Ollydbg displays only the ordinal numbers for library calls (call <jmp.&MSVBVM50.#581>). From where can I get the import library of MSVBVM50 to add it to Ollydbgs list of import libraries?

Thanks.
Anonymous
04-08-2003, 05:37 PM
hmm...i dont know if this will help you, but search on the internet for p-code debugger from Mr. White (if i remember weel from WKT group), or go to protools.cjb.net and got to page for p-code debugger. I think that there you will find NMS files (i really dont remember...search)

Proximus


Breakpoint

RCE Messageboard's Regroupment > General > Breakpoint
netstavi
04-06-2003, 12:09 PM
How are use Breakpoint for VB va Delphi. I don't set breakpoint for Visual Basic
Helpme ?


plugins

RCE Messageboard's Regroupment > General > plugins
Anonymous
04-08-2003, 01:08 PM
plugins
Anonymous
04-08-2003, 03:19 PM
yea you got it, PLUGINS !

servil


JMP EIP

RCE Messageboard's Regroupment > Bugs > JMP EIP
Anonymous
04-21-2003, 10:39 PM
JMP EIP is not recognized while assembling, which is kinda annoying... Is it a bug or a feature? =)
oh me anon
04-22-2003, 04:41 AM
use ctrl+e (binary edit)and hard code eb fe u get jmp eip

00405CF0 - EB FE JMP SHORT 00405CF0 ; this is jmp eip put a bp here
Anonymous
04-22-2003, 07:38 AM
or just put the address of the opcode. Eg:

405CF0 JMP 405CF0

Will generate the same hex code.


overflow in 1.09b

RCE Messageboard's Regroupment > General > overflow in 1.09b
Anonymous
04-24-2003, 01:16 PM
i am running winxp professional and i tryed to open
c:\windows\system32\cipher.exe with an argument as long as the text box
would allow to test and inspect the cipher.exe overflow recently posted on
bugtraq. after opening ollydbg quickly crashed with the following message:
AppName: ollydbg.exe AppVer: 1.0.9.1 ModName: unknown
ModVer: 0.0.0.0 Offset: 50505050
50 being the hex representation of ascii 'P'
mmmmmKay


How to hide ollydbg?

RCE Messageboard's Regroupment > General > How to hide ollydbg?
look46
04-25-2003, 06:14 AM
Enhorabuena ricardo for your tutorials. I've a problem with a crackme that i found in the net, it has a debugger detection but i cant crack it. the crackme is done with vb6. my question is : how can disable the antidbg routine? thanx
Ricrado Narvaja
04-25-2003, 03:27 PM
IN nt/2000 and XP is more easy, in 98 is more difficult,what SO have you.

Ricardo Narvaja
look46
04-26-2003, 05:24 AM
i have win98, i cant find isdebuggerpresent in kernel32. in command line i wrote bp isdebuggerpresent but didn't work. Please ricardo if you have some new tutorial about this tell me. i've seen your tutorials "toda la teoria comprimida" zip file but doesn't help me about that. thankx
Anonymous
04-26-2003, 07:07 AM
no set breakpoint. examine targets iat for isdebuggerpresent and overwrite this part of the iat with your own code that will simply return false. then no matter how many times it's called, it will never trigger.
look46
04-26-2003, 07:59 AM
Thankx, i did't by nopping isdebuggerpresent routine in kernel32.dll, and xor eax,eax befor ret. it works, thankx for your help. I have an other question, how can i set a breakpoint on hmemcpy in win98


Windows Error-Program too large to fit in memory

RCE Messageboard's Regroupment > General > Windows Error-Program too large to fit in memory
charcoal
04-25-2003, 04:56 PM
I want to run Ollydbg on my syatem at work under Windows 2000 and get an error message (in a DOS window) "Program too large to fit in memory". The program run just fine on my home PC under Windows 2000, so it must be some set up issue. I log on as an administrator.
Another hint is that Ollydbg.exe in windows explorer shows a generic "dos program" icon rather than the Ollydbg icon.
The PC in on a network with extensive "Group Policies" which are know only to the IT department. However, I have loaded many other "unauthorized" programs before without this problem.
Help!
charcoal
04-25-2003, 08:02 PM
Apparently, this was due to file transfer error. A freshly downloaded copy workled fine.


How to bp hmemcpy

RCE Messageboard's Regroupment > General > How to bp hmemcpy
look46
04-26-2003, 10:14 AM
I've seen the tutorial of ricardo about hmemcpy for XP, i did't for win98 but doesn't work. there is some one who can tell me how can i do it. thankx
Ricrado Narvaja
04-26-2003, 10:44 AM
Is Point HMEMCPY, not HMEMCPY is diferent is a point very similar but not is equal, ah?

Is only for NT/2000/XP

My suggestion change your 98 to XP, OLLYDBG is more powerful in XP.

Ricardo Narvaja
Anonymous
05-19-2003, 06:30 PM
Where can I find this tutorial?
Ricrado Narvaja
05-19-2003, 08:00 PM
Mail me to ricnar22@millic.com.ar and i tell you.

Ricardo
Anonymous
05-25-2003, 05:20 PM
Is there anyway to get an english version of this?
Ricrado Narvaja
05-25-2003, 09:50 PM
there are and english version in my FTP

Ricardo
Anonymous
05-26-2003, 11:22 AM
what is your ftp address?
thx
Ricardo Narvaja
05-26-2003, 11:28 AM
Mail and i tell you.

Ricardo
PD:3 post before is my mail
Anonymous
05-28-2003, 06:17 AM
I can not loged in your ftp
i use this
user : curso
pass : curso

my email Hackerzonline@hackermail.com
Ricrado Narvaja
05-28-2003, 07:36 AM
is full very parts of the days try on night

Ricardo
Anonymous
05-30-2003, 08:46 PM
Ricardo, I'm on your FTP, but which file is it. You have TONS of stuff on there...;)
Ricrado Narvaja
05-31-2003, 08:45 AM
in NUEVO CURSO- TEORIAS

33-PUNTO_ H INGLES.rar

Ricardo Narvaja
Anonymous
05-31-2003, 04:36 PM
Thanks Ricardo for that. Getting it now...:)
Anonymous
06-14-2003, 08:31 AM
podrias pasarme ese tut tambien???
Ricrado Narvaja
06-14-2003, 07:53 PM
si
Ricrado Narvaja
06-14-2003, 07:54 PM
proxima pregunta adonde jeeje
Anonymous
07-07-2003, 01:44 AM
Hai Ricrado,
I DL your tut '33-PUNTO_ H INGLES'and tryed it.
At the point where a make a breakpoint memory on access and press RUN (between FIGURE 14 and FIGURE 16), it goes to Kernel end than to GDI32, but never comes back to the program.
Maby it someting to configer in Olly... don't no (nOOb okee :)) ?

BurkBurk
Ricrado Narvaja
07-07-2003, 05:00 AM
in a few cases of configurations of machines, are reported this ( a 1 or 2% of the people what try the HMEMCPY sucesful), for a understand you have a non commmon configuration (keybord, mouse extrange, processor , etc?)

Ricardo


syntax coloring

RCE Messageboard's Regroupment > Bugs > syntax coloring
Anonymous
04-26-2003, 07:22 PM
Can't get syntax coloring to work on a Dutch Windows XP machine,
while it runs out of the box on another Windows 2000 one.
Manually changing the ini file does not help.
Anonymous
07-02-2003, 01:41 PM
I have the same problem. Windows XP Pro
TBD
07-03-2003, 04:14 AM
XP Pro SP1 - no problem.
have you right click in CPU window / Appearence / Highlighting / Select a scheme ?

other versions worked ? please be more specific so we can test it.
Anonymous
07-03-2003, 02:48 PM
*LOL* sry it worked now, thx. I had made the settings under Options/Appearence, i thought that these settings were accepted automatically. Didn't know that i
must select a scheme in CPU Window.


Remove bp & run program at same time...

RCE Messageboard's Regroupment > General > Remove bp & run program at same time...
Saje
05-01-2003, 08:03 AM
I'd like to do the following:

Set some breakpoints, when a breakpoint is reached remove it and continue running program. Obviously this can be done by pressing F2 then F9 - what I want is to do this in a single keypress. Is this possible? Can I map a certain key to trigger F2 then F9? Any help would be very appreciated.

Saje.
Anonymous
05-01-2003, 10:05 AM
if you want to see what breakpoints are reached in which order, just use a logged breakpoint instead of a breakpoint which causes the program to pause.
Anonymous
05-17-2003, 06:07 AM
how can i set breakpoint on every line when my program is running?
i don't wonna press F2 on every line, is there some shortest way?

sorry to my bad englesh....
Anonymous
05-17-2003, 08:23 AM
F8 will place a breakpoint on the next line for you so you can step through the code. I don't any reason to "set a breakpoint on every line".


Possible bug in attach to process?

RCE Messageboard's Regroupment > General > Possible bug in attach to process?
Anonymous
05-01-2003, 03:26 PM
further details here:
http://board.win32asmcommunity.net/showthread.php?s=&postid=100564 #post100564 (http://board.win32asmcommunity.net/showthread.php?s=&postid=100564#post100564)


Ollydump 2.20.108 dumping a dll

RCE Messageboard's Regroupment > Plugins > Ollydump 2.20.108 dumping a dll
asd
05-02-2003, 08:20 AM
Olly dump is awonderful tool to dump exes. How can i dump dlls?
Anonymous
05-03-2003, 01:37 PM
In exactly the same way. A DLL is just really another version of an EXE.
asd
05-04-2003, 12:52 AM
Olly dump has option dump debugged process. If i want to debug a dll i would open an exe which uses that dll and then stop at entry point of the dll.
now if i open Olly dump and give the OEP and size base. and dump it dumps the main exe and not the dll. (ofcouse if i give the values above the dump exe wont work -- anyway i have crossed then oep of exe since i want to dump dll.)


Plugin idea

RCE Messageboard's Regroupment > Plugins > Plugin idea
Anonymous
05-03-2003, 02:24 PM
Hi,
When we do a crack, can we record to a specific position? when we close ollydbg we have to do all the steps again, which is troublesome sometimes. If we can save all the environment as a project, then we can continue our work next time without wasting time doing the previous routine.
-EW
Anonymous
05-03-2003, 06:30 PM
If you just want to save you patched program to disk, then this is implemented already - just tell olly to save the executable to disk.

Note however that OllyDbg is a debugger, not some magic cracking tool, so cracking features may be ignored.
Anonymous
05-04-2003, 05:02 PM
1. If you use CTRL+G - go to some address, it will be remember for next time, even if you must reanalise exe file
2. All breakpoints stay
3. All comments and labels stay.
4. Paper and pencil ;-)

Well if this is not enough please stop use Olly debugger and try to use softice for example. Or better - stop cracking. Best quality of good cracker is patience.

gf+
aka
05-04-2003, 07:25 PM
Hi gf+,
gf+ Is that Godfather+ ?

I don't see your tutorial in Delphi anymore ? Where can i find it ? I intend to try on Tmpegencode 2.511... ( newest ).It's hard for me ( newbiew ).

:)
Anonymous
05-05-2003, 09:35 AM
yes, I am.

if you search for my tut about cracking delphi targets you can go to to google and write in search field: godfather+ and you will get it on first hit.

Try little more, if you don´t succed I will help you.
gf+
Anonymous
05-05-2003, 02:04 PM
Patience is good. but efficiency makes you a better cracker. otherwise why we need develop new tools? I'm just suggesting an idea here. I'll do my cracking with or without the plugin.
-EW
Anonymous
05-06-2003, 05:41 AM
Efficiency come like result of patience and work, which you need to invest in analyse routines and protection mechanisme again and again.

New tools are OK. But When someone start cracking with Olly debugger he lost feeling for real. Olly is simply too good. If you work with softice or old dos debug then you know what I mean. Ice have raw power but user interface is minimalistic. OK. Numega work more on functionality than on gui. Respect.

Today I use ice only for realy hard stuff (16 bit programs, dos, Hard lock protection, some new Exe protectors etc.)

" I'll do my cracking with or without the plugin. "

that I like ;-)

gf+


Access violation?

RCE Messageboard's Regroupment > Bugs > Access violation?
Anonymous
05-06-2003, 04:07 AM
I have a program that's unable to load in OllyDbg. it runs normallly on win xp . here are the error i encounter:

Access violation when readiing [ffffffff]

EBX = 00000000
DS: [ffffffff]=???

the proggie is written in VC. i tried to bypass but fail. exit code 80 (128).

any clues?? thanks
TBD
05-06-2003, 04:20 AM
it doesnt help. we need more info like - do you have the source or not ?
where it GPF (in your program or in dll) ?

you said "unable to load" - you cannot start at all your program ?

also you can post a link to it so everyone can take a look.

a lot of different things can go wrong
Ricardo Narvaja
05-06-2003, 12:25 PM
There is a antidebug rutine sure, in the program, read the tute in english 68 Armadillo for newbies and in the beginning there are a method for hide ollydbg.
And is possible the program use the api IsDebuggerPresent to detect a debugger.With the method of the tute you run the program with this antidebugging trick.

Ricardo
Anonymous
05-06-2003, 01:23 PM
6C3ED626 5E POP ESI
6C3ED627 > 55 PUSH EBP
6C3ED628 8BEC MOV EBP,ESP
6C3ED62A 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
6C3ED62D 53 PUSH EBX
6C3ED62E 33DB XOR EBX,EBX
6C3ED630 3BC3 CMP EAX,EBX
6C3ED632 74 02 JE SHORT MFC42.6C3ED636
6C3ED634 8918 MOV DWORD PTR DS:[EAX],EBX // Failed here EAX=FFFFFFFF

for some reason , i can't give out the program.

Ricardo sorry for be a newbie, do you have the link for the tute u mention??

appreciate any help giving.
Anonymous
05-06-2003, 01:37 PM
Ricardo i found the tute. keke thanks again.
oh me anon
05-07-2003, 07:27 AM
mov eax,[ebp+10] ---> moves aome thing from stack to eax
xor ebx,ebx
cmp eax,ebx ; so basically eax must be zero so that it takes the je that comes next

so the access viol can be eliminated
that means [ebp+10] must be 0
you land at access violation coz [ebp+10] !== 0

it may be designed like that for triggering an access violation and handling
tha access violation via a structured exception handling code

look for the seh (olly marks it in stack and cpu as well
btw if you use seh you can do almost anything with the situation
for example modify debugregisters,change eip, writein the code section (if the code section has write permission(else it can virtual protect and write loop holes every where) change the registers to new value so that it works now
but also the program gets to know that it is being debugged)

btw did you try passing that exception to program (shift+f7)
or adding last exception in debug options olly got lot of options to tackle these situations
Anonymous
05-09-2003, 09:11 AM
modul kernel32
77E7387D 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50]
77E73880 50 PUSH EAX
77E73881 FF15 0015E677 CALL DWORD PTR DS:[<&ntdll.RtlRaiseExcep>; ntdll.RtlRaiseException
77E73887 5E POP ESI;MSVCRT.77C114AC//Access violation no RTTI Data

heres another exception i encount, I m able to pass this exception a few times (shift + f7) and the program runs.
quick question what's the drawbacks of bypassing these expetions??
thanks
Ricardo Narvaja
05-09-2003, 10:30 AM
Is difficult if not view the program, if the program RUN out of OLLYDBG is obvious there are a detection of OLLYDBG.
When you press Shift + f9 and the program ends, go to the K (call stack) and view the calls in the list, the upper is the last call the program enter ,right click VIEW CALL and go to the executable or part of the program last executed before the error, look if there are a conditional jump, for not execute the bad call, if changing the conditonals jumps befores this call not RUN good the program, go to the call stack again and take the second call and make the same process, i dont know if is your case, but if i cant look the program, is only an idea.

Ricardo Narvaja


Close program (Alt-F2) bug?

RCE Messageboard's Regroupment > Bugs > Close program (Alt-F2) bug?
bundy
05-06-2003, 10:12 AM
When I press Alt-F2 (or the small x button) OllyDbg asks me if I really want
to close program. Until now everything's okay. Press Yes and program gets unloaded. But when you press NO, program gets UNLOADED TOO (according to log) and you are unable to continue.
TBD
05-06-2003, 11:44 AM
bundy: i was able to reproduce the bug too. i notified Olly about it.
thanks!


DLL initialization failed

RCE Messageboard's Regroupment > Bugs > DLL initialization failed
Anonymous
05-09-2003, 05:32 AM
Could someone verify this problem: when comlog.dll is in the same directory as OllyDbg.exe, OllyDbg displays the following error message when starting:

OllyDbg: OLLYDBG.EXE - DLL Initialization Failed

Initialization of the dynamic link library C:\ComLog.dll failed. The process is terminating abnormally.

The mysterious ComLog.dll is a part of ComHooks 1.0 (c) EliCZ (http://elicz.cjb.net/ , "exports" section)

Morris
Morris
05-09-2003, 06:38 AM
Forgot to mention:

WinNT4 WS SP6a (also on WinNT4 SRV SP6a)
OllyDbg 1.09b
TBD
05-09-2003, 07:04 AM
Morris: can you post a command line example that fails ?
i'm too lazy to dwelve deeper to see how it is used.

i can test on NT4SP6, OD 1.09b
Morris
05-09-2003, 07:55 AM
Simply:

ollydbg <enter>

or: doubleclick the OllyDbg.exe icon
Morris
05-09-2003, 08:09 AM
Well, further investigating the problem I renamed ComLog.dll to !ComLog.dll and the problem persisted. Then I renamed it to ComLog!.dll and the problem still persisted.

Then I renamed a help file to SomethingLog.dll and OllyDbg reported that "SomethingLog.dll is not a valid Windows NT image" (of course it is not - it is a .hlp file!).

That gave me an idea that OllyDbg tries to load all *log*.dll files that are in it's directory.
Anonymous
05-09-2003, 10:09 AM
More likely ollydbg is assuming all DLLs are plugins, and when one fails to load, it gives the above error messages.
Morris
05-09-2003, 10:28 AM
May be so.
Anyway, no other dll gives such message, and there are 21 dll there, some of which are:

ApiHooks.dll
BOOKMARK.DLL (OD plugin)
CMDLINE.DLL (OD plugin)
ComHooks.dll
ComLog.dll
CPUMON.DLL
cygwin1.dll
pdh.dll
P rocessWorks.dll


Following pointers in the dump

RCE Messageboard's Regroupment > General > Following pointers in the dump
Anonymous
05-10-2003, 08:51 PM
Say I had a pointer in the register esi to a bit of memory, how can i follow this in the dump?
Anonymous
05-10-2003, 09:08 PM
I'm not exactly sure what you mean, but if you want to check whenever the program accesses that memory, why not setup a hardware break-on-access breakpoint?
Anonymous
05-11-2003, 07:25 AM
Well, say eax is a pointer to a space of memory. I can see what eax is, but not whats in the memory at eax which I need to see. If I right click and goto follow in dump->memory address it brings me to a location, but doesn't tell me where the data starts, so I have no idea where the data is :(
oh me anon
05-11-2003, 08:26 AM
say you have this
mov eax,401008
after you process this instruction eax will be 401008
now if you right click and follow in dump
dump will show you what is there at 401008

at 401008 there may be an ascii null terminated string like "this is what you are looking for"

or 401008 may hold one more address like 401067

or it may be a constant like 0000000A

if it holds an address you may follow it also just select the dword and right click you get two more options like follow in dump or follow in dissembler

deciphering is an art olly is not a magicians wand and it does not have extra sensory perception
Anonymous
05-11-2003, 09:24 AM
say i have
push eax
just before a call. And eax is a pointer to a piece of data that I need, say, 00ADBBA0
if i right click, goto follow in dump, and press memory address. It brings me to some data in the dump, but I don't know where abouts it is in the dump, I dont know where the dword starts. Can you help with that? :(
Anonymous
05-11-2003, 09:26 AM
Not dword, i mean data.
Anonymous
05-11-2003, 07:19 PM
I'm afraid you'll have to make yourself more clear. It sounds like you are trying to find the start of data memory, which doesn't exist, as data can be stored anywhere (even in code section).
Anonymous
05-13-2003, 12:49 PM
No...
There is a pointer to some data in a register while debugging. And I need to be able to find that data where ever it is, and obtain it.
Anonymous
05-13-2003, 01:56 PM
Right click register and "follow in dump".
Anonymous
05-13-2003, 04:52 PM
I've tried that. It goes to a place in the dump, but it doesn't tell me where the data starts, so really I am as clueless as before. Help? :(
Sungazer
05-22-2003, 01:47 PM
When you use Follow in Dump, Olly jumps in the Hex-Dump Window exactly to the _first Byte_ to which your adress points. You should see left in the address field your value form eax, or whatever you tried to follow...


arguments

RCE Messageboard's Regroupment > Bugs > arguments
Anonymous
05-11-2003, 10:56 PM
hello,

when setting the program argunts, i set something like "test123" when i run the program, and use GetCommandLine to check its arguments, it does return "c:\myprogram.exe test123" while it should return just test123, am i wrong ?
Anonymous
05-12-2003, 07:39 AM
GetCommandLine returns executable with path and parameters. you should extract the parameters yourself. or use CommandLineToArgvW (UNICODE only)
Anonymous
05-12-2003, 09:23 AM
the first command line arg is always the executable filename, the programs args start from the second.
Anonymous
05-12-2003, 10:36 AM
Hello, as far as i've seen its not like that or im doing something wrong, i've written a program to illustrate what i said:

-- launch.asm --
cmdline db "this is the command line",0
arquivo db "host.exe",0

invoke CreateProcess,addr exefile,addr cmdline,NULL,NULL,NULL,NULL,NULL, NULL,ADDR st_info,ADDR pr_info
-- launch.asm --

-- host.asm --

invoke GetCommandLineA
invoke MessageBox,0,eax,eax,0

-- host.asm --

after running launch.exe, host.exe will give the command line which is "this is the command line" and NOT "host.exe this is the command line"

can u clarify this to me ? am i doing something wrong ?
Anonymous
05-12-2003, 10:38 AM
arquivo = exefile in the thread above
Anonymous
05-12-2003, 08:15 PM
If your using CreateProcess, you'll get exactly what you are passing to that as your command line. So by passing "this is the command line" in your CreateProcess call, you'll get "this is the command line" from GetCommandLineA.

However, when the OS loads your process, you'll get "host.exe this is the command line" as it prepends the exe name first before calling CreateProcess.
Anonymous
05-13-2003, 12:01 AM
ah ok, thanks a lot,
is there any way to get "this is the command line" in ollydbg ? maybe olly can create the process with the CreateProcess api ?
Anonymous
05-13-2003, 05:16 AM
Ollydbg does create the process with the CreateProcess API, but always prepends the executable filename onto it, just like Windows does. It would therefore be easier if you did the same.


waiting :)

RCE Messageboard's Regroupment > General > waiting :)
Darus
05-12-2003, 10:48 AM
we wait :)
http://darusweb.free.fr/ban2.gif
TBD
05-12-2003, 12:15 PM
nice gfx!

olly is working on OD2.0 but nowdays he is busy with job work. even his
work email it is not checkin'

anyway. it will took some months till first OD 2.0 will show up. so be patient.

since yesterday i am on a business trip in germany i hope that i will meet Olly and i hope to get a peek on the development.

on the last year encounter i saw a interface making scripting that left my mouth open.

i will keep the board informed as soon as will have more info.

till then ... check this thread. (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=5&topic=230)


another ollydbg 2 request

RCE Messageboard's Regroupment > General > another ollydbg 2 request
Anonymous
05-17-2003, 06:28 AM
im constantly wanting to add comments from within a "find all references to..." list. this isnt so hard to do manually, i just double click on each item in the list which brings the dissasembler to that line, then add the comment, then go back to the list window, and continue, but it sure would be convenient if i could add comments to those lines from within the found references list directly.


how can i dump PE files for OllyDbg and ollydump.

RCE Messageboard's Regroupment > General > how can i dump PE files for OllyDbg and ollydump.
andyboll
05-17-2003, 02:29 PM
i have download the OllDbg1.09b and ollydump.dll,place the ollydump.dll in the folder of OllDbg1.09b,
now,how can i use dumping?
i need the details for dump,can you help me? i'm new for Olldbg!!!
:)
Elixia
05-17-2003, 03:17 PM
Plugins menu -> Ollydump -> Dump debugged process.

Best to make sure your on the OEP before doing so however, and that the protected program isn't segmented (eg. Armadillo).


log modular calls?

RCE Messageboard's Regroupment > General > log modular calls?
Anonymous
05-17-2003, 04:51 PM
is there any way to log all intermodular calls in ollydbg?

thanks for any advice giving.
Elixia
05-17-2003, 06:20 PM
Yes, use "Set log breakpoint on every command" in the Intermodular calls window.
Anonymous
05-17-2003, 10:45 PM
sorry if my question sounds noob 2 you

when i try to set log breakpoint on every command, it dosnt log the names of all the calls.

do exactly i need to refill in condition, explanation and expression box??


why i can't find plugs menu or command bar in

RCE Messageboard's Regroupment > General > why i can't find plugs menu or command bar in
andyboll
05-17-2003, 11:23 PM
i have download ollydbg1.09 from "http://home.t-online.de/home/Ollydbg"
but i can't find plugs menu or command bar?
why?how can i do?
i need your helps!!!
Ricrado Narvaja
05-18-2003, 01:08 AM
in this forum, upper look this

Home · Reply · Statistics · Registration · Search · FAQ · Language ·OllyDbg Stuph(plugins, tutorials) ·

plugins (click in this link )or here

http://dd.x-eye.net/ollyplugin.html

Ricardo


how can i make breakpoint for messages?

RCE Messageboard's Regroupment > General > how can i make breakpoint for messages?
andyboll
05-18-2003, 10:30 AM
ep:WM_KEYDOWN
how can i break it?
Ricrado Narvaja
05-18-2003, 11:32 AM
put a Breakpoint conditional log in TranslateMessage and pout condition

MSG==101 or MSG==102

or MSG==WM_KEYDOWN

and put the mark in stop on condition

Ricardo
andyboll
05-18-2003, 12:36 PM
Translatemessage?what's mean?
can you give me a picture about this window?
Ricrado Narvaja
05-18-2003, 03:29 PM
is an API.

in this api you can put a Bp Conditonal log, in XP are better.

In 98 is more difficult for no access to the BPX direct in apis.

Ricardo


[!!!] NO MORE *CRACKING* POSTS [!!!]

RCE Messageboard's Regroupment > The Heap > [!!!] NO MORE *CRACKING* POSTS [!!!]
TBD
05-19-2003, 05:02 AM
hi all,

as my host dont want to have any problems and i dont want to switch (again) hosts
ALL CRACKING RELATED POSTS WILL BE DELETED with no warning.

also i think i will close the forum for anonymous users.

sorry for this inconvienience but if you want cracking related posts you must use another forum.
Anonymous
05-19-2003, 05:25 AM
np
TBD
05-19-2003, 05:30 AM
Anonymous: ahm. who are you anonymous ? :)
codeinject
05-19-2003, 05:55 AM
does the forum use cookies?
why i will not be auto login ?
TBD
05-19-2003, 06:38 AM
codeinject: yup. they have a timeout feature.
Anonymous
05-19-2003, 10:13 AM
Personally, If you stop anonymous posts, I simply will not be posting anymore.
TBD
05-19-2003, 11:04 AM
Anonymous2: the anonymous posting it is a great feature but also the most abused one.
i offer to you this opportunity to share knowledge for free and i think it is fair enough to at least login.
so, i think from the next week the anonymous posts will be restricted. and of course the cracking related posts.

ps. you cannot satisfy everyone. IMHO this is the only way to go if the forum will stay on win32asmcommunity.net
Anonymous
05-19-2003, 12:47 PM
i think you are totally right in asking for people to log in tbd you have done more then enough by making the program free and including technical support, if a few users dont want to loggin then i say c-ya later as the community will do fine without you:)
TBD
05-19-2003, 12:50 PM
Anonymous: then why you dont login <eg>.

for the record, i am not the author of OllyDbg. i created this forum to have a place where users can share their experience and help Olly in getting user feedback & requests for next versions.

so, i am only the forum moderator and not the program author :)
aka
05-19-2003, 02:28 PM
Hi,

I am a newbie, I search on google, i don't see so much about olly tutor.I hope i see a lot crackmes with method Armidillo, etc. When i read some old tutors, some author didn't want to contact via e-mail.Only forum is a place to communicate.

Thanks Folks. I learn a lot tutorials form this forum.
Thanks Ricardo.
TBD : I don't know if Ricardo has a new tutor, he can post here, let me know to get it from his ftp. (ftp://ftp.) I don't mind translating to English (in file over 40 MB ).
I didn't learn anything from old tutors without source program.I just read and read, and i didn't image how it run in debug.(it is difficult to image how it run debug in brain :)) ).

Sorry, English is not my language.
Ricrado Narvaja
05-19-2003, 03:47 PM
Sorry i not understand how the comunication of the new tute on my ftp, the tute is not posted here, is violating any law of the forum, i see the explications of this tute well this can be bad, but a comunnication of a new tute, is bad?, i don't understand, well, i'm sad, but this are the rules, and i accept this.
Sorry
Ricardo Narvaja
aka
05-19-2003, 04:25 PM
I obey the rules as well. I don't want this forum to be closed. :)))
Anonymous
05-19-2003, 05:04 PM
I login from now on. Can board support cookies to store login info?

Ricardo: Could you please remove the URLs to your FTP site, as this stores a lot of cracked software. If this is not possible, would it be possible to change the password to the ftp and not give it out?
codeinject
05-20-2003, 01:11 AM
ohh no,Ricrado Narvaja's post is deleted?
is those post related with crack?

i see technology in those posts. it is sad see those post has been deleted.

but i have to accept the rules,maybe good for OD's future
TBD
05-20-2003, 04:43 AM
Ricrado Narvaja: sorry that i had to remove your posts. a lot of good info were in there.

aka: yes. the tutorials are great, but would be nice if the tutorials are not specific to some programs. it would be nice to have generic tutorials, that show some hints, and not everystep.
Hiroshimator
05-20-2003, 07:25 AM
one of the problems is that a page you link to is legally considered belonging to your page so you *are* responsible for its content (excluding links *they* link to)

So if you put somewhere on a respectable site a link to warez on that moment they'll have warez on their page, it's crazy I know but I got wind of it through someone convicted of 'only linking' to warez pages (and similar illegal content) so do not think it does not get acted on or that it doesn't exist.

I figure it's a twisted legal way to try and deal with warezsites that don't house the warez directly, but it can create problems for conscious, legal sites if they aren't careful.

On a more personal note: you're actively messing with the work of a fellow developer. I know the knowledge you gain is nice and helps a lot but please never forget that behind every program there is a programmer just like you, only trying to make a living through what he or she loves to do: programming.

There exist already messageboards that will cather to some of these topics (google for "fravia forum and you're bound to find something"), why not use them?

my 0.02€


[ODF] login problems

RCE Messageboard's Regroupment > The Heap > [ODF] login problems
TBD
05-21-2003, 08:22 AM
it seems that 1.6 upgrade broken the login process. it is impossible to login from the main page, but it is possible when posting.

i am working on fixing the problem.

sorry for this
codeinject
05-21-2003, 11:16 PM
JeJe,have know this long time ago;
btw:give a choice to choose the cookie keep time is good.

CoDe_Inject
aka
05-22-2003, 03:29 AM
CoDe_Inject and CoDe_InSide are twoperson or one. :))
codeinject
05-22-2003, 11:33 PM
I am from China not CoDe_InSide,sorry for make such a misunderstand.
TBD
05-23-2003, 05:21 AM
problem solved. it was a cookie problem.


C++ and ASSEMBLER tutorials

RCE Messageboard's Regroupment > The Heap > C++ and ASSEMBLER tutorials
Anonymous
05-21-2003, 03:36 PM
The best assembler site with tutorials for beginers or advance, and links to downloads compilers is: http://win32asm.cjb.net/

For C++ you can get a free compiler from: http://www.borland.com/products/downloads/download_cbuilder.html

Tutorials from: http://www.cpp-home.com/
Plus I type the word C++ tutorials on google.com
and show over 400,000 sites GOOD LUCK
jose7 jose7@prtc.net Jose E. Ramirez
Raygun
01-11-2005, 01:06 AM
Actually, one of the best assembler sites is

http://webster.cs.ucr.edu/AoA/index.html
hosiminh
01-11-2005, 10:27 AM
Iczelion's Win32 Assembly Homepage

_http://win32assembly.online.fr/


rebuild import table

RCE Messageboard's Regroupment > General > rebuild import table
andyboll
05-22-2003, 01:04 AM
sometimes,we need to rebuild import table by hand,and before i aready use tools such as Import ERC,but here have some funcions also is invaild ,how can i do?
can you help me?
Anonymous
05-22-2003, 07:36 AM
You need to trace functions that are invalid until you see that the protector is calling the original API, and then overwrite the invalid with the actual.


New security anti debuging.How to defeat it?

RCE Messageboard's Regroupment > General > New security anti debuging.How to defeat it?
Anonymous
05-22-2003, 07:22 AM
xxxxxx x.0 and many new releash programs use DebugActiveProcess(___) to debug it's self. When i attach to debug ,it reply Unable to debug process.HOw to fix this ploblem?

[TBD] removed program name
Ricardo Narvaja
05-22-2003, 08:42 AM
Go to fravia board and ask there

http://www.woodmann.com/upload/

or mail me to ricnar22@millic.com.ar

Ricardo Narvaja


Search

RCE Messageboard's Regroupment > General > Search
Anonymous
05-23-2003, 04:00 AM
I would like to set break points on some functions or text references..
Is there a way to search through the disassembly to locate the desired data or function name...
Anonymous
05-23-2003, 05:12 AM
yes
TBD
05-23-2003, 10:05 AM
functions: ctr+n or right-click/Search for/All intermodular calls
text: right-click/Search for/All referenced text strings

in short, RTFM :)


cookie problem should be solved

RCE Messageboard's Regroupment > The Heap > cookie problem should be solved
Hiroshimator
05-23-2003, 04:50 AM
as the title says :)
Anonymous
05-23-2003, 05:13 AM
wot cookie problem?
TBD
05-23-2003, 05:21 AM
yeap. it is working. thanks Hiro!


[REQ] AutoDisable "IsDebuggerPresent"

RCE Messageboard's Regroupment > General > [REQ] AutoDisable "IsDebuggerPresent"
Anonymous
05-24-2003, 12:27 AM
Autodisbale win32api "IsDebuggerPresent"
That is to say always return FALSE.
tulipfan
05-24-2003, 12:31 AM
I just Register & Login,but the topic also is "Anonymous", why?
Fred
05-24-2003, 06:57 AM
For debugging in Ollydbg, there should be no reason to change this. It is only required for cracking programs, which is not permitted to be talked about on this board. Please think about your questions before posting or post may be deleted.

Anyway, for anyone wishing to know if there program is being debugged, there are many ways - there's not just IsDebuggerPresent. Check out Armadillo for example. For obvious reasons however, I'm not going to describe the various methods here.
tulipfan
05-26-2003, 02:36 AM
Sorry!

but i think IsDebuggerPresent is the_most_used_way
and it will be usefully if AutoDisable it.
TBD
05-26-2003, 04:43 AM
tulipfan: you are free to implement this feature in a plugin :)
it would be a good oportunity to learn the OD internals.
lownoise
05-26-2003, 10:00 AM
TBD: you're completely right! i did the same you're asking tulipfan to do! My own plugin patched the return of IsDebuggerPresent, And corrected the byte in memory of detecting the debugger using the seh, described by ^DEAMOIN^ and used in severall protectors lyke ultraprotect.
Learnig the OD internals will help you a lot if you have to deal with apps with the same protection.
TBD
05-26-2003, 10:22 AM
lownoise: and why you dont share this plugin ? :)
lownoise
05-27-2003, 08:14 AM
TBD:Well OllyDbg isn't officialy a cracking tool (: and therefore i don't share this plugin Because someone could use it to dump programs from memory protected with U....Protect :)
codeinject
05-28-2003, 01:20 AM
only a small note is good.
1:how use plugin to modify the data in the datawindows.
2:when to modify the data.(maybe after restart a exe,OD send a MSG?)
codeinject
05-28-2003, 02:00 AM
find it!
extc ulong cdecl Readmemory(void *buf,ulong addr,ulong size,int mode);
extc ulong cdecl Writememory(void *buf,ulong addr,ulong size,int mode);

but the MSG after OD load exe is ?
lownoise
05-28-2003, 05:33 AM
Ok here is the idea to patch api call IsDebuggerPresent
I assume you know how to patch the api call in memory to return the corrected value
* NewApiData=memory patched api bytes
* GetProcAdress IsDebuggerPresent
* writememory newapidata on return value of getprocaddress IsDebuggerPresent

Create a plugin who does the above steps and execute the plugin when olly paused when app is loaded ( debugging options / Events/ Make first pause at system breakpoint
codeinject
05-28-2003, 05:39 AM
oh,i know,but it is not auto_disable.
i mean that when install the plugin,not need to do something else.
lownoise
05-28-2003, 06:10 AM
You don't have to do something else , just run the plugin when app is loaded.
if you want to auto_disable this you have to patch kernel32.dll on your hdd
because the app loads kernel32.dll in his own memory space
codeinject
05-28-2003, 06:21 AM
i want to know when the od load a exe and stoped,od should post an MSG?
at this time our plug can easily defeat the XXX. but who know the MSG when od after load an execute?

i have code the plug but not auto_all @_@
lownoise
05-28-2003, 06:45 AM
I think you have to Open the exefile in your plugin.

int OpenEXEfile(char *path,int dropped);
Returns 0 if executable file is successfully started
codeinject
05-28-2003, 06:51 AM
OD 2 should create such a MSG.

thank you!
i will have i try!
Me
05-28-2003, 06:56 AM
Plugins can have hotkeys, so there's nothing wrong with having to press ALT+F2 for example to execute the "isdebuggerpresent" disabler.


Offset

RCE Messageboard's Regroupment > General > Offset
Anonymous
05-26-2003, 08:53 PM
I have found where I want to alter the code in a app using Olly.

I can alter it in Olly but if I look for the offset in Hiew I cannot find it.

How does the offset or address in Olly translate to a hex editor?

For Example it says in Ollies CPU window that I am at 082f467C, but I cannot find that address In any hex editors.

Does this mean that the address is in memory?

If so, how do I patch something that is in memory ?

Thank-you for any help.
Anonymous
05-26-2003, 09:05 PM
How come I am anonymous? I put a login name in the box during registration.

How do you patch memory then ?
comrade
05-27-2003, 12:33 AM
If you are at 082F467Ch, it could mean you are debugging some code inside a DLL. DLLs are loaded at an arbitrary location and pointers inside DLL code are relocated. Look at Modules window to see at which address each DLL is loaded.


[HELP] OD 2.0 problems. need your input ! :)

RCE Messageboard's Regroupment > General > [HELP] OD 2.0 problems. need your input ! :)
TBD
05-28-2003, 10:08 AM
yo ppl,

i talked with Olly and he has some "problems". so if you any you have ideeas/suggestions/... that he can use, post them here.

1.[Win2000] CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,debugge e) locks OllyDbg when debugged application is paused on debugging event which makes toolhelp functions unusable.

2. ideeas to implement implement name/data storage. in v1.x it was implemented as an array of index/pointer pairs and it uses vanilla binary search to find label or analysis data. Balanced tree is good but when module unloads and you must exclude range of data, it becames a nightmare. Binary radix tree is better but slower and memory-expensive.

... please ONLY posts related to these two problems. no questions/requests for OD 2.0. thanks
Me
05-28-2003, 03:45 PM
Strange... I do a:

HANDLE hModuleSnap = CreateToolhelp32Snapshot ( TH32CS_SNAPMODULE, debugee.dwProcessId );

Whilst in the middle of a "WaitForDebugEvent" / "ContinueDebugEvent" loop and it works fine here on both w2k and wXP. Not sure about 95/98/me, but I don't care about those platforms anyway.

As for your idea of implementing name/data storage - how about something similar to the windows registry?


conditonal breakpoints, didn't find anything

RCE Messageboard's Regroupment > General > conditonal breakpoints, didn't find anything
Anonymous
05-28-2003, 12:38 PM
hi, please give me a little hint how to bp with conditions.
or tell me where i can read it, i searched really but didn't find anything.
regards
lownoise
05-28-2003, 03:02 PM
If i remember correctly in the help file of olly you'll find some examples
Nobby
05-28-2003, 03:49 PM
You obviously didn't search very far as there are examples included in the directory where ollydbg is installed!


BUG: Inspector Update...

RCE Messageboard's Regroupment > Bugs > BUG: Inspector Update...
Anonymous
05-30-2003, 11:15 AM
I can't seem to see that ollydbg 1.09b will highlight the inspector's window if the memory that the inspector is observing changes. Is this a bug? Usually with the general registers (i.e. EAX, EBC, ECX, etc) will highlight to red if its value is changed at EIP but the inspector doesn't seem to have this behavior.

If this is true than this would be a request for this feature in the next Ollydbg release.

bfd007


I want to use new version of Ollydbg

RCE Messageboard's Regroupment > General > I want to use new version of Ollydbg
Teerayoot
05-31-2003, 06:56 AM
:)
Anonymous
05-31-2003, 12:14 PM
why?
Anonymous
05-31-2003, 12:51 PM
You can't :P


Unable to pass exceptin when condition log

RCE Messageboard's Regroupment > General > Unable to pass exceptin when condition log
Teerayoot
05-31-2003, 07:08 AM
Sometime when i set condition log breakpoint on every intermodullar call Ollydbg stop and say Unable to pass exceptin in status bar and hang .How to solve this ploblem.
Teerayoot
06-16-2003, 07:16 AM
hmm,i know my question is beyound you ability,:)
Anonymous
06-16-2003, 10:11 AM
No no, you need to explain more.


What causes Ollydbg to say this?

RCE Messageboard's Regroupment > General > What causes Ollydbg to say this?
Zaxyn
05-31-2003, 01:25 PM
Loading a home-made PE executable file into Ollydbg gives a message saying invalid pe file, although it'll still debug it, and the file works fine outside of the debugger.
comrade
05-31-2003, 03:23 PM
It doesn't follow all rules. Also noticed if OllyDbg does display that message, it will not display strings or other helpful side notes when disassembling. Perhaps author can post criteria for "valid" PE executable?
TBD
06-02-2003, 04:36 AM
i've asked Olly about this sometime ago. and he said that are at least 20 points where this message is triggered.

i will ask this when i will meet him (hope this weekend)
Anonymous
08-08-2003, 07:24 PM
pjiouoiuo
Anonymous
08-08-2003, 08:03 PM
iam sorry


VB.net and Olly tutorial

RCE Messageboard's Regroupment > General > VB.net and Olly tutorial
ashpach
06-01-2003, 09:12 AM
is there a tutorial to work with .net apps ?
Teerayoot
06-05-2003, 04:51 AM
U can try. :P


I need best ollydbg.ini.

RCE Messageboard's Regroupment > General > I need best ollydbg.ini.
Teerayoot
06-04-2003, 08:42 AM
if i not forget ollydbg config file
Give me.
TBD
06-05-2003, 04:46 AM
you didnt say please :)
use OD to configure to your needs. there is not "best ollydbg.ini"
Teerayoot
06-05-2003, 04:47 AM
:)


How to use ollydbg in linux box.

RCE Messageboard's Regroupment > General > How to use ollydbg in linux box.
Teerayoot
06-04-2003, 08:50 AM
How to use ollydbg in linux box.
TBD
06-05-2003, 04:45 AM
OD is only for Windows.
Anonymous
07-12-2003, 03:33 PM
nice answer...quick and precise
think we would be great friend in real world
Anonymous
07-12-2003, 08:35 PM
Wine will let you run OD in Linux, although you can still only debug Windows apps with it, and it's very funny with that.


How to use ollydbg debug java program that run on

RCE Messageboard's Regroupment > General > How to use ollydbg debug java program that run on
Teerayoot
06-04-2003, 08:52 AM
How to use ollydbg debug java program that run on mobile phone.
mimas
06-04-2003, 01:33 PM
OllyDbg is made for x86 familly CPUs, Java runs on a java virtual machine (with a java CPU) and mobile phones are often powered by Arm or Motorola CPU. So you can't do this.
Teerayoot
06-05-2003, 04:49 AM
hmm,anyhow i want to debug java program ,which debugger can do this?
TBD
06-05-2003, 05:28 AM
Teerayoot: you can try a java decompiler.


Breakpoints inside dlls?

RCE Messageboard's Regroupment > General > Breakpoints inside dlls?
Anonymous
06-04-2003, 06:36 PM
Hey all!

I have an app that uses LoadLibrary / GetProcAddress to call functions in a dll.
I can set breakpoints in this dll, but every time i restart the program OllyDbg forgets them. Is there any way to keep those breakpoints?

Cheers!
Anonymous
06-04-2003, 08:32 PM
No, as it's a seperate program from the one you are debugging.
Ricrado Narvaja
06-04-2003, 09:14 PM
Put if you are in XP a HARDWARE BREAKPOINT and dont forget olly this BPXS.

Ricardo narvaja
oh me anon
06-05-2003, 09:00 AM
well use analyze (ctrl+a)
in that dll and set break points olly will remember those break points if it is not self modifying code
if it is smc olly will warn you of some corruypted break point and disable all bpts you can enable them in runtime after the proggie is loaded
hope this is what you are looking for
aka
06-05-2003, 01:40 PM
Hi,

Every time I debug in graphic or small games, i put bp in program, and i always get freeze, can not to go back OllyDbg.

give me a hint.

Thanks
Ricrado Narvaja
06-05-2003, 07:06 PM
This a trouble with DIRECTX but SOFTICE have the same trouble, directX freeze if you interrupt in any form.

Ricardo
Anonymous
06-05-2003, 08:15 PM
Ricardo, Oh me anon: you guys rock!!! Thanks a million!!!


hwbp inside seft-unpack-prog.

RCE Messageboard's Regroupment > General > hwbp inside seft-unpack-prog.
Teerayoot
06-05-2003, 04:58 AM
When i set hwbp sometime it break ,sometime not break,why?
Anonymous
06-05-2003, 10:21 AM
Most likely because it's a packer that disables the hwbp?


Bug (?) in MapConv plugin

RCE Messageboard's Regroupment > Plugins > Bug (?) in MapConv plugin
Anonymous
06-05-2003, 08:36 PM
Hey ppl!

I think you missed something while writing this excellent plugin:

<pre>Insertname(0x401000 + lnumber , NM_LABEL, maplabel);</pre>

Here you assume that imagebase is 0x400000 and offset of the code section is 0x1000. This is not always the case, for example this won't work for a dll...

Can you please fix this bug, or should I do it??

Thanks!
TBD
06-06-2003, 04:37 AM
yup, i know about that. but i was to lazy to fix it.
as now i dont have access to BC compiler, can you fix it ?

and send it to me to update the stuph page.

thanks
Anonymous
06-06-2003, 04:14 PM
Oke... Do you know if there is any nice function to get the right value automagically? Any other tips? Never written any olly plugins before...
_Loki_
06-06-2003, 07:56 PM
Yup, Imagebase (eg. 0x400000) is in the PE header.
The first executable address would be in the first executable section VirtualAddress property (which would be an RVA, such as 0x1000).

Note that first executable address is NOT the entry point. This is placed as the EntryPoint in the PE file, and will also be an RVA.

Simply add the Imagebase to an RVA to make it a VA.
sv
06-07-2003, 07:13 AM
Hi try :

Retrieves various OllyDbg settings and variables.

int Plugingetvalue(int type);

Parameters:

type - setting or variable to retrieve:

type Cast to Explanation
VAL_HPROCESS (HANDLE) Handle of debugged process
VAL_PROCESSID Process ID of debugged process
VAL_HMAINTHREAD (HANDLE) Handle of main thread of debugged process
VAL_MAINTHREADID Thread ID of main thread of debugged process
VAL_MAINBASE Base of main module in the debugged process
VAL_PROCESSNAME (char *) Name of the debugged process
VAL_EXEFILENAME (char *) Name of the main debugged file
VAL_CURRENTDIR (char *) Current directory for debugged process

regards

SV
Anonymous
06-09-2003, 09:46 PM
Thanks guys! All done now =)

TBD: I mailed you the new version of the plugin. Plz put it in the plugins section of this site.


WinAmp

RCE Messageboard's Regroupment > General > WinAmp
comrade
06-06-2003, 01:10 AM
Whenever I am debugging in OllyDbg (v1.09b), meaning actually stepping through code, my WinAmp (v2.91) becomes unresponsive. It plays music, but its UI does not respond. Anyone else experience that?
TBD
06-06-2003, 04:38 AM
comrade: i am using foobar and i dont have any problems.
what OS / PC do you have ?
comrade
06-06-2003, 09:51 AM
foobar (turtoise ;)? What's that?
"You know what a turtle is? Same thing!"

I run Windows 2000 Pro SP2. Processor is Pentium II. But its not problem in my system, maybe not even OllyDbg but WinAmp. Just wanted to see if anyone else experienced that.
TBD
06-06-2003, 10:22 AM
comrade: foobar (http://foobar2000.hydrogenaudio.org)
made by Peter Pawlowski (Winamp development team).
- super light player featuring minimum necessary functions
- plain win32 gui (skinable plugin available - foo_wsgui)
- lot of shortcuts, customizable (loved that one)
- 00% in task manager on my comp (P4/2g)
comrade
02-15-2006, 01:53 AM
I've attached to WinAmp while it was stuck, and discovered one of its threads (apparently, the GUI thread) was blocked by a DDE call. The DDE call was generated by mIRC notification plug-in. I disabled the plug-in and everything is fine :)


Label Names

RCE Messageboard's Regroupment > General > Label Names
comrade
06-06-2003, 09:52 AM
Is it possible to label a procedure (an address) a certain name? For example, if there is a function at 004010100h, I would like to give it some name like "strlen" and even possible name its parameters. So when I step through code, I would see "call strlen" instead of call 004010100h, or maybe a side tip like for API functions.
TBD
06-06-2003, 10:27 AM
comrade: RTFM :)

labels: key ":"
comments: key ";"
parameters: read help's "Custom function descriptions"
oh me anon
06-06-2003, 03:13 PM
well u can also use assume arguments so that when you see in stack you can see those parameters (it is in right click some where)

when you are on certain call press f7 single step and use assume arguments
so that olly will decode that function as StdFunction (no of arguments)
then press ctrl+a (analyze) stack will show the call with all its params as if it is an api call

hope this helps a little
comrade
06-06-2003, 06:05 PM
Thanks!


Multiple Data Dump Windows

RCE Messageboard's Regroupment > General > Multiple Data Dump Windows
comrade
06-08-2003, 04:56 PM
Is it possible to have multiple data dump windows so you can watch two addresses at same time?
_Loki_
06-08-2003, 08:33 PM
yes, ALT+M and select the memory or memories you require.
oh me anon
06-09-2003, 06:01 AM
you can watch as many windows as you like not just two
use view memory rightclick dump and use ctrl+g (follow address)

u can also view dump in cpu and navigate to different dumps by using + or -

ie in dump panel press ctrl+g (address)
as many times as you want with different address

then use + or - in num pad to see different places (this works good as you dont have to minimize maximize every time to see dump

as you said comrade olly is ammmmmmmaaaaaaazinnnnggggggg

btw are you the hotmail comarde (if so edit your post in rea board and say ollyyy is amazing ) ;)
hehehe
comrade
06-09-2003, 01:38 PM
My e-mail is comrade2k@hotmail.com. Does you mean that?


Amazing!

RCE Messageboard's Regroupment > The Heap > Amazing!
comrade
06-08-2003, 05:34 PM
I was debugging, and labelled some piece of code "strncmp", and OllyDbg now automatically shows parameters for this code as s1,s2,maxlen, just like real parameters to standard strncmp! Amazing!!!
_Loki_
06-08-2003, 08:34 PM
It's even more amazing when you disassemble the file using IDA, and then load the map file into Ollydbg and find all the standard routines like strncmp automatically labelled for you with parameters and all :)
comrade
06-09-2003, 01:39 PM
Nice, I'll keep note of that.


[news] 10.Jun.2003 - about OD 2.0

RCE Messageboard's Regroupment > Announcements > [news] 10.Jun.2003 - about OD 2.0
TBD
06-10-2003, 05:15 AM
hi ppl,

yesterday I meet Olly (2nd time) and we talked about OD 2.0 and other things.

about OD 2.0, I saw a pre-alpha version, the GUI it is the same (more or less) but is more customizable.

also the core is rewriten from scratch and also an emulation engine is in works ;)

OD 2.0 will be released next year, so please dont ask when. you can use
OD 1.x very well for anything right now, so forget about OD 2.0 :)

1.09c will come this week - mostly bugfixes.

ps. Olly is a great guy, he came ~250 km (twice, last year too) just for this meeting. Thanks Olly !
Anonymous
06-10-2003, 08:31 AM
sometimes you can tell just by using someone's software, that they are a cool person - i will give a toast to olly when i go to have a beer tonight.
Anonymous
06-10-2003, 02:44 PM
Give Olly our regards and a very big "thanks" for the best debugger ever made

:)
helloword
06-10-2003, 09:02 PM
I am sure that many programmers will be happy to help Olly coding Ollydb.
Why do not propose to Olly same help for example:
Program Analysis
Program coding
Program testing
….
oh me anon
06-11-2003, 03:50 AM
heh yeah one of the best debuggers that i ve ever used far far better than the black box that is sice with luminous text in dos window for application debugging

if it is an application than olly is THE (TEH in l33t speak) debugger to use
and it is free no need to fetch it from somewhere

hip hip hurray and three cheers and high fives and whatever that human kind says for these occasions goes to oleh for bringing out the best and making it free

must be some kind of angel in disguise
WinHack
06-12-2003, 10:06 AM
Geate Thanks to Olly!


[new] 1.09c released

RCE Messageboard's Regroupment > Announcements > [new] 1.09c released
TBD
06-12-2003, 05:09 AM
OllyDbg 1.09c (http://home.t-online.de/home/ollydbg/odbg109c.zip)

bugfix release that removes most of bugs reported since version 1.09b was released.
Anonymous
06-12-2003, 07:16 AM
awesome
Anonymous
06-12-2003, 10:04 AM
good！
Anonymous
06-12-2003, 11:33 AM
Thank you very much.
Great.
Anonymous
08-15-2003, 02:53 PM
I noticed that the link posted by TBD was down... so, messing around i tryed typing a "d" in place of the "c" ... it worked ... so I guess 1.09d has been released, so let me say it before the admins/creators do so!!

OllyDbg 1.09d ("http://home.t-online.de/home/ollydbg/odbg109d.zip")

Respectfully,
--Glorfindel
Anonymous
08-15-2003, 02:55 PM
woopsy... my mistake in the URL... i am used to HTML where u place the quotes around the address... heres that again...

OllyDbg 1.09d (http://ollydbg.win32asmcommunity.net/"http://home.t-online.de/home/ollydbg/odbg109d.zip)
Anonymous
08-15-2003, 02:56 PM
OK... i give up! .... just copy/paste this, lol

http://home.t-online.de/home/ollydbg/odbg109d.zip

Respectfully,
--Glorfindel


IsDebuggerPresent plugin

RCE Messageboard's Regroupment > Plugins > IsDebuggerPresent plugin
Anonymous
06-12-2003, 06:10 AM
Hi
I have done this little MASM plugin.
I hope it will be useful ;)

http://membres.lycos.fr/svtc/Progs/IsDebuggerPresent.rar

SV
TBD
06-12-2003, 06:40 AM
very nice work SV. two things:
* use for user information texts the OD provided function Addtolist (not critical messages) or Message(for critical) instead of MessageBox
* use HTML/PNG instead of RTF to decrease the size

and then i will put the plugin on OD Stuph page :)
1bitshort
06-12-2003, 07:06 AM
That URL doesnt work - file not found?
TBD
06-12-2003, 07:11 AM
use http://membres.lycos.fr/svtc/ instead the direct link
1bitshort
06-12-2003, 07:22 AM
Ok, it does work, you just have to be patient and wait for the error page to clear ;)
sv
06-12-2003, 07:46 AM
Flash & Error are used now (exept About stuff).
HTLM/PNG too ;)

SV
TBD
06-12-2003, 07:57 AM
excellent SV. i will update the OD page in about 1 hour.
till then here it is a mirror - SV_IsDebug11.zip (http://ollydbg.win32asmcommunity.net/stuph/SV_IsDebug11.zip)

ps. i hope you dont mind that i changed to zip :)

also added a simple test program
tulipfan
06-15-2003, 11:47 PM
gr8 work!
sv
06-16-2003, 05:46 AM
Hi
Thanks tulipfan.
TBD : could you update with 1.3 ?
Thanks all for testing and finding all theses bugs !!
I'm admiring all freeware author like Oleh or Ketilo with his RadAsm (it's a big work).
TBD
06-23-2003, 05:45 AM
sv: sorry for the delay on updating to 1.3 :)
btw, what are the changes ? do you have a history ? :)

thanks
Anonymous
06-23-2003, 11:49 PM
Crashes when i hit hide on 98se 1.09c

module ISDEBUG.DLL 01b7:1000127d

EAX=00000000 CS=01b7 EIP=1000127d EFLGS=00210202
EBX=00000000 SS=01bf ESP=0077ee58 EBP=0077ee60
ECX=0000e0c0 DS=01bf ESI=000001b9 FS=370f
EDX=00000000 ES=01bf EDI=0077f574 GS=2b2f

Byte CS:EIP:
ff b0 ac 03 00 00 5b 83 c3 30 6a 01 6a 04 53 68

Stackdump:
00000000 10001172 0077ee7c 0049230e 00000000 00000000 00000000 000085e4 0000e0c0 0077f56c 0043239f 00000000 0000e0c0 00000000 0077f574 000085e4
Anonymous
06-24-2003, 04:09 AM
if(windows98 has crash many times )
{use WindowsXP;

}
sv
06-24-2003, 05:31 AM
Hi

It seems that you haven't loaded a process before hiding.
I haven't 98 here, i'll check.
sv
06-24-2003, 05:40 AM
Hi TBD

Thanks for your update.
No history for the moment.
I have just added Option and fixed bugs and bugs and .....!!!!!!! :)
sv
06-27-2003, 01:52 PM
V1.4
! crash when nothing loaded fixed
+ new loading detection. Now, if exe isn't fully loaded, it sleep again.
You can use it with small sleep time value (500 ms).
http://membres.lycos.fr/svtc/
Tacman
06-29-2003, 04:59 AM
Thanks. Very nice work.


Debugging DLLs

RCE Messageboard's Regroupment > General > Debugging DLLs
Anonymous
06-12-2003, 10:11 PM
Excuse me for being a newbie. But im having problems disassembling dlls.
Should i open it in the File->open menu or anywhere else. Im having errors doing that. it says -unable to start the file DLL.dll-
I still use wdasm/hexeditor because of this problem.
Teerayoot
06-13-2003, 03:21 AM
Wait untill Ollydbg 2.0 releashed.
TBD
06-13-2003, 04:26 AM
or you can make a small proggie that loads the DLL and then analyze it :)
Anonymous
06-13-2003, 07:33 AM
Find the program that uses the dll, load that program and do your work on the dll whilst the program has it open.
Anonymous
06-14-2003, 01:44 AM
Gee thanks. now if i can only login correctly.
Anonymous
09-02-2003, 12:14 PM
And is it possible to break inside a dll?
I tried with a small program.Only the splash screen was inside the executable but the core of the program is inside one dll.
I load the .exe with olly and I press F9 then the prog runs but after the splash ,Olly terminate the process,the program is still runing.
I try to trace into each call but I never break inside the dll.
So,is it impossible or Have I made something wrong?
But how can olly break inside dll such as Kernel32 or User32.
Ricrado Narvaja
09-02-2003, 03:06 PM
In debugging options-events mark break on dll load and stop in dll load jeje, in view- executables or view- memory you can put bpm in the dll, and if is other process still running, open other ollydbg and go to file - attach and atach olly to this process and continue debugging normally.

Ricardo
Anonymous
09-02-2003, 08:02 PM
yeah as ricrado says


SV: EXE Rebuilder plugin info

RCE Messageboard's Regroupment > Plugins > SV: EXE Rebuilder plugin info
TBD
06-13-2003, 07:22 AM
SV, i've seen in the screenshots from the IsDebug plugin that you have a plugin, ExeRebuilder.

can you provide us with more info (author, description, where to download ...) ?

thanks.

also, if you have plugins that are not showned in OD Stuph page dont hesitate to notify me about them :)
sv
06-13-2003, 10:02 AM
Hi TBD

I have coded another plugin to rebuild an exe from memory.
It works fine as it was a personal standalone tool.
It doesn't work like Ollydump (nice plugin!) because it realign
raw section and save a little space but it doesn't include IT rebuilder.
It must be cleaned a little more before a public release ;)

SV
TBD
06-13-2003, 10:04 AM
sv: ok. when it is ready, you know who to notify :)


finding function names

RCE Messageboard's Regroupment > General > finding function names
Anonymous
06-13-2003, 08:16 AM
if an exception occurs in a dll that is used by a program, how do you find the function in which the exception occurred?
TBD
06-13-2003, 08:23 AM
you can use the trace feature or inspect the stack
Klomp
06-13-2003, 10:26 AM
I thought ollydbg stopped execution as soon as an exception occured?
TBD
06-13-2003, 11:13 AM
Klomp: you can ignore exceptions (check options)


BUG in 1.09c ?

RCE Messageboard's Regroupment > General > BUG in 1.09c ?
Ricrado Narvaja
06-13-2003, 09:15 AM
I use 3 o 4 times de OLLY 1.09c and now this run de programs but dont stop more in the entry point and all is blank in the screen of the olly, is running the program well but don't display nothing.

Ricardo
TBD
06-13-2003, 09:18 AM
can you be more specific, like what program it is :), if with 1.09b shows the same error ... so we can reproduce the error
oh me anon
06-13-2003, 11:45 AM
i dunno if this helps you ricardo but a program i was debugging had this same problem in win 98 not in win 2k the program was using some trick to hook the int 3 and putting an iret at the start of interrupt handler and using
some sidt maneovere

so the first time it will run properly and olly will stop at the programs entry point but the next time olly will not stop at the entry point at all but will proceed to execute the exe and the cpu will be blank but the taskbar at bottom will say running

but sidt manipulating is possible only on 9x and not in nt
Ricrado Narvaja
06-13-2003, 12:50 PM
The same program run well in 1.09b, i,m looking for that, i change the ini of the 1.09b to 1.09c maybe this
i unzip in other location and try again.

Ricardo
Ricrado Narvaja
06-13-2003, 12:57 PM
Well i unzip in other location and let the ini of the 1.0C and works well again, thanks.

Ricardo
Ricrado Narvaja
06-13-2003, 07:49 PM
Well a friend of mine report the same bug maybe is a plugin disturing, to me not repeat the bug but two persons with the same bug is extrange, i think is a plugin not compatible with 1.09c

Ricardo
Ricrado Narvaja
06-13-2003, 07:51 PM
I quit the plugins and all function well, i think the plugin isdebuggerpresent is not compatible with 1.09c, in any programs produce this bug.

Ricardo
sv
06-14-2003, 05:34 AM
It's a problem with the sleep time in the plugin.
If it is too short, process is not see as debuggee process !
I have modified sleep time to 1s and it works well for me !
Ricrado Narvaja
06-14-2003, 06:29 AM
And you post the plugim modified?

Ricardo
Ricrado Narvaja
06-14-2003, 06:35 AM
The plugin in

http://membres.lycos.fr/svtc/Progs/IsDebuggerPresent.rar

is the modified version?

Ricardo
sv
06-14-2003, 10:49 AM
Hi Ricardo

Next version have option : Autohide O/N and you can choose your sleep time.
I hope it will be enought to work fine !!!
For the moment the version is not up to date.
I'll post here when it'll be uploaded in my page.

SV
sv
06-14-2003, 11:26 AM
It's done.
I really hope it will work fine for you now!!
If it doesn't uncheck autohide option :(

http://membres.lycos.fr/svtc

plugin V1.2

Regard

SV
Pov
06-14-2003, 03:23 PM
it doesn't work on a few of my programs - instead it creates access violation.

I think I have found problem by looking in sources. You get a pointer to the process block via FS segment in the CURRENT process and then write to that address which is in ANOTHER process. You need to get this address in the process being debugged, not the process which is the plugin, as they could be different.
Pov
06-14-2003, 03:25 PM
Also, is it possible to also add ability to change Ollydbg window title? Some programs look for this window and bomb out if it's found.

Thanks!
Ricrado Narvaja
06-14-2003, 05:24 PM
I dont download bute my friends say works fine only has a little bug when you click in dump, the about appear.

Ricardo
sv
06-15-2003, 08:02 AM
Thanks for reporting bug.
Dump is fixed !
Pov i'll try in next version.
sv
06-15-2003, 03:43 PM
Pov

Could you try v1.3 beta which fix FS segment issue.
Thanks to test it with yours programs.
SV
Pov
06-15-2003, 05:10 PM
sv: Thanks. Progs work now.


[bug] 1.09c copy of a clipboard(CF_TEXT)

RCE Messageboard's Regroupment > Bugs > [bug] 1.09c copy of a clipboard(CF_TEXT)
Anonymous
06-13-2003, 01:47 PM
If number of WideCharCount and MultiByteCount is large same,
it will become a protection error within WideCharToMultiByte.

Contrary asm and source were written.
Please make it reference.
http://taku-lark.hp.infoseek.co.jp/soft/109cbug.txt
Teerayoot
06-16-2003, 07:20 AM
I guess you working on Win98.isn't it?Work on WindowsXp intead.
Anonymous
06-16-2003, 09:45 AM
If you don't have something to say, beter be quiet
gf+
comrade
06-16-2003, 05:58 PM
Why? What are you going to do? Beat him up?
gfplus
06-17-2003, 05:36 AM
Here people come to get some answers. Idiotic comentars are not neccessary and only take place. Expecialy from people which even don't know how to ask question.

So same going to you.
gf+
Anonymous
06-18-2003, 08:05 PM
i have same question in use ollydbg


hmem

RCE Messageboard's Regroupment > General > hmem
Anonymous
06-14-2003, 08:35 AM
hmem
Teerayoot
06-16-2003, 07:18 AM
No no ,do not make this sense.


tres preguntas para RN

RCE Messageboard's Regroupment > General > tres preguntas para RN
Anonymous
06-15-2003, 09:19 PM
1) tengo una ventana clasica "tu no estas reg****ado...", pongo un bp MessageBoxW, luego traceo hasta que entre en la victima con un bp en code, y aparesco en una seccion llena de JMPs, me manda al inicio de una llamada,
aqui va la pregunta ¿se puede tracear, pero inversamente? osea saber las ultimas posiciones del EIP dentro de la victima para encontrar el salto de verificacion.

2) tengo una dll con telock 0.98a segun peid, con el excelente tute del pelock
tengo el oep, ahora quiero encontrar el salto magico, pero no lo hallo con el olly 1.09c, siempre consigo la tabla de importaciones fallada. ¿sera por que
es un dll, puedes postear los pasos a seguir con olly ?

3) ¿ hay alguna version de ollydmp que permita dumpear dlls ?

gracias RN

azegc

PD. enviame la dir de tu FTP server por favor. azegc@hotmail.com
comrade
06-16-2003, 02:18 AM
Hable ingles?
Anonymous
06-16-2003, 05:30 AM
? i don't understand. jeje. only english
Teerayoot
06-16-2003, 07:15 AM
hmm mee too,Can you (poster) tranlate to english ,or you have no ability to writen in english language at all ,:)
Ricrado Narvaja
06-16-2003, 09:40 AM
1)Bueno tenes el trace into que te permite tracear el programa hasta el BPX que pusiste y cuando para alli miras para atras en el listado que esta en el boton ... , las lineas de donde paso, otra opcion es cuando para alli, ir al K que es el call stack y ves los calls donde estro el ultimo es el de arriba de todo, y sigues hacia abajo, asi miras de dodne vino tambien, siguiendo los calls desde donde entro y puedes ver si hay saltos antes de alguno de ellos.
2)Es posible que el metodo no sea igual con una dll nunca lo intente siempre con exes, eso si para poder hacerlo en olly debes tenes el programa que usa dicha dll si no no podras, de cualquier manera siempre la foram de hallar el salto magico es poner o un BPM on WRIE o HARDWARE BPX on WRITE en una entrada de la tabla mala para que pare cuando va a guardar el valor malo, una vez que vez donde para seguro antes de eso estara el magico a veces esta bastante mas arriba de los que muestra el tute jeje.
3)No no hay hasta ahora

Ricardo Narvaja
Anonymous
06-16-2003, 11:13 PM
thanks RN!


Breakpoint on file

RCE Messageboard's Regroupment > General > Breakpoint on file
Anonymous
06-16-2003, 11:35 AM
Hello,

Is it possible to set a breakpoint whenever a file tries to open/access/close a file?

Thanks in advance!
Spud
06-16-2003, 12:06 PM
yes.

oh, you want to know how? Press ALT+F1 and type "bp CreateFileA".
Anonymous
06-16-2003, 12:24 PM
Nah, didn't wanna know how ;-)

But anyway: works great! I inmediately found where I was looking for!

And if someone feels like to answer another question: is it also possible for in the future to set a breakpoint on a particular filename? (and if so, how it is done ;-) )
(Maybe this is possible, cause I noticed that the filename is the first parameter in the call...)

Thanks again!
Anonymous
06-19-2003, 12:05 AM
Look before CreateFileA, it PUSHes variables onto the stack. If you look in WinAPI help file, the first parameter is the filename, in assembly, parameter order is reversed, so your last PUSH before CreateFileA is the address of the filename. In command line type d ADDRESS to see the string. Not sure if you can break point specifically on filename. You could use a script or some shit in softice.
Anonymous
06-19-2003, 05:56 PM
or you can use a conditional breakpoint on CreateFile APi. read the help :)
Anonymous
06-20-2003, 06:33 AM
I press Alt+F1 on olly debugger. it does nothing... any idea why?
Anonymous
06-20-2003, 07:49 AM
install the commandline plugin
Anonymous
07-14-2003, 04:17 PM
i need a breakpoint when the WORD in memory address at 12AE74 is equal to $FFFF

help help thx
Teerayoot
07-16-2003, 03:26 AM
easy,try it by your'self!

--- select on line to break( alway above createfileA )look memory reference
such as when you select line that $ffff is a arg---
push [dd ds+4b] now right click select bp -> contition bp ,in text box

fill [dd ds+4b]==a value that true ,ollydbg break
or [dd ds+4b]=="string" yeah,you can play with this for any api call.


ollydbg2 feature request - break on certain dll lo

RCE Messageboard's Regroupment > General > ollydbg2 feature request - break on certain dll lo
Anonymous
06-16-2003, 01:47 PM
when debugging dlls of applications which use alot of dlls, it can be annoying to have to set it to break on every dll load. what would be great is if the break on dll load option could have a list of dlls to ignore and/or dlls to trigger on. just a simple list of file names, so that olly would skip breaking on the dlls we dont care about.
Anonymous
06-16-2003, 01:49 PM
for this to work well, a right click in the view-executables list (this list that pops up on a dll load) to add a dll to the list would be important too.
Teerayoot
06-19-2003, 03:00 AM
if(specify_dll_loaded)stop.
he he ,i think this is great if possible.


REALLY BUG IN 1.09 C

RCE Messageboard's Regroupment > General > REALLY BUG IN 1.09 C
Ricrado Narvaja
06-17-2003, 05:13 AM
When in the dump i mark a very big zone 3000 k or 4000k and make BYNARY COPY, olly makes an error in kernel32.dll in the middle of the process, the same operation with the same program with the same zone marked in 1.09b goes well and copy perfectly.

This really is a bug i'm using 1.09b, i need copy big parts and this is not possible in 1.09c.

Ricardo
Ricrado Narvaja
06-17-2003, 07:00 PM
ahgg is 3000 or 4000 bytes no so big, sorry, olly 1.09c fails and make and error message.

Ricardo
Teerayoot
06-19-2003, 03:06 AM
Olly,you should make new implement of this,BIG BUG.


ollydump?

RCE Messageboard's Regroupment > Plugins > ollydump?
wipey
06-18-2003, 11:42 AM
Could someone please write me a tut or find me a tut, on dumping files with ollydump? I'm newish to packed files and after finding the OEP I'm not sure what the other values should be or how to dump successfully:S
Anonymous
06-19-2003, 02:58 AM
i want too,because i have some ploblem when dumping a packed prog (such as UPX)it never got a working when dumped with a ollydump.
comrade
06-19-2003, 09:09 PM
You have to rebuild dump... its raw.
Anonymous
08-02-2003, 01:22 AM
"You have to rebuild dump... its raw."

No

Just find the OEP and when you are on it dump the process using OllyDump and it works (for UPX).

Just be carefull to use the latest version of OllyDump.
Anonymous
08-02-2003, 12:44 PM
Best use ImpRec to fix the import table before you try to run it however.


Debug an EXE on behalf of other users

RCE Messageboard's Regroupment > General > Debug an EXE on behalf of other users
Anonymous
06-19-2003, 11:20 PM
Hi, I'm having trouble debugging a game. Is that possible/How can I execute a file using a different user. I use WinXP, so I basically want the game to load in a different desktop. This way I can see the screen at the resolution and color palette I work on.

Daniel
Anonymous
06-20-2003, 02:21 AM
You must have secound monitor to display a game running on and debuger run on a first monitor .


Unpacking UPX

RCE Messageboard's Regroupment > General > Unpacking UPX
melvill
06-20-2003, 06:42 AM
Hi Guys,

hv read some where that it is possible unpacking UPX file on debuggin session with OLLY is that correct ? if yes how ?

rgds

Melvill
Anonymous
06-20-2003, 07:50 AM
yes it's correct. Just search for the famous signature bytes, breakpoint, run, dump. Job done :)
Ricardo Narvaja
06-20-2003, 11:20 AM
the plugin ollydmp is useful, and have a tracer to help find the OEP to dump.

Ricardo
Anonymous
06-20-2003, 06:14 PM
Hello Ricardo
Can you write a tut about how to use ollydmp please?

regards
Ricrado Narvaja
06-20-2003, 07:54 PM
i write many tuts and i have a tut how unpack upx with ollydmp but is not translated is in spanish and for XP.

Ricardo
melvill
06-21-2003, 06:19 AM
Thks Guys

Ricardo, can you send this tut for me ? i understand Spanish

melvill@crkportugal.com

thnks
Anonymous
06-21-2003, 10:26 AM
loooool

And what about us? :(
I don't understand Spanish lng. :(
Anonymous
06-21-2003, 01:07 PM
Why do you need a tut for UPX? It's by far the easiest packer to unpack !
Anonymous
06-21-2003, 02:48 PM
I don't need a tut for UPX ,I need a tut about how to use OllyDmp only.
Anonymous
06-21-2003, 03:11 PM
If you don't understand spanish, use Babelfish.

Also, I find LordPE better than OllyDump.
Ricrado Narvaja
06-21-2003, 07:14 PM
LordPE is different OLLYDMP.

If you dump with ollydmp and rebuild with lordpe, ollydmp try reconstruct the IAT, the 90 % of unpackings in UPX, rebuild perfect IAT, with lordpe is a good dumper but no rebuild THE IAT, the dumped run only in your machine if run, and you need use IMPORT RECONSTRUCTOR or REVIRGIN, with OLLYDMP is not necesary, make all the work.

Ricardo
RobMad
06-22-2003, 12:56 PM
Ricardo Narvaja, can you send me the tut for unpack UPX in Ollydbg?
ps: I can read spanish well! ;)

robmad@hotmail.com

Thanks!!!
Anonymous
06-25-2003, 12:21 AM
Yah send me too please :P

I understand spanish TOO (babelfish even)

Thanks

TByteSoft@ntlworld.com
Anonymous
06-27-2003, 12:32 PM
http://www.geocities.com/r_etarded/ollydump.html

a tute to unpack with olly/ollydump for UPX/FSG
Anonymous
07-03-2003, 08:01 AM
Checkout GuiPEX. A program that is make to both uncompress/compress programs. Works like a charm.
Anonymous
07-05-2003, 12:04 PM
I am a noob to unpacking. I followed the tutorial above and unpacked the exe.
But when i load the unpacked exe in Olly, Olly says that the Entry Point is outside the code as specified in the PE Header. So i can't set breakpoints very well. Is this ok? If not, how can i correct the PE Header in this example tutorial? Sorry for my bad english ;) Thanks.
pov
07-05-2003, 04:07 PM
Change the flags of the section containing the real entry point to executable, and then ensure that the Baseofcode and Baseofdata pointers in the PE header are correct.
Ricrado Narvaja
07-05-2003, 06:51 PM
Is not a truoble this, in a pecked program this cartel always appear, and in a unpacked program too, is not important don't worry and continue.

Ricardo


about plugin api

RCE Messageboard's Regroupment > General > about plugin api
Anonymous
06-20-2003, 07:20 AM
how can i use plugin api to modify the eax....

t_thread* t2;
t2->context.Eax = ApiAddress;

this code doesn't work


Code Injection Error!

RCE Messageboard's Regroupment > General > Code Injection Error!
Anonymous
06-20-2003, 12:30 PM
I was used to run Ollydbg under Windows2000 and all went fine. Now I use Ollydbg 1.09c under WindowsXP Pro SP1a and I *always* receive the following error message when I attach to an executable (and sometimes when breakpoint is reached):

"In order to perform action that is not supported by OS, Ollydbg has injected short piece of code (...), but received no response within 5 seconds. (...)"

How can I avoid this message? Should I change some settings? Update DLLs?
Please help!
Anonymous
06-20-2003, 06:14 PM
you can disable from options "allow code injection winproc ..."
... on my XPSP1a works fine.
Anonymous
06-21-2003, 05:01 AM
I already tried this option but it doesn't help so I deleted ollydbg.ini then I added each option carefully. I left only SSE/AMD/registers and it works.


OllyDbg v1.09c File Open Error

RCE Messageboard's Regroupment > Bugs > OllyDbg v1.09c File Open Error
comrade
06-22-2003, 01:04 AM
Whenever I try to debug a file in OllyDbg v1.09c, it tells me "Unable to open or execute file C:\Folder\program.exe", but still opens it fine and debugs fine. So this is just some useless (?) message box, does not appear in v1.09b though.
melvill
06-22-2003, 03:12 PM
Hi comrade,

I'm using 1.09c and works fine. no open error neder with w98 or XP.

Melvill


Hey,my friendz.

RCE Messageboard's Regroupment > The Heap > Hey,my friendz.
Anonymous
06-24-2003, 04:12 AM
Hey i have some domain,but not have webspace to contruct my debuging stuff(Cracking),if you know that allow then tell me please.;)
(someone else)
TBD
06-25-2003, 03:49 AM
Anonymous it depends who wants to have troubles :)
Anonymous
06-26-2003, 02:31 AM
hey,TBD,what's your nationality?i anxius to know. ;)
Anonymous
06-26-2003, 02:32 AM
and how old r you?


AL register - How do I modify it?

RCE Messageboard's Regroupment > General > AL register - How do I modify it?
Anonymous
06-24-2003, 11:01 PM
How can I modify the AL register? It's not in the CPU window.../How do I modify any register using the cmdline plugin?

Thanks,

Daniel
Anonymous
06-25-2003, 05:27 AM
AL is the lower 8-bits of the AX register.
AH is the higher 8-bits of the AX register.
AX is the lower 16-bits of the EAX register.
EAX is viewable in the CPU window.
Anonymous
06-25-2003, 12:58 PM
Ahh thanks...


Run Trace starting condition/EIP?

RCE Messageboard's Regroupment > General > Run Trace starting condition/EIP?
Anonymous
06-25-2003, 12:59 PM
Is there a way to auto-start run trace when specific EIP is reached (just like with pause condition) ?

Thanks
Anonymous
06-26-2003, 02:28 AM
hmm, good idea.i want to know too.:)
TBD
06-26-2003, 04:31 AM
nope. you can make a plugin though :
- breakpoint on desired EIP, Startruntrace


Run Trace problem

RCE Messageboard's Regroupment > General > Run Trace problem
Anonymous
06-25-2003, 01:21 PM
I have a range of code I want to run trace. Click Debug then click "Open or clear run trace" then in code window I select the area I want to trace, right click > Run Trace > Add Selection. Then I press CTRL + F11 and the program runs. I stop the trace because when it reaches a certain point in the program I stop it (I know where to stop) but Run Trace shows a few lines of code and the locations are not ones I specified in selection. ARGGHGH

Help
TBD
06-26-2003, 04:11 AM
have you tried increasing the run trace buffer ?

also try to put a breakpoint before and after the run-trace selection to see if you reach that code.
Ricrado Narvaja
06-26-2003, 06:17 AM
For run race works well you can start the trace in the section you can look, if you start in other section or part of the memory the trace always be incomplete, try this.

Ricardo
Anonymous
06-26-2003, 01:07 PM
Ok...I obviously tried something while I Was waiting for replies... so It's probably what Ricardo said...I set breakpoint, when it reaches it, I blindly (I cant see anything, it's a game) press CTRL+F12. I got good results.

Thanks,

TByte


Modifying FP Registers

RCE Messageboard's Regroupment > General > Modifying FP Registers
anonymous
06-25-2003, 08:18 PM
When I right click on a FP Register and modify it, when I step, it resets to the previous value. Is there something special I need to do to modify these Registers? This is 1.09c BTW

pH
TBD
06-26-2003, 04:08 AM
anonymous: on my box it doesnt resets to the previous value. have you tried on a different machine ?


you deleated my topic!

RCE Messageboard's Regroupment > General > you deleated my topic!
Anonymous
06-26-2003, 02:34 AM
hey,TBD,you suck.i hope my topic is usefull to another user.you suck!
TBD
06-26-2003, 04:04 AM
... and you are talking about which post ?
comrade
06-26-2003, 09:13 PM
Probably some crack post...


Truncate an EXE

RCE Messageboard's Regroupment > General > Truncate an EXE
Anonymous
06-26-2003, 01:11 PM
Hi

I want to optimize a program, it has hillarious amount of strings that are used for debugging...it slows things down. I want to CUT the strings from the file, reducing the EXEs size, then I will remove all references to these strings...but how can I rebuild the EXE so after cutting the strings, offsets are still good?

TByte


whats difference between different break points

RCE Messageboard's Regroupment > General > whats difference between different break points
oh me anon
06-29-2003, 03:38 PM
we can use various kinds of breaks for stoppinng an app at the required eip in olly
1) toggle f2
2) memory on access
3) memory on write
4) hardware on execution
5) log bpt
6) conditional log
7) pause runtrace on condition
8) run till selection f4
what are the differences between them and how to effectively use them
ie how to determine which bpt is going to be the most effective on what conditions

suppose i have a loop which loads all the bytes from specific address to another specific address using lodsb and then xors al with some byte and stosbs it and i put a f2 toggle bpt in that place olly will load the cc (int 3)instead of the original opcode in the lodsb instruction and xor the int3 and store it back which will obviously screw up the result

in one such case i used hardware on execution and find that the result is different than normal f2
i also bookmarked the place and then restarted the app used goto bookmark
and used f4 (run till selection)it returns the same result as hardware on execution

so what is the inherent difference between those two

can i use memory on access break point on same situation and still get good results

if this also will return good result why so many options are required

any and all explanations are welcome
hope i get some answers
Pov
06-29-2003, 08:19 PM
F2 uses "debugger breakpoint" (overwrites original code with INT 3 instruction, places back original code when the INT 3 has been reached).

Hardware execution doesn't need this code alteration, and so code like you describe above will execute corretly. However, you only have 4 of these hardware breakpoints, so need to use them wisely. The "debugger breakpoints" are infinite in use.
Pov
06-29-2003, 08:21 PM
Secondly, a "hardware on execution" will only break if the code is executed, a "hardware on access" will break if the code is executed OR read by the program (eg. for CRC check).
oh me anon
07-01-2003, 03:37 PM
hardware on access u mean memory on access isnt it
btw this hardware on execution is available only on nt based systems it seems
viz win2k it is not available on win9x

but run till selection(f4) is available in both 9x and w2k

if it doesnt alter the opcode with cc (int3) how is it accomplished just general idea is ok (dont ask me to google ;))

and does run till selection uses this hardware processess or what ever it is
called

why should it be limited to just 4 bpts ( i know it is 4 and you can delete them and follow them in debugger hard ware break points options)and set them with rightclick

some kind of theoratical explanation in laymans terms would be helpful to
understand these break points

hope i get some more replies
Pov
07-01-2003, 08:19 PM
"Run till selection" uses a one-shot hardware on execution breakpoint.

The Intel (and AMD/etc) CPU's have some special registers which are intended for debugging use only. By storing special values into these registers, a program can ask the CPU to execute an INT 1 (interrupt 1) instruction immediately whenever a specified memory location is read from or written to. They can also stop when a memory address is about to be executed as code. The number of these registers is finite, and with the current processors, it's limited to 4 breakpoints. The wonders of Windows however, allows this to be 4 breakpoints per process as it will change the registers on each process switch.

The only limitation here is that if a breakpoint is placed by a ring 3 (application layer) program and occurs in ring 0 (system layer) space, then the ring 3 program will not be notified of the breakpoint until the system returns to the ring 3 layer.
oh me anon
07-05-2003, 12:14 PM
"Run till selection" uses a one-shot hardware on execution breakpoint.

do they behave differently on w2k and w98 coz in 98 i see a different result and in w2k i see a different result
w2k s result is consistent with hardware break point
and do you mean debug registers when you talk about special registers
dr1 to dr7
is this registers visible only in w2k and not w98
Pov
07-05-2003, 04:06 PM
Yes, behave differently in win98/2k, and special registers == debug registers. debug registers however are possible in both 98 and 2k, but 2k has more restrictions.
oh me anon
07-06-2003, 02:25 PM
so with w98 and above situation (the app tracing itself for cc) what break point should i use since i cannot use either int 3 or run till selection
Anonymous
07-06-2003, 08:44 PM
Use anything that will throw an exception and then let Olly catch it - for example, an access violation, or invalid lock sequence. I've used LOCK NOP before which stops execution in it's track with an INVALID LOCK SEQUENCE exception. Now, most assemblers will not let you create such an invalid command, so just use hex mode and use something like F0 90.
oh me anon
07-11-2003, 01:21 PM
Use anything that will throw an exception and then let Olly catch it

i didnt understand (yep iknow db 8d c0 lea eax,[eax]will create an access violation and i can trap it with seh but how you propose this can be done with
a precoded exe that i just only trace ) do you say i use hexed to modify the bytes at the place where i want to stop (i dont think it will work coz the app is tracing itself and will create a hash based on the modified bytes) iam interested in finding the hash without any modification to exe as soon as it is created (ie i need to stop at the exit point of loop where it traces itself)

and i want to do this in w98 (w2k is ok i can use hardware bpt or run till selection ) but i just dont see a possibilty in w98

any ideas
Anonymous
07-11-2003, 06:10 PM
You can still do hardware breakpoint in win98, they are just done differently than in WinXP/2K. Noticed hundreds of examples by using google.

Or you can use a complete Intel processor emulator (such as TR) which allows you to set as many "hardware" breakpoints as you like as it's emulating the entire processor.
thomasantony
03-05-2005, 06:41 AM
Hi,
I know this is an old thread. But still can anyone tell me where I can get such an emulator. Google only tells me about embedded system emulators only.

Thomas Antony


ExtraCopy plugin

RCE Messageboard's Regroupment > General > ExtraCopy plugin
Regon
06-29-2003, 05:06 PM
Hi,
Here is my first plugin which correct references of relative jumps and calls at copy the block of instructions.

extracopy0.8.zip (http://regon.isgreat.tv/extracopy0.8.zip)
TBD
06-30-2003, 01:09 PM
nice plugin Regon. thanks for sharing.

Teerayoot: I fixed the link in Regon's post and I deleted yours (sorry)
Regon
06-30-2003, 02:22 PM
Repaired determination a number of instruction in the block.
Copy to the clipboard added

extracopy0.9.zip (http://regon.isgreat.tv/extracopy0.9.zip)


How do I debug IE plugins like an OCX object?

RCE Messageboard's Regroupment > General > How do I debug IE plugins like an OCX object?
zhudachang
07-03-2003, 11:26 AM
Would you please give me some tips?

Thanks in advance!

Kind Regards,
Z.D.C
TBD
07-03-2003, 11:41 AM
zhudachang: you can try creating a small loader for your OCX
or attach to IE and feel lost in there.

as I didnt do that before I cannot help you here. anyone else ?


Hardware breakpoint on specify module

RCE Messageboard's Regroupment > General > Hardware breakpoint on specify module
Teerayoot
07-05-2003, 08:47 AM
When i set hardware breakpoint it's seem something bad for me ,that i can not control to specify break only certain module ,if it can it 's very usefull for me such as when i set on some debugged prog and not break on some system module like user32 kernel32 or 33 if it have .Hmm Can you set hw bp on condition that not break on others module ,if can how to ?
Teerayoot
07-05-2003, 08:49 AM
sorry for bad grammatically.
Anonymous
07-05-2003, 09:01 AM
No, you can't do what you are asking. You can only use address, not module. Addresses are process-wide.
Teerayoot
07-05-2003, 09:10 AM
I mean address in another modules.Can i set hw bp that read ,write only debugged exe ,not another dll or some .... other
Anonymous
07-05-2003, 04:10 PM
No, you can only set breakpoint for the process, not a specific module in the process. Since breakpoint is hardware, it done in processor, and processor not know (or care) which module is executing.
Teerayoot
07-06-2003, 02:49 PM
hmm,i know ,but intead can i set memory breakpoint that r,w on this process not other dll?
Anonymous
07-06-2003, 04:36 PM
No


Where to download imprect ?

RCE Messageboard's Regroupment > General > Where to download imprect ?
Anonymous
07-05-2003, 09:13 AM
I need ,it's importance for me .
I had been heard about some dubper prog that dump in raw mode ,it 's want rebuild before exe can run ,where to found that ,tell me please?
Anonymous
07-05-2003, 04:11 PM
www.google.com (http://www.google.com)
Anonymous
07-06-2003, 02:45 PM
hey,i searched many time but no results,please tell a file name location spacify .
Anonymous
07-06-2003, 04:39 PM
http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=imprec+download (http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=imprec+download)
Ricrado Narvaja
07-07-2003, 05:02 AM
Write me to ricnar22@millic.com.ar and i send you.

Ricardo
Teerayoot
07-07-2003, 06:35 AM
Thak you.
Darus
07-10-2003, 08:47 PM
http://mackt.cjb.net/


A thought

RCE Messageboard's Regroupment > General > A thought
Anonymous
07-05-2003, 10:14 AM
I thought about something nice for olly debugger : Olly recognize a number of functions, and displays their name whenever a program call them.
but isnt that hard coded in olly?

My idea is to look at the address the program called, go into the dll and look for the name of the function (its inside the dll!)

Or maybe olly does that already? :)
Anonymous
07-05-2003, 04:09 PM
Er, olly does that already and has done since the first public release!


Getting spaces

RCE Messageboard's Regroupment > General > Getting spaces
arnorp
07-06-2003, 12:39 PM
Hi everybody,
My question is very simple. Cause I'm use Olly by a few days.
How, where, I get some spaces to add my code in exe file. Where I put its, if in the file has no space to make changes? after the last command (retnnn...) comes the "jumps to dwords..." May I insert in the midlle of file? How to move the folowing intructions without damage its?
Please, step by step.
WOW! I'm asking too much. But I need this answers. Sorry.
Thanks
Anonymous
07-06-2003, 04:42 PM
check to see if space between raw size and virtual and place code in the alignment part.
Tornado
08-31-2004, 04:25 PM
Hi....can anyone please describe how should i do it so...with Ollydbg...i.m new also...i just wanna add 5 lines of extra code ...but i got no space.....thank you for your help....
armmad8
09-02-2004, 05:05 AM
i did had this kind of problem...

my quick solutions is...

1. look for a text string that is long and cut it.. the hex u freed can now be use.

code -> jmp to free text string loc. put some code then jmp back to code + X.

hope this helps..

regards
Tornado
09-05-2004, 07:04 AM
Thank you very much....i did what Anonymous say...Armmad8...thank you for suggetion too.....Peace guys....Wow....


Newest 1.09c bugs.

RCE Messageboard's Regroupment > General > Newest 1.09c bugs.
Teerayoot
07-06-2003, 02:56 PM
When i debugging winrar 3.20 ,i select View resource strings in execute module window,then i right click select Copy whole table ,olly crash on sometimes.
Not only winrar and another prog too but it not occur everytime that ollydbg has crash.
Anonymous
07-06-2003, 03:37 PM
olly 1.09c crashes alot for me when copying large text.
Anonymous
07-08-2003, 04:35 AM
Same problem here. Olly 1.09 clipboard copy has definetely a bug
Anonymous
07-10-2003, 11:52 AM
yes, i got the same problem in olly 1.09c
sometime it is, but i am not sure what occurs olly crash
when i debug program with olly 109 sometime the program attached cannot run normally, and no any response during runtime under xp, i think it is a big problem.
Anonymous
07-11-2003, 05:18 AM
I never had such issues with previous releases.
I hope Olly will fix those bugs in 1.09d
lordor
07-14-2003, 03:27 AM
i have the same problem.after i press ctrl+c,then rightclick mouse,sellect "copy /to dipboard",olly will crash.
TBD
07-17-2003, 04:16 AM
problem will be fixed in 1.09d that will come these days.
thanks everyone who reported.


Can someone please send me the HMEMCPY tut!!!!!!!

RCE Messageboard's Regroupment > General > Can someone please send me the HMEMCPY tut!!!!!!!
AllenDang
07-07-2003, 04:04 AM
I'm a chinese , I want to learn how to set the hmemcpy simular breakpoint in winXP or Win2000.Before today,I thought it is impossible to set Hmemcpy under winxp,lucky,I find Richard write a "how to" ,but I can't visit the dl web site you have given.
So , can someone please send me the tut.
Thanks very much!!
Ricrado Narvaja
07-07-2003, 05:01 AM
Well what is your mail, if not write me to ricnar22@millic.com.ar and i send you.

Ricardo
Anonymous
07-07-2003, 05:16 AM
My mail is AllenDang@19.cn.
Thank u!!!
Teerayoot
07-07-2003, 06:16 AM
Ricrado Narvaja ,You 're very good person on the world.You help all people that have a ploblem .I love you very much. ;)
AllenDang
07-07-2003, 06:59 AM
Yes,yes.
Ricrado ,u are a good person.
I love u toooooooooooo.
haha,two men fell in love with a man?
Anonymous
07-08-2003, 11:46 AM
when did this become a gay community?

should create own forum for them :P
Teerayoot
07-09-2003, 02:34 AM
it's good if you can create for me,but i will use it as cracking forum.:)
Anonymous
07-09-2003, 05:42 AM
can any of u help me I dont know how to use ollydbg to crack I have read the help files but still nothing that help me. if any of u have a tutals that will help me send it to me place

some help me my mail is <A HREF="mailto:ezenwaezemba@netscape.net">
Anonymous
07-09-2003, 05:43 AM
that first one mess up here it is ezenwaezemba@netscape.net
Pov
07-09-2003, 10:17 AM
This is not a cracking board, please take your requests elsewhere.
Anonymous
08-22-2003, 12:04 PM
Sorry for my dad english.I'm a malagasy and I want to know if it is possible to set an hmemcpy brekpoint in winXP or Win2000 with ollydbg 1.08.
if it is possible,can someone send me a tuts.
Thanks very much!!
Anonymous
08-22-2003, 05:40 PM
No it not possible as hmemcpy does not exist under xp/2k.
Anonymous
08-29-2003, 12:32 PM
I have a little problem.
I get the version 1.09d of ollydbg and I tried to load prog packed with UPX and I get a warning message like"maybe it is crypted...".So I pressed continue but I've still get the warning message over and over again.
This problem doesn't exist with ollydbg 1.08b.
Is it a bug maybe there is a problem with my computer.
Anonymous
08-30-2003, 11:22 AM
you will get message over and over again just unpack the file then you will not get the message any more it is not a bug it is meant to be like that
Anonymous
09-02-2003, 11:56 AM
Where can I find the more complete documentation about ollydbg.
I read the documentation inside the zip file but many olly's function are not documented there.
Anonymous
09-02-2003, 08:00 PM
Click "Help", and then click "Contents".
loveboom
09-11-2003, 08:40 PM
Ricrado Narvaja
hi,can bpx hmemcpy in xp /2k??? if can do it ,send me :lovebomNew@hotmail.
thank you !!!!!!!!!!!!!!
Ricardo Narvaja
09-12-2003, 06:41 AM
Is Point H o point hmemcpy is a simil, not a real hmemcpy and works in NT 2000 and XP

Ricardo
madcaplaughs
09-13-2004, 02:53 AM
Hi, I'm rather new at coding but Im giving it my best shot to learn on my own.

I came here because of HMEMCPY isn't a valid function anymore in XP (hidden in dll's uder new handles/aliases)

Ricardo, or somebody w/ the Point H tutorial very kindly send it to my email?

I downloaded the program with NO tutorial (i think it was the same one) and it was written in a language I did not understand, therefore, couldnt get far with the application. -> swedish_fireba11@hotmail.com <-- thank u
very much.


IDA 4.50

RCE Messageboard's Regroupment > General > IDA 4.50
Anonymous
07-08-2003, 02:31 AM
I know about ida that can diasm and produce new pe code,i never used to try it befor.Any one ,it's good or bad if compare with ollydbg?
TBD
07-08-2003, 03:50 AM
every tools is good for what is created. IDA is good for disasm from a lot of
platforms (x86, ARM, Motorola, ...) but it is not freeware.

you can download from the net a freeware version so you can try for yourself


request import recontruction tut

RCE Messageboard's Regroupment > General > request import recontruction tut
Teerayoot
07-08-2003, 02:38 AM
I nedd tut that teach me how to use import recontruction(imprec 1.4...)
rebild some packed crypted prox.

I's not working for me every time when i rebuild with it.
Ricrado Narvaja
07-09-2003, 05:15 AM
Well, i have 100 tuts 30 or 35 cases with rebuild table, the only thing are in spanish jeje, but, the case is Import Reconstructor is and aid tool if you use well you reconstruct the table if not, you have bad results.
Import reconstructor has any automatic features (IAT AUTOSEARCH, PLUGINS), in the new packers, they fool this automatic features, for this the manual search of OEP, IAT START, IAT LENGHT, and putting corrects values is a delicate question if you have no experience, in some packers and if you put bad values bye bye baby.
For other point of view, many packers detour to self routines, the values of entries on IAT, complicating the work, any packers has magic jumps (armadillo for example, telock, pelock too, you can found this magic jump and the table is 100 % ready for IMPREC, but in other cases (asprotect for example), there are a magic call you can NOP and 90 per cent of the entries are repared, but no resolve all entries, 6 to 10 entries are sustituted for own routines, IMPREC have a plugin for asprotect for fix this bad entries, but is for 1.2 version of aspr, for 1.3, using the plugin, 1 or 2 entries you may fix manually (there are a plugin for 1.3 in a page but is not compilated and if work of not work i don't know )

Sorry for my bad english
Ricardo
Teerayoot
07-09-2003, 06:33 AM
Hmm,after reading your esay for a while ,use ollydump to find OEP and fill in OEP in imprec ,i got some working prog,i'm please and enjoy with it,but still have some ploblem about didodumper ,i fallow didodumper tut on dump arm crypted prog , rebuild with imprec fill OEP and select autosearch IAT ,get import, delete all trunk and other..things finally select fix dump select didodumper 's dumped .When i run dumped_ program that say about error in writing memory address and destroy ,and other prox (GR 5.1F) run show splash for a moment and die.I dunno how to going on in which way .I really new beginner in unpacking stuff .Spanish tut ,he he i can't read at all ,Ricardo if possible please tranlate into eng (or thai ;),i think it's usefull for many user that same ploblem as me. :)
Anonymous
07-09-2003, 10:15 AM
if your using dillodumper, do NOT use the IAT AutoSearch option - it'll give you the wrong import table! You must use the exact values that dillodumper gives you.
Ricrado Narvaja
07-09-2003, 11:49 AM
iat autosearch not guarantee correct values, in new packers, for other side dillodumper not repair nanomites, for this, you must repair nanomites manually.
My tuts of armadillo in ollydbg are in english, and teach you how dump, how repair the iat and how repair nanomites all manually, if you dump with dillo dumper you can use my tute of iat and nanomites only and not of dump.

Ricardo
Teerayoot
07-10-2003, 02:53 AM
Hmm,i got working now(crypted arm),after try in and try out for a while,but some prog do not have import list name at all ,it' s just as invalid name.I change ipt size to 20000 ,it take for a while to get list ,but still invalid .i am confuse now,many question come to me,i want to know that all prog use 400000 as image base,or else how to find image base if not 400000,and pick section in imprec ,what 's that ?I really need tut!!!!
Ricrado Narvaja
07-10-2003, 06:45 AM
well if is armadillo, you first know, in the two versions are a magic jump, you can find, in my tuts, and in the crusader tuts always for resolve the IAT of arma you can found the magic jump first, nop this conditional jump. and the program run perfectly, with the difference the entries of the IAT are reredirected to the original APIS, with this, you can use the IMPREC perfectly and this tool reconstruct this table well if not you cannot reconstruct the table well, what is the problem for the magic jump, in armadillo with no cpoymem2 is easy to find, and nop, but in armadillos with copymem2 is a litle dificult, for the reason of the two procesess with the same name (copymem2), and one debugging to other (father-son process), well if you can work with this, in the son process is the correct conditional jump to rebuild the table perfectly, i have tuts in english for the two cases for ollydbg.

If you look in the IAT entries, the values you found for example
(in my machine)

XXXXXXX 34 7f 17 01

well this is 01177f34

and what api is pointed with that

go to view-memory in olly when the program is stoped in OEP and look in the blocks if in this position there are a DLL (if are a valid entrie the value 1177f34 maybe point to a dll) but nothing is in the block, exist but is blank.
If you go to this position you found a routine created by arma, and when you dump the executable, this routine, not is dumped, and when you run the dumped there are an exception when try to reach this point.

The 2 ways to repair this is trace this entrie in 1177f34 in the original and wiew finallly what is the real api is reached, and in import reconstructor put in the entrie the name of this api, and make the same work for the other bad entries one by one (is not recommendable my doctor say is bad for my health), jeje.

The other way, is to find the point when armadillo in unpacking the target,when put the value 1177f34 in this entrie, and when you reach that point there is a conditional jump in this zone, (magic jump), if you try, nop, and the table is filled with api direct values (77xxxxxx in my machine), when you obtain this, you can repair the dumped and import reconstructor said YES (correct) all the entries, and press FIX DUMP and correct the dump and this work perfectly.
Sorry for the long explication but i not see in what point you are working, if you have bad entries, or you have all entries well, and the error is in the values of start or size of the table.

Ricardo Narvaja
--Zine--
07-10-2003, 10:22 AM
Best way to find IAT is to provide the unpacked program with a fake one so it'll run, and then when it crashes, analyse crash address in Ollydbg and you'll most likely find that it's smack in the middle of the IAT, just search backwards for start of real IAT, and then load imprec and resolve :)


bpint 3

RCE Messageboard's Regroupment > General > bpint 3
Anonymous
07-08-2003, 05:41 AM
Is there a way to set a bp on int3 in Olly like in Sice?
Anonymous
07-08-2003, 07:44 AM
Olly stops on INT 3 by default.
Teerayoot
07-09-2003, 02:24 AM
Ollydbg powerfull than sice ,you can set any kinds of breakpoint such as,
int3 bp,hw bp,memory bp ,sice can do ,ollydbg can do more. :)


is unpacking aspr illegal

RCE Messageboard's Regroupment > General > is unpacking aspr illegal
Anonymous
07-08-2003, 08:25 PM
hi people, ive got a question?
is it illegal unpacking asprotect on a software?
Anonymous
07-09-2003, 02:19 AM
NO!
Teerayoot
07-09-2003, 02:27 AM
Depend on your goal,if you unpack ,crack and sold or distribute ,It's alway illegal.
If you unpack and learn for education pupose ,it's not illegal. :)

Any ideas?
Pov
07-09-2003, 10:19 AM
it illegal if prohibited by program license, and many programs have this in there license that you are not allowed to disassemble or decompile the code, so check program license to make sure.
Ricrado Narvaja
07-09-2003, 11:54 AM
jaja this this is noy true, the disclaimer says this but you have the righths of property of your computer, and in your computer you can make the actions you want, if not distribute, and not sell nothing, the disclaimer is in this case abusive, restricting the liberty of manipulate YOUR computer in the form you want, for this you PAY the machine, the HD, and the memory, and the content stored in this is YOUR and manipullable, for you and a form what you want, if you can not change a byte in your HD, your liberty for use your computer is very restricted.

Ricardo
Pov
07-09-2003, 07:42 PM
I think you'll find your wrong there Ricardo, although you buy the software and install it on your hd, you only buy the right the *use* the software, you do not buy the right to modify or otherwise examine the software in a form not does not mean loading the program into the memory of a computer for the sole reason of execution and allowing you to use the features of said program. Anything you do to the program that does not include execution (eg. loading it into a hex editor, and even viewing the sectors on it with a disk editor) is not legal. The only defense you have here is that you are reverse engineering the program for interoperability reasons.
Ricrado Narvaja
07-09-2003, 08:26 PM
I use the software in my machine, the software is tried, used, modified,i decide the use, the restrictions are not acepted in mi machine and in our laws (argentina) only if you sell or distribute is illegal, the rest is private use in private property, and the disclaimer cannot restrict this is inconstitucional here.
Is how you buy a house and when i buy you i say you can make this things the bathroom, only use for pee, jeje, is private and nothing can make nothing with this. And more if i not sell, and not distribute, how you know the use or changes of the program in my computer, is impossible you are a theoric.

Ricardo
Ricrado Narvaja
07-09-2003, 08:32 PM
Is the same thing you copy a CD in a cassete you say is illegal, i say not, otherwise if i not sell or distribute cassetes with the copies the company discografic, never know on my private use or copy, ths cassetes are made for this, and the computers are for this too, for use in a form you want, not in a form the companies want.

Ricardo
Anonymous
07-09-2003, 09:18 PM
When you come to amerika they will cut your balls off ;-)
Anonymous
07-09-2003, 10:21 PM
I guess this is america too. and has many countries ;-)
Ricrado Narvaja
07-09-2003, 11:04 PM
They enter in a private house to veriyfy your programs of your computers?
This a americam freedom and a defenders of private property? Maybe Stalin or Hussein your president?

Ricardo Narvaja
Teerayoot
07-10-2003, 02:58 AM
I 'm side with you ,Ricardo Narvaja.;)
Anonymous
07-12-2003, 06:39 AM
no, my goal is just unpack it , no crack no distribution, if i really wanna crack it i could use stripper or something like that for the unpacking job...!
so , i can ask what i want :

ive found the oep
dump there
found the stolen bytes
but please tell me your normal way for reconstructing the iat:
Anonymous
07-12-2003, 08:10 AM
imprec with ASProtect plugin.
Ricrado Narvaja
07-12-2003, 08:56 AM
well the 1.2 asprotect plugin fail in recontruct 2 o 3 apis in 1.3 and don't function well in the new asprotects, there are a new beta 1.4.3 of import reconstructor and a new plugins you can download in

http://www.wasm.ru/

and the new petools in this page say reconstruct asprotect too, i not try but are new tools for this you can try.

3. PE Tools v1.5.109.2003 [NEOx] (256.93 kb) NEW! ->
4. ImpRec Plugins [Madness/ZILOT] (13.6 kb) NEW! ->
5. Obsidium 1.0 [Obsidium Software] (971.5 kb) NEW! ->
6. Dll2lib 1.42 [binary-soft] (2571 kb) NEW! ->
7. ImpRec 1.43 beta5 [MackT] (217.98 kb) NEW!

Ricardo Narvaja
Anonymous
07-15-2003, 06:13 PM
Hey, Ricardo, you make our site popular :)
Ricrado Narvaja
07-15-2003, 07:45 PM
yes i put your page in crackslatinos and has 300 crackers jeje, and in others lists too.

Ricardo
volodya
07-15-2003, 11:35 PM
Enough to be an anonymous :)
Lets continue our nice talk.
I'm one of the wasm team, so my opinion matters.
What would you like to see on our site? Remember, no warez :)
BTW, I was enjoying reading your tutorials. Unfoturnately most of the very interesting things are in Spanish, but I have a lot of camerades :) to make a translation for me.
Ricrado Narvaja
07-16-2003, 06:03 AM
Well i look your page with a online translator and is a very good page,
the tools in your page are very new, and very actaulized.
I'm going to look other parts of the page to see (tutorials, etc) and i say one opinion, obvios translating online are more slow form of view, but i take my time and read interesting pages how yours.

Ricardo


how to bpx nag show?

RCE Messageboard's Regroupment > General > how to bpx nag show?
Anonymous
07-08-2003, 10:43 PM
whn i use ollydbg 1.09c to crack some program under window 2003 server i cannot get any response from ollydbg, i need install xp?

i am not clear how to use ollydbg and cannot find more useful info,
i want also to know how to bp hmemcpy and some bpx methods as those commands under softice, if someone have free time pls tell me tks a lot

my email:newcastlecity@hotmail.com

best wishes

virtualspace
Teerayoot
07-09-2003, 02:12 AM
Do not need hmemcpy ,type bpx Showwindow or in user.dll name module set bp in showwidow ,trace untill Nag appear and trace a litle bit you will go to excact call to nag sub.For information mail me
Cr.Jack@bugsgroup.com

Defeat nag is easiest cracking method.
Anonymous
07-10-2003, 11:43 AM
tks i try it
Anonymous
07-10-2003, 06:25 PM
!!! THIS BOARD IS NOT FOR CRACKING REQUESTS !!!

PLEASE TAKE YOUR REQUESTS ELSEWHERE !


Brake point hlp plz :)

RCE Messageboard's Regroupment > General > Brake point hlp plz :)
Anonymous
07-09-2003, 01:34 PM
Hello! I need help on how to place a brake point on a memory address... I cant find out how to do it :( I right mouse clicked on the CPU box and i dont see it as an option, so if you guys can help me out by telling me how i can set it up to do so, or if it already can do it (without any plugins) how to do it :) thanx in advance!!!! -chuck
Anonymous
07-09-2003, 07:43 PM
Right click in asm code or memory area, not CPU.
Teerayoot
07-10-2003, 02:43 AM
Just press F2 while select on target line to break!,very easy do not need some brian at all.
Anonymous
08-29-2003, 12:47 PM
Excuse me for my bad english.it's not my native langage.
I want to know more about the point.h
why is it called like this?
I read tutorial about it but there is some part I still don't understand.
The tutorial says something like "type MSG==201..." but what does it mean?why MSG?why 201?And it says also "in some computer you must set MSG==202 instead of 201..."why?
Can someone tell me more about it.
Ricrado Narvaja
08-29-2003, 07:00 PM
201 is MSG==WM_LBUTTONDOWN

202 is MSG==WM_LBUTTONUP

When you press a button generally this messages are utilized for this reason are used in the tuts.

Ricardo
Anonymous
09-02-2003, 11:51 AM
Thank you Ricardo.
Anonymous
09-02-2003, 11:59 AM
Hey Ricardo!
Where can I get documentation talking about this.
Anonymous
09-02-2003, 08:01 PM
Click "Help", and then click "Contents". Other docs @ msdn.microsoft.com


LInux ELF reversing?

RCE Messageboard's Regroupment > General > LInux ELF reversing?
Anonymous
07-10-2003, 07:16 PM
OllyDbg gives a really nice environment for debugging/disassembling applications; I was wondering if it was possible to add support for reversing Linux ELF binaries in OllyDbg, and if someone WAS to go through the trouble of writing code to do such a thing, would it be in the actual OllyDbg source or would it be as a plugin?
Frankly, for UNIX/LInux reversing tools, a nice graphical layout of code, data, jmp arrows, string references, and references to library calls/function calls is very difficult to find, and i was wondering if there could be a windows prog. to do it. Offline disassembly would be a good start, and in some cases more then enough.

/M.A.R
Anonymous
07-10-2003, 07:43 PM
There are many of these kind of disassemblers on freshmeat, and IDA also supports disassembling Linux executables if you want to pay for a disassembler.


newbe Q

RCE Messageboard's Regroupment > General > newbe Q
Anonymous
07-11-2003, 01:27 PM
Hi all debuggers ;)
a some q
i found not any list of commands of olly debugging mnemonics
found original intel x86 mnemonics but different much with olly disassembled mnemonics
is there any list of olly 's mnemo ?
with addressing ,postadressing,etc?
i was some years ago superb at c64 assembler and wanna to learn more about 32 bit assembling but need all mnemonics described ..... it differs a little only :D with 8 bit assembly
thanks for any reply
with best regards beginner ,future master :) Stallion
Anonymous
07-11-2003, 06:14 PM
http://www.simtel.net/pub/pd/40228.html


how2break on mouse event?

RCE Messageboard's Regroupment > General > how2break on mouse event?
Anonymous
07-12-2003, 11:58 AM
when i trace one program how to set a condition breakpoint?
such as when ecx=00993344 bpx 6600770000 or when mouse clickup break into program?

by the way, how can i break program when it get in or out from user32.dll?

tks
oh me anon
07-12-2003, 02:23 PM
well if the module is loaded dynamically after the exe started running you can use the break on new module option in debugger options

apart from that you can break point on access of any module use memory on access after you view memory

for the above stated problem you can use conditional break point

you need to experiment a little when using it

i say one example develop on it

uMsg == WM_COMMAND
<winproc> , TranslateMessage
pause always
log arguments
log blah blah --> i forgot

then u can view the log window for details (you can save it too for future referances)

last but not least you can use pause on condition in runtrace option also

well there may be many more possibilities (it is a great tool take your time to
explore it byte by byte )and it will be a truly enjoying experience

thank oleh for such a good better best bestest bestest^infinity ;) application


Bug or not but the problem is

RCE Messageboard's Regroupment > Bugs > Bug or not but the problem is
Anonymous
07-13-2003, 11:40 AM
Hi

I compile my program for debugging with MASM. When i load it in olly debugger, once i can see symbols, next time not, then i can see source, next 10 times not. Where is the problem? I change only my source file, i didn't touch any compiler switch or something similar (changing behaviour of olly debugger).

thanks in advance

stanks
Anonymous
07-14-2003, 06:12 PM
is bug


breakpoint please help

RCE Messageboard's Regroupment > General > breakpoint please help
Anonymous
07-14-2003, 04:19 PM
i need a breakpoint when the WORD in memory address at 12AE74 is equal to $FFFF
Anonymous
07-14-2003, 06:10 PM
set bp in normal way. alt+b, right-click "edit condition". done.


breakpoint a var ?

RCE Messageboard's Regroupment > General > breakpoint a var ?
Anonymous
07-14-2003, 04:30 PM
i need stop on a breakpoint when the same breakpoint is called 200 times.
Anonymous
07-14-2003, 06:11 PM
set bp cond.
Teerayoot
07-16-2003, 06:01 AM
hmm,look this post you will finger it out http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=310 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=310)


teach

RCE Messageboard's Regroupment > General > teach
ToRnAdO
07-15-2003, 12:36 AM
teach me how to crack with ollydbg
TBD
07-15-2003, 04:15 AM
ToRnAdO: this is not a cracking forum, so please do not put any more cracking related posts
Teerayoot
07-16-2003, 05:57 AM
hmm,beginner,many many tutorial can teach you -> www.anticrack.de (http://www.anticrack.de)


Another bloblems? ,another bugs?

RCE Messageboard's Regroupment > General > Another bloblems? ,another bugs?
Teerayoot
07-16-2003, 03:11 AM
As olly declare in help file about feature that support or fix pe header (i cann't remebber it because i do not use my own pc,play in university,at home no have internet;).
When i try to load some progs ,ollydbg not stop on entry point on main module,intead programe run suddenly ,that's program do not packed or crypted at all,althouge i set for stop on system bp.;(

I think ollydbg have a ploblem about pe header(i do not experian about pe header ),this not happen in previous version(1.09b).

And another ploblem is some prog(yes,this packed)(ULV studio 7.0) when i load into ollydbg ,,it load and unload for a long time(see in log window.)
Yes ,this is not happen in previous verstion too!
Ricrado Narvaja
07-16-2003, 06:07 AM
The trouble for run and don't stop for me, quiting the plugin IsDebuggerPresent, or with a new version 1.4, in my machine,are okay now, and don't configure the plugin for autohide.

Ricardo
Teerayoot
07-16-2003, 06:56 AM
"And another ploblem is some prog(yes,this packed)(ULV studio 7.0) when i load into ollydbg ,,it load and unload for a many time only main module(exe)(see in log window.) as below
ule.exe loaded some text ripped...
ule.exe unload
ule.exe loaded
ule.exe unload
.
.
.
ule.exe loaded
What make this happen .
I am curious to know!

Yes ,this is not happen in previous version too!"and many program occur like this.


String data reference!,why it's not implement

RCE Messageboard's Regroupment > General > String data reference!,why it's not implement
Teerayoot
07-16-2003, 03:34 AM
DO you used to play with Win32Dasm yet,It's disambling and phase a index string to strings data reference .but in Ollydbg it not!.Just a index,when i want to find a string data reference ,i must select view resource strings ,and look for a while(ohh ,ollydbg do not have a search feature;() ,and copy index,ant go to code window,search for all contants .he he it take a lot of time to play with a resource string .

If possible ,Loadstring api call ,please phase index to strings . :)
I hope you will do in next version.
Anonymous
07-16-2003, 05:35 AM
Olly *DOES* have a search feature in the resource strings sections (and every other section) - RTFM!
Teerayoot
07-16-2003, 05:41 AM
No,Ollydbg no have!,You misunderstand me!I mean resource strings not "Search for all reference strings" command on right click menu!
Ricrado Narvaja
07-16-2003, 06:09 AM
In view-executable , you click in the executable you want and right click in view resource strings.

Ricardo


SV_IsDebug14 do not handle anymore!

RCE Messageboard's Regroupment > General > SV_IsDebug14 do not handle anymore!
Teerayoot
07-16-2003, 06:40 AM
When i debugging some program (from WebToolMaster and many from),that prog call isdebuggerpresent to check debbuger present or not?
Why it's still present when i use SV_IsDebug14 hide it(program fucked up)and in api isdebuggerpresent(sorry if i miss spell it) memory reference have value 1),but when i set bp on isdebuggerpresent trace 3 line after break change value to 0 in memory reference(memory location may difference in another machine ),hmm now program run!!


Unicode handling bug?

RCE Messageboard's Regroupment > Bugs > Unicode handling bug?
Anonymous
07-17-2003, 12:28 AM
hi there olly,

i've used olly on remotelyanywhere build 407 (v5.x - www.remotelyanywhere.com) (http://www.remotelyanywhere.com)) and it successfully located the unicode string "BAD.SIGNATURE".

when i used olly on remotelyanywhere build 408 (http://www.remotelyanywhere.com/remotelyanywhere.zip), it can't seem to find it, along with many other unicode strings. When i used a hex workshop on it, it located the string ok. When i used softice, it could also interpret it with no problems.

any ideas?


New ollydbg 1.09d

RCE Messageboard's Regroupment > General > New ollydbg 1.09d
Ricrado Narvaja
07-17-2003, 06:16 AM
Corrected bug in copy to clipboard and bynary copy .

Ricardo


Ollydbg and MASM

RCE Messageboard's Regroupment > The Heap > Ollydbg and MASM
Anonymous
07-17-2003, 08:46 PM
Is there any masm IDE that integrates with ollydbg?
TBD
07-18-2003, 03:48 AM
a lot of the IDE support adding custom tools, so you can add OllyDbg.
Anonymous
07-18-2003, 04:03 AM
wow thnx. But im quite dissapointed coz my ide (radasm) only opens up ollydbg. I would want something that automatically opens the exe of what im editing in asm.
TBD
07-18-2003, 09:50 AM
Anonymous: for RadASM you must go in Option\Tools Menu and add at the command "[path to OD\]ollydbg.exe ,$" to open the exe you are working on
Anonymous
07-18-2003, 06:10 PM
Now thats a debugger. Tnx TBD.
Anonymous
07-21-2003, 02:27 AM
TBD did you mention a problem to Olly with MASM and debugger that i recently post here? I send him email about that 4 days ago, but still no reply.

thanks in advance

stanks
TBD
07-21-2003, 04:51 AM
stanks: which problem ? Olly is very busy on the moment so you must wait.

[edit] found it. with the symbols and masm. can you send me a zip with the problem so i can check ?


Question on memory breakpint

RCE Messageboard's Regroupment > General > Question on memory breakpint
Anonymous
07-18-2003, 02:26 AM
Hello,

Im new to this and have a question. I want to set a breakpoint when the memory at location 019E1538 is written to. How would I do this?

I try to set a mem breakpoint thru the hex dump before I start the program but the memory address is not specified yet and I do not know how to get to it so that I can set the breakpoint.

Thanx for the help,
-Flack
TBD
07-18-2003, 03:51 AM
i dont think is possible. one method that i think is to write a plugin that monitors the address and when it is available to set a breakpoint, or make
a trace and look for the address that access your memory location
Anonymous
07-18-2003, 09:13 AM
a hardware breakpoint will work. Set the breakpoint when the memory is created, and then restart the program. it'll stay in memory whilst the memory is not available and become active as soon as it is available.
Teerayoot
07-22-2003, 03:09 AM
In dump window set hw bp,and select hp on write,but some time system call may write to that memory location ,you will break a thouson of time !,Same as my ploblem as previous post before,


Run Trace question

RCE Messageboard's Regroupment > General > Run Trace question
Anonymous
07-18-2003, 03:08 PM
Hello,

Is there any way for me to do a run trace that only traces into the subroutines that remain in the main module rather then all subroutines?

For example, if I use Ctrl+F11, the trace log will contain all the instructions called in ntdll and be huge. Is there any way for me to avoid those modules?

The reason Im asking is because I want to do a run trace on two files and see where they first differ wihtout having to look at those other modules.

Thanks
Anonymous
07-18-2003, 03:17 PM
no possible
oh me anon
07-19-2003, 03:28 AM
check mark the skip library calls in debugger options and try i never tried but think might work in your case will post after trying later coz i dont have olly loaded here now when i post
Teerayoot
07-22-2003, 02:53 AM
Prefile that module ,that feather 're very usefull,i think it work well,becasue i newver go into system call too deep ,alway check in debug option ,force it not go inside system call.


Is it possible to save Command History?

RCE Messageboard's Regroupment > General > Is it possible to save Command History?
Anonymous
07-18-2003, 06:25 PM
According to the help file

"OllyDbg keeps track of up to 1000 last commands displayed in Disassembler window... If run trace is inactive, you can navigate through the history by pressing buttons '+' and '-'."

Is there a way to save this command history to a file? I tried to activate run trace but nothing is recorded. Commands in the run trace are recorded only if I use run trace (Ctrl F11 or F12). If I am using F8 to run thru the code, can I still save the command history?

Thanx


Question/Bug?

RCE Messageboard's Regroupment > General > Question/Bug?
Anonymous
07-19-2003, 12:05 AM
When I press the right mouse button in a module, I see a submenu called "Copy To Executable".

Under this submenu, there are usually 2 submenus, "Selection", and "All Modification".

Lots of times I see only the first one (and i really need the second :)
Why is that? a bug?
Teerayoot
07-22-2003, 03:01 AM
Arr...,problably ,You just modify code one location ,try many one ,i think the secound will appear ;)


Opcode unidentified

RCE Messageboard's Regroupment > Bugs > Opcode unidentified
Anonymous
07-19-2003, 01:35 AM
Ollydbg was unable to indentify the opcode C2h,FFh, FFh, or rather retn ffffh.


Protect with asprotect! arghhhh!

RCE Messageboard's Regroupment > General > Protect with asprotect! arghhhh!
mrbar
07-19-2003, 11:01 AM
I'm download a program modelmaker 7.05d. it seem protectd with asprotect
but astripexp don't work with it. I using:
olly 1.09d
LordPeDeluxe (dump)
PeEditor 1.7 (change eop and seccions)

But can't get the program run! Showm a message box with a very much symbols and a referento to a dll lnpg.dll (modelmaker owner). For this I can,t use the revirgin to rebuild the IAT. What a have to do?

thanks
Ricrado Narvaja
07-19-2003, 11:42 AM
Use Import Reconstructor, and with the call magic, you nop, and the table will be resolved 90 %, only you can fix at hand the 10 or 11 enters of the IAT, are allways equal in all asprotects.

GetProcAdress, GetModuleHandleA, GetCommandLineA, SetHandleCount, GetVersion, GetCurrentProcessId and FreeResorce, use a program you can unpack with asprstripper and compare, th enters of the IAT, the lines of this emulated apis are always equals, or very similarity, i mede two tuts of asprotect 1.2 1.3 and the NEW ASPROTECT with ofuscated STOLEN BYTES, but are in spanish.

Ricardo
Anonymous
07-19-2003, 05:40 PM
This is not a cracking board, please take your questions elsewhere.

Ricrado Narvaja: You are very naughty to help out here. This is not a cracking board - please do not post answers to cracking related questions.
Teerayoot
07-21-2003, 07:35 AM
Great ,i have this ploblem too,Some prog ,i can unpack and run well,but some prog still don't work .
I use Imprect to rebuild ,and trace all api call with trace level 1,and it have some invalid ,then i trace with asprotect plugin,it work well,but some prog (Cryton button 2.0)have one invalid ,i select switch to loader ,and fix dump ,but still don't work.

Ricado,It's very great if you tranlate your tut into English lang ,Yeah it' will very usefull to everyone again ;)
Ricrado Narvaja
07-21-2003, 11:38 AM
the friend who translated my old tutes have the PC broken for this reason i have no posibility of decent translation in the moment.
The repair of the iat only whit the IMPREC tracing level 1, and plugins dont work, two or three apis are bad repaired.

Ricardo
Ricrado Narvaja
07-21-2003, 11:42 AM
For the Anonimous what post before, only unpack a program is not cracking is only unpacking, if i speak of a name of a program you have reason if mentioned how unpack a NAME of a commercial program, but never name of a comercial program has been mencioned, for this reason is not a cracking post is a unpacking post.

Ricardo
TBD
07-21-2003, 11:44 AM
Teerayoot and Ricrado Narvaja
please do not respond/post anymore cracking related posts. i know that are not specific in howto but i dont want to loose the host again. so please be understable and keep the posts only OllyDbg related and no cracking/reversing even if it uses OllyDbg.

thanks
Anonymous
07-21-2003, 12:08 PM
i´m sorry guys for mention of a program, i´m studding, packers, pe´s and other related subjects.

I use the oly with ollydmp plugin but, but when i open import reconstructor there is very many call (not only 7 to 10). What to do?
Ricrado Narvaja
07-21-2003, 05:46 PM
I can't answer here mail me to ricnar22@millic.com.ar and i tell you.

Ricardo Narvaja
Teerayoot
07-23-2003, 03:16 AM
Ricado,I 'm clue about your first reply topic(Magic jump),and i 'm not experian in unpacking ,Some how i can unpack some program ( i don't know what's version that he use asprotect),just dump prog and rebuild it .However (that i said before)some programe have one invalid (yes many many have alway have one invalid,after i trace with asprotect plugin,but some prog, imprect fonund api about 3-6 api call that plobably i may supply wrong oep )

Hmm,explain long enough.i need you help me (teach )how to manual rebuild that invalid api call) .
Teerayoot
07-23-2003, 03:22 AM
TBD,i will never refer or name a commercial programe again for make this board non cracking .But just a talking about reservving knowlange.

Yes,if i said mush more,U will notice that i use a broken language.
Apologize for my bad language.
Ricrado Narvaja
07-23-2003, 07:12 AM
Give your mail and i write in private is easy.

Ricardo
BruceLee
07-24-2003, 05:07 AM
Unpacking ASProtect with Olly Debugger is a piece of cake :)
You may find the OEP in 30 sec... and stolen bytes too :)
Then go to OEP and dump :)
Use ImpRec to resolve APIs.
The end :)
Anonymous
07-24-2003, 09:53 AM
Yup, Alexey makes it easy for us by using SEH (which he thinks makes it harder to reverse... ho hum :) :)
tlsact
07-01-2005, 06:49 AM
arrive to the oep step by step and dump it.
then ,you can use imprec to find the IAT for repair the file.
if you can't run it successfully,you may to resolve the APIs and relocate it,even you must find the lossed code and create a section to reload them.
homersux
07-02-2005, 07:08 PM
BruceLee, can you send me an email to homersux2000@yahoo.com please? Thanks.


breakpoints always vanish

RCE Messageboard's Regroupment > General > breakpoints always vanish
Anonymous
07-19-2003, 06:22 PM
Is it a bug, an option, or disability of ollydbg to lose the breakpoints you set after forcing an exit or restart. the big problem is whenever i forced a restart, breakpoints are no longer saved even when you do the restart the right way.
Anonymous
07-19-2003, 09:50 PM
it's a feature, not a bug.
Anonymous
07-20-2003, 03:42 AM
How can i enable or disable that feature?
Anonymous
07-20-2003, 08:19 AM
options->debugging options->security

and tick the three "Ignore" boxes.
Anonymous
07-20-2003, 08:09 PM
that doesnt seem to work. Just in case, my problem is that i want ollydbg to save the breakpoints and comments i made after a session. im not sure if the reason im losing them is the warning olly gives every yime you restart/close an active process. But i remember well back in ollydbg 1.09b, olly saves breakpoints no matter what.
Teerayoot
07-22-2003, 02:57 AM
he he,i think you set udd directory miss location ,or else that prog is packed or crypted (try hw bp),that he or she remove bp everytime when it loaded.
But! it 's not a bug ,SURE! ;)
Anonymous
07-24-2003, 02:06 AM
i have a dual boot system. 98 (hidden) and xp. i put ollydbg directory in mydocuments of 98. im always in xp so i just have a shortcut to olly. Was that the reason?
whats udd anyway?
Anonymous
07-24-2003, 08:03 AM
i had this problem before and i sovled it by deleting the ollydbg .ini file. after that it remembered breakpoints again.
Anonymous
07-25-2003, 08:05 PM
its the .ini file afterall. Tnx


Log function arguments on __vbaStrCmp

RCE Messageboard's Regroupment > General > Log function arguments on __vbaStrCmp
Teerayoot
07-21-2003, 04:03 AM
Sorry,if this information involve cracking stuff a little bit.Main pupose of this information is how to learn to play with __vbaStrCmp and how to use ,add custom fuction discription that i think it is very usefull to everyone.

Read my tutorial link below
http://www.bugsgroup.com/pub/__vbaStrCmp.html
Anonymous
07-21-2003, 06:56 AM
:( image can not be show!
Tacman
07-21-2003, 07:19 AM
Thanks for that info :)
Teerayoot
07-21-2003, 07:21 AM
It's server rule strictedly,file name case sensitive .

but i already fixed it.
Anonymous
07-23-2003, 01:48 AM
Could you explain this a little further:

He he ,it's easy to fish some serial on VB program ,because a powerful of Ollydbg condition log feature.You ,you can add own Custom function descriptions for every module name ,but Olly make some uncomfortable to us which we must change DOT arg file to target name DOT arg,Instead of use as module name ,in this case, name Msvbm60.arg

When I try and set the conditional log breakpoint, I don't have the ability to change log function arguments.
Teerayoot
07-23-2003, 02:55 AM
You must change iqedit2.arg that i provided to target programe that you 're debugging ,sush as you 're debugging victim.exe you must change to victim.arg ,then copy to olly folder ,you not need to analyze but you must close ollydbg and reopen again ,log function argument will now selectable :)
Teerayoot
07-23-2003, 03:02 AM
For information further,See ollydbg help file,it's formal rule of custom fuction description.
Anonymous
07-23-2003, 06:34 PM
Thanks for the reply. I must be missing something because I just can't get it to work for me for some reason. Don't know what it is. I renamed the .arg correctly and restarted Olly but that damn log function argument is still disabled.
Anonymous
07-23-2003, 06:47 PM
Is there some setting that I would also have to change in Olly as well?
Anonymous
07-23-2003, 07:04 PM
FINALLY, I got it to work. What I did differnent is instead of Conditional Log Breakpoint I did is Set Log Breakpoint on Every Reference. Worked like a charm. Too easy almost...;)


??? Questions ???

RCE Messageboard's Regroupment > General > ??? Questions ???
Anonymous
07-23-2003, 11:21 AM
1.
How to search for bytes?

In SoftICE s 0 l ffffffff 90,90,90,...
In OllyDbg ???

2.
I have win2000 and I want set breakpoint on GetVolumeInformationA... or GetProcAddress, but how???

Thx,
Bruce Lee
Anonymous
07-23-2003, 11:53 AM
in ollydbg, the right click is like talking to god; everything is done with right click (well almost). do right click -> search for -> binary string. you can even use ?? for wildcards i think. for setting bpx on imports, do ctrl-N for a list, and then ... right click to bpx.
Anonymous
07-23-2003, 11:58 AM
In packed target when press ctrl+n found missing imports :(
And now what?
Anonymous
07-23-2003, 12:19 PM
here's a trick most people dont know. it was in some olly tips i forget which #. you can get around this by doing view -> executable modules, and locate the library where the call is, in other words kernel32.dll or whatever. then from inside that library you can do ctrl-N and set a breakpoint on the EXPORT you are interested in. then it will break when your app calls that export of that lib. its not the easiest solution, but it can be useful when you are not sure where the import calls are in your app.
Anonymous
07-23-2003, 07:52 PM
if you want to set breakpoint on GetVolumeInformationA... or GetProcAddress, etc easily in Ollydbg, just do:

bp GetVolumeInformationA

or

bp GetProcAddress

Other useful commands are:

D expression Follow address in dump
DUMP expression Ditto
DA [expression] Dump in assembler format
DB [expression] Dump in hex byte format
DC [expression] Dump as ASCII text
DD [expression] Dump as addresses (stack format)
DU [expression] Dump as UNICODE text
DW [expression] Dump in hex word format
STK expression Follow address in stack
BP expression [,condition] Set INT3 breakpoint at address
BPX label Set breakpoint on each call to external 'label' within the current module
BC expression Delete breakpoint at address
MR expression1 [,expression2] Set memory breakpoint on access to range
MW expression1 [,expression2] Set memory breakpoint on write to range
MD Remove memory breakpoint
HR expression Set 1-byte hardware breakpoint on access to address
HW expression Set 1-byte hardware breakpoint on write to address
HE expression Set hardware breakpoint on execute at address
HD [expression] Remove hardware breakpoint(s) at address
STOP Pause execution
PAUSE Ditto
RUN Run program
G [expression] Run till address
GE [expression] Pass exception to handler and run till address
S Step into
SI Ditto
SO Step over
T [expression] Trace in till address
TI [expression] Ditto
TO [expression] Trace over till address
TC condition Trace in till condition
TOC condition Trace over till condition
TR Execute till return
TU Execute till user code

and others that you can find in the documentation...


Breakpoint on CreateWindowsExA in win2000

RCE Messageboard's Regroupment > General > Breakpoint on CreateWindowsExA in win2000
Anonymous
07-23-2003, 11:47 AM
It is possible in Olly Debugger?
Ricrado Narvaja
07-23-2003, 07:14 PM
Yes

Ricardo
Anonymous
07-23-2003, 07:48 PM
Or the longer answer...

bp CreateWindowExA

using the Ollydbg command line...
Teerayoot
07-24-2003, 05:30 AM
No,in command line ,ollydbg don't work if that prog is packed or crypted(sometime normal prog can't work too,becasuse ipt is in another module) ,you must set bp in user32.dll module name ,just press F2 on CreateWindowExA.
Anonymous
07-24-2003, 09:55 AM
Rubbish. "bp" can set it directly in the runtime library and so will work regardless of whether program is packed or not. I use it when unpacking Armadillo program so your talking crap.
Teerayoot
07-25-2003, 04:12 AM
It never break for me!,what'wrong on my computor?
Anonymous
07-25-2003, 07:37 AM
Try reinstalling Ollydbg and using latest command line plugin.
yaa
07-27-2003, 07:16 AM
It could be that CreateWindowExA is NOT called. The application could be using MFC or some other library to create windows.

yaa
Anonymous
07-27-2003, 04:14 PM
Ermm... The MFC library itself uses CreateWindowExA when you ask it to create a window... So do most other libraries.
Anonymous
08-03-2003, 01:13 AM
you need to go look to see what APIs are being used in the program first.. CreateWindowExA usually HAS to be called sometime if its a GUI..

but go look at all the APIs being called..thats the easiest way.

sounds like its packed though..


Unable to read memory of debugged program

RCE Messageboard's Regroupment > General > Unable to read memory of debugged program
yaa
07-25-2003, 08:51 AM
Hello,

while debugging a program I recently downloaded I'm getting a "Unable to read memory of debugged program" error message on almost all commands available. Anyone have an idea on how this is accomplished?

Regards,
yaa
yaa
07-26-2003, 06:09 PM
Hello,

if anyone wants to take a look at the program that is determining this behavior, this is Visual Prolog 6.1 and it can be downloaded from www.simtel.net/product.download.mirrors.php?id=60705.
(http://www.simtel.net/product.download.mirrors.php?id=60705.
)

Regards,
yaa
Anonymous
07-26-2003, 06:22 PM
If this is not your own program, then it's almost certainly because you trying to "crack" the program, which is not permitted to be talked about on this site.
yaa
07-26-2003, 07:31 PM
Hello,

I'm not trying to crack anything, the product is a freeware for personal use, so there is really no reason why one should crack it. I develop software myself and often debug programs to "take a look" at how others accomplish certain results expecially what apis are called and passing what parameters.

Regards,
yaa
Anonymous
08-07-2003, 07:04 AM
Hi,
I have the same probs, but in this time its a crackme RECCXi (http://picasso.poupe.net/?p=recc).
Can anybody help me?
Anonymous
08-14-2003, 09:18 AM
Look up VirtualProtectEx?
Anonymous
08-15-2003, 02:08 PM
I get the same error when trying to set a breakpoint on a WM message. I would like to be able to break when WM_COMMAND is sent to the application. In the OllyDbg help it explains how to do this but when I set the breakpoint this error appears.

Thanks,
Alex
yaa
08-15-2003, 06:39 PM
Ok, it seems that VirtualProtectEx could explain the behaviour we are seeing ... I'd guess that called with a PAGE_EXECUTE would probably be the right choice.

In fact it would be nice to develop a tool that could "query" another process' virtual memory space and "draw" a map of that memory allowing to eventually change the setting of memory pages ...

Does such a tool already exist?

yaa


Stack dump

RCE Messageboard's Regroupment > Bugs > Stack dump
bundy
07-28-2003, 12:19 PM
Olly doesn't remember there is stack dump!

It remembers that there are 5 columns, but ... see yourself
bundy
10-01-2003, 07:55 PM
Seems like noone really noticed my posting, maybe I was in hurry and wrote this what is above.
Here's the bug, and how can it be reproduced:
- in apparance -> restore windows position & width of column is ON (default setting)
- during debugging in stact window -> Show ASCII/UNICODE dump (a new column apears)
- restart olly
- load some program -> and see olly doesn't remembers there is a dump column
Anonymous
10-01-2003, 08:11 PM
this is by design


Changing the ID of a window , how to ?

RCE Messageboard's Regroupment > General > Changing the ID of a window , how to ?
Neitsa
07-28-2003, 07:53 PM
Hello everyone,

Maybe my question seems strange, but all i want to know is if it's possible to change the ID of a window in OllyDBG. For instance, imagine that a Message box as the ID x0BB9 and i want it to be x007B. How could i do it ? Is it possible in Olly ?

Thank you very much.
Anonymous
07-29-2003, 05:25 AM
No, it's not possible.
oh me anon
07-29-2003, 12:10 PM
r u talking about control id of a button etc they are in resource section of an exe u can view them by using view--->memory ---->executable modules---->.rsrc ---dump

u can also use view resoure blah its available in right click somewhere and dump it

you can edit them using ctrl+e in cpudump and then save them back to the original exe using copy to executable
Neitsa
07-29-2003, 02:59 PM
thank you very much, that's all i want to know !


Plugins for Olly...

RCE Messageboard's Regroupment > General > Plugins for Olly...
BruceLee
07-29-2003, 10:23 AM
Where to download?

Thx!
Anonymous
07-29-2003, 10:24 AM
Click "OllyDbg Stuph(plugins, tutorials)" at top of this page.


Keyboard shortcuts

RCE Messageboard's Regroupment > General > Keyboard shortcuts
yaa
07-30-2003, 10:38 AM
I was wondering if there are undocumented shortcuts in olly ... for example in the small pane under the disassembler, once I select a command in the disassembler, I'd like to go on one of the operands and be able to using a return or a space bar key to immediately go to the selected address in the dump without having every time to call the context menu and select the menu voice "follow the value in the dump" ... it would make my life easier ...

yaa


Small bug: comments not unicode

RCE Messageboard's Regroupment > Bugs > Small bug: comments not unicode
yaa
07-30-2003, 08:30 PM
It seems that user comments added to code are not unicode ....

yaa


Source code now show when work on MFC!

RCE Messageboard's Regroupment > General > Source code now show when work on MFC!
Teerayoo
07-31-2003, 04:47 AM
When i write program using borland ,i debug with olly ,yes in source window source code show very well,but when debug mfc prog (debugging information included) in source code window,it' not show!
What's the ploblem?
Teerayoot
07-31-2003, 04:54 AM
i using ViSual studio 6.0.


Unpacking Softwrap just right click!

RCE Messageboard's Regroupment > General > Unpacking Softwrap just right click!
Teerayoot
07-31-2003, 05:07 AM
Olly is a great debugger on the earth.One day after i decide to unpack some softwrap prog that written using VB,fist i try to dump using Ollydump then rebuild using imprec .It don't work .it seem something wrong.After try in and try out for a while ,i got it.he he i never think why unpacking softwrap is too easy for every unpacking that i made before,just fallow this intruction
First after you click try on softwrap dialog,fire up OllyDbg ,Attact process that u want to unpack(normally it's extention .locked )then Right click on Cpu Window ,select copy all ,then copy to executable and Save to unpacked.exe
It's work great.

Yes Just Right click!
BruceLee
07-31-2003, 06:00 AM
:)))) Wonderfull :))))
Tacman
07-31-2003, 06:12 AM
whe i try to run the unpacked exe I get and error - xtreamlok alert, dll loading problem or debugger detected or integrity violated. Any advice on how to beat this?
Anonymous
07-31-2003, 07:50 AM
mmmhhh, ok, let me see if what I'm following you correctly ...

1) I got UPX and pack notepad.exe with it
2) I start up the packed notepad
3) I attach the running packed notepad with ollydbg
4) I go to the disassembler pane in the CPU window (if necessary I select the correct executable with ALT+e if the packed exe is not show in the disassembler pane) and right click doing copy->select all
5) once all the code is selected I do copy->to file
6) I copy to the file system all the code with an exe extention and run it
7) it should work .... but it doesn't!!!

Did I follow you correctly or not???
With what kind of packer/encrypter did it work for you???
On what operating system are you working on???

JimmyBoy
Anonymous
07-31-2003, 10:16 AM
JimmyBoy: It's obviously not going to work on UPX is it? :p

To unpack UPX (and most other packers/protectors) you need to find OEP and dump there.
Anonymous
07-31-2003, 10:30 AM
Hello Anonymous ... obviously what is "obvious" to you may not be so "obvious" to me, don't you think????

If every packer needs finding the OEP and fixing the initial jump, what is Teerayoot talking of unpacking then???????

JimmyBoy
yaa
07-31-2003, 11:43 AM
Hello Teerayoot,

what is the extention .locked that you talk about?

Regards,
yaa
Tacman
07-31-2003, 01:05 PM
He's talking about the Softwrap protection. The app exe that is protected has the extension .locked
Anonymous
07-31-2003, 07:06 PM
Hmmm, how can you do that???
When I try this proggie exit with code 0.
You can unpack but later this dump file is impossible to debug?
Anonymous
07-31-2003, 07:20 PM
did you fix pe header after dumping?
BruceLee
08-01-2003, 04:51 AM
Hmmm I don't... but hmmm, I'll check that!
Anonymous
08-03-2003, 05:59 PM
It's impossible. Mission Impossible :(
You may on this way only remove nag. Program is still protected by softwrap and
contains a lot of SMC!!! :(
Anonymous
08-03-2003, 09:56 PM
"It's impossible. Mission Impossible :("
a 30 sec max job with unpacking softwxxx with 'the other debugger', horses for courses.
Anonymous
08-07-2003, 02:07 AM
what is the executable?
Anonymous
08-07-2003, 02:27 AM
and where's the unpacked.exe?
TBD
08-07-2003, 03:48 AM
this is not an unpacked forum ... so please do not abuse it.


od under win98 question

RCE Messageboard's Regroupment > General > od under win98 question
lg888
08-05-2003, 07:09 AM
cannot set bp at kernel32.dll,but under win2k,it work. why?
oh me anon
08-05-2003, 02:52 PM
becuse win98 does not allow any break point in any system dlls
but win2k allows you to do it

but if you want you can use follow option and see what it does in those dlls
by perring at the place in dll but even single stepping inside dlls would not be possible in win98 while w2k will allow you to single step through


rtrace.exe -- does not crash as expected.

RCE Messageboard's Regroupment > General > rtrace.exe -- does not crash as expected.
Anonymous
08-06-2003, 07:58 PM
Downloaded version 1.09 and the rtrace tutorials. Ran rtrace.exe (2/2/2002) on a Windows 2k Pro, fully patched, SR4, and instead of the expected "This program has performed and illegal operation..." window with the [debug] button as in the tutorial, I get a "Progam Error... has generated error.. [close]" No debug option, no register dump, nothing.

Am I missing some option or registry key setting somewhere?

Thanks for your help!
mimas
08-06-2003, 08:25 PM
Just register ollydbg as the just-in-time debugger (options -> just-in-...)
Anonymous
08-06-2003, 09:31 PM
thanks!


Continue on Softwrap unpacking

RCE Messageboard's Regroupment > General > Continue on Softwrap unpacking
Teerayoot
08-07-2003, 06:03 AM
I think that scheem only work on VB prog(i do not found any prog written by other lang,if it written by other lang i think it must first dump and rebuild).because it do not want any dump or rebuild procedure.Just copy all and save to executable.

As i said before .After click Try(only work if prog never expired yet)now program totally unwrapped ,fire up ollydgb and attact to process ,select progname.locked then in cpu window,right click ->copy -> select all ,Right click again ,select copy to excecute...bla bla -> Save to file,this procedure copy all excecute code to file.

Enough for this unpacker.


hmemcpy

RCE Messageboard's Regroupment > Plugins > hmemcpy
Anonymous
08-08-2003, 03:55 PM
hmemcpy
Anonymous
08-08-2003, 06:05 PM
No, we can't tell you how to use hmemcpy in WindowsXP just because you read it in some cracking tutorial. This is not an cracking forum and hmemcpy doesn't exist under WinXP, so go away.
Anonymous
08-13-2003, 01:29 PM
Hehehe, what a reply ...

JimmyBoy
Anonymous
08-17-2003, 03:41 PM
And how to use hmemcpy in windows 98se???
Anonymous
08-17-2003, 04:15 PM
you can't its only for winnt
Anonymous
08-17-2003, 04:17 PM
and its not hmemcpy its point.h
Anonymous
08-17-2003, 08:42 PM
and hmemcpy is only used in debuggers for cracking, so no discussing it here. There are lots of tuts about hmemcpy if you can be bothered to search the net.
Ricardo Narvaja
08-17-2003, 09:13 PM
I like this anonimous put a real name or an alias how crackers do,I put my real name anonimous and I'm a cracker Ricardo Narvaja and I'm very proud of this, and a use of point H is for prcatice in crackmes, this is not illegal, is only a entertainment, not stupidizing how look TV, only for yor brain WORK a little .

Ricardo Narvaja
PD:I Wait for your NAME i'm tired of anonimous COWARDS
Anonymous
08-18-2003, 05:20 AM
No.
Anonymous
08-29-2003, 01:28 PM
Shut up Anonymous,cracking is a noble art.Why don't you like it?
Or are you too stupid for being a cracker.
Anonymous
08-30-2003, 07:08 AM
cracking is elligal
Ricrado Narvaja
08-30-2003, 08:45 AM
Is not illegal here if you don't sell o distibute cracks.
And is not illegal talk abaout protections, jeje.
Ricardo Narvaja
Anonymous
08-30-2003, 11:20 AM
in some parts of world yes it is illegal and some protections are patented, so illegal to talk about these
Ricrado Narvaja
08-30-2003, 01:47 PM
Talk is illegal ? In afghanistan maybe or in Stalin Rusia jeje i dont know any nation in illegal talk of any theme (relax a little and quit this stupids ideas of your mind)
Ricardo
Anonymous
08-30-2003, 03:11 PM
yes talk is ilegal this board is worldwide and in some parts of world this talk is illegal therefore not allowed to talk about it
Ricrado Narvaja
08-30-2003, 03:19 PM
yes some dictators maybe censored a talk, and in this board is a private rule, is not for illegality, if i make a board i put the rules i want, and this board has this rule but a rule is not a law, is only a ridiculous rule only for this board.
If you know one only case in ANY part of the world of anybody sentenced for this illegality tell me date and where was this juzgament jaja, what ridicouluos, i'm very afraid wow jeje.
I respect the rules of this board, (ONLY HERE) but noy the laws invented for you for afraid a children.

Ricardo
Anonymous
08-30-2003, 06:51 PM
i don't know sentenced but i dont want sentenced myself so i shutup here
Ricrado Narvaja
08-30-2003, 07:18 PM
juju you are very comic, great joke

Ricardo
methuselah
09-03-2003, 02:49 AM
Reverse engineering, cracking, call it what you will is NOT generally illegal. If you are worried about the "licensing" conditions on most software, either remove the conditions before you install (NOT illegal, as you haven't agreed to anything at that stage), or get your dog, wife/significant other, or somebody else to push the "Agreed" button on installation.

If you are stupid enough to believe that a court can prove that YOU agreed to NOT disassemble a program, don't reverse engineer it! RE is a hobby for me - I am old, don't need any more software, and have paid for what I consider of value.

No software is uncrackable. Even if it were, someone will post valid keygens or serials on the Web. I can't understand why software companies waste money (and increase the cost to me, the consumer), trying to protect the unprotectable.

Why do you think I play with Olly? I can find quickly on the Web registered/cracked copies of IDA Pro, WDASM, Softice, TRW2000 and so on. I like Olly - sometimes I use the others for the very small areas where Olly can't compete - but I would almost say that a good brain (not mine) and Olly can overcome almost any problems.

Ollydbg for ever!!!
TBD
09-03-2003, 03:45 AM
methuselah: i agree with you 1oo%
oh me anon
09-06-2003, 04:17 PM
good brain (not mine) and Olly can overcome almost any problems.

no need for a good brain too just the normal ordinary brain with olly can do wonders no need to use sice or any other thing for its class of operation


Sudden exit?

RCE Messageboard's Regroupment > General > Sudden exit?
Anonymous
08-10-2003, 10:37 AM
Hi all,

I'm trying to locate the reason for a kernel32 exception on win98 systems in a VB/PB program I wrote some time ago. The program works fine on all other platforms.

Using ollydbg to run the program on win98, it exits at the point where the two violations happen and returns exit code -1. the log data window shows two access violations in kernel32 which were ignored on request (not mine!), then only one DLL is unloaded (syntpfcs.dll) and then the exit codes are coming up (two threads and one process).

Where do I best start? I can't work it from VB because there is no low level support but from PB I can use inline ASM to INT 3 for instance.

thanks for any suggestions you may have.


visual basic debugging

RCE Messageboard's Regroupment > General > visual basic debugging
Anonymous
08-10-2003, 03:17 PM
i need to know what the function mean in vb 6 ?

CALL DWORD PTR DS:[<&MSVBVM60.__vbaFpI4>>; MSVBVM60.__vbaFpI4

thanks for help
Anonymous
08-10-2003, 08:34 PM
floating point to integer


Tutorial - How to find a hardcoded serial and patc

RCE Messageboard's Regroupment > General > Tutorial - How to find a hardcoded serial and patc
Nilrem2
08-12-2003, 09:49 AM
Hi all, thought I'd share a tutorial with you I wrote last night, it's aimed at beginners, it's a crackme program so don't worry, it's legit, I'm against cracking programs that require purchase (unless it's 100% for learning nothing else).
Anonymous
08-12-2003, 10:13 AM
Even though your tutorial is for a crackme type program, the general idea is to demonstrate to people how to find serials in commercial software, so could post is not really "legit" as you put it.
Anonymous
08-12-2003, 12:18 PM
Who cares? It's a friggin crackme!!
Nilrem2
08-12-2003, 12:58 PM
I've given you a gun, it's up to you what you aim it at.

I'm only trying to help people who are new to OllyDbg.
Anonymous
08-12-2003, 05:33 PM
Still however, this is not a cracking board, so posts such as this should not be posted to this board. Only material in the way of Non-cracking related Ollydbg posts should be put here. However, it seems that Ollydbg is only used for cracking programs, and never actually used for debugging your own programs.
jayte
08-12-2003, 07:48 PM
Not true, and it would be extremely unfortunate if that general perception were to propagate (that is: OllyDbg = Cr**kingTool, rather than OllyDbg = FirstClassUltraCapableDebuggerWrittenByAFirstClass Individual).

I have my own opinion(s) regarding software "protection"; generally, that it's a ridiculous waste of time, and programmers would do well to focus on writing better software, instead of better protection, but... that's beside the point. The point is, Oleh has--through the graces of his good nature--given us a tool which halps us to do just that: Write better software. Make his day brighter by letting him know that his efforts have helped you reach that end; not that you're using it to help you defeat someone else's hard work.

Maybe it's a matter of skillz and/or talent - it's a lot easier to break something, than it is to create something great. If that's what you're doing - breaking shit... how 'bout stfu about it, or will you not be fully satisfied 'till you ruin it for everybody...

(note: "you" = whoever the shoe fits)

Jeff
Anonymous
08-12-2003, 08:21 PM
I agree. I use Ollydbg for reverse engineering, and do RE for fun and learning, not for cracking. If I left every program I had cracked installed on my PC, I would need a PC case just for the harddisks! No, what I do is crack a program, find out how the protection works, and then delete it. After a while I write my own program and use the newly found knowledge in that program (but not necessary for protection purposes - sometimes just because I think it's a better/more efficient way of doing something).
Nilrem2
08-13-2003, 05:03 PM
Sorry for posting this here, this tutorial was not meant to help you crack programs you have to pay for, I have never cracked a program that needed purchase and used it, only cracked a program for knowledge, then reverted to the uncracked version (and that is the truth I'm a software developer myself) I was just looking for tutorials for OllyDbg and could only find a handful and thought I would try and help spread the word of OllyDbg and help new users to it. Plus it is telling you how to crack a crackme not a specific application/game/os (windows has a hardcoded serial), but I can see how it could be misused. Where do you think this tutorial would be most suited, is there a board or site somewhere, or even a forum, I would hate for the tutorial to be wasted.
Anonymous
08-13-2003, 07:32 PM
http://www.exetools.com/forum/

post it there, they thrive on stuff like your tut.
anonymous
08-14-2003, 07:13 AM
Long live Crack'n'roll
Nilrem2
08-14-2003, 08:54 AM
Many thanks.


Conditional breakpoints?

RCE Messageboard's Regroupment > General > Conditional breakpoints?
Anonymous
08-12-2003, 11:11 PM
Hi!

I tried to set a conditional breakpoint with condition
<pre>[ecx] == 0012ffe1</pre>
When i try to run this code the breakpoint fires even though
the value pointed to ecx is not 0x0012ffe1.. Why is that? Am I
missing something?

Thanks!
Darus
08-13-2003, 04:27 PM
ecx == 0012ffe1 ?
Anonymous
08-13-2003, 06:21 PM
well I don't use olly so not sure but [ecx]==0x0012ffe1 & ecx == address may work better, just a suggestion.


Run Trace: stangest behavior

RCE Messageboard's Regroupment > General > Run Trace: stangest behavior
Anonymous
08-13-2003, 01:09 PM
Hello,

I haven't used much Run Trace feature in Ollydbg and today playing around with it while trying to understand how it works I noticed that it has indeed the strangest of behaviors.
I noticed that:

1) statement addresses are not correct -> when I dump to file the run trace I see that each statement is "given" the address of the statement two rows before (also all addresses referenced in my executable are wrong when dumped to file for example in jumps)
2) statements dumped to file sometimes are even wrong (this happenes rarely):
- in run trace -> 0061F71F CALL DWORD PTR DS:[EC+705]
- when run trace dumped to file -> 0061F71F MOV ECX,DWORD PTR DS:[ESI]
3) apart these bugs (strange that no one noticed them before) I can't seem to understand what is happening in run trace .... I run it, and afterwards I go thru it step by step (I have even syncronized the CPU pane with the run trace listing to better understand what happens) and while sometimes it follows correctly the program execution other times it starts jumping around as if the application where a multithreaded application ... but this is not the case. Following the run trace listing it seems that while one procedure is executed completely and correctly, other procedures get executed only in the few lines. Also register values get are reported being updated by statements that don't touch them at all .......
Honestly I can't understand what Run Trace is sometimes doing.
Can anyone help me understand how to use it and how to interpret the listing it generates???

JimmyBoy
Anonymous
08-13-2003, 01:34 PM
.. other procedures get executed only in THEIR FIRST few lines ...

JimmyBoy


Some ollydbg tutorial ....

RCE Messageboard's Regroupment > General > Some ollydbg tutorial ....
Teerayoot
08-14-2003, 04:02 AM
It 's take 3 days for a web developing and written tutorial .Some thing may do not work correctly.But i think it will usefull to you.
Go on this link WWW.BUGSGROUP.COM (http://www.bugsgroup.com)
Anonymous
08-14-2003, 05:32 AM
doesn't work
yaa
08-14-2003, 05:40 AM
maybe if you cut and paste the address it MIGHT work .....

yaa
Teerayoot
08-14-2003, 06:08 AM
(Edited by: Teerayoot)
Just click it working now :)
netstavi
08-14-2003, 03:33 PM
Thank You Teerayoot, website very good
lg888
08-15-2003, 04:28 AM
it work now ,but still some problem. any way,very nice
Anonymous
08-15-2003, 05:24 AM
hi i dont understand one part of that string source index tutorial.

u said after the 3 breakpoints on the "mov" u restart.
then u said to first break on mov [byte ds:49EDE8], al and press F9
i dont know how to break on that adress and when i press F9, i didnt land on 00448ada.

plz can u be specific on how to that break on that
address "mov [byte ds:49EDE8], al"
pookypooka
08-16-2003, 03:29 AM
Still doesn't work isn't it?
Y can't you post the tutorial here in the forum or give the direct url where the tutorial file is located?
Teerayoot
08-18-2003, 02:16 AM
Anonymous
I think that tutorial it 's will totally explained ,not need explain any more.But anyway
if you want to know more post at my site ,becasue TBD has strictly
not allow post any cracking involed.
Teerayoot
08-18-2003, 04:06 AM
If www.bugsgroup.com (http://www.bugsgroup.com) is not working use this www.hacker2002.com (http://www.hacker2002.com) as a mirror.
Teerayoot
08-20-2003, 02:23 AM
New tutorial added today .
Teerayoot
08-22-2003, 02:39 AM
Another tutorial add(Serial Fishing)
This a direct link http://www.polarhome.com:793/~teerayoot/tutorial/tut5.php

For any comment feel free to post on my forum

http://www.polarhome.com:793/~teerayoot/eforum/index.php
Teerayoot
09-02-2003, 08:15 AM
The link had been changed,so that use www.bugsgroup.com (http://www.bugsgroup.com) or www.hacker2002.com
(http://www.hacker2002.com
)
www.hacker2k2.com (http://www.hacker2k2.com) INTEAD!


Rocognizing calls parameters?

RCE Messageboard's Regroupment > General > Rocognizing calls parameters?
Anonymous
08-14-2003, 09:44 AM
Hello,

Lets say we have the following code:
<pre>push 0FFFFFFE
call GetStdHandle</pre>
Olly now recognizes the pushed value as being
the nStdHandle parameter and labels it as such..

Now consider;
<pre>mov eax, 0FFFFFFE
mov esi, GetStdHandle
push eax
call esi</pre>
Now the push and the call aren't labeled as nStdHandle and GetStdHandle.

Is it possible to get olly to recognize such dynamic calls and label them appropriately?

Thx!
Teerayoot
08-27-2003, 05:57 AM
"Assume argument function ",on Right click menu .
I think this will work,not tried it yet.
Anonymous
08-27-2003, 03:33 PM
You rock! =)


hmemcpy

RCE Messageboard's Regroupment > General > hmemcpy
Anonymous
08-15-2003, 09:22 AM
hmemcpy
Anonymous
08-15-2003, 10:18 AM
!
Anonymous
08-22-2003, 06:20 PM
:O


NOTICE OF INFRINGING ACTIVITY

RCE Messageboard's Regroupment > General > NOTICE OF INFRINGING ACTIVITY
Anonymous
08-15-2003, 10:35 AM
To Whom It May Concern:

We have determined that this website is engaged in unauthorized activities,
relating to circumventing copyright protection of computer programs published by the
various companies.

We have a good faith belief that none of the activities listed above have been
authorized by the rightholders, their agents, or the law.

We expect that you will take expeditious action to remove this material and
and thereby prevent the illegal reproduction and distribution of pirated software

We appreciate your cooperation in this matter, and will be contacting you further
in the future if this matter is not resolved.
Anonymous
08-15-2003, 12:22 PM
Who are you? ... why not state it clearly?

jimmyboy
Anonymous
08-15-2003, 01:39 PM
They could be the FBI, the CIA, the ARMY or Fox Mulder!!!!! I think it FOX MULDER!!!

Open up your eyes, here there is no illegal reproduction or distribution of anything .. hang around here, you could even learn something.

fUZZYlOGIC
1bitshort
08-15-2003, 02:13 PM
*sniff, sniff*
Can anyone smell a troll, or have I just forgotten to empty the bin again?

If this joker was serious about his childish legal threats he wouldnt be hiding behind the Anonymous alias. There is nothing on this website that goes against any laws - heck, its just a discussion forum (so much for freedom of speech?), and it's also very evident that the admins here make it quite clear that cracking-related posts aren't acceptable. Debugging and reverse engineering is a serious business, and a legal one at that (how can viruses be analysed otherwise?), so our anonymous friend here not only has no clue what he is alleging, but is probably just some random shareware developer who's annoyed that somebody made public how weak their shareware protection scheme is. He'll never take anyone to court because he knows he'll be laughed at and the case thrown out.

Thankyou for visiting us "Anonymous", but can you kindly grow up and find something constructive to do so as to leave us to our work.
Thankyou.
Anonymous
08-15-2003, 04:29 PM
Someone's just screwing around, that's why its' anonymous....


Dll Main

RCE Messageboard's Regroupment > General > Dll Main
Anonymous
08-15-2003, 05:13 PM
Hi - I'm trying learn how use olly but in particular to debug a dll that is doing something in its "dllmain". As a simplified test case I have created a dll the prints a message to stdout in its dllmain and also exports some stupid function. Additionally I have created a simple win32 console app that calls the exported function and quits (the console app links directly to the dll's implib) ok...
so when I start up the console.exe in olly, the debugger stops at jmp _crtMain (or something like this....) and I can see from the log that my dll has been loaded and I can see the dllmain message had been printed to the console. The question is how do I set a break point inside the dllmain (assume I don't have the source, implib, etc.)

thanks
yaa
08-15-2003, 06:42 PM
Request OllyDbg to break on DLL loading:
options -> debugging options -> events -> break on a new module (DLL)

yaa
Anonymous
08-15-2003, 06:47 PM
This is what i tried, but for some reason it doesn't work... hmm i'm using 1.09b maybe this is bug that has been fixed.
Anonymous
08-15-2003, 06:51 PM
same thing in 1.09d -- oh well. could it be because i statically link to the implib?... also, i'm using msvc7
yaa
08-16-2003, 06:37 AM
Strange, it always breaks for me ...
How about this other idea ... the dll should have a module entry point exported ... put a breakpoint on it, it should break on startup ... please let us know ..

yaa
Bisanabi
08-18-2003, 05:55 PM
>could it be because i statically link to the implib?...

Yes.

The corresponding dynamic link library (dll) will never be loaded, because you have compiled (a copy of) the code into the executable itself...
yaa
08-19-2003, 10:34 AM
What does statically linking to the import library mean????
To call a DLL you HAVE to link its import libary otherwise how would you be able to call its exported functions? How can you "dinamically" link an import library???? This is nonsense.

yaa
Anonymous
08-19-2003, 04:06 PM
No, no, no.

You can bundle the DLL into your executable itself. Yes, this increases the size of your executable, but it means you don't have to rely on a (potentially) out-of-date dll, as all the functions have been bound to your exe at compile time.
yaa
08-19-2003, 05:40 PM
I know that you can take in the needed functions ... but this IS NOT statically linking the import library. The import library IS ALWAYS STATICALLY LINKED.

yaa
Bisanabi
08-20-2003, 06:54 PM
You are correct, yaa, as are Anonymous2 and I...

With little information provided and no source, we can only make guesses as to what the problem is. Since OllyDbg does work for us, it SHOULD be working for the requestor as well. Obviously, there is an assumption being made that is incorrect. From previous experience, I have seen people look at a directory listing and see some old .dll file, but have compiled the actual function code into the executable. Since the problem hasn't been resolved, I threw this out as a possibility to look into. Perhaps the original user is not using the terminology correctly...


Help!

RCE Messageboard's Regroupment > General > Help!
pookypooka
08-16-2003, 03:24 AM
I've just started to learn how to crack. All i can do is patching.
I read a tutorial about how to find hardcoded serial by Merlin.
When i run the program (F9)without setting any breakpoint, why the program run for a while then pause? I hope there'll be anybody could help me out here.
I'm just a kid.
yaa
08-16-2003, 06:43 AM
Dear pookypooka,

this isn't a cracking forum, here you may learn how to best utilize this great debbuger that is ollydbg ... the reason why you app stops could be an exception ...

yaa
Anonymous
08-18-2003, 07:09 AM
Okay if this board isn't a cracking forum, i wont talk anything more about cracking, but why my program just pause? I really dont understand
yaa
08-18-2003, 07:48 AM
Can't you read what I posted?
IS THERE AN EXCEPTION SIGNALED?????

yaa
Anonymous
08-18-2003, 07:54 AM
I've read what you posted.
And there's no exception signaled.

So...what do you use OllyDbg for????? For educational purpose? Ohh man, i dont think so.
Anonymous
08-18-2003, 10:23 AM
We use OllyDbg to debug our own programs and to reverse engineer other programs for inter-operability reasons. It is not used for cracking.
yaa
08-18-2003, 10:28 AM
May then be the application awaiting some use input? What is this application that you are debugging? Helping you out trying to guess the possible cause, isn't too easy, you know ..

yaa


Process stays on top of Olly

RCE Messageboard's Regroupment > General > Process stays on top of Olly
Anonymous
08-16-2003, 08:02 AM
Ran into this problem on more than several occassions. When I'm debugging something and lets say I use my point.h or even a bpx on getdlgitemtexta, when the program breaks it stays on top of Olly. Then when I start stepping through, it still stays on top, making it a real bitch to see most of the code depending on the size of the window that is on top.

Did I miss a setting somewhere or has this happened to anyone else? Been bugging me for quiet some time now.
yaa
08-16-2003, 09:05 AM
It can be done easily, it's simply a topmost window/dialog ... look for a call to SetWindowPos for the involved window and change the second parameter passed to the API to 0 ...

yaa
Anonymous
08-16-2003, 10:24 AM
or just run WinSpy and tell it to remove the topmost flag
Ricardo Narvaja
08-16-2003, 02:00 PM
press ALT +f5 and OLLY will be on TOP, before RESTART OLLY press ALT mas F5 again to return to normal.

Ricardo
Ricardo Narvaja
08-16-2003, 02:17 PM
You press ALT +F5 and you look the word TOP in OLLY and when press again this word TOP dissapear.

Ricardo
Anonymous
08-16-2003, 04:23 PM
Thanks Ricardo, thats exactly what I was looking for and it worked perfect...:)


Armadillo 1.80

RCE Messageboard's Regroupment > The Heap > Armadillo 1.80
Anonymous
08-20-2003, 10:02 AM
Can anyone tell me if olly debug could be helpful in treating that pest which is known as Armadillo 1.80?Thanks!
Anonymous
08-20-2003, 05:52 PM
Yes, read Ricardo's posts. He describes several tuts about Arma.
Ricard
08-20-2003, 06:53 PM
But no so old jeje, 2.65 to 3.10 jeje
In this old armas, th program make a TEMP file copy this file to other location rename to exe, and is ready jeje.
Ricardo
RicardoNarvaja
08-20-2003, 06:57 PM
But no so old jeje, 2.65 to 3.10 jeje
In this old armas, th program make a TEMP file copy this file to other location rename to exe, and is ready jeje.
Ricardo
Anonymous
08-21-2003, 08:32 AM
I knew that.I searched for that TEMP file but I couldn't find it.
When the program is running, the TEMP (I heard it must look something
like programname.tmp0) doesn't appear in the process list either. Yet all
good get file type progs that I used say that the file is crypted with
Armadillo 1.80. Anyway, where can I find those Armadillo tutorials?
Thank you for replay!
Anonymous
08-21-2003, 08:45 AM
Look in your Local Settings\Temp folder or use FileMon to find it =)
TBD
08-21-2003, 10:18 AM
ahm, where is the OD involved here ? :) and this posts are more cracking related.

sorry but i must lock the thread.


[plugin] WindowJuggler 0.01 BETA by EsseEmme

RCE Messageboard's Regroupment > Plugins > [plugin] WindowJuggler 0.01 BETA by EsseEmme
EsseEmme
08-20-2003, 09:46 PM
A new plugin coded really fast and probably full of bugs ... if useful further development may follow ...

http://host.deluxnetwork.com/~esseemme/windowjuggler.zip

Tested only on W2K ... please W95/W98/ME users let me know if it works fine ...

Cya,
EsseEmme
TBD
08-21-2003, 10:17 AM
EsseEmme: very nice and usefull. do you plan to release the source ?
i want to add it to OllyDbg Stuph page and it would be nice to have the source also :)
EsseEmme
08-21-2003, 12:20 PM
Hello TDB, haven't seen you around for sometime. No problem for adding the plugin to the OllyDbg Stuph webpage. As for the source code I will probably release it myself in the future ... at the moment I'm planning to work a lot on it, there are other interesting things that could be added: I'll let you know when I'm ready to release the source.

BTW, a technical question: I have seen that the Registerpluginclass API accepts only a window procedure as the 4th parameter .... having a dialog box (and dialog box procedures have a different interface) how can you still register with OllyDbg so to receive the appropriate window/ollydbg messages? In version v0.01 I did not call Registerpluginclass and in fact my dialog received no messages apart the WM_DESTROY when OllyDbg was closing and somehow my plugin was able to block the process termination (I had to call a ProcessTerminate in the end to let OllyDbg finaly close).

In version v0.02 I have created a hidden window, registered it with OllyDbg and then created the dialog setting the window as its parent ... this way when the parent window terminates also the child is terminated ... and since the parent receives all messages, when required it can forward messages to the child ...

Still I'm wondering if there is a better solution ...

Cya,
EsseEmee
TBD
08-22-2003, 04:12 AM
EsseEmme: was on vacation :)

have you tried passing to Registerpluginclass your dialog procedure ?
... i didnt tried myself, yet.


[plugin] WindowJuggler 0.02 BETA by EsseEmme avail

RCE Messageboard's Regroupment > Plugins > [plugin] WindowJuggler 0.02 BETA by EsseEmme avail
EsseEmme
08-21-2003, 12:02 PM
Hello,

a quick update to the plugin ... v0.02 BETA is out and can be download at http://host.deluxnetwork.com/~esseemme/WindowJuggler_v0.02.zip.

As before, the plugin has been compiled on a W2K machine ... 95/98/ME users let me know if it gives problems ..

Cya,
EsseEmme
EsseEmme
08-21-2003, 12:53 PM
Sorry, the link in the previous post wrongly took in the final dot .. this is the working link http://host.deluxnetwork.com/~esseemme/WindowJuggler_v0.02.zip

Cya,
EsseEmme
EsseEmme
08-21-2003, 02:08 PM
Sorry guys, had to move the plugin over to this other location ... http://www.ournet.md/~esseemme/WindowJuggler_v0.02.zip

Cya,
EsseEmme
Tacman
08-21-2003, 04:05 PM
Works great for me on WinXP Pro SP1. Thanks
EsseEmme
08-22-2003, 11:08 AM
THX Tacman for your feedback, nice to hear it works ok ... I'd like to hear from someone using 95/98/ME if the plugin runs fine even on these machines ...

Cya,
EsseEmme
BasengBae
09-17-2003, 01:54 AM
for windows 98 not working very well, but for XP it's very nice, thank's
EsseEmme
10-07-2003, 08:01 AM
BasengBae would please explain further what you mean by "not working well". Have you verified that the last version of the plugin still presents the problems you noticed on Windows98?

The last versions of the plugin is available at http://www.ournet.md/~esseemme/WindowJuggler_v0.04.zip.

Anyhow, I will be releasing version 0.05 of the plugin very soon.

Cya,
EsseEmme
BasengBae
10-09-2003, 02:31 AM
Sorry EsseEmme, not for Beta V 0.02 but Beta V 0.04 :)

My computer is dualbooting (win98 & WinXP) on the WinXP Beta V 0.04 working verry well (name of Caption appear in textbox ) but on the win98 not appear anything in the textbox.

for Beta V 0.05 not working on my Win98
*) I was replace my windowjuggler Beta V 0.04 file with Beta V 0.05
and I want to download Beta V 0.04 again (sorry I have not backup) but
Link forbiden could you open your link for V 0.04, thank you
EsseEmme
10-09-2003, 06:28 AM
BasengBae thank you very much for your feedback. I'm lacking any useful feedback and yours is thus most welcome.

I'm sorry to hear that the plugin is not working under w98 boxes.
I'll be honest, I also have kept no copy of v0.04 and this simply because having received no report about it not working I was confident it was indeed behaving fine under all operating systems!
But this is not a problem. I've put up a w98 virtual machine and tomorrow night (tonight I'm out) I'll test the plugin on w98 and solve this issue. Be patient for only 2 days more.

Please also, since I now posted 2 versions of the plugin (one with and the other without the C runtime) it would help me to know exactly WHAT is NOT working of each version on your w98 machine.

Cya,
EsseEmme


[plugin] WindowJuggler 0.03 BETA by EsseEmme out

RCE Messageboard's Regroupment > Plugins > [plugin] WindowJuggler 0.03 BETA by EsseEmme out
EsseEmme
08-22-2003, 08:20 PM
Version 0.03 BETA of WindowJuggler is out .... cleaned up a bit more the code, added support for unicode window classes and captions and added the possibility of changing the selected window's caption from plugin user interface ...

http://www.ournet.md/~esseemme/WindowJuggler_v0.03.zip

Cya,
EsseEmme


Unpacking telock?

RCE Messageboard's Regroupment > General > Unpacking telock?
Anonymous
08-23-2003, 09:55 AM
Hey ppl.

Im trying to unpack telock 0.98 with olly... I find the oep and dump there using
ollydump with "fix imports" checked but the dumped exe still crashes... any ideas?
Tacman
08-23-2003, 01:26 PM
I doubt anyone will give you an answer here. Try this place ;

woodmann.cjb.net
Anonymous
08-23-2003, 02:09 PM
try posting the question on bugsgroup.com where things are a bit more relaxed than at woodman board.
Anonymous
08-23-2003, 03:47 PM
www.google.com (http://www.google.com)
Ricrado Narvaja
08-23-2003, 08:02 PM
I have a telock tut is in spanish if you want mail me ricnar22@millic.com.ar

Ricardo
Anonymous
08-23-2003, 08:51 PM
When trying to visit "bugsgroup.com" I just get the following:

"The page you are looking has either been removed or is temporarily unavailable."
Anonymous
08-23-2003, 09:51 PM
don't know what the problem is, works fine for me. try the alternative url hacker2002.com
Teerayoot
08-25-2003, 04:00 AM
bugsgroup.com do not work because i do not implement subdomain record.so that
use www.bugsgroup.com (http://www.bugsgroup.com) intead.

FOr a telock unpacking ,i will plublic my tutorial soon.
Anonymous
08-25-2003, 09:36 AM
i've made a tut on tElock with olly >> http://tone007.cjb.net/
i use olly, lordpe and imprec
Anonymous
08-25-2003, 02:48 PM
Anonymous, that looks like a nice tute, but is there an English version? :D
Anonymous
08-28-2003, 06:41 PM
Yeah, would someone please transale key parts to english?
Anonymous
08-28-2003, 08:15 PM
av.com is your friend. It'll translate for you.


Jump to <&MSVBVM60.#100> ??

RCE Messageboard's Regroupment > General > Jump to <&MSVBVM60.#100> ??
99bobster99
08-25-2003, 01:31 PM
Hello,

I'm trying to debug a program, but I've run into an instruction which causes Ollydbg to stop debugging ??

Ollydbg loads the program fine, I press F9 to start the debug. All is fine, the program begins and pops up a registration message box. Ollydbg CPU monitor window is on the following instruction;

CALL <JMP.&MSVBVM60.#100>

I then enter a username and serial number in the application program, before pressing "Ok" I setup a point.h breakpoint. The program then tells me the registration is not correct, but Ollydbg never debugged anything in between selecting "Ok" and seeing the incorrect reg message.

Does anyone have any suggestions ?? I've read a lot of tutorials on this but nothing has worked ??
Anonymous
08-25-2003, 03:53 PM
Your debugging a visual basic program, and so Ollydbg isn't the right tool for the job. What you want is something like BoundsChecker and the like. VB apps can not really be disassembled to anything meaningful, unlike a C, C++ or Delphi application.
Tacman
08-25-2003, 06:03 PM
Smartcheck is the favorite choice for vb apps
Anonymous
08-25-2003, 06:47 PM
you must break on vb api like vbastrcmp etc
Teerayoot
08-26-2003, 05:55 AM
www.bugsgroup.com (http://www.bugsgroup.com) it's have a tutorial that point on this ploblem.:)
Anonymous
08-26-2003, 10:08 AM
mmmhhh, more than debugging this app you are probably just trying to crack it, I'd say ....

jimmyboy
Anonymous
08-26-2003, 10:30 AM
Nahhh, he wrote the app himself, why would he want to crack his own app?
Anonymous
08-26-2003, 07:13 PM
well my friend, the guy is saying he fails registering the application ....
you mean that he is so dumb that he can't register his own application????
Gee, I didn't consider that ...

jimmyboy
Anonymous
08-26-2003, 07:44 PM
Yup, that's right. Due to a bug in his registration routines, he can't get the application registered, so needs to debug it to find out why the application is rejecting his (perfectly valid) registration code.
Anonymous
08-26-2003, 10:30 PM
mmmhhh, the guy must be a whiz

jimmyboy
Anonymous
08-27-2003, 08:23 AM
Hi guys,

You guys are absolutely correct. I'm trying to protect my own hard work and am trying to make it my shareware program 100% uncrackable. I'm trying to mask the way that crackers can easily find the reg code. Thanks for all your help, I've just rendered Smartcheck useless !! Hee Hee. I will be posting my routine on a popular programmers forum for all to use as well. Thanks again.

Regards, the whiz.
Anonymous
08-27-2003, 10:03 AM
My friend we did not mean to offend you ... it's just that I personally like things to be called with their name .... not debugging, cracking .... it's as simple as that ..

jimmyboy
Teerayoot
08-28-2003, 02:29 AM
All program are crackable.Do not waste your time to protect it.
Just release as a freeware if you want it to be non crackable ;)
Anonymous
08-28-2003, 07:54 AM
the whiz,
come on over to bugsgroup and post the name of the app, maybe we can help each other, reversers are not the enemy, most of us on it for challenge not to release cracks.
99bobster99
09-03-2003, 02:29 PM
Hi guys,

Here is the files location. Let me know how you can crack it.

http://www.iclub.com/registration.asp?download=ClassicSetup.exe

You will need to register an email address, then it will allow you to download the proggie.

I love the challenge as well.
Anonymous
09-04-2003, 02:27 AM
can not download,can i download on simtel.com or download.com

?

tbd members.
Anonymous
09-04-2003, 08:37 AM
I got it downloaded, just enter a fake name, address and the other info. Once entered it will automatically start the download. Interesting challenge !!

simon
99bobster99
09-06-2003, 04:09 AM
I didn't think you guys would have any luck cracking my program with Ollydbg !! Hee Hee ... pretty nice routine isn't it !!
Anonymous
09-06-2003, 06:41 AM
already cracked, thanks to ollydbg.
Anonymous
09-06-2003, 11:58 AM
I've been playing with this proggie for a few days now, can't figure it out ?? Anyone have a tut ?

simon


Fullscreen

RCE Messageboard's Regroupment > General > Fullscreen
Lude78
08-26-2003, 06:11 PM
Hi,
how to debug application that runs in fullscreen (like games) ?
Sometimes bps are in this video mode but I can't see anything...
Can you help me?
Thanks.
Anonymous
08-26-2003, 07:37 PM
Yes, you need a debugger such as SoftICE, and/or debug remotely (via serial port or ethernet to another PC)
Teerayoot
08-27-2003, 02:49 AM
Hey,This ploblem solved in Ollydbg 1.09d(in previous i have same ploblem as you).
You must set Alway on top,if that game use alway on top future.

I have debug alot of game(full screen) use Ollydbg ,for information contact me..
Anonymous
08-31-2003, 01:18 PM
Hey Teerayoot, can you share your info? I set "Always on top" in olly but sometimes it doesnt pop up even though a breakpoint fires, which leaves me with no other options then restarting my computer because I cant see any other windows (not even task manager). =(
Anonymous
08-31-2003, 06:27 PM
As already said, use SoftICE as it's designed for this kind of debugging.
Anonymous
08-31-2003, 06:28 PM
BTW, Latest version of SoftICE can be downloaded from www.exetools.com (http://www.exetools.com)
Teerayoot
09-01-2003, 05:45 AM
Hey, ;) DO you want to see a screenshot of my debugged game :)

even ,Directx game ,Opengl game.
i will paste link to screenshot soon.
Ascar
09-01-2003, 06:01 PM
proove it
Teerayoot
09-05-2003, 07:29 AM
I figure it out what the ploblem . It's because a vga card driver. When i using driver from nvidia ,i can not debugging in fullscreen mode. but when chage driver to microsoft driver ,it work fine .

Notice : i use Geforce2 mx 400;
Sorry i do not have screen shot at this time .
But screenshot will come with next my fullscreen tutorial.


WindowJuggler 0.04 BETA available

RCE Messageboard's Regroupment > Plugins > WindowJuggler 0.04 BETA available
EsseEmme
08-26-2003, 10:16 PM
Version 0.04 BETA is available at http://www.ournet.md/~esseemme/WindowJuggler_v0.04.zip

The plugin can now select disabled windows ....

Cya,
EsseEmme
Teerayoot
08-27-2003, 02:57 AM
Please plublic plugin source code too,It's will usefull to another programmer.

Or make it as GPL ,it will grow very qucklly.
Tacman
08-27-2003, 04:07 AM
thanks
EsseEmme
08-27-2003, 09:56 AM
Thank you guys, I was starting to think that no one was even trying out the plugin.

Teerayoot I will release the code, but for the present I will go on further developing it myself .... I have got various ideas already like visually showing the windows boundaries as you go around "selecting" them, giving the possibility of first saving a set of window handles from a given application and then from the plugin interface "command" them without having to get back to the application user interface, capturing an application's menu hierarchy and being able to "control" it from the plugin UI, etc.

I still dunno if anyone has tried the plugin on a 95/98/ME machine and if it works.

Guys but I must say that I see little development going on around this great debugger. Too little in fact. If it weren't for Gigapede who made half of the available plugins ....
And Teerayoot releasing the source code does not ensure anything ... there is the source code for all available plugin and STILL no one is developing anything or further improving the existing ....

Cya,
EsseEmme
Anonymous
08-27-2003, 06:40 PM
EsseEmme: Nice plugin! I like it. Will wait patiently for next version.
EsseEmme
08-27-2003, 08:43 PM
Thank Anonymous, nice to hear that you liked it ...
I'll have to release a new version soon because I see that certain applications are stubborn in accepting to be "controlled" ... I'm changing the code to make it more "convincing" .. :-)

Cya,
EsseEmme


DLL break on load

RCE Messageboard's Regroupment > General > DLL break on load
pistol pete
08-27-2003, 02:01 AM
I'm having trouble having ollydbg break on dll load. I'm debugging an app that uses loadlibrary to dynamically load a dll. When I set the option in ollydbg to break on a dll load it does so, however, when I then proceed to set a breakpoint on a function inside the dll the function isn't executed upon resuming the program running, it appears it has already been executed because the app functions as normal (yes, I'm positive the function I'm setting a breakpoint on is called normally). Any ideas?

I'm testing on Win XP Pro + SP1, P4 2.8GHZ
Teerayoot
08-27-2003, 02:42 AM
Press F2 then Press F9 ,It's work well for me.I guest this is another Ollydbg buggys.
Teerayoot
09-11-2003, 03:31 AM
SOryy F12 not F2 .
Anonymous
09-11-2003, 04:34 AM
I use this approach to set bp in DLL EP. This is very useful if DLL is packed.
I have to say that this is short explanation with regard to my PC environment (XP SP1) and Olly.
Before you have to find EP of DLL (peid,lordpe,...)
After set BP in module ntdll offset 925d
My PC:
77f59e5d 33c0 XOR EAX,EAX --offset 925d
77f59e5f 81ff03000040 CMP EDI,40000003
........
If you land here press ALT-E and check if your dll is in LIST. In this point
Dll is in memory without jumping to EP.
If yes go to the EP and put BP there and remove BP in ntdll (your will)
Remember your address of ntdll offset (note down to sticky) and next you can
put BP on other cases

Bye


can i change EIP when debug?

RCE Messageboard's Regroupment > General > can i change EIP when debug?
lg888
08-27-2003, 05:00 AM
can i change EIP when debug?
Teerayoot
08-27-2003, 05:52 AM
Yes,you can ,just right click on target line then select New origin here !


plugin feature and winxp

RCE Messageboard's Regroupment > General > plugin feature and winxp
mathilda
08-30-2003, 07:57 PM
hi, need some help;
copied the complete ollydbg folder from win98 to winxp.
under win98 the plugin button is visible but not under
winxp. what do i miss?
mathilda
Anonymous
08-30-2003, 08:41 PM
reinstall ollydbg
Ricrado Narvaja
08-31-2003, 06:48 AM
In apearence-directories change the path (plugin path) to the new path of the dll in XP and work.

Ricardo
mathilda
08-31-2003, 09:17 AM
ricardo,
thanks for the hint. another question: i would like to
have the ini-file not on the xp desktop. by now i didn't
found any way to manage this.
mathilda
Anonymous
08-31-2003, 09:32 AM
put ollydbg in dir on hd along with ini file
create shortcut on desktop to point to ollydbg


Pausing run trace if buffer full?

RCE Messageboard's Regroupment > General > Pausing run trace if buffer full?
Anonymous
09-01-2003, 06:42 PM
Hi,

I just wonder if it is possible to set a condition such, that run trace pauses if the run trace buffer is full?
I now that it is a cyclic buffer, but assume that I just want to stop after a certain number of steps.

Thanx,

MrSmith
oh me anon
09-06-2003, 04:22 PM
i think you can increase the size of buffer in debugging options

your computer may complain no virtual blah blah memory sometimes if you increase the buffer size


Question to: "trace over system dll"

RCE Messageboard's Regroupment > General > Question to: "trace over system dll"
Anonymous
09-02-2003, 06:34 AM
Hi everybody,

I'm just experimenting with the Run Trace feature and I saw in the debugging options that it is possible to "trace over system dlls" and it seems that Ollydbg regards all dlls that are in system32 as "system dlls".
My question is what can I do if I want to trace MFC42.dll, which also lives in system32, but don't want to trace the other system dlls like user32 ? Is there a way to tell Ollydbg that some dlls should be traced although the are in system32?

Many thanks,

MrSmith
Anonymous
09-02-2003, 06:47 AM
Yes, delete it from system32 and put in your program directory, but be careful if this dll need some other application.
yaa
09-02-2003, 07:55 AM
It is not necessary to delete it from system32 .... it's enough to make a local copy of it in the folder of your app. The application should start using the local one automatically.

yaa
yeryry
02-13-2005, 08:17 AM
Can be done without moving files etc..
Alt-E
Right-click on mfc42.dll in list..
"Mark as non-system DLL"
^^


How to write the common.arg

RCE Messageboard's Regroupment > General > How to write the common.arg
helloword
09-02-2003, 04:07 PM
In VB 6 the function vbaVarCmpEq compare two variables and the code source should be

Dim Var1 as String
Dim Var2 as String

Var1 = 10
Var2 = 20

If Var1 = Var2 then
Do something
End if

This is a possible example assembler code

lea ecx, dword ptr ss:[ebp-100]
push ecx ; (Var1 = 10)
lea edx, dword ptr ss:[ebp-90]
push edx ; (Var2 = 20)
call near dword ptr ds:[<&MSVBVM60.__vbaVarCmpEq>] ; (If Var1 = Var2 then)

OK I have a simple question.
Can someone write the common.arg file for me to better understand how does it work.
Thank you in advance
Anonymous
09-02-2003, 08:03 PM
No
Anonymous
09-03-2003, 02:43 AM
Tutorial on www.bugsroup.com (http://www.bugsroup.com) is go on this point.
Teerayoot
09-03-2003, 02:50 AM
Yes,just make a little modification it can fit that function.
Teerayoot
09-03-2003, 02:52 AM
All function can make a custom function even parameter as a pointer.

Read Ollydbg help file ,Oleay explain so well an easy to understand.
Ricrado Narvaja
09-03-2003, 06:53 AM
Well i try with this function and read the great Terrayoot tut, but this function __vbaVarCmpEq is very different to the __vbaStrCmp of the tut, i read too ollydbg help and with this type of function (with parameters in locations far in the stack, not in the common position in the top of the stack), i think not is possible make a custom description with the posiibilities descripted in the help of ollydbg, maybe any possibility was not mentioned. I don't know if any can make a custom description for this type of functions plis copy here i try and i can't make nothing.
Thanks
Ricardo


2.0

RCE Messageboard's Regroupment > Announcements > 2.0
Anonymous
09-03-2003, 09:32 AM
2.0
Teerayoot
09-04-2003, 04:44 AM
yes,i will avaiable soon ;)

1.09d -> 2.0 ,it a huge jump.
Anonymous
09-04-2003, 02:02 PM
comming soon until It's released. :))
Anonymous
09-04-2003, 02:22 PM
lol
Anonymous
09-11-2003, 08:40 PM
Will it run under windows 98 too?????
or I have to upgrade my pc.
Anonymous
09-12-2003, 05:32 AM
it xp ONLY
TBD
09-12-2003, 07:36 AM
please stop talking nonsense.

OD 2.0 will be released when Olly finishes it. and it will run on Win98. duh!


Nag in vb???

RCE Messageboard's Regroupment > General > Nag in vb???
BruceLee
09-04-2003, 10:59 AM
What is the fastest way to find out where proggie written in vb calling dialog?
How to enable button on dialog? Any suggest for breakpoint?
Mr.P
09-04-2003, 03:17 PM
smartcheck
BruceLee
09-04-2003, 06:05 PM
I use smartcheck but Smartcheck give me strange address...
I found in SmartCheck btnTry.Enable (FALSE) ???
How can I break on try button enable?
Which breakpoint?
Mr.P
09-04-2003, 07:26 PM
Have you cracked a VB program before? Note that they are completely different to "normal" Windows apps, so you might want to read up on Visual Basic cracking before approaching your target.
Teerayoot
09-05-2003, 02:39 AM
set bp on showwindow ,it work fine.
sometime showwindow not work ,use createwindowa it use every program even delphi but it 's difference to showwindow ,showwindow is easier to play with.
or else set condition log on enable window and see where are caller .

Not hard ,not hard ;)
Teerayoot
09-05-2003, 02:41 AM
smartcheck not working if the program not compile with native-code or p-code i not sure ,but it's not work.
Anonymous
09-11-2003, 05:35 AM
You find a lot of nag in VB progie in this code sequences
Magic Word
+000002B0

e.g.
call dword ptr ds:[edi+000002B0]
or
call dword ptr ds:[eax+000002B0]

If problem to find or there is a lot of magic word set BP on ShowWindow and if it is for your nag trace until return to code in your progie and look a bit upper and nope this line or find JUMP above.


Software detecting Olly Now

RCE Messageboard's Regroupment > General > Software detecting Olly Now
Anonymous
09-06-2003, 02:58 AM
Someone asked to look at the CodeCoffer packer software to
see how good the protection is on apps. This is the first
protector I have come across that actually detects Olly and
kills its process. Check for Olly is 55C24E it checks more
than Olly but back to the question hiding Olly now any one
come accross this yet.
Anonymous
09-06-2003, 06:42 AM
just change the window title/class.
Anonymous
09-06-2003, 01:32 PM
No Olly needs OLLYDBG to run correctly .. thats how its finding
it Ive changed the every reference to OllyDbg and the name itself
but Olly changes it back
Anonymous
09-06-2003, 03:03 PM
It's a 5 minute job to change it, so your obviously not changing every occurance - are you changing both the ascii and unicode versions of the name?
Anonymous
09-06-2003, 07:44 PM
Yeah I know wide and ansi formats 41 ansi and 8 unicode changed
still is able to detect it and no its not the IsDebuggerPresent
Anonymous
09-06-2003, 08:37 PM
Have you also cleared the debug flag in the process environment/information block? New protectors prefer this to IsDebuggerPresent as it means there's no API call to break on.

If you don't know what I'm talking about, then just single step through some code which DOES call IsDebuggerPresent and single step through that API code and see what it does :)
Ricardo Narvaja
09-06-2003, 09:56 PM
well the IsDebuggerPresent plugin put 7ffdf002 in 0 this is the flag read for the api,a nd for rhe programs too, and with the title of the window try the program windowhacker with this interchange the handle with this program and the title of ollydbg (filemon, regmon or the program you want) will be windowhacker.

Ricardo
Anonymous
09-06-2003, 10:08 PM
Ricardo dl this protect and you will see .. I wrote a plugin for
Imprec to get the imports back since they are all immulated ..
just stumps me to it finding Olly after changing every possible
way to detect it .. quick note on it 10003d77 is the oep for
the perplex.dll it decrypts when started to decrypt the rest of
the program program OEP on this machine (w2k) is 4A8BA4 for the
latest download
Anonymous
09-06-2003, 10:13 PM
btw it does a process walk when it looks for
TRW200, Olly, softice, procdump32, etc
Anonymous
09-07-2003, 06:09 AM
> No Olly needs OLLYDBG to run correctly
Not if you patch Olly itself, just change the 0 to a zero or something ... ;)
Anonymous
09-10-2003, 02:58 AM
tElock detects olly too now, with a enumwindows
Anonymous
09-10-2003, 07:32 PM
what does IsDebuggerPresent do? How does it detect the presence of a debugger?

JB
Anonymous
09-11-2003, 03:22 AM
Its an API call, see MSDN
Anonymous
09-11-2003, 04:32 PM
kernel32.dll:IsDebuggerPresent
77E7191E >/$ 64:A1 18000000 mov eax,dword ptr fs:[18] ; IsDebuggerPresent
77E71924 |. 8B40 30 mov eax,dword ptr ds:[eax+30]
77E71927 |. 0FB640 02 movzx eax,byte ptr ds:[eax+2]
77E7192B \. C3 retn
Anonymous
09-13-2003, 08:24 AM
Guys I know what IsDebuggerPresent.
What I was asking is what the code of IsDebuggerPresent does to detect a debugger (does it set the debug flag in the process environment/information block or something else) ..

JB
Anonymous
09-13-2003, 10:04 AM
IsDebuggerPresent (from Win2K kernel32.dll):
<pre>77E8171D >/$ 64:A1 18000000 MOV EAX, DWORD PTR FS:[18]
77E81723 |. 8B40 30 MOV EAX, DWORD PTR [EAX+30]
77E81726 |. 0FB640 02 MOVZX EAX, BYTE PTR [EAX+2]
77E8172A \. C3 RETN</pre>
Anonymous
09-13-2003, 11:01 AM
ehehe, I did not understant that was the answer. Thank you.
BTW what is FS:[18]?

JB
Anonymous
09-13-2003, 03:10 PM
The PIB (Process Information Block), and yes, it can be changed so that IsDebuggerPresent always returns false regardless
Anonymous
10-06-2003, 05:13 AM
Something I stumbled upon while debugging a prog. Wouldn't let me debug any further...:(

<pre>
0012EFC0 |00191358 UNICODE "yes"
0012EFC4 |00000008
0012EFC8 |00BA4988 ASCII "Disable Script Debugger"
0012EFCC |00BA4928
0012EFD0 |00BA0124 ASCII "yes"
0012EFD4 |00180017
0012EFD8 |00BA4988 ASCII "Disable Script Debugger"

</pre>


Memory Change Logging Utility

RCE Messageboard's Regroupment > General > Memory Change Logging Utility
Anonymous
09-06-2003, 12:00 PM
Hello,

Is there a utility available that will monitor and log changes made to a specific memory area under Windows XP ? I'd like to log changes made to a specific memory region.

Please let me know.

Thx.
Anonymous
09-06-2003, 12:23 PM
Easy, set a guard page at the page you'd like to monitor and you'll be told whenever the address is read from or written to.
Anonymous
09-06-2003, 04:49 PM
In Ollydbg, the target only uses the memory for a brief moment. When I try to set a breakpoint on memory access, ollydbg says there is no memory there. The program has not allocated yet. How do you get around this ?
Anonymous
09-06-2003, 08:33 PM
use a hardware breakpoint when the memory *IS* there, and then restart the program being debugged. As soon as the memory exists, the breakpoint will be valid and active.
Teerayoot
09-12-2003, 03:49 AM
sometime may remove by packer.such as asprotect .


trace command

RCE Messageboard's Regroupment > General > trace command
Anonymous
09-06-2003, 12:04 PM
How do i set "Command is one of: xor eax,eax" as u can do in ctrl+t but i wanna use toc in cmdline?
oh me anon
09-07-2003, 09:12 AM
i wanna use toc in cmdline? toc ???? cmdline ???? be clear else no answer is going to come

in ctrl+ t you can check mark the the command is one of and write

XOR R32,R32 and olly will pause if any of the commands is executed

xor eax,eax,
xor eax,edx,
xor any register, any other register

if you want to stop on byte xorring like xor al,bl
then you can use XOR R8,R8

you can also try using XOR RA,RB if registers are different (it is quicker to zero in)
Anonymous
09-07-2003, 12:45 PM
I wanna set "Command is one of" using commandline? hard to understand?
Anonymous
09-07-2003, 04:27 PM
Well, I don't understand, and it seems no one else does either.

Explain what you want better.
Anonymous
09-07-2003, 08:59 PM
I don't want to have to set it in ctrl+t i want to set it in commandline ok ??? example... toc eip==xor eax,eax
Anonymous
09-08-2003, 10:09 AM
???
Anonymous
09-08-2003, 05:01 PM
My god, are you all stupid ppl? What he means is that he wants to use the command line or command bar plugin and type something like "bp blah if eip='xor eax, eax'".

For example: instead of pressing F2 on a disassembly line at address 401000 you can write bp 401000 in a command line plugin.
Anonymous
09-08-2003, 08:33 PM
so as you are the only one here not stupid, tell him how to do it.
Teerayoot
09-09-2003, 04:15 AM
http://www.polarhome.com:793/~teerayoot/html/smilies/lol.gif
Teerayoot
09-09-2003, 05:42 AM
"Stupid" is a word that prick all debugger heart.So do not use it if possible ;)


Conditional breakpoints on flags?

RCE Messageboard's Regroupment > General > Conditional breakpoints on flags?
Anonymous
09-06-2003, 07:16 PM
Hey!

Is it possible to make a breakpoint fire only when a flag is set to 1?
For example I want to break on a JZ when the zero flag is 1...
Anonymous
09-06-2003, 08:34 PM
of course
Anonymous
09-07-2003, 07:09 AM
How then? I looked in the help file but there were no examples of that there...
Teerayoot
09-08-2003, 06:57 AM
the flag is set after the result of register ,so that use set conditon bp on register intead .

such as al==0 break it like z flag is set .


ollydump v 2.21 Cann't Dump this process

RCE Messageboard's Regroupment > Plugins > ollydump v 2.21 Cann't Dump this process
Anonymous
09-07-2003, 03:55 PM
Found OEP but cann't dump this process Error message:Bad Dos Signature
it's a masm32 file,i can use Trw2000 1.22 dump it ,
Download: http://www.tlzj18.com/jdpack.zip
Anonymous
09-07-2003, 04:26 PM
hmmm, exe hdr fuxored, repair by using master.
Teerayoot
09-09-2003, 05:39 AM
recompile ollydump ,remove the pe header check routine .
Anonymous
09-09-2003, 05:59 AM
kindly,could you please inform where to find master tool. thanks
Teerayoot
09-09-2003, 06:38 AM
http://www.polarhome.com:793/~teerayoot/html/tool.php?detial=13
Teerayoot
09-09-2003, 06:47 AM
Tried yet ollydump 220fixed ,i got it on Ricado ftp server.
loveboom
09-10-2003, 06:43 PM
Thank you !
Bad luckI can open that page but cann't download it,i am from China
Teerayoot
09-11-2003, 01:38 AM
Try again.(the server may busy)
That 's ploblem happend on me too.
loveboom
09-11-2003, 08:44 PM
Where are you from??i cann't concent server ,i think must patch it(DIY)
Anonymous
09-12-2003, 07:37 AM
loveboom,
I can email you it if you want.
Anonymous
09-14-2003, 04:09 AM
Thank you Email: loveboomNew@hotmail.com


Feature or plugin wish - code sequence recognition

RCE Messageboard's Regroupment > General > Feature or plugin wish - code sequence recognition
1bitshort
09-08-2003, 12:54 PM
It would be _so, so good_ if OllyDbg (or a plugin) could detect code sequences and comment them accordingly (and then it'd be easy to make a public library for known code sequences). For example, this is the start of a UPX-packed exe (nothing unfamiliar ;) ...
<pre>00406A90 > $ 60 PUSHAD
00406A91 . BE B0604000 MOV ESI, 004060B0
00406A96 . 8DBE 50AFFFFF LEA EDI, DWORD PTR [ESI+FFFFAF50]
00406A9C . 57 PUSH EDI
00406A9D . 83CD FF OR EBP, FFFFFFFF
00406AA0 . EB 10 JMP SHORT 00406AB2
00406AA2 90 NOP
00406AA3 90 NOP
00406AA4 90 NOP</pre>
Obviously a few of those bytes change (addresses etc) so a bitmask would also be required, but that's the only 'hurdle', if you could call it that. It could then automatically add comments that have been associated to that byte sequence.

I would be willing to pay for such a plugin to be made, but I think its the sort of plugin that everyone would benefit most from if it was free and available to everyone, so then a public database of code sequences can be built... almost like snort the IDS, how it analyses network traffic for known byte sequences :)

Anyway, just an idea ... if anyone wants to turn it into a reality I for one would be very grateful!
Teerayoot
09-09-2003, 05:30 AM
Good idea!http://www.polarhome.com:793/~teerayoot/html/icon/icon14.gif
Anonymous
09-09-2003, 08:28 AM
Indeed, that would be very cool.

MrSmith
en0n
09-11-2003, 08:42 PM
Try using PEiD. it could be helpful
Anonymous
09-12-2003, 12:57 AM
Thanks en0n, but PEiD is only useful for detecting packer/compiler etc, it can't be used to detect little code snippets scattered throughout programs (like anti-debug tricks, etc)
Anonymous
09-21-2003, 10:40 AM
We can make MAP files and use MapConv
-koncool


How to set condition log on some reference strings

RCE Messageboard's Regroupment > General > How to set condition log on some reference strings
Teerayoot
09-09-2003, 05:36 AM
I search for a strings and found many string on Reference window.
I like to set condition log on every "This message not show in unregistered version "http://www.polarhome.com:793/~teerayoot/html/smilies/wink.gif .

Can i do this ?http://www.polarhome.com:793/~teerayoot/html/smilies/rolleyes.gif


hardware breakpoints not working

RCE Messageboard's Regroupment > General > hardware breakpoints not working
Anonymous
09-09-2003, 06:58 PM
Hi,
anyone think of a reason this should happen, its a packed app I'm debugging and last time I looked at it about 10 days ago breakpoints worked fine so detecting olly seems unlikely to be the problem.
Anonymous
09-09-2003, 07:11 PM
delete .udd file
Anonymous
09-09-2003, 07:19 PM
thanks, someone had already suggested that to me but it made no difference.
Teerayoot
09-10-2003, 02:57 AM
move Ollydbg to other location.
if ploblem still happend delete ollydbg.ini and re setting again.
Just one idea.
Anonymous
09-26-2003, 05:40 PM
Packer like asprotect clear debug register inside exception handler. So hardware breakpoint will not work after exception.

If another breakpoint is caught by ollydbg (eg, a soft int3 on system api ),
Ollydbg will restore the debug register so hardware breakpoint will work again until next exception.


SafeSerial OCX Protection

RCE Messageboard's Regroupment > General > SafeSerial OCX Protection
Anonymous
09-10-2003, 12:27 AM
Hi,

I've just run across a target using the SafeSerial (www.sikandersoft.com) protection. I haven't been able to do very much with Ollydbg, has anyone else had any luck ?


Help Common.arg

RCE Messageboard's Regroupment > General > Help Common.arg
Anonymous
09-11-2003, 03:53 AM
Please give me sample how to make a common.arg or application.arg another (I was read teerayoot tut but I dont understand yet )
Teerayoot
09-15-2003, 08:06 AM
not finished yet but i think it 's will be a sample for a writting function desctiption

//cut here

info "custom function description " collection on Vb strings,Written by Teerayoot(Cr.Jack@bugsgroup.com)
info rename this file to target name(target.arg) then copy to Ollydbg folder

info MSVBVM60.__vbaStrCmp
FUNCTION __vbaStrCmp
"Arg1" UNICODE
"Arg2" UNICODE
END

info MSVBVM60.__vbaStrCat
FUNCTION __vbaStrCat
"Address" HEX
"Strings" UNICODE
END

info __vbaStrCopy (set bp on SysAllocStringByteLen in OLEAUT32 module)
FUNCTION SysAllocStringByteLen
arg1 UNICODE
arg2 HEX
END

info __vbaStrComp (set bp on VarBstrCmp in OLEAUT32 module)
FUNCTION VarBstrCmp
string UNICODE
string UNICODE

END

info MSVBVM60.__vbaVarTstEq(not implement yet)
FUNCTION __vbaVarTstEq
string UNICODE
string UNICODE

END
info MSVBVM60.__vbaVarTstGt

FUNCTION __vbaVarTstGt(not implement yet)
string UNICODE
string UNICODE

END

info MSVBVM60.__vbaVarTstNe

FUNCTION vbaVarTstNe
string UNICODE
string UNICODE

END

info MSVBVM60.__vbaFileOpen
FUNCTION __vbaFileOpen
flag HEX
flag HEX
flag HEX
filename UNICODE

END
info rtcMsgBox(not implement yet)
FUNCTION rtcMsgBox
string FORMAT
string FORMAT
string FORMAT
string FORMAT
string FORMAT

END

// ending cut here
Teerayoot
09-16-2003, 05:28 AM
but it's working .
Ricardo Narvaja
09-16-2003, 06:34 AM
the functions say NOT IMPLEMENTED YET dont work , I understand well?

Ricardo
BasengBae
09-17-2003, 01:41 AM
thank you
Teerayoot
09-17-2003, 04:00 AM
Ricardo Narvaja

Yes ,"NOT IMPLEMENTED YET " is a comment written by me.
You should rewritten again in that function.

But anyhow ,it's more powerfull than previous releashed.
such as you can log function argument on
__vbaStrComp
__vbaFileOpen
__vbaStrCat

that __vbastrcmp don't working on some prog.
Anonymous
09-17-2003, 03:03 PM
Very nice Teerayoot, thanks for putting that together.
BasengBae
09-18-2003, 03:37 AM
make log Arg (Hex=??????? INT=???????? UNICODE=?????? )

I have an idea Try This :

/////Cut Here

info "custom function description " collection on Vb strings,Written by Teerayoot(Cr.Jack@bugsgroup.com)
info "Modify by BasengBae"
info rename this file to target name(target.arg) then copy to Ollydbg folder

info MSVBVM60.__vbaStrCmp
Type Value1
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value2
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

FUNCTION __vbaStrCmp
"Arg1" Value1
"Arg2" Value1
End

info MSVBVM60.__vbaStrCat
Type Value3
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value4
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End
FUNCTION __vbaStrCat
"Address" Value3
"Strings" Value4
END

info __vbaStrCopy (set bp on SysAllocStringByteLen in OLEAUT32 module)
Type Value5
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End
Type Value6
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

FUNCTION SysAllocStringByteLen
"arg1" Value5
"arg2" Value6
END

info __vbaStrComp (set bp on VarBstrCmp in OLEAUT32 module)
Type Value7
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value8
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

FUNCTION VarBstrCmp
"string" Value7
"string" Value8

END

info MSVBVM60.__vbaVarTstEq(not implement yet)
Type Value9
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value10
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

FUNCTION __vbaVarTstEq
"string" Value9
"string" Value10

END
info MSVBVM60.__vbaVarTstGt
Type Value11
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value12
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

FUNCTION __vbaVarTstGt(not implement yet)
"string" Value11
"string" Value12

END

Type Value13
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

Type Value14
Text "(Hex="
HEX
Text " INT="
INT
Text " UNICODE="
TRYUNICODE
Text ")"
End

info MSVBVM60.__vbaVarTstNe
FUNCTION vbaVarTstNe
"string" Value13
"string" Value14

END

info MSVBVM60.__vbaFileOpen
FUNCTION __vbaFileOpen
"flag" HEX
"flag" HEX
"flag" HEX
"filename" UNICODE

END
info rtcMsgBox(not implement yet)
FUNCTION rtcMsgBox
"string" FORMAT
"string" FORMAT
"string" FORMAT
"string" FORMAT
"string" FORMAT

END

////////End
Teerayoot
09-21-2003, 02:54 AM
Good work.


Cant find

RCE Messageboard's Regroupment > General > Cant find
Underlordkrullik
09-11-2003, 12:54 PM
Hey i worked hard on making a game trainer took alot of work and only found out that... when the game reloads the adress changes... after loading olly and open the game in it i open up the game in a normle exe format and then use a memory finder/hex editor.. then when i find the adress i want in the memory finder.. i look for it in olly but nothing is found.
-
Basicly all i need is to stop the adress from changing when the game reloads.

If anybody can help please do.
Tacman
09-11-2003, 02:13 PM
The game is using DMA. Which means the memory is allocated dynamically. You cant stop it changing but that doesnt mean you cant make a trainer for it. Visit http://www.gamehacking.com/ and grab some tuts. Also there is lots of help in the forum there.
Anonymous
09-11-2003, 03:53 PM
Moron. Memory can ONLY be allocated dynamically, there's no way to statically allocate memory at a given address. All the standard windows functions allocate memory dynamically, a game doesn't request it.

Also, what's this bollox about DMA? I guess it means "Dynamic Memory Access", but THERE IS NO OTHER WAY you plonk !

May I suggest you visit msdn.microsoft.com and actually learn how an application requests and uses memory from the OS, or are you another of these people that doesn't know anything beyond the "screen & keyboard" principle because your using some programming language for 3 year old toddlers like Visual Basic, which does everything for you?

Please, just stop talking complete CRAP, and actually learn a fact or two before you go blabbering onto other people exactly what someone else told you, because you have no idea yourself of how it works.
Tacman
09-11-2003, 05:18 PM
Actually I believe its Dynamic Memory Allocation :) but whatever. Lets take for example a game which has lives. On some games the address containing the lives will always be found at the same place even after reset. On others, as the one above the address will change. How many trainers have you made? None? Perhaps you should take your own advice :)

Underlordkrullik check out this tut and it will explain better than I can http://www.geocities.com/smil0r26/tutorials/tut1.txt.
Anonymous
09-11-2003, 06:39 PM
Actually, I've made 3 trainers so far, so shove that in your pipe and smoke it :p

What you'll actually find is that some games keep stuff like that globally in a structure, whilst others keep the info in a class object, and of course, when the class is instantiated, you don't know where the data part will appear in memory.

The obvious solution (which I use myself) is to search for a specified signature in memory, either near that signature, at a constant offset will be the values you need to alter; OR - you'll find a pointer or such like to the data structure which contains the values you want to alter.

So, since you know it all, how many trainers have YOU made?
Tacman
09-11-2003, 07:21 PM
I dont claim to know it all and I'm not the one shouting abuse.
You've only made three? :) I wont bother answering any more of your raves. This is not the place. If you really want to continue making an ass of yourself come to irc #gamehacking and speak to me there. I'll be using the nick Mango.
Teerayoot
09-12-2003, 03:41 AM
http://www.xcheater.com/download.ashx/cheat_tools/tsearch_16.zip can do for you
It's builtin with debugger .
When you know the address go to olly then patch it ,
work well for me.


Windows messages. How to intercept?

RCE Messageboard's Regroupment > General > Windows messages. How to intercept?
en0n
09-11-2003, 08:39 PM
Ok, I'm debuggin a program(dll) which sends a message to one of its windows via SendMessageA.
How can i intercept it on the side that proceses that message?

bp on GetMessageA won't work...
en0n
09-11-2003, 10:05 PM
Solved!
View->Windows.

But what now? God knows...
Anonymous
09-12-2003, 03:33 AM
conditional log bp.


Where can i download the stronger pe-lock?

RCE Messageboard's Regroupment > General > Where can i download the stronger pe-lock?
loveboom
09-11-2003, 08:57 PM
i can unpack the ding boy pe lock and aspr1.23rc4 and now i want download stronger pe-lock? aother,now i have a aspr 1.23rc4 unpack file but cann't crack it,it use Rsa1024, how to Crack it ???
Anonymous
09-12-2003, 01:27 AM
the best PE lock http://www.xprotector.com/
Anonymous
09-12-2003, 02:53 AM
"the best PE lock" is one that works ;)
XProtector wont even load on my machine, its exe just sits there in a loop hogging one CPU - a good example of where something is protected too much, to the point where it's more inconvenient than secure.


Tut: How to crack XYZ?

RCE Messageboard's Regroupment > General > Tut: How to crack XYZ?
Anonymous
09-12-2003, 06:57 PM
Does anyone have a tut on cracking XYZ? Preferred with OllyDbg. Thanx in advance.
Anonymous
09-12-2003, 09:40 PM
[snip]
I'm only a newbie.
[snip]
So please don't think that I'm a leecher or something, and don't dudge me :-)
TBD
10-01-2003, 12:42 PM
why people dont understand that this is NOT a cracking forum !!!

so, again, please do not post anymore request on how to crack/r3v3rs3/...
because the posts will be deleted.

why you dont start making a plugin or come with suggestions in how to improve OllyDbg ?

ps. ... because cracking is much easier than creating is not an accepted answer ;)


Ollydbg w/ anti olly detection

RCE Messageboard's Regroupment > General > Ollydbg w/ anti olly detection
StealthMan
09-12-2003, 08:44 PM
I've hacked Ollydbg so it's no longer detectable by popular protectors, allowing you to crack the software they are protecting much more easily.

The hacked version may be download from:

http://www.zg520.net/soft/soft/669.htm

Note that once downloaded, there are no longer any string references to "Ollydbg" or the author, as all of these have been completely removed to hide the debugger from detection. I've also added some extra features to hide the program better in the process list.
Anonymous
09-13-2003, 06:00 AM
I hope you got consent from Oleh first, as this violates the License Agreement. From license.txt:
You are not allowed to modify, decompile, disassemble or reverse engineer
the Software except and only to the extent that such activity is expressly
permitted by applicable law. You are not allowed to distribute or use any
parts of the Software separately.

*shrug* we all love and use the program for free, so let's at least respect its License Agreement. Perhaps a tutorial on how to patch it wouldn't be so bad...
StealthMan
09-13-2003, 06:36 AM
That license agreement means exactly shit, I like to see Oleh enforce it in a court of law.
Anonymous
09-13-2003, 07:04 AM
stealth, i think it's a good thing you are doing,
but if you made your changes available as a search&replace patch that could be applied to current and future versions of ollydbg, and thus provided as an extra utility, rather than a replacement exe for ollydbg, it would be perfect and i think everyone would be happy.
Anonymous
09-13-2003, 07:06 AM
>> I like to see Oleh enforce it in a court of law.

many of us here think of oleh as a deity here - he deserves incredible respect and appreciation from all of us for making ollydbg available for free, and continuing to improve it.
Anonymous
09-13-2003, 07:56 AM
StealthMan your disregard of the license agreement is one thing, but your lack of respect for Oleh is another and won't be seen favorably by many people here. He's taken a lot of time to research and develop this software, and lets you and all of us use it for free. He doesn't want money or even a thankyou, so Im amazed you can be so disrespectful to him when you clearly like and use his software.

All you had to do was email him for permission to release a modified version. I'm sure you'd be surprised at how friendly and helpful he is in his emails.
StealthMan
09-13-2003, 09:38 PM
Fair enough, modified version removed and replaced with original version from Oleh.
Anonymous
09-14-2003, 12:55 AM
:) You should still email him though - he might not mind, all you need is his permission in an email and then you can put it straight back :)
Or alternatively, just write a tutorial about how you patched it.
Anyway, you've done the right thing :)


Call Stack Window Empty

RCE Messageboard's Regroupment > General > Call Stack Window Empty
Anonymous
09-14-2003, 10:50 AM
Has anyone encountered this?

After breaking on a BP WriteProcessMemory and looking at the Call Stack panel (Alt-K), It is empty!

This is done with an Armadillo protected file of course...

Any suggestion to solve this?

tnx
Ricardo Narvaja
09-14-2003, 06:11 PM
Look in the stack is the same the returns of the calls are in the stack if you go down you can view the returns of the calls when you down in the stack

Ricardo


Help me out!...

RCE Messageboard's Regroupment > General > Help me out!...
Anonymous
09-14-2003, 05:31 PM
What am I supposed to look for when you try ti crack a software that needs a serial or something? I run the program then open ollydbg and then I attach it and run the program there. What do I look for? Can someone help me out! I really want to learn.. Is there any tutorial that can teach me?
Tacman
09-14-2003, 06:11 PM
For the sake of this site cracking is not supposed to be discussed here, even though some do :). Go here for help http://zor.org/krobar/
MeepMeep
09-14-2003, 06:18 PM
First, gather evidence from the program before even loading it in the debugger. Log strings and the like that are displayed, such as "Unregistered version". Then, see what happens when you request to type in a serial number, and see what happens when the serial number is incorrect. Log down all responses and everything the program does.

Then load the program into the debugger and search for those.
Anonymous
09-19-2003, 12:23 AM
Thanks guys..


Binary copy/paste, is it a bug ?

RCE Messageboard's Regroupment > Bugs > Binary copy/paste, is it a bug ?
Neitsa
09-14-2003, 08:11 PM
Hi everybody,

When i use "binary Copy" to copy line's opcodes from one line and i try a "binary paste" on an empty line it seems that not all of the opcodes are pasted. So, is it bug ?
Does this function is for copying and pasting opcodes or i've made a mistake?

Thanks.
Ricardo Narvaja
09-15-2003, 06:29 AM
try in the zone for pasting, mark 2 o 3 lines more in the zone of copy.

Ricardo
Anonymous
09-15-2003, 10:04 AM
you have to select the same size region as you copied before pasting
Teerayoot
09-16-2003, 03:35 AM
Not nessasary same size ,just bigger than copied region.
Ricardo Narvaja
09-16-2003, 06:36 AM
maybe select same size can make an error.

In 3 lines you can put 6 bytes or 5 bytesor 3 bytes and this is the problem, selecting a more big zone in the copied region you are sure is all copied in this zone.

Ricardo Narvaja
Anonymous
09-16-2003, 06:27 PM
you need to learn how to talk english, Ricardo - what do you mean? I don't understand.
Teerayoot
09-17-2003, 04:05 AM
But i understand well ;D
Ricardo Narvaja
09-17-2003, 07:02 AM
In the dump window if you bynary copy and bynary paste, the size of two zones is equal in numbers of bytes, but in the cpu window if you choose 3 lines for example , how many bytes there are in 3 lines of code ?
3 bytes, 4 bytes, 5 bytes, thats the trouble, if you selected the same numbers of lines when you paste the bytes can be less of the number of bytes in the zone copied, for this reason the zone for parting maybe bigger or with more lines.

Sorry for my bad english, i try understand and explain me, but i don't speak english.

Ricardo
Anonymous
09-17-2003, 07:49 AM
i understand now, thanks
Neitsa
09-17-2003, 10:31 AM
Thank you very much for your anwers, now i understand how to do this (i wasn't thinking about selecting bigger zone...).

Regards, Neitsa.


HOw to sue Ollydump dump dll?

RCE Messageboard's Regroupment > General > HOw to sue Ollydump dump dll?
Teerayoot
09-15-2003, 08:14 AM
I can dump dll with another dumper ,but sometime not working well.
It's possible to dump dll with Ollydump?
Anonymous
09-15-2003, 10:05 AM
use ollydump plugin -> http://ollydbg.win32asmcommunity.net/stuph/
Teerayoot
09-16-2003, 03:33 AM
AnonymousDo you understood the question?


2002 XXXXect vX.X

RCE Messageboard's Regroupment > General > 2002 XXXXect vX.X
sex123
09-17-2003, 09:19 AM
Plese help me how to crack or fin the good serial from thats software becose
[...removed...]
TBD
09-18-2003, 07:26 AM
i think people dont understand that this is not a cracking forum,
so PLEASE DO NOT POST anymore any cracking related forum.


2 questions

RCE Messageboard's Regroupment > General > 2 questions
Anonymous
09-18-2003, 01:50 PM
Is it possible to search (or break) on an indentifier id/handle?

What I mean is, I have for example a button, this button has a handle and an identifier id. Now I want to find some code that modifies something about this button (i.e. changes it's caption or enables the button). I can find the button with the view|windows "tool" but then I can't set a breakpoint on this "window/handle" so that Olly breaks when something is done with that handle/window.

And a 2nd question:
How can I break when I click on a specified button? Can I i.e. set a breakpoint on the BN_CLICKED command?

I hope that I'm clear enough with what I mean with my questions ;-)
Thanks in advance for yours anwer(s)!

P.s. sorry for the topic title, but I couldn't think of a better name for this topic on this short notice.
Anonymous
09-18-2003, 08:26 PM
You can't break on handle or id, but you can set a conditional breakpoint on the function you think it's going to use and place the conditional as for looking at the stack to see what id/handle it's giving to the function. There's not that many functions that change the text or make a button enabled.

Secondly, to break on the click of a button, I'd break on the windows message (WM_COMMAND ?) and again check the commandid by looking at the stack.
Anonymous
09-19-2003, 03:24 PM
Thanks for your answer!
Hmm, I was already afraid of that I couldn't break on a handle or id. But is it aslo impossible to _search_ the analysed code for this specefic handle/id? Because it is shown nice and simple as clean text to me, and if it isn't most of the time it is still hardcoded in the source, so it could be possible I guess.

And secondly: thanks, I will try to see if that's going to work!


ollydbg and catchin exceptions

RCE Messageboard's Regroupment > General > ollydbg and catchin exceptions
netmaniac
09-19-2003, 06:52 PM
Hi people,

Im new to ollydbg, yesterday i downloaded it and decided to apply ollydbg's capabilities on a recently discovered secuirty vulnerability on some service. i wanted to analyze what is happenin with that service so i attached ollydbg to it. when i send specially crafted overflow string to vulnerable service it usually crashes and ollydbg suppouse to catch that exception before it crashes. but it doesnt. it simply stays running. Did i misundestand something with olydbg. can anyone point me to right direction pleaze. thanx
Anonymous
09-19-2003, 08:26 PM
:p
Teerayoot
09-23-2003, 03:20 AM
http://www.avet.com.pl/pipermail/bugdev/2003-March/002869.html

Involed your question ,good to starting on that document.


Previous instruction/address

RCE Messageboard's Regroupment > General > Previous instruction/address
Anonymous
09-25-2003, 04:08 PM
Hello,

Is it possible to view the previous adress of the disassembled program? I mean sometimes a function is called by many different calls, or sometimes it is not clear in the analysed text who calls the function, but I want to see what the caller was (or where was jumped from), without using the execute till return function (because this doesn't work for jmp commands)

For example I have this code-snippet:
00BA927B EB 00 JMP SHORT 00BA927D
00BA927D 83C4 08 ADD ESP,8
00BA9280 E9 2A030000 JMP 00BA95AF
00BA9285 B8 F0C9BF00 MOV EAX,0BFC9F0 <--------------Currently here
00BA928A 50 PUSH EAX
00BA928B E8 306589FF CALL Install_.0043F7C0

And I've set a breakpoint on all these addresses, but it breaks only on the currently here statement, and I can figure out what the previous instruction was...

Tnx for ya help!
Anonymous
09-25-2003, 04:15 PM
Use the trace function - it'll tell you every instruction executed before the one you are at - then you know exactly how you got there.
Anonymous
09-25-2003, 04:22 PM
Tnx for your quick answer. But I already tried to use that, only as far as I know when you use the trace function, you should also (auto)step through your program, and first of all the program is quite big, and besides that, if I keep stepping through my program it almost everytime comes up with an unhandled exeption (with don't pop-up normally), so am i doing something wrong or?
Ricardo Narvaja
09-25-2003, 09:45 PM
the better trick for trace without exceptions for the trace is made this

example

you start in the executable

use the trace option of the ollydmp (trace into to oep)

this trace till first api and stop
execute till return
f7
trace again
repeat the process when stop in a api, execute till return and f7 and trace

is tedious but is 100 % effective and you can view the apis used for the program
and tracing is imposible of beat

The other otion is run till a location near the point you can reach and make the same process strating in a location more near of the point of the study.
Ricardo


not breaking on oep

RCE Messageboard's Regroupment > General > not breaking on oep
Anonymous
09-27-2003, 01:44 PM
I have this app that doesnt break on oep, it just runs normally
and no disassembly in window and is not packed. And have tried
setting to break on ep doesnt work either if I set system bp
it breaks and even trying to set a bp maually on oep it still
doesnt break it is like its another process
Ricardo Narvaja
09-27-2003, 02:46 PM
Youa have the pluginIsdebuggerpresent quit or deactive, or actualize to more recent version, equal is not recommendable the AUTOHIDE option in this plugin, put manually in HIDE when stops in EP

Ricardo
Anonymous
09-27-2003, 03:15 PM
Its not the plugin its not activated. This is when loading the app,
no bp's set and not trying to hide debugger.
Ricardo Narvaja
09-27-2003, 07:29 PM
If you can a zip of ollydbg unzip in other location and try in this other OLLYDBG, if in this olly stop in EP, maybe a option bad configured or a udd file corrupt.

Ricardo
Anonymous
09-27-2003, 08:23 PM
I've seen this before
Anonymous
09-27-2003, 08:32 PM
Theres nothing wrong with the config or udd file, I even deleted
the udd file for the app. Still same thing. I can get it to to
break on a API call or even a EBFE on the OEP and select pause
I can get back to the OEP but this is the first I seen this for
olly any suggestions
Teerayoot
09-29-2003, 02:17 AM
Same ploblem as me.even the prog not packed or crypted.

The ploblem solution is :

Dump that victim and rebuild import table.

I never got another solution ,if you know tell me.
Anonymous
10-03-2003, 11:44 AM
Does this program use its own dlls? maybe they put some trick code in "dllmain", which get executed earlier than exe code.


Unable to Attach to Process

RCE Messageboard's Regroupment > General > Unable to Attach to Process
Anonymous
09-28-2003, 03:19 AM
I'm getting this Olly error when I try to attach to a running process. How does this process keep from being looked at ? Is there a way around this ?
Anonymous
09-28-2003, 08:27 AM
It's probably protected by Armadillo and the like with the "Debug blocker" option set. There's no real way around it as the process itself is already being "debugged" by it's master process, so Ollydbg can't step in and even sniff it, nevermind debug it.

However, you can debug it's master process, and force the master to stop debugging it, place the child into an infinite loop and allow ollydbg to connect to it.
Anonymous
09-28-2003, 03:29 PM
So if you run an Armadillo-protected exe that has the 'Debug blocker' option set, you'll actually have TWO executables running???
Anonymous
09-28-2003, 05:29 PM
This Armadillo app runs and yes, there are 2 apps running. 1 app specifically for the registration window and the main executable. The app for the reg entry is the one that will not allow attachment. How do you setup the master process to stop debugging it ?
Anonymous
09-28-2003, 08:25 PM
Yes, all kinds of debug blocker actually have two executables running.
Anonymous
09-29-2003, 09:47 AM
Is there a "good" PE examiner that is recommended to tell you what packer was used on a particular target ?
Anonymous
09-29-2003, 10:09 AM
yes
Anonymous
09-30-2003, 08:19 AM
Which PE examiner would you recommend ?
Anonymous
09-30-2003, 07:13 PM
peid 0.9
Anonymous
10-01-2003, 01:10 AM
Will peid 0.9 work on dll files as well ?
Anonymous
10-01-2003, 05:25 AM
yes
Anonymous
10-02-2003, 12:33 AM
Are there any good tuts for unpacking and restructuring an Armadillo v2.5-v2.6 target ?


Help on breakpoints

RCE Messageboard's Regroupment > General > Help on breakpoints
Anonymous
09-28-2003, 06:20 AM
Hi

Can you help me with breakpoints. I am trying to set a conditional bp. When eax is -1 i want to stop execution of program. I try to set eax<0, but program won't stop. What is wrong?
How to set a bp when FindFirstFile API function return ERROR_PATH_NOT_FOUND (or anyother error or any other API function)?

Thanks in advance

stanks
Teerayoot
09-29-2003, 02:26 AM
eax = -1 mean eax = ffffffff .

FindFirstFile ,when ERROR_PATH_NOT_FOUND had return ; notice content of register(regular is eax) and set cond bp on that register .
Anonymous
09-29-2003, 02:03 PM
> eax==-1 mean eax=ffffffffh
yes i know that. and i know that help file says to put condition eax<1 if you want all values below 0 (zero), but program won't stop.
I didn't remember that. Thanks for tip.

stanks


How set log conditional on all Compare functions ?

RCE Messageboard's Regroupment > General > How set log conditional on all Compare functions ?
lulucz
09-28-2003, 06:17 PM
For examle I need break when any expression CMP is 00AAAAAA.
Thanks LuLu from Czech
Anonymous
09-28-2003, 08:26 PM
This is obviously for cracking reasons, so go away


Conditional hardware breakpoint?

RCE Messageboard's Regroupment > General > Conditional hardware breakpoint?
Anonymous
09-29-2003, 04:15 PM
Hi,

Is it possible to create hardware breakpoints with condition like for normal breakpoints?

For example i create a hardware on write breakpoint, but want OllyDbg to stop only if the memory address the breakpoint is set to equals 0.

Any help is apreciated.

Thanks in advance
Anonymous
09-29-2003, 07:04 PM
Not possible


Cant see Plugins in Ollydebug' v1.09d's

RCE Messageboard's Regroupment > Bugs > Cant see Plugins in Ollydebug' v1.09d's
paul333
09-30-2003, 02:15 PM
When i run Ollydebug v1.08 i can see "Plugins" in olly's main window BUT in Ollydebug v1.09d i cant..how do i access the plugins then..i cant see them?

Thanks

paul333
oh me anon
09-30-2003, 03:19 PM
have you tried checking the plugin path in directory menu of appearence options

alt+o ---> click the coloured rectangles button ----> directory--->pluginpath---> is it ok ----> if not ok browse for folder that has the plugins and set path
Anonymous
10-01-2003, 03:59 PM
Thanks oh me anon that sorted it ..:)

paul333


To the kids that keep posting crack requests

RCE Messageboard's Regroupment > General > To the kids that keep posting crack requests
Anonymous
10-01-2003, 02:10 PM
It seems like every week now some kid comes here asking how to crack a program, and despite TBD's polite and very reasonable requests not to post such things, they continue.

Folks, we often take for granted the things we appreciate the most. This forum is a great resource for all users of OllyDbg - an excellent debugger (I still can't believe that we're all allowed to use it for free), and people should respect Oleh for his creation and generousity - he hasn't made a single cent out of any of us, yet all of us have been helped many a time by Oleh's program.

While some kids think that debuggers are only for cracking, a lot of people here actually have legitimate uses for debuggers like OllyDbg, and their posts do nothing but degrade this forum and even put the livelihood of this forum at risk, legally and otherwise.

If you do have crack-related questions, there are thousands of places on the web to go to so it's not like you're without a place to go, but please don't abuse this forum - it's too good for that.

Thanks for your time, and thanks for contributing to this forum to help make it what it is. Let's keep it that way.
Anonymous
10-02-2003, 05:48 AM
He will sell after v2 is stable i bet.
Anonymous
10-02-2003, 08:33 AM
I wouldn't blame him if he did :)
(It's worth paying for!!!)
Anonymous
10-02-2003, 08:35 AM
The only problem is that debugger programs attract crackers for obvious reasons, so if Oleh did sell it it would only be a matter of time before somebody released a crack. :(
I'd pay for a registered version of OllyDbg because it's quality software, written by a clearly dedicated author!
TBD
10-02-2003, 11:59 AM
I meet Olly twice and from what I spoke with him, he doesn't plan to make it commercial.
... but of course donations doesn't hurt anyone :)
Anonymous
10-02-2003, 01:21 PM
He's a very generous person
Anonymous
10-02-2003, 05:37 PM
Nahh, he's just making the ultimate cracking program. Can't say I blame him, but he knows full well that because of this he can't sell the program because of the obvious intent.

Which is why I'm puzzled at Ollydbg messageboards not allowing cracking posts, when the program itself has been made with cracking in mind.
Anonymous
10-02-2003, 08:59 PM
Have you thought to inform datarescue and numega they will be unable to sell their products because of "obvious intent"?.
Anonymous
10-02-2003, 10:16 PM
Yes, I've been trying to get IDA Pro banned for some time now. Unfortunately, all I got was them agreeing to remove a few features that were not needed for the purposes in which they intended the program to be used.
angelam
10-18-2003, 05:20 PM
Hi;

Seems to me everybody here is more paranoid than a Mathematician. No one is going to close this forum down because some kid is asking how to crack the latest Shareware piece of dreck. The truth is, with all these hot debuggers, and all these whiz kid crackers, sales of our Shareware go up every quarter. This is true of every other software vendor I know. All the programmers I know are flattered that anyone is even looking at their latest monstrosity. All the programmers over here have tried their hand at a little cracking now and then. So don't take yourself so seriously, We don't care!

P.S. Personally We admire this Oleh guy very much, for his generosity.

Angela
psyCK0
10-26-2003, 12:16 PM
I've been trying to get IDA Pro banned for some time now
What do you think ppl at Symantec, F-Secure etc use to disassemble virii?
Notepad?

all I got was them agreeing to remove a few features
OMG. What features did we miss because of you? As a registered
IDA user I've only seen features added, not removed. I will
complain to Pierre that they let idiots influence their software.
jddakid
02-13-2004, 04:05 AM
The irony in this is, the people like the " mr ban " up there are driven only by personal and monetary gain. Have you noticed that all the money driven companies are so vocal in trying to stop well written programs or so called " crackers"; when in fact if they put that much energy into their protection schemes and less on badgerring us .......................Keep up the great work oleh very well written program and a very nice site ....kudos brudder.
falcon
03-25-2004, 06:08 PM
can you crack this file for me : http://www.....

just kidding :D but hi, im new to the forum and olly, but i look forward to learning with you all.

And anonymous, i know how you feel, i hate it 2.
There should be a big header at the top saying, we wont crack for you! Or something that notify the those rotten people about posting crack requests.


int3 traping problem on XP

RCE Messageboard's Regroupment > General > int3 traping problem on XP
Anonymous
10-03-2003, 04:50 AM
I having problem with traping the following test code.

@@:
xor eax,eax
jnz @b
int3
ret

Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area.

What's wrong?
I'm on XP1.

BiMode
Anonymous
10-03-2003, 04:52 AM
I having problem with traping the following test code.

<pre>
@@:
xor eax,eax
jnz @b
int3
ret
</pre>

Whenever trapped, it's will break in the middle of jnz opcode (EIP will points between 74 and FC) and if i try to step to will cause some unexpected error so I have to increment EIP each time to point outside jnz code area.

What's wrong?
I'm on XP1.

BiMode
oh me anon
10-03-2003, 02:49 PM
004024F6 33C0 XOR EAX,EAX
004024F8 75 07 JNZ SHORT 00402501
004024FA CC INT3
004024FB C3 RETN
004024FC 90 NOP
i havent understood what you are asking but i assembled this in place in olly and used new origin here option and single stepped through this it seems to work flawlessly xor eax,eax makes eax,0 and changes the zero flag to 1
so the jnz isnt taken next step int3 is executed and i see a notification in olly status bar stating int3 in blah blah and the next instruction ret returns to what ever is in stack top
Anonymous
10-04-2003, 01:32 AM
NO, you misunderstood me.

try to create the exe that has the code above (and set Olly as JIT too).
run the exe and use OllyDbg to trap the fault and you will see.

Don't forget to look at EIP and see which is at.


Exporting Hit trace data

RCE Messageboard's Regroupment > General > Exporting Hit trace data
Anonymous
10-06-2003, 07:22 PM
Is there any way to export/log only lines hit on a hit trace to a file? I want to be able to use a perl script to analyze those lines.

Unfortunately, copying the entire disassembly to a file does not copy the hit trace highlighting, or I could filter out the non-hit lines. Manually copying them out is not an option when tens of thousands of lines have been hit.

Thanks in advance.
Anonymous
10-07-2003, 10:21 AM
no, but what you can do is right click in the window and select "log to file"
Anonymous
10-07-2003, 11:57 AM
You can do that for run trace, yes.

I'm talking about hit trace. Run trace is kind of useless when the messaging and rendering code running every frame makes it 1.2 million lines long(yes, that is the actual length of the run trace I tried). Hit trace is much more manageable because only 10's of thousands of lines are getting hit.

However, if the only way to gain access to hit trace data is to look for the little red highlights manually, it's even more useless.


Break when a particular menu item is clicked

RCE Messageboard's Regroupment > General > Break when a particular menu item is clicked
Anonymous
10-07-2003, 03:16 AM
I have a program that im debugging, im trying to break when I click on a particular menu item. At the moment ive got it breaking at CreatePopupMenu, and I can then see all the calls to AppendMenu. Does anyone know how to set up some sort of conditional breakpoint so that it only breaks when I hit the particular menu entry that Im after?
Many thanks in advance
Anonymous
10-07-2003, 04:11 AM
Me again. To elaborate, I know that the WM_COMMAND message is sent when a menu is clicked, and that the low word in wparam is the ID of the menu. So if I could somehow set up a conditional breakpoint to do that, thatd be great. But what would the expression be? Something like this should work: MSG==WM_COMMAND && LOWORD(WPARAM)==1234 (where 1234 is the menu id)
But the loword/wparam bit isnt valid, anyone know how to do that?
Anonymous
10-07-2003, 10:24 AM
Well, turn on debugging, recompile the program and the compiler will tell you the address of the routine that will be called when the menu item is selected, just create a break here.

If you don't have access to the source code, then your obviously trying to crack someone elses program, in which case, you should leave. now.
Anonymous
10-07-2003, 11:07 AM
> If you don't have access to the source code
Correct, I don't.
> then your obviously trying to crack someone elses program
No, I'm not, and that's a very silly assumption - if you think using debuggers is only about cracking then maybe it's you that's the cracker.

I have a program that I use regularly that works fine under all OS's, but for some reason one of the menu functions does nothing when I click on it when running it on my NT box, but it works fine on my Win2K box, so I'm trying to find out where it's falling over, then maybe I'll be able to work around it.

I thought this was the right forum to ask debugger-related questions about OllyDbg, but never mind, i'll ask elsewhere. Thanks anyway.


Load old comments

RCE Messageboard's Regroupment > General > Load old comments
Anonymous
10-07-2003, 02:50 PM
Is there a way to load old comments? I had a program full commented, but suddenly (probably my own fault, I don't know) the comments dissapeared, and because all the UDD files still exist, I was wondering if it is possible to load these files again, directly or in a "sneaky" way (like renaming files)

I have already selected all three checkboxes in security.

Thanx for ya help!!!


Get rid of anonymous posts?

RCE Messageboard's Regroupment > General > Get rid of anonymous posts?
Coops
10-07-2003, 07:24 PM
TBD,

Just my two cents worth but wouldn't it be fairly simple to prevent "Anonymous" from posting? Seems like it would get rid of the kiddies as well as those that keep attacking folks that ask genuine questions about the workings of Olly?

Those self-elected pirate cops might actually get a real life and move on?

Just look at the post where someone asked a qn on how to trap menu item calls...
Tacman
10-08-2003, 03:53 AM
Agreed. This is the only board I know which allows anonymous posts. Please change it.
EsseEmme
10-08-2003, 10:30 AM
Not allowing anonymous posts will not stop kiddies from posting certain requests: having a nickname and an email address associated to a given post is like having nothing. But I do agree that there is no reason to allow anonymous posts on the board.

EsseEmme


[forum] No more anonymous posts allowed

RCE Messageboard's Regroupment > The Heap > [forum] No more anonymous posts allowed
TBD
10-08-2003, 07:26 AM
so, no more anonymous posts allowed anymore, from now on you must login to make a post.

sorry for those who liked it (me included) but it seems that some people like to abuse it.


Hello i'm new italian user

RCE Messageboard's Regroupment > General > Hello i'm new italian user
mskeng
10-08-2003, 09:08 AM
Hello I'm italian, and I'nt speak english very well! :( :(

I would know were I can fin (in olly dbg) command line, I want creat a break point to a setTime string, but the file that i want to debug is a dll, and I can't load only its, there are a tutorial for using ollydbg with command line??
EsseEmme
10-08-2003, 10:21 AM
Benvenuto.

If I understood well what you are asking for you can download the command line plugin for OllyDbg from the following page http://ollydbg.win32asmcommunity.net/stuph/

But really to place a breakpoint on a DLL you don't need the command line plugin. To put a breakpoint on a statement inside a DLL you need "someone" that will load that DLL for you ... and then you need to have OllyDbg "analyze" the DLL (this in order to have OllyDbg "keep" the set breakpoints). You'll then be able to put (and retain) all the breakpoints you want on the DLL's code.

Se hai problemi ad esprimerti in inglese lascia anche la "versione" italiana della tua richiesta. La tua domanda risulterà sicuramente più chiara almeno a chi capisce la lingua italiana.

Cya,
EsseEmme
mskeng
10-09-2003, 12:52 PM
Ciao esseEmme, il mio problema è questo:

Innanzi tutto devo fare il debug di un file .cpl, e allora agisco in questo modo lancio l'applicazione che userà questo cpl, poi lancio ollydbg e attacco l'applicazione che usa il cpl, poi eseguo la cpl! Ora quello che a me interessa sapere è perchè ogni 30 sec emette un beep dopo 10 minuti di funzionamento, come posso settare olly dbg per scoprirlo??

Excuse me english user, but i don't speack english very well, and so i don't write in this language, if into you, are a italian user please give me a hands!

I read very well english language, but i don't speak and write english language, excuse me! :) :)

Peace!
EsseEmme
10-09-2003, 09:48 PM
mskeng per consentire a tutto il forum di poter eventualmente contribuire ti risponderò in inglese.

What mskeng is saying is that he has a .cpl file (which if I'm not mistaken is a specialized dll) used by some application. He is able to start the host application and attach the cpl file and would like to know how to discover why this cpl file emits a beep every 30 seconds after the initial 10 minutes.

Well my friend, I'll be honest, I don't know in what languages this cpl can be made. Supposing it is C and supposing the beep is made using the Beep or MessageBeep win32 APIs you'll have to search for the "Names" in the cpl file (the imported functions) and put a breakpoint on all instances of the beep functions (Beep and/or MessageBeep APIs). Pay attention to put the breakpoints on the imported functions of the cpl file and not the host application. After that just run the application. At the first beep OllyDbg should break (meaning it should stop) on the guilty call.

Cya,
EsseEmme
mskeng
10-10-2003, 06:49 AM
Tnks, essemme, I understood your explication, I know that the .cpl file using the messagebeep API! I have put a breakpoint on all istances of beep function!
But, how I, after breaking the messagebeep API, can exit to this fuction, and execute the coice string per string?? What is the command (keycommand, shortcuts, or other!), for escape to breakpoint to messagebeep API, and run the coice of the program string per string??

Thanks for all message yor are posting, and for explication to my question!!
Best Regards, this is a very Cool forum, I like You!! ;)
...
EsseEmme
10-10-2003, 04:44 PM
mskeng I can't understand what you are saying. Please clarify your post.

EsseEmme
mskeng
10-11-2003, 07:29 AM
Well, I have putted a break point on SetTimer api, and ollydbg break on this import, well, I have analized the code, and I have see the routine that set the timer. this is the code:
10003C40 >/$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
10003C44 |. 57 PUSH EDI
10003C45 |. 25 FFFF0000 AND EAX,0FFFF
10003C4A |. 33FF XOR EDI,EDI
10003C4C |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4]
10003C4F |. C1E0 05 SHL EAX,5
10003C52 |. 8B5408 44 MOV EDX,DWORD PTR DS:[EAX+ECX+44]
10003C56 |. 8B41 20 MOV EAX,DWORD PTR DS:[ECX+20]
10003C59 |. 85C0 TEST EAX,EAX
10003C5B |. 7E 3E JLE SHORT asio2ks.10003C9B
10003C5D |. 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C]
10003C61 |. 53 PUSH EBX
10003C62 |. 56 PUSH ESI
10003C63 |. 8D3400 LEA ESI,DWORD PTR DS:[EAX+EAX]
10003C66 >|> 8B99 14050000 /MOV EBX,DWORD PTR DS:[ECX+514]
10003C6C |. 33C0 |XOR EAX,EAX
10003C6E |. 85DB |TEST EBX,EBX
10003C70 |. 7E 1C |JLE SHORT asio2ks.10003C8E
10003C72 |> 8B99 78040000 |/MOV EBX,DWORD PTR DS:[ECX+478]
10003C78 |. 83C2 02 ||ADD EDX,2
10003C7B |. 40 ||INC EAX
10003C7C |. 66:8B1C33 ||MOV BX,WORD PTR DS:[EBX+ESI]<<<<-------se metto nop nop nop nop sull'indirizzo 1003c7c il beep non si sente, ma dopo dieci min si sente un vuoto (si stoppa l'audio!) per un secondo, se invece annullo tutto il ciclo che va da 1003c72 a 1003c80 mi si sente un rumore strano che non è proprio un beep ma quasi!

10003C80 |. 66:895A FE ||MOV WORD PTR DS:[EDX-2],BX
10003C84 |. 8B99 14050000 ||MOV EBX,DWORD PTR DS:[ECX+514]
10003C8A |. 3BC3 ||CMP EAX,EBX
10003C8C |.^7C E4 |\JL SHORT asio2ks.10003C72
10003C8E |> 8B41 20 |MOV EAX,DWORD PTR DS:[ECX+20]
10003C91 |. 83C6 02 |ADD ESI,2
10003C94 |. 47 |INC EDI
10003C95 |. 3BF8 |CMP EDI,EAX
10003C97 |.^7C CD \JL SHORT asio2ks.10003C66
10003C99 |. 5E POP ESI
10003C9A |. 5B POP EBX
10003C9B |> 5F POP EDI
10003C9C \. C2 0800 RETN 8

10003c9d Nop

Well, that I can do for bypassing this procedure, what breakpoint that I can put in my code for test if this routine Only Set Timer, or Do any other operation??

The program entry point is: 10003C7C, well, but the routine start at 10003C40!!
If i jmp the complete routine:
10003c40 jmp 0003c9d the program host of cpl file, crash after 10 minute!
What can i do for bypassing the Timer, but non create a crash of the program Host, after 10 minute???

Tnks a lot, fo space that you are give me for posting this question,
You are My Big FrendzZ!

Peace! :)
mskeng
10-11-2003, 10:30 AM
Are, you understend?
I have pose a Bad question?
I have fail?
.
.
..
...
....
Tnks! :)
EsseEmme
10-11-2003, 10:48 AM
If the procedure starting at 10003C40 is the procedure called by the SetTimer function, and this procedure does not do anything that is "necessary" to the application, you can simply modify the time-out value (3rd parameter of the SetTimer function) to such a huge value that the procedure will never be called (or it will be called after a few days).

For example, if you set the 3rd parameter to decimal 864000000 (337F9800 in hexadecimal) the procedure starting at 10003C40 will only be called after 10 days of your application's consecutive execution.

EsseEmme
mskeng
10-11-2003, 12:01 PM
Excuse me EsseEmme, but I'm very Big stupid! :(confused):, but: What is 3rd parameter??
I waiting for.....

:)

RETNKS! ;)
EsseEmme
10-12-2003, 07:31 PM
Take a look at this link (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winui/winui/windowsuserinterface/windowing/timers/timerreference/timerfunctions/settimer.asp).

The third parameter (uElapse) controls after how long the procedure (lpTimerFunc) is called.

EsseEmme


Enable disassembly of non-standard code

RCE Messageboard's Regroupment > General > Enable disassembly of non-standard code
MazeGen
10-08-2003, 02:19 PM
Hi everybody,
I made a snippet of non-standard testing code for my analyzer (it's nothing special, but for instance series of ADD instruction). Problem: when I load it as an PE EXE, it looks like OllyDbg's heuristic analysis don't want to disassemble the code (OllyDbg shows only DBs). How can I fix it? I tried changes in Options / Debugging options / analysis1-3, but the problem remains.

Can somebody help? Thank you.

I use OllyDbg v1.09c
TBD
10-09-2003, 03:56 AM
MazeGen: can you post an example ? sometimes i also get DBs instead of code when OD thinks that is data and not code.
MazeGen
10-09-2003, 03:29 PM
<pre>
00401000 >/$ 6A 00 push 0 ; /ExitCode = 0
00401002 \. E8 3B010000 call <jmp.&kernel32>; \ExitProcess

; My testing code starts here:
00401007 90 nop
00401008 00 db 00
00401009 D5 db D5
0040100A 65 db 65 ; CHAR 'e'
0040100B 00 db 00
0040100C D5 db D5
0040100D 66 db 66 ; CHAR 'f'
0040100E 00 db 00
0040100F D5 db D5
00401010 67 db 67 ; CHAR 'g'
00401011 00 db 00
00401012 D5 db D5
00401013 . 65 66 67 00 ascii "efg",0
00401017 D5 db D5
00401018 03 db 03
00401019 D5 db D5
0040101A 65 db 65 ; CHAR 'e'
0040101B 03 db 03
0040101C D5 db D5
0040101D 66 db 66 ; CHAR 'f'
0040101E 03 db 03
0040101F D5 db D5
00401020 67 db 67 ; CHAR 'g'
00401021 03 db 03
00401022 D5 db D5
</pre>

If I try to enable disassembly using jump instruction, disassembly is only partial: :(

<pre>
00401000 > $ EB 07 jmp short MODRMSIB.00401009
00401002 . 6A 00 push 0 ; /ExitCode = 0
00401004 . E8 3B010000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00401009 > 90 nop
0040100A . 00D5 add ch,dl
0040100C . 65:00D5 add ch,dl ; Superfluous prefix
0040100F . 66:00D5 add ch,dl
00401012 . 67:00D5 add ch,dl ; Superfluous prefix
00401015 . 65:66:67:00D5 add ch,dl ; Superfluous prefix
0040101A . 03D5 add edx,ebp
0040101C . 65:03D5 add edx,ebp ; Superfluous prefix
0040101F . 66:03D5 add dx,bp
00401022 . 67:03D5 add edx,ebp ; Superfluous prefix
00401025 . 65:66:67:03D5 add dx,bp ; Superfluous prefix
0040102A . 90 nop
0040102B . 67:0037 add [bx],dh
0040102E . 66:67:0037 add [bx],dh
00401032 . 65:66:67:0037 add gs:[bx],dh
00401037 . 67:0337 add esi,[bx]
0040103A . 66:67:0337 add si,[bx]
0040103E . 65:66:67:0337 add si,gs:[bx]
00401043 . 90 nop
00401044 . 67:0035 add [di],dh
00401047 . 66:67:0035 add [di],dh
0040104B . 65:66:67:0035 add gs:[di],dh
00401050 . 67:0335 add esi,[di]
00401053 . 66:67:0335 add si,[di]
00401057 . 65:66:67:0335 add si,gs:[di]
0040105C . 90 nop
0040105D 00 db 00
0040105E . 35 65 00 ascii "5e",0
00401061 . 35 66 00 ascii "5f",0
00401064 . 35 67 00 ascii "5g",0
00401067 . 36 65 66 67 00>ascii "6efg",0
0040106C 36 db 36 ; CHAR '6'
</pre>

As you see it, this testing code is only series of ADD instructions with different size of registers, different source and destionation operands and different prefixes.

I think there have to be some way how to enable it. I don't believe Olly forgot to enable it.
TBD
10-10-2003, 03:46 AM
MazeGen: i think OD screws up on 40105D when it marks the next as data.

maybe you should use for you task RTA2 (http://ibiblio.org/paulc/rta/) which is based on Olly's disassembly engine.
MazeGen
10-10-2003, 04:00 PM
Thanks TBD,
RTA2 looks interesting. I am preparing for debugging with symbols (I code in MASM), so I have to look for another debugger anyway. I like OllyDbg, but it doesn't eat CodeView or PDB debug informations (produced by M$ LINK), so I'm trying to configure SICE or VC++ debugger.
By the way, do you have some experience with symbolic debugging MASM code?
Coops
10-10-2003, 04:19 PM
Hey guys, sounds like MazeGen is going to move on to another debugger for his project but I am still interested in a solution for the problem he raised since I have also encountered this problem once or twice... Has anyone else faced this and found a solution?
MazeGen
10-10-2003, 04:40 PM
Coops,
Do you mean the problem with marking code as data or symbolic debugging?

EDIT
Oh I got it, the problem with the code as data
/EDIT
TBD
10-13-2003, 04:02 AM
MazeGen: ollydbg.hlp: to read symbolic debugging information in Microsoft formats (CodeView, COFF, PDB and SYM), you need dbghelp.dll.

check this thread (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=40) for MASM32 symbolic debugging.

ps. use the power of search, Luke :)
sgdt
10-18-2003, 03:10 AM
Just a silly question, but have you tried the Control Up/Down arrows? You know, to set where the first byte at the top of the code window starts?
MazeGen
10-20-2003, 07:24 PM
TBD,
Thanks, I've used the power of search already, but I found only an information that plug-in for MASM (my compiler) is under development or so. So that that reference is new for me. It could be really groovy!
Anyway, I just tried both

\masm32\bin\Link /DEBUG /DEBUGTYPE:CV /SUBSYSTEM:WINDOWS main.obj
(does create main.pdb and main.ilk files)

and

\masm32\bin\Link /DEBUG /DEBUGTYPE:CV /PDB:NONE /SUBSYSTEM:WINDOWS
(it doesn't)

but OllyDbg seems to have no debug info: Ctrl+F5 not working, View -> Source window is empty, and I don't see the source line on info pane, as you've wrote in referenced post. Additionaly, I am not able to find out more informations about it...
If it really works, please help me... I don't want to move on to another debugger already!

P.S. I have dbghelp.dll in main OllyDbg folder.

sgdt,
I'll have a look later, thanks!
TBD
10-21-2003, 03:18 AM
MazeGen:here is what I did step by step using Iczelion Tutorial 4 - Paint

1. created a new directory, ODTest
2. copy paint.asm from \masm32\ICZTUTES\TUTE04
3. create make_debug.bat
4. add \masm32\bin\ml /c /coff /Zi paint.asm
5. add \masm32\bin\Link /DEBUG /DEBUGTYPE:CV /SUBSYSTEM:WINDOWS paint.obj
6. save and run make_debug.bat
7. open OllyDbg with paint.exe
8. CTRL+F5 (view Source)
9. ... and it works.

please try this and tell me if it works.

ps. MASM plugin SDK it is available on the stuph page
MazeGen
10-22-2003, 06:30 AM
TBD,
thank you very much! I've tried your test with paint.asm and it works. I tell you what happend: When I link my own asm prog without debug info, the code looks in OD exactly like my source code. OK. When I link the same with debug info, for some unknown reason the following code is added at the top of code:
<pre>
00401000 CC db CC
00401001 CC int3
00401002 CC int3
00401003 CC int3
00401004 CC int3
00401005 > E9 06000000 jmp SELECTOR._Start
0040100A CC int3
0040100B CC int3
0040100C CC int3
0040100D CC int3
0040100E CC int3
0040100F CC int3
00401010 > 8CC8 mov ax,cs ; my code
</pre>

And, if gray cursor is at the one of added instructions, all seems like there is no debug code, as I wrote already (not depending
on current eip). Well, that was the problem :)
It is really groovy, and I'm glad that additionaly I have no more need to move on to another dbg.

And MASM plugin SDK - I'll have a look.

Finally, I have one more question: I use tabs in my source code for justify, but the source line on info pane shows a little black panes instead of a tab-space. I don't know why, because the source view looks all right and I use the same font (System fixed font) in both. Maybe bug?

sgdt,
the Ctrl-Up/Down arrows works, but it has no influence on false marking code as data.

P.S. sorry for my english ;)
TBD
10-22-2003, 10:38 AM
MazeGen: i think the added code is from the linker to support the internal debuggers (VC, TD, ...) -> no info. i saw that on delphi and VC (if i remember correctly)

tabs: i dont know if it is a bug or a feature :) for me is a feature because i hate tabs in source :) (everyone has different tab setting -> ugly idents)

also, if you want, please add some details about your analyser :)
MazeGen
10-23-2003, 07:12 AM
TBD,
tabs: IMHO it's a bug (probably tab (ASCII 9) doesn't fit in recognized chars area, so OD shows small black panes). You're right, but tabs are very useful for justify source code. Anyway, OD has the same tab setting as my FAR editor :) but then the Visual Studio disasm has different setting :(

Analyser: I code a code obfuscator. It is generally intended for protection binary code written in assembly foremost. There is possible to get some papers about it. One of my goals is public commercial version. In these days I'm coding disassembler and I'm writing test-mode code for hand-checking its right behaviour. However, OD doesn't like this code and mark it as data :(

I'll send Olly specification about this problem, because nobody knows how to figure it out.
MazeGen
11-08-2003, 07:21 PM
Hi,
the following is my questions and Olly's answers ('*' means my comment):

> 1. The source line on info pane shows small black panes instead of
> real tabs. I think it's bug, because the source view window shows
> the tabs correctly. It makes reading single source line harder.

Pass 0x09 to ExtTextOutA(), and it will draw (depending on selected font)
either small squares (Terminal 6/Courier), black rectangles (system fixed font)
or vertical lines (ask me not which). I was too lazy to interprete 0x09 as
tabulation and pass it directly to my engine, that's all. Maybe I'll address
this errata-or-feature-but-not-a-bug in v1.10.

*I hope so, Olly ;)

> 2. Heuristic scanner seems to be too sensitive for strange code - it
> often marks code as data. I know it has to be sentive because of API
> parameters recognition etc. I tried to switch different switches in
> Debugging options, but non-event. I think the best approach to manage
> this problem can be some new switch, something like "Disassemble code
> section always as code, never data".

Hmm... just detele analysis, and Disassembler will display everything as a
code.

*Olly is right here, we miss Options -> Debugging Options -> Analysis 1: "Auto
*start analysis of main module" and "Keep analysis between sections" switches.
*They both have to be switched off. And it works!

But, of, course, this is not exactly what you want. There is one trick that
allows to remove analysis from the selected piece of code. Modify any command,
then select the piece you need and undo modifications. OllyDbg marks whole
selection as not analyzed.

*I didn't try it, but it seems to be good trick.


[plugin] WindowJuggler 0.05 BETA

RCE Messageboard's Regroupment > Plugins > [plugin] WindowJuggler 0.05 BETA
EsseEmme
10-08-2003, 08:31 PM
WindowJuggler 0.05 BETA is available.

http://www.ournet.md/~esseemme/

Cya,
EsseEmme
JDog45
10-09-2003, 02:42 AM
Thanks for putting this together for us...:)
EsseEmme
10-09-2003, 06:32 AM
You are welcome JDog45.

Please people, since I have reports of plugin not working under Windows 98 (and I expect Windows 95 and ME), post here the descriptions of exactly WHAT is NOT working under these operating systems.

Cya,
EsseEmme
EsseEmme
10-09-2003, 06:50 AM
I have verified that both versions (with and without CRT) of v0.05 of the pluging are not showing the main dialog box on w98 machines. I'll fix the issue and post a working version in 2-3 days.

Cya,
EsseEmme
EsseEmme
10-09-2003, 07:08 AM
mmmhhh, I'm finding a few problems even under Windows 2000.
Sorry for having released such a buggy version of the plugin. I'll solve everything during the coming weekend.

Cya,
EsseEmme


[plugin] WindowJuggler v0.06 BETA

RCE Messageboard's Regroupment > Plugins > [plugin] WindowJuggler v0.06 BETA
EsseEmme
10-11-2003, 11:55 AM
WindowJuggler v0.06 BETA is available at http://www.ournet.md/~esseemme/.

Tested on both Windows 98 and Windows 2000 boxes. Now everything should be working fine on all platforms.

Cya,
EsseEmme
Tacman
10-11-2003, 03:29 PM
Cool! Thanks for sharing
BasengBae
10-14-2003, 12:30 AM
Thank you EsseEmme...

Now for my win98 working verry well

Best Regard
BasengBae


Pls I need HMEMCPY tutor

RCE Messageboard's Regroupment > General > Pls I need HMEMCPY tutor
dreamweaver
10-12-2003, 07:35 AM
I'm running Win2K3.
Please help me. my email : dreamweaver@qznic.net
JDog45
10-12-2003, 08:15 AM
There is no hmemcpy on Win2K3
Ricardo Narvaja
10-12-2003, 08:58 AM
There is no HMEMCPY in NT/2k, XP and 2003 but the tutorial of POINT H is a similar point with the same effects of HMEMCPY and works in 90 % of the programs.

You want this?

Ricardo
Teerayoot
10-31-2003, 05:40 AM
WHere to get tutorial ?,Ricado
I want to see it's similar or not .
canoewhiteh2o
11-10-2003, 02:52 PM
Ricardo,

I realize there is no HMEMCPY in 2K and XP, but I would be interested in seeing the tutorial. My email is canoewhiteh2o@yahoo.com

Thanks
Teerayoot
11-11-2003, 04:31 AM
My email Teerayoot@bugsgroup.com .


Why i don't make a bpx in.....

RCE Messageboard's Regroupment > General > Why i don't make a bpx in.....
mskeng
10-12-2003, 06:24 PM
If i open an application, the application il olly start to program entry point, but why I do not break an istruction that start first of program entry point??

:)
Bye!
JDog45
10-12-2003, 11:05 PM
Its probably packed.


how to use symbols just like windbg

RCE Messageboard's Regroupment > General > how to use symbols just like windbg
a1rsupp1y
10-13-2003, 03:16 AM
under windbg, we can use command: dt -v -r ntdll!_TEB
to find something; and under ollydbg ,i have set symbols path ok.
i want to do the same work like dt -v -r ntdll!_TEB, how to do it ?
OYXin
11-28-2003, 02:33 AM
hi,a1rsupply,#music@0x557.:)It seems that ollydbg can't do that.


ollyGHOST ???

RCE Messageboard's Regroupment > General > ollyGHOST ???
psyCK0
10-15-2003, 06:33 PM
Hey all,

Heard of a tool called ollyGHOST that can be used
to hide olly from anti-debugging tricks... Anyone
knows if it really exists?
yaa
10-15-2003, 06:34 PM
Only under w9x ... http://biw.rult.at/vbb/upload/showthread.php?s=0ed349811027d47dd2d78ab c0650c38e&threadid=333
(http://biw.rult.at/vbb/upload/showthread.php?s=0ed349811027d47dd2d78abc0650c38e&threadid=333
)

yaa
sgr2001
10-21-2003, 12:23 PM
welcome!
He appeared there he studied verily this program PE Tools v1.5

Woe unto you! by the horn
http://www.petools.cjb.net/

Crawl


DeJunk plugin

RCE Messageboard's Regroupment > Plugins > DeJunk plugin
Cip
10-16-2003, 06:05 AM
Browsing the site AntiCrack Deutschland (http://www.anticrack.de/index.php), I've found an interesting "OllyDbg Plugin Collection 2.0 (http://www.anticrack.de/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=3905)".

In this zip file are contained almost all the zip files found in the OllyDbg Stuph page.
There is also a zip file containing DeJunk plugin v0.12, written by flyfancy (originally witten by ljtt).

Unfortunately the source files are not included in the zip and in the readme.txt the only readable thing (for me) it's the email address of the author.

Anyway it seems an interesting plugin...
(JunkType=Common,TELock,UltraProtect,Custom)
TBD
10-16-2003, 07:27 AM
thanks for the notification Cip.
i updated the OllyDbg stuph page with the DeJunk plugin (no need to download the entire Plugin Collection)
Teerayoot
10-31-2003, 05:36 AM
What's DeJunk use for ?
Cip
10-31-2003, 09:20 AM
Teerayoot: as stated in the Stuph page, it find/remove junkcode from packers (JunkType=Common,TELock,UltraProtect,Custom).


I'm new with Olly

RCE Messageboard's Regroupment > General > I'm new with Olly
NutverLal
10-16-2003, 11:35 AM
Hi,
I am new to Olly. I'v used SoftICE before.
Where is the documentation of Ollydbg?
TBD
10-16-2003, 12:05 PM
NutverLal: usually in the .hlp file.
but mostly it is by trial-n-error and the reading the .hlp file :)

if you use the command line plugin you will find a lot of similarities with SoftICE
NutverLal
10-17-2003, 11:42 AM
Thanks, mine was currupt.
I am developing a plugin that captures the passwords...
I am looking for API Doc.

Thanks for your quick response...
EsseEmme
10-17-2003, 02:13 PM
The documentation for OllyDbg's APIs can be found within the SDK at:

http://home.t-online.de/home/ollydbg/plug108.zip

Cya,
EsseEmme
NutverLal
10-21-2003, 04:44 AM
Thanks EsseEmme,
I'm buissy now a days due to exams.
I'l be back soon. Though I'm working on that Plug-in.

- NutverLal
Teerayoot
10-22-2003, 07:44 AM
I think you too hurry ,all things go wrong with you.
Look around you first before take a question.


icon in url ?

RCE Messageboard's Regroupment > Plugins > icon in url ?
Roomi
10-18-2003, 11:07 AM
hi,
I have seen there is a red icon in yuor site address bar...
how you do make that..
can u please tell.

thanks for any help..
EsseEmme
10-18-2003, 03:26 PM
Although this is not *exactly* a OllyDbg related post here is your answer (http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml/howto/shortcuticon.asp).

EsseEmme
Roomi
10-18-2003, 03:32 PM
thanks


Problem with borland debug information

RCE Messageboard's Regroupment > Bugs > Problem with borland debug information
gfplus
10-21-2003, 11:31 AM
Hi, all,
special greetings to TBD, and Olly

I have Delphi project with >100 forms and units. When try to debug it, and want to see source debugger can't see any source file. I check exe - debug section is there BUT !!! 16MB !!! big.

I check back to version 1.04 - this version find source paths, but source names are totaly wrong (not valid names, seams that there is some problems with offsets)

If I try with smaller file than all is perfect.

for tbd: soon I will release mapconverter plugin written completly in Delphi ;-)
I still fighting with conversion of plugin.h to delphi :-(
TBD
10-22-2003, 03:42 AM
gfplus: maybe we should wait for OD 2.0 ? :)
have you sent a bug report to Olly ?

also when you release mapconv it should be nice to have the SDK for delphi too.


Not sure??

RCE Messageboard's Regroupment > General > Not sure??
Teerayoot
10-22-2003, 08:00 AM
I have made some debuging on shareware program that limit day trial to 15 days.
That prog use commercial protection to protect itself.
It's packed and have antidebugging protect.
When i try to load them into Ollydbg ,it say "You must unload debugger first" (sorry if the word do not same exactly as report but it's invole about that)

even ,i already remove debugger flag (IsdebuggerPresent) api.
even i change ollyddg window class name and ollydbg window name.

But that prog still say "You must unload debugger first" .

i do not paste that program name here ,but his company have many software that use this commercial protector protect it.

Sorry for ungood englist grammar.
and sorry for too long that i have gone for this board ,
i am busy with making audio player that have some cracking protection .

Teerayoot ,reguard.
psyCK0
10-22-2003, 12:20 PM
Identify the commercial protection and remove it... There are numerous ways to detect a debugger, IsDebuggerPresent is only one of those.. Might be somthing like:
.xxx:00401044 mov ecx, large fs:30h
.xxx:0040104B test ecx, ecx
.xxx:0040104D js NO_DEBUGGER
Just one of the tricks...

Not a good forum for such questions I think... Try Woodmann's board for example...


watching

RCE Messageboard's Regroupment > General > watching
ndnd
10-24-2003, 04:19 AM
hi,
i've been analysing some software recently and the way i usually do it is i wait until i break something and the connection dies. This is pretty ineffective so today i attached ollydbg to the process and i was greeted by nothing. what i really wanted was to be able to watch the registers being modified in real time etc...so i can get a good picture of the application. I looked everywhere for a place to see my data being sent to the server (its a SMTP server) and could not find anything. I looked at some of the 40+ entries in 'Executable modules' and still nothing. Im running XP if this makes any difference.

Anyway, any help would be appreciated!
- nd


attach to process

RCE Messageboard's Regroupment > General > attach to process
Jurgen
10-24-2003, 05:06 PM
For what can you use of attach to process ?

Thank you.


some little problems

RCE Messageboard's Regroupment > General > some little problems
Crono
10-26-2003, 08:49 AM
Hi, i started (from 0) to use ollydbg some weeks ago for "educational purposes" (i'm not joking, i really needed it at the uni ;) ), and i loved it. Although debuggers are (imho) primarly used from the mass to crack programs, i found it useful to debug some c programs, and to learn how some compilers work. I also did many "crackme", and i think they're great to learn things.

However i think that ollydbg has 1-2 "workflow" limitations, and i'm here to ask you some help (maybe i only missed some things in the options dialog :) )

One is the "feature" that sometimes disables breakpoints when you ctrl-f2 (restart). Why it does that? Is there a way to disable this thing?

Two is the keybindings. I'm very disappointed with the way keys are associated to actions: why every key opens the "assemble" (or comment ecc) dialog? I mean, i'm in a debugger, primarly i'm searching for things, settings breakpoints, reading memory... wouldn't be better to bind, for example, the B key to the breakpoints window, and to close it when it's open? I mean, if i want to see breakpoint now i have to use the mouse to click on the blue button, or press ALT-B (a bit tricky..), and to close it i have to press CTRL-F4 (argh!) or use the mouse. Imho, it would be better to have B open the bp win, and B to close it. And so on for other things (like CTRL-N, CTRL-E). When i debug a program i almost never modify the assembly code, in fact now i use the open comment dialog just 'cause sometimes i put comments on the code... i think that a "A" key that acts like a double click on the asm code would be better.

Or am i only saying stupidities? :)

However, thanks for this great app, it's the best and it's free.
psyCK0
10-26-2003, 12:14 PM
One is the "feature" that sometimes disables breakpoints when you ctrl-f2 (restart).
The only time it does this is when you trace into a dll etc. When entering a new module press CTRL-A, then set breakpoints. Then they will be saved.

Two is the keybindings
Yeah, it'd be cool if Olly allowed one to change the default key assignments...
Teerayoot
10-31-2003, 05:54 AM
Crono One is the "feature" that sometimes disables breakpoints when you ctrl-f2 (restart).
Because that prog are packed ,you must use hw bp.
OD disable it for security reason.

keybindings.
If you fimilair with Borland c++ or delphi,that it 's same keybindings with some keybindings add because olly have more feature


What is the asm code executed by IsDebuggerPresent

RCE Messageboard's Regroupment > General > What is the asm code executed by IsDebuggerPresent
yaa
10-28-2003, 12:50 PM
Hello,

could anyone with a w9x machine cut and paste the assembly code executed by the IsDebuggerPresent API?
Thx.

yaa
psyCK0
10-29-2003, 08:50 PM
Well, have no 9x machine handy but as far as I can remember it was something like:
<pre>mov ecx, large fs:30h
test ecx, ecx
js short NO_DEBUGGER</pre>


Show User Screen????

RCE Messageboard's Regroupment > General > Show User Screen????
mark_E
10-28-2003, 03:48 PM
If I recall correctly, Softice has a handy macro associated with the 'F4' button which displays the user screen.
I can't find anything similar in Olly. Does such a function exist?

mark_E
Ricardo Narvaja
10-28-2003, 05:55 PM
In softice F4 is necesary, alt + TAB dont function, but in OLLYDBG is not necesary WITH ALT +TAB you can switch to OLLYDBG when you WANT.

Ricardo
mark_E
10-28-2003, 06:27 PM
Hi Ricardo,

What I'm after is a way of viewing the deuggees window without the remanents Ollys window appearing in it. i.e. redraw the screen.
I must admit tho' I didn't try task switching, just minimising Olly.

mark_E
JDog45
10-29-2003, 07:33 PM
What I've done is go to Window and then select "Always On Top". This gets rid of any other remanent left over by Olly because you have to minimize Olly before you can see any other background windows. I've too had that problem before with debugging on a breakpoint.
Teerayoot
10-31-2003, 05:33 AM
JDog45 are truely,that is the way to eliminate remanent windows.
mark_E
11-05-2003, 05:16 PM
. . . but I actually meant the debugee (left the 'b' out to confuse you all?)NOT the debugger.
Thinking further on the matter this could be trickier than envisaged, so never mind - not a biggie - thanks for your input anyway.

mark_E
jayte
11-07-2003, 05:46 AM
It's a very important feature, imo, particularly with graphics oriented apps. V2 might bring us remote capabilities.

Jeff


can´t find OEP with DUMP Plugin

RCE Messageboard's Regroupment > Plugins > can´t find OEP with DUMP Plugin
greg
10-29-2003, 01:27 PM
Hello

I read some tuts about " how to use Olly dump "
The tuts are about asprotect protected examples and fsg protected exampels.
and it´s always like this :
1.load the exe
2. Plugin->OllyDUMP->Find OEP by ....
3. Wait while Olly is tracing
4. Dump at the OEP

But this method does not work with my olly.
Olly always says
Thread XXXXXX terminated, trace stopped
and do not stop at the OEP or find the OEP

My olly only find the OEP when i use upx packed exampels.

Can somebody help me?
Perhaps i have to change some Debugging options because in the tutorials everything works fine.

Thanks
Ricardo Narvaja
10-29-2003, 03:15 PM
In asprotect this method does not work.

1)go to DEBUGGING OPTIONS-EXCEPTIONS and quit all marks, only let the first mark.
2)RUN
3)the program stop in exceptions pass all with SHIFT + F9.
4)look the value of the last exception befores the program begin.
5)repeat the process again restarting the program and go the this last exception before the program begin.
6)PASS WITH SHIFT + F7 (NOT f9 in this moment)
7)go to VIEW-MEMORY and in the section code (STARTS in 401000) put a BREAKPOINT MEMORY ON ACESS.
8)RUN
9)WHEN THE PROGRAM STOP IN MEMORY BREAKPOINT ON EXECUTION (look in the lower left corner) you are in the entry point, or if the program has STOLEN BYTES in the first line executed of original program.

Ricardo
psyCK0
10-29-2003, 03:27 PM
Nice technique Ricardo! How do you recover the stolen bytes?
greg
10-29-2003, 05:26 PM
Thanks a lot Ricardo !
You really helped me

Hmm..
Can i ask you one more thing? Hope you don´t get bored

Is there a similar way for Aspack, because with Aspack number 3 ( stop in exeptions pass) don´t work.

Greg
JDog45
10-29-2003, 07:30 PM
Ricardo always knows all kinds of tricks..;)
Ricardo Narvaja
10-29-2003, 08:51 PM
well the stolen bytes are long for explain in a forum , i have tuts but this is not a cracking forum, but the general method is look for a value in one register when you reach the OEP or the FIRST LINE EXECUTED OF THE PROGRAM (if eax=0, take other register.)
Repeat the process till pass last exception and put a bpm in the section osf asprotect (the section of the exceptions), RUN, when program stop
GO TO DEBUGGING OPTIONS-TRACE and quit all marks and in DEBUG SET CONDITION put
EAX==XXXXXX

XXXXXX is the value you read in eax when stop in OEP, and configure RUN TRACE to LOG TO TXT for the case of the stolen erased, in this case in the txt, will be stored and not erased.
TRACE INTO

LOOK IN RUN TRACE WINDOW, there are one o two loops for slow the tracing, stop the trace in this case, jump to the end of the loop and continue tracing.

If the program stop when EAX==XXXXXX you are in the stolen bytes before this bytes are executed.
In the general cases this work well, if are encripted stolen bytes is other thing, is other method jeje.

Thos methods of OEP are only for asprotects, not for aspack, in aspack in NT/2000/XP you can use the PUSHAD method (this method function well in many packers NOT ARMADILLO, ASPROTECT, PELOCK, TELOCK)in other packers goes well.

Execute the PUSHAD in the beginning of the program with f8 and look in the stack

for example

if your top value of the stack is

124478 09009876

go to the DUMP and GOTO EXPRESSION=124478

mark the 4 bytes and HARDWARE BPX ON ACESSS

Rin and the program when stops in the next line of a POPAD are just to JUMP to OEP, press f7 one or two lines and you are in the FTP.
(ftp://FTP.
)

Ricardo Narvaja
Ricardo Narvaja
10-29-2003, 08:53 PM
grr, you are in the OEP not FTP, sorry

Ricardo
greg
10-30-2003, 07:20 PM
Yep

THANKS A LOT RICARDO.
You are " THE MAN" :)

Greg
Teerayoot
10-30-2003, 08:17 PM
Not nessary to be on OEP.
:D

You can even dump after stolen excuted.
but in dumped file let's fix it with the real byte.

Work well for me (Asprotect).


[forum] only OD bugs and non crack posts from now

RCE Messageboard's Regroupment > The Heap > [forum] only OD bugs and non crack posts from now
TBD
10-30-2003, 08:06 AM
hi ppl,

it seems that nowdays all new posts are cracking related (including crackmes). as I still want to keep this hosting I will delete all cracking related posts (including requests for new cracking features for next versions)

I am sorry that we arrived at this point, but this forum was intented a place were OD users can share plugins, find bugs, ... and not a tutorial forum on "how to crack".

If someone doesnt agree to this "restrictions" (s)he is free to look to another forum.

::remember:: because it is free you dont need to abuse it ... because it can be closed down !
greg
10-30-2003, 07:33 PM
Sorry IF i have done something wrong
--> "It seems that nowadays all new posts are cracking related"
I do not think that i posted a cracking related post but sometimes it depends on the point of view.
And yes you are right, closing down this great forum would be "not good".
**feel sorry**

Greg
Teerayoot
10-30-2003, 08:11 PM
I think if do not have cracking releat question a bit,the forum is not interresting.
So that let's cracking play a bit not too much . ;)
TBD
10-31-2003, 03:49 AM
Teerayoot: i'm sorry if "is not interesting" for you, but no more cracking posts are allowed from now on !

even if OD can be used for this that doesnt mean that is the only purpose.

so let's keep it only on creating a better OD :)


Crackmes

RCE Messageboard's Regroupment > General > Crackmes
1bitshort
10-31-2003, 02:20 PM
Firstly, please keep this thread constructive and polite. Everyone reading this thread is no doubt a big fan of both these forums and the magnificent OllyDbg debugger (all hail!), so lets work together to ensure they both remain available for all of us to enjoy.

My query is just in regards to "crackmes". Regardless of which country you live in, it isn't illegal to post or host crackmes or solutions to crackmes, so I'm just wondering what your thoughts are about these? We absolutely _DONT_ want this forum becoming a "how do I crack this" forum, but at the same time, crackmes offer a unique way of learning about various protection schemes, and in the case of analysis (virus analysis, etc), such protections must be overcome before the real code can be analysed so crackmes can offer a unique shortcut into learning these protections.

In other words, there are reasons both FOR and AGAINST being able to post crackmes and crackme solutions here. I was just hoping for a _CONSTRUCTIVE_, mature, and polite discussion about why they should, or shouldn't be, allowed here.

Thankyou to everyone who posts their thoughts, and peace to everyone else. :)
JDog45
10-31-2003, 04:07 PM
I'm all for crackmes for the reasons you mentioned above. Helps software makers find the flaws in their security.
yaa
11-01-2003, 11:53 AM
Talking of crackmes on this forum isn't probably harmful. Although one may argue on what really lies behind playing with crackmes I believe crackmes are often very intelligently designed small pieces of code that do surprising things. But I do agree with TBD that this must not become a cracking forum.

yaa
TBD
11-03-2003, 09:08 AM
reasons both FOR and AGAINST being able to post crackmes and crackme solutions here

against
- a simple google search for "how to crack with OllyDbg" will return the forum and in 99% cases they will post a crack related question without reading the rules of the forum
- as the one who host the forum requested that no cracking related posts should be allowed I want to respect that because I like it here. and also my intention was not to create a cracking forum - only a OD users forum

for
- there are some nice crackmes that involve nice tricks with x86 opcodes and SEH that are a good test for OD. so, some snippets of code from this one are allowed for testing
Ricardo Narvaja
11-03-2003, 07:39 PM
For

The 99,99 users of OLLYDBG are crackers and the reports of BUGS of different versions of OLLY was made 99,99 % made by crackers, and the 0.01 % are one programmer and this are very busy with your own program for write for the bugs.

Ricardo Narvaja
Cip
11-04-2003, 06:43 AM
Ricardo Narvaja: it does not matter what people are doing with OllyDbg. If they use it for cracks and they discover bugs or missing features they can always report it on this board.

The point of TBD is basically that if they have problem on "how to crack...", they can discuss it somewhere else. Not here!

If this board will be closed because of cracking related discussions, we will all (crackers and not) miss a place where we have the opportunity to drive the improvements to OllyDbg.

Personally, I'm not against crackmes but I perfectly agree with TBD on not allowing them because of the reasons he wrote.
Ricardo Narvaja
11-04-2003, 04:54 PM
Well i accept the rules of the forum, but i`m only putting a opinion, for me OLLYDBG is used for crackers, and this are the users and the beta testers , if i cannot talk about cracks crackmes, etc very well iaccept this, but is only my opinion or is prohibited too.

Ricardo
cyazz
11-05-2003, 06:44 AM
perhaps you could link a forum on which is discussed how to resolve crackmes ? (crackmes only)
there would be a seperation of the q's here!

cyazz


breakpoint on USER32.PostMessage

RCE Messageboard's Regroupment > General > breakpoint on USER32.PostMessage
ohhara
10-31-2003, 11:51 PM
I tried to set break point on USER32.PostMessage. After setting the breakpoint and continue the execution, the ollydbg hangs(1.09c). Did I do something wrong? I am Sorry if it is a foolish question.

I want to know who posts which messages in the target application. If there is anyone knows another good way, please let me know. It would be great help.

Regards.

--
Taeho Oh ( ohhara@postech.edu, ohhara@plus.or.kr ) http://ohhara.sarang.net
Postech ( Pohang University of Science and Technology ) http://www.postech.edu
PLUS ( Postech Laboratory for Unix Security ) http://www.plus.or.kr
Teerayoot
11-01-2003, 05:57 AM
That ploblem happen if you try to set breakpoint on main module,
try on user32.dll module ,on PostMessage right click and choose Togle breakpoint .
Conditional breakpoint work well if want to know which code call api.


Can OllyDbg debug DOS (MZ) programs?

RCE Messageboard's Regroupment > General > Can OllyDbg debug DOS (MZ) programs?
jim_monte
11-02-2003, 07:20 PM
Hi,

I have been having problems using 32-bit registers while
debugging with CodeView. Someone recommended OllyDbg to
debug DOS (MZ) programs. I am not at all familiar with
OllyDbg, so I would appreciate some information regarding
its ability to debug MZ and COM programs. Thanks for
any info.

Jim Monte
_Squidge_
11-02-2003, 08:11 PM
Ollydbg can debug 32-bit programs only.
Teerayoot
11-03-2003, 01:34 AM
Let's hiew to for you.
Althouge ,he can not run as debugger ,but it's can disasamble and you can anlyze to make some patch.


About .net

RCE Messageboard's Regroupment > General > About .net
AlexZ
11-03-2003, 12:30 AM
ollydbg is really great ,
i'd like to know, will it support .NET framework in later version?
Teerayoot
11-03-2003, 01:36 AM
I think maybe.
because .NET framework file is a modified of pe format.


Ollydbg stepping bug?

RCE Messageboard's Regroupment > General > Ollydbg stepping bug?
Squidge
11-04-2003, 12:15 PM
Can anyone help with the following code? The *seems* to work standalone (doesn't crash), but doesn't work under Ollydbg - it gives the result indicated in the comments, and therefore gives an Access Violation on the REP MOVS command. Since the ADD command I'm using (81) is supposed to be for immediate adding (ie - not from memory) I'm completely at a loss of why the calculation is wrong.

The entire code for the function is below, which was written using Ollydbg 1.09d's assembler.

code:

00181040 > 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; mydll.J4 (get structure pointer)
00181044 57 PUSH EDI
00181045 56 PUSH ESI
00181046 E8 00000000 CALL mydll.0018104B ; get current EIP value
0018104B 5E POP ESI ; for self relocation [0x18104B]
0018104C 81C6 B5100000 ADD ESI,10B5 ; add 0x10B5 to 0x18104b gives 0xE42100 ?!
00181052 8BF8 MOV EDI,EAX
00181054 51 PUSH ECX
00181055 B9 00020000 MOV ECX,200
0018105A F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] ; Fill in structure
0018105C EB 17 JMP SHORT mydll.0018106D
0018105E 90 NOP
0018105F 90 NOP
00181060 > 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; mydll.J4CD
00181064 50 PUSH EAX
00181065 E8 D6FFFFFF CALL mydll.J4
0018106A C3 RETN
0018106B 90 NOP
0018106C 90 NOP
0018106D 33C0 XOR EAX,EAX
0018106F 59 POP ECX
00181070 5E POP ESI
00181071 5F POP EDI
00181072 C2 0400 RETN 4

I've checked the Intel command reference, and the add command I'm using is definitely the immediate version (at first I thought maybe it was adding values from memory, but this is not the case).

To try and get some more information, I've also set ESI to zero in Ollydbg directly before the add command, and got this:

ESI before ADD = 00000000
ESI after ADD = 00CC10B5

The only other I can think of is bad relocation, but I don't use relocation in this dll (the codes is completely relocatable itself - no need for fixups).

Just thought about another thing - CC is the opcode for INT3, which Ollydbg uses to step through code, correct? Is it possible that Ollydbg guessed the wrong instruction size wrong and put the CC in the wrong place, but didn't remove it correctly afterwards?
oh me anon
11-04-2003, 01:49 PM
00402404 8B4424 04 MOV EAX, DWORD PTR SS:[ESP+4] ; stack ss :[0012ffbc] = 00000000 so eax = 00000000 after execution
00402408 57 PUSH EDI ; edi = 00000000
00402409 56 PUSH ESI ; esi = 4034c4
0040240A E8 00000000 CALL ****.0040240F ; esp =40240f == retn from call
0040240F 5E POP ESI ; so esi now becomes 40240f
00402410 81C6 B5100000 ADD ESI, 10B5 ; esi now becomes 004034c4
00402416 90 NOP

well i assembled this in place in olly and used new origin here to execute this
it seems to work properly but i am using 1.09b not d so one idea could be check ur code in that version and report if its a problem
drizz
11-20-2003, 03:40 PM
...related

can someone confirm this?
this crashes on WinMe when singlestepped, but works ok on Win2k

start:
add esp,23h
lea esp,[esp+ebp-23h]; <- here
sub esp,ebp
retn
end start

using 1.09d


OK - What am I doing wrong (CMDLINE)

RCE Messageboard's Regroupment > General > OK - What am I doing wrong (CMDLINE)
bboitano
11-04-2003, 02:21 PM
I know this must be a stupid question but why doean't my cmdline plugin work? Pressing Alt+F1 does nothing. I have cmdline.dll in the same directory as Ollydbg (1.09d (Step 4))

Running XP Pro as Admin.

Tried reinstalling (well - re-extracting!) makes no difference.

Path to Ollydbg is C:\Documents and Settings\Admin\Desktop\Tools\ida\odbg109d - is that too long - does it need to be off the root?

Thanks in advance
Ricardo Narvaja
11-04-2003, 04:48 PM
In APPAREANCE-DIRECTORIES are the configuration of the paths of plugins, if the path is bad , change the path to the correct.

Ricardo
bboitano
11-05-2003, 06:47 AM
Ricardo,

Thanks for that. I'm off to hang my head in shame ....

Cheers


Its been quite a while since the last OllyDbg rele

RCE Messageboard's Regroupment > General > Its been quite a while since the last OllyDbg rele
1bitshort
11-08-2003, 01:38 PM
This is just an observation, not a criticism!!! :)

It's been quite a while since the last OllyDbg release!
This isn't a criticism because OllyDbg in its current state does everything I need it to do, and more, and for $0 I reckon I got my moneys worth and more :)

But because I love OllyDbg so much, I cant help but be curious about the status of OllyDbg v2 :) :) :)

Anyway, just wanted to say "Good Luck!" to Oleh with the upcoming v2 release, we're looking forward to it! :)
Teerayoot
11-09-2003, 09:02 AM
I agreed ,too long ,never heard about news upcomming V2.0 ;
JUst tell us ,what are you doing ,Oley?
TBD
11-10-2003, 04:18 AM
Olly: "so OllyDbg 2.0 goes slowly forwards (already more than 1 MB code). Now I work on analysis. It is mainly the same as in 1.09 but significantly faster. Maybe I'll make fast analysis (only distinguishing between code and data) obligatory for all modules."

so, it is working on it. no "when is finished" questions please. when is finished (or a beta) it will be released.

ps.
* no, i dont have a beta.
* yes, i saw an early beta. (in may.2oo3)
yaa
11-10-2003, 08:00 AM
I wonder if Oleh is thinking of releasing a 1.10 version of OllyDbg ... a think he has gathered a long list of smaller or bigger bugs in all there months on the current version of the debugger.

yaa
Ricardo Narvaja
11-10-2003, 04:47 PM
I mail OLEH for a bug of the 1.09d version and he say me , the bug will be corrected in 1.10 version, and this was three weeks ago, for this reason i think 1.10 will be released before 2.0.

Ricardo
yaa
11-10-2003, 08:14 PM
I also mailed a few of what Oleh himself told to be bugs that had been already reported to him. So it seems that even the latest version has a whole list of bugs awaiting to be fixed.

yaa


Strange analysis

RCE Messageboard's Regroupment > General > Strange analysis
psyCK0
11-09-2003, 11:56 PM
When I try to debug an exe that includes this code:
<pre>
GetFile proc hWin:HWND

mov ofn.lStructSize,SIZEOF ofn
push hWin
pop ofn.hWndOwner
push hInstance
pop ofn.hInstance
mov ofn.lpstrFilter, OFFSET FilterString
mov ofn.lpstrFile, OFFSET buffer
mov ofn.nMaxFile,MAXSIZE
mov ofn.Flags, OFN_FILEMUSTEXIST or \
OFN_PATHMUSTEXIST or OFN_LONGNAMES or \
OFN_EXPLORER or OFN_HIDEREADONLY

invoke GetOpenFileName, ADDR ofn
ret

GetFile endp

DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM

mov eax,uMsg

.if eax == WM_INITDIALOG
; Set up dialog icons
invoke LoadImage, hInstance, addr szFileIcon, IMAGE_ICON, 32, 32, LR_LOADFROMFILE
.if eax != 0
invoke SendMessage, hWin, WM_SETICON, ICON_BIG, eax
.endif
</pre>

....
....

Ollys analysis produces:

....
....

<pre>
00401031 $ 55 PUSH EBP
00401032 . 8BEC MOV EBP,ESP
00401034 . C705 31314000>MOV DWORD PTR DS:[ofn],4C
0040103E . FF75 08 PUSH DWORD PTR SS:[EBP+8]
00401041 . 8F05 35314000 POP DWORD PTR DS:[403135]
00401047 . FF35 80314000 PUSH DWORD PTR DS:[403180]
0040104D . 8F05 39314000 POP DWORD PTR DS:[403139]
00401053 C7 DB C7
00401054 05 DB 05
00401055 > 3D314000 DD Cryptor.0040313D
00401059 0E304000 DD OFFSET Cryptor.FilterString ; ASCII "EXE Files"
0040105D . C705 4D314000>MOV DWORD PTR DS:[40314D],OFFSET Cryptor>
00401067 . C705 51314000>MOV DWORD PTR DS:[403151],104
00401071 . C705 65314000>MOV DWORD PTR DS:[403165],281804
0040107B . 68 31314000 PUSH OFFSET Cryptor.ofn ; /pOpenFileName = OFFSET Cryptor.ofn
00401080 . E8 B5000000 CALL <JMP.&comdlg32.GetOpenFileNameA> ; \GetOpenFileNameA
00401085 . C9 LEAVE
00401086 . C2 0400 RETN 4
00401089 55 DB 55 ; CHAR 'U'
0040108A 8B DB 8B
0040108B EC DB EC
0040108C 8B DB 8B
0040108D 45 DB 45 ; CHAR 'E'
0040108E 0C DB 0C
0040108F 3D DB 3D ; CHAR '='
00401090 10 DB 10
00401091 01 DB 01
00401092 00 DB 00
00401093 00 DB 00
00401094 75 DB 75 ; CHAR 'u'
00401095 2E DB 2E ; CHAR '.'
00401096 6A DB 6A ; CHAR 'j'
00401097 10 DB 10
00401098 6A DB 6A ; CHAR 'j'
00401099 20 DB 20 ; CHAR ' '
0040109A 6A DB 6A ; CHAR 'j'
0040109B 20 DB 20 ; CHAR ' '
0040109C 6A DB 6A ; CHAR 'j'
0040109D 01 DB 01
0040109E 68 DB 68 ; CHAR 'h'
0040109F 00304000 DD OFFSET Cryptor.szFileIcon ; ASCII "xxx.ico"
004010A3 FF DB FF
004010A4 35 DB 35 ; CHAR '5'
004010A5 80314000 DD Cryptor.00403180
004010A9 E8 DB E8
004010AA 74 DB 74 ; CHAR 't'
004010AB 00 DB 00
004010AC 00 DB 00
004010AD > 00 DB 00
004010AE . 0BC0 OR EAX,EAX
004010B0 . 74 55 JE SHORT Cryptor.00401107
004010B2 . 50 PUSH EAX ; /lParam
004010B3 . 6A 01 PUSH 1 ; |wParam = 1
004010B5 . 68 80000000 PUSH 80 ; |Message = WM_SETICON
004010BA . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
004010BD . E8 6C000000 CALL <JMP.&user32.SendMessageA> ; \SendMessageA
</pre>

....
....

Why is it showing all this DB stuff???
psyCK0
11-10-2003, 12:09 AM
Hmm, seems like this problem was discussed in another thread... Still there is no good resolution, removing analysis is not the way to go =)
MazeGen
11-12-2003, 06:07 PM
psyCK0,
What about that (message from Olly from the thread)?
But, of, course, this is not exactly what you want. There is one trick that
allows to remove analysis from the selected piece of code. Modify any command,
then select the piece you need and undo modifications. OllyDbg marks whole
selection as not analyzed.


BUG IN THIS FORUM

RCE Messageboard's Regroupment > The Heap > BUG IN THIS FORUM
Ricardo Narvaja
11-10-2003, 04:50 PM
When i enter without login in this forum, i see new posts, and when i login for reply, i see older posts, and the new post i want reply dissapear, and i cannot reply, because without login is not possible reply a post.
TBD
11-11-2003, 03:34 AM
Ricardo Narvaja: "i see older posts" on the first page or in each forum ?
if you see on the first page you must select "Sorted by: New answers"
Ricardo Narvaja
11-12-2003, 05:45 AM
thanks.

Ricardo


Memory searcher plugin?

RCE Messageboard's Regroupment > Plugins > Memory searcher plugin?
spongebob
11-12-2003, 04:17 AM
I need help making a memory searcher plugin.

Here is a description:

"I would really like a Memory Searcher!

You search for a value in memory, and then you can filter your search results by saying 'value has changed' or 'value has increased', and you will eventually get the location of your value. Then have another search that finds the pointer to the value you just found.

It's annoying to have to use an extra program to do this, that's why I think it would be great if it was integrated into Olly."

Once you find the location of your value in memory, I also want to be able to break on it, and land in it's code.

First of all, Can this be done?

If so, then how should I go about making it?

Thanks.
1bitshort
11-12-2003, 02:53 PM
I cant answer your question in regards to plugins, but in case you didnt know OllyDbg already has an excellent memory search function. To use it, just press Alt+M (or select the View menu, then Memory). Then, press Alt+B (or right-click and select the Search popup menu). It allows you to search for ascii, unicode, and hex expressions, allows you to search just one section of memory or all sections, and supports optional case sensitivity, so Im not sure if theres really a need for a memory search plugin
JDog45
11-12-2003, 03:34 PM
I think he's talking more like set a bp. Indicate that EAX=0 run the program have it break again. Now indicate that EAX=1 and then his little prog will show you the location in the code where that takes place. Am I close?
spongebob
11-12-2003, 09:18 PM
Well say you search for a value of "2" in memory, you will get many many results. So the mem-searcher must have a filter feature, so you can play around in the process then go back to the searcher and say "value has changed" or "value has decreased", and so by continuing this process you eventually find the exact location of the value you want to manipulate.
1bitshort
11-12-2003, 11:55 PM
Like what those 'game trainers' do? For example, your score might be 10000 so you do a mem search for all values that are 10000. Then you keep playing to raise your score, and then do another memory search with the new value. Eventually (usually after just two or three goes) you'll find just one or two locations where this value is constantly being stored. Is that what you meant?
JDog45
11-13-2003, 03:32 AM
I think that's exactly what he means. So for our purpose like if 30 days is it for a trial prog and then the next day its 29, it will take you to the location in the code that does that change?
sgdt
11-16-2003, 02:52 AM
Now THAT would be frik'n awsome!

VC++ debugger shows red for changed items, but only on items actually shown. It would be fantastic to step over a long winded routine and see the delta of what all it did.

I guess if the process space changes in size, say due to dynamic allocation, it would have to assume that new space as "changed", but that'd be ok.

That would be cool. I guess it'd be a memory pig, duplicating the selected process's memory space, but computers now days are big too.

I wonder if it could be detected? In other words, if a program wanted to know if this was happening to it, could it do a VirtualProtect and set a PAGE_GUARD on a piece of memory it KNEW should never be accessed, and then later make sure the PAGE_GUARD had never been triggered? The only way it would show triggered is if someone had accessed that memory. I guess if it was ever an issue, such a plug-in could remember to reset anything prior to returning control.

hmmmm.....
spongebob
11-16-2003, 06:04 AM
It's nothing revolutionary.

Have you ever used a memory searcher like Tsearch or Artmoney? I just want something like that, but to have it integrated with Olly.
asiandragon
11-16-2003, 11:59 AM
There are some program when I push F9 to run a program, and it doesn't work. The program doesn't not run. And I see a message:
---------------------------------------------------------------------- ----
Access violation when writing to [00000000]- use Shift+F7/F8/F9 to pass
exception to program
---------------------------------------------------------------------- -----
What should I do now?Because I know that software unpacked by ASProtect and I want to find OEP. But when I can't run the software, I can't find OEP. Can somebody help me?
JDog45
11-16-2003, 03:31 PM
There are some program when I push F9 to run a program, and it doesn't work. The program doesn't not run. And I see a message:
---------------------------------------------------------------------- ----
Access violation when writing to [00000000]- use Shift+F7/F8/F9 to pass
exception to program
---------------------------------------------------------------------- -----
What should I do now?Because I know that software unpacked by ASProtect and I want to find OEP. But when I can't run the software, I can't find OEP. Can somebody help me?

Shouldn't this be an entirely new thread??? When you get that error.....do what it says. Press Shift+F9
sgdt
11-19-2003, 12:55 PM
There are some program when I push F9 to run a program, and it doesn't work. The program doesn't not run. And I see a message:
---------------------------------------------------------------------- ----
Access violation when writing to [00000000]- use Shift+F7/F8/F9 to pass
exception to program
---------------------------------------------------------------------- -----
What should I do now?Because I know that software unpacked by ASProtect and I want to find OEP. But when I can't run the software, I can't find OEP. Can somebody help me?

The exception needs to be passed to the application. It is going to zap your hardware break points.

To get back on topic, one "feature" that would be REALLY handy would be "cut-n-paste" hardware breakpoints. In otherwords, say have one or more "hardware breakpoint profiles" (one of which would be "empty") that you could choose from on the fly prior to stepping or continuing or running. I've never seen something like that in a debugger, but I can't imagine why it hasn't been done already. It would be quite useful.

So you'd have "Set 1" to get thru the first part of your program, "Set 2" to get thru the second, "Empty" to get around some checks, "Set 3" for the third part, etc. Sure beats doing it all by hand.

Doesn't that sound usefull? Or am I just not thinking clearly. I don't think it would be too much work...
spongebob
11-19-2003, 06:53 PM
Wow, this thread has been totally hijacked.

Is it that hard to start your own threads?
yaa
11-19-2003, 08:44 PM
spongebob, please go on in your project. If you need help, insist in asking for it. There are so few plugin developers that anyone willing to make one must be encouraged.

Please spongebob repeat exactly, listing them, the requirements (or if you prefer the functionalities) you'd like to implement.

yaa
spongebob
11-20-2003, 12:37 AM
Ok.

Here are a few ideas I had for the searcher:

Types of values one can search for:

1 byte integer
2 byte integer
4 byte integer
8 byte integer
float (real4 and real8)
Other floats, and even 32 bit floats in IEEE hex format.

also:

double
byte string
word string
pointer
word
Dword
ALL

String searchers would be cool cause you could do stuff like change strings in live memory.

For the initial search:

Exact value
Range of values
Unknown value
sequence of values
coded value

Then for the actual filtering of search results:

Value has changed to: x

Value has changed

Value has not changed

Value has increased

Value has decreased

Range

Value has increased by: x

Value has decreased by: x

Value has changed by more than %: x

Value has increased by more than%: x

Value has decresed by more than%: x

Value has changed by less than %: x

Value has increased by less than%: x

Value has decresed by less than%: x

Then once you find the location of your value in memory, be able to BP on that address so that you can see the code.
yaa
11-20-2003, 03:47 PM
From what you say it seems that you'd like to be able to:

1) search the memory allocated by a debugged application for values corresponding to higher level language types (1 byte, 2 bytes, 4 bytes, 8 bytes, unicode and ansi strings, etc)
2) identify changes to the "watched" memory locations corresponding to the said types (how about "watching" memory areas providing a start and end address???)
3) breakpoint placing on "watched" memory

To that I would add:
4) tracing of code statements "guilty" of memory modifies or allocations
5) logging to file or ollydbg window of changes to a memory area

yaa
Ricardo Dinucci
12-05-2003, 12:27 PM
Cool guys i'm trying to search a pointer in OllyDbg too!

But how i can see, the olly didn't has this option...

So i agree with you guys, the olly need add those options in the software.

But i have another problem!
Sure, relacioned it.

Do you guys know the TSearch?
So i run it, and when i DEBUG the Counter-Strike(half-life) in TSearch, the game is closed.

The same think happen when i try to debug in OllyDbg.

But the different's i can fix this problem in OllyDbg. And didn't fix this problem in TSearch.

Or be,
OllyDbg - Debug(ok) - Found Pointer(error).
TSearch - Debug(error) - Found Pointer(ok).

I'm in this table...

I don't know what i do.
With i try to found a way to debug in TSearch or Wait for this pluggin in OllyDbg.

Reggars :-)
Sorry my english is really bad.


happy birthday OllyDbg !

RCE Messageboard's Regroupment > Announcements > happy birthday OllyDbg !
TBD
11-17-2003, 03:38 AM
happy birthday OllyDbg on your 3rd anniversary :)

thanks Olly for you work and keep it up !
pzalps
11-17-2003, 03:55 AM
congratulation
renchler
11-17-2003, 07:39 AM
HAPPY BIRTHDAY OLLYDBG!!!!!!!!!!!!!!!
i remember when i first discovered olly a couple years ago. made my life so much funner. i told all my friends. at first they say "bah - softice for me."
2 years later - they all use ollydbg now :)
thank you oleh for bringing happiness to us.
ollydbg is the true zen debugger.
gfplus
11-17-2003, 08:25 PM
Yeah, HAPPY BIRHTDAY and best wishes....

to Olly - you can be proud on your small debugger with unbelievable great possibilities.
oh me anon
11-18-2003, 11:33 AM
wishing many many many happy returns of the day

and my best wishes to its great author for creating such a wonderful application

many many happy returns of this day
Teerayoot
11-19-2003, 03:18 PM
3rd anniversary! but sill version 1.90d ,i think olly work too slow ;)
Anyway __HAPPY BIRD DAY TO YOU__ (Olly).
TBD
11-20-2003, 03:37 AM
Teerayoot: 1.09d is not from 3 years ago ! ;)

quick versions doesnt mean quality, check this:
Olly:"source [for 2.0] is 1.22 MB long, so my progress is rather slow, but I'm more than satisfied with the quality."
psyCK0
11-21-2003, 10:05 PM
Happy birthday OllyDbg!

Thank you Oleh for the debugger that made my life so much easier!
BasengBae
12-06-2003, 02:56 AM
Sorry I am Late : Happy Birthday Ollydbg, succes for you


remote exception identifier plugin

RCE Messageboard's Regroupment > Plugins > remote exception identifier plugin
endee
11-18-2003, 12:01 AM
i was thinking that a plugin that wrote the string "EXCEPTION!" to ever file handle that a process has when an exception is caught would be a good idea.
this would require ollydbg to be able to inject code into the executable to search through each of the 32 possible file handles. if someone is using a fault-injector over a network then when they recieve the string "EXCEPTION!" they know they have possibly found something.
any ideas on doing this? or would it need to be written into ollydbg by the author?


ARG.x and LOCAL.x labels

RCE Messageboard's Regroupment > General > ARG.x and LOCAL.x labels
Hiftu
11-19-2003, 06:43 PM
Hi!

I'm pretty new in OllyDbg. How can I rename my [ARG.1] [ARG.2] ... etc.
labels? E.g: I know what this "variable" contains and it would be easier to debug the code if I could see MOV EAX,[SERIAL] instead of MOV EAX,[ARG.1].
Teerayoot
11-20-2003, 10:59 AM
No way!!!
But inteadly you can make a comment by pressing ; and fill MOV EAX,[SERIAL] on asking text box.Fullfill with make sense debugging.
ANY IDEA about another way.
oh me anon
11-21-2003, 12:17 PM
do you mean your disasm in cpu pane looks like this

0040102E |. 817D 0C 10010>CMP [ARG.2], 110

and you want it to look like this

0040102E |. 817D 0C 10010>CMP DWORD PTR SS:[EBP+C], 110

if it is yes then do this

options ---> debug options(alt+o)---->analysis1--->uncheck the show ARGs and LOCALs in procedure---->ok

else i didnt understand your question


Automating Olly?

RCE Messageboard's Regroupment > General > Automating Olly?
psyCK0
11-21-2003, 11:10 AM
Hello,

Does anyone know of a way to automate olly? Right now im debugging an app
that requires me to set a couple of breakpoints, change some memory values
etc. every time i run it so i can get to the part that intrests me...

Maybe a scripting plugin should be done?
yaa
11-21-2003, 01:38 PM
yes, it's a nice idea for a plugin.

yaa
psyCK0
11-21-2003, 09:00 PM
Ok, started writing... It already shows an About box! =)

Anyone who wants some specific functionality can post in this thread.

Release date: before 20 January 2009. Seriously, I make no guarantees it
will ever be released, i have a history of not finishing started projects.
sgdt
11-23-2003, 01:09 AM
I have a question, maybe a sugestion, dunno...

It's really quite easy to setup a J-Script or VB Script engine, you know, set your active site and voila. Writing a COM object exposing the plug-in SDK routines might be a bit tougher, but do-able.

My thinking is that, with this type of scenerio, you could even add dynamic script functions for certain types of events, say when you break, etc., that could be changed at in the script as it goes. (i.e. in the script, OllyObj.OnNextBreak = Function_ProcessStep15).

Ok, so creating a COM object that would allow you to access the registers of the target, control program flow, mod memory, and receive events based on actions (i.e. implicit parsing of Getstatus in ODBG_Pluginmainloop), well, I don't know. It seems to me it would be quite usefull.

In theory, it could make short work of a lot of problems that are currently manual. Scripting languages aren't exactly speed demons, but they sure are faster than typing. :)

What do you think?
TBD
11-25-2003, 03:48 AM
nice ideea :) waiting for progress ...
psyCK0
11-25-2003, 07:57 AM
sgdt: Not a bad idea at all... Was writing this plugin in MASM, but parsing script files is a bitch...

Lets see that I understood you correctly: a COM object that exposes Ollydbgs API routines should be developed. It should also fire events when things such as exceptions and breakpoints happen. Right?
sgdt
11-25-2003, 03:26 PM
Yes.

You feed it a COM object that exposes most of the plug-in SDK. The plug-in will need to implement ODBG_Pluginmainloop, parsing the status change via Getstatus, so that it can fire one shot script events on target status change (i.e. break point, termination, exception, etc.).

The rest of the functions are pretty much 1:1 mapping to a COM object.

You need IActiveScript, IActiveScriptParse, and IActiveScriptSite. And of course, a COM object exposing the plug-in SDK routines.

I'd also recomend a few helper routines, for searching/modding memory, setting flags w/o needing to know the bit offsets, etc.

It would help with a lot more than simple automation. Finding bugs in a repeatable way would be invaluable. Also, it would eliminate the tedium of having to visually look at a register to see if your at the right spot yet.

Being able, in the script, to say what should the next script routine to be fired on a given state would be most cool. i.e. OllyObj.OnNextBreak = Function_ProcessStep15.

Of course, OllyObj.OnNextBreak = "" would mean when olly hits next break, go interactive... :)

The only trick to remember is when you are invoking script events, the parameters are going to be variants, and you really need to pay attention to the types. For example, the same script routine can choose a different result type based on how it ran. I think MicroSoft (does that mean Small and Limp?) just wanted to keep programmers on their toes...

The scripting engine itself is tiny. The implementaion of the OllyObj is where the fun begins... :)
psyCK0
11-27-2003, 07:05 AM
OMG, its been some time since i used ATL etc and ive repressed all the emmories of it. It isnt gonna be any beautiful clean code in this plugin =))
psyCK0
12-21-2003, 11:33 PM
Now I'm starting get stuff working with this plugin, but Id really need some help.
sgdt, you seem to know your COM. You suggested using something like "OllyObj.OnNextBreak = Function_ProcessStep15". What I dont understand is how Im supposed to pass a function pointer? I mean, in VB id use the addressof operator, but its not present in vbscript. The property of the COM object is of IDispatch* type, which means it wants a pointer? Any ideas on how to implement this?
focht
12-22-2003, 06:53 AM
Greetings...

VBScript 5.0 or later: use the GetRef() method.
(Before 5.0 there was no way to use function pointers)

Example to create a reference to a function, allowing set the event handler:

<pre>
set OllyObj.onNextBreak = GetRef( "foo")

function foo()
alert( 'onNextBreak() event called')
end function

</pre>

Regards,

A. Focht
sgdt
12-22-2003, 02:31 PM
The object (OllyObj) is injected into the engine via "AddNamedItem". The scripting engine, when it encounters "OllyObj" calls "GetItemInfo" to get type info and a IDispatch pointer.

"GetIDsOfNames" and "Invoke" are used to fire events into the script. That is why I just had the event function name as a string, to avoid lifetime issues with a pointer. Minor slowdown, but avoids potential problems.

Speed is pretty decent, because once it has the IDispath, it calls the member routines nicely. Still, strong helper functions are prefered, as lots of little calls could bring a computer to its knees. This is why "ODBG_Pluginmainloop" can't be exposed directly, but rather only its effect of determing state.

The plugin basicly drives the script, with the script providing context on what to do next, but the scripting engine can keep global variables to maintain scope from call to call if desired.

From script, you have access to the filesystem, etc., via standard active x objects, but you have to manually create them (new activex for *.js, CreateObject for *.vbs). The interface for the scripting engine is derived by the file extention (CLSID_VBScript for *.vbs, CLSID_JScript for *.js).
TBD
01-05-2004, 07:14 AM
sgdt: any progress on the automate OD plugin ?
psyCK0
01-05-2004, 11:05 AM
Humm TBD, I think you misunderstood. I am the one writing this plugin. =)
There is some progress, it's already parsing scripts, stepping through disassembly and displaying EIP in a nice messagebox. =) Now I'm working on it being able to script events...

I don't really have that much time to dedicate to it, but I expect to have a v0.1 ready sometime quite soon...
sgdt
01-05-2004, 04:24 PM
Mine is just for fun, so I could get around a protector (written because I got tired of always having to press Shift F11 for 13 times before having to mod a memory address and add HW Break Points, and then... Well, you get the idea.). Mine isn't very stable yet, so I'm certain TBDs efforts will be what you want instead.

Active Script itself is fairly trivial to implement. The only tricky part is the object(s) you inject into the engine have to be in sync, which is sometimes harder than it sounds. But still, it's a big time saver when doing repetitive tasks.
TBD
01-06-2004, 03:55 AM
psyCK0: oops, sorry :)
anyway, maybe you can post your progress and we can start helping in some way.
psyCK0
01-06-2004, 09:01 AM
Right now there is not much to share. I will, as soon as it is working somewhat...

sgdt: What are the synchronization issues you mention? I have some problems implementing multiple commands, like two "step over" in a row, because only one of those can be executed each time ODBG_Pluginmainloop is passed... =/
sgdt
01-06-2004, 01:34 PM
What I did was set the name of the next script function to call. In the case of two step overs, the first says 'OllyObj.OnNextBreak = "Function_ProcessStep15"' and then in Function_ProcessStep15, it says 'OllyObj.OnNextBreak = ""' to go interactive on next break.

I couldn't figure out state any other way than in ODBG_Pluginmainloop. What I do is maintain state, and then when it changes in ODBG_Pluginmainloop, I call into the script with what changed (assuming the event function name string is set).

The race condition has to do with the injection of OllyObj into the scripting engine. Well, not actually the injection, but on program termination, things currently get pretty hairy... :( Learning quite abit about COM in ActiveScript, which is almost harder than dealing with the protectors I'm trying to circumvent. Still, in the long run, it should make things quite a bit easier.
psyCK0
01-06-2004, 02:56 PM
Well, maybe IactiveScript::GetScriptThreadID() / SuspendThread() can help me here...

Really iritating that you cant set breakpoints in the COM object when debugging. I only succeed in getting breakpoints on the ollydbg plugin functions. Well, well.. If I ever finish this work you'll get on the contributors list. =)
psyCK0
01-07-2004, 06:53 AM
BTW sgdt, do you think I could have a look at your implementation? Maybe then I get some bright ideas...


unpacking telock

RCE Messageboard's Regroupment > General > unpacking telock
Eggi
11-22-2003, 12:07 PM
I have only found one topic, and there was a link to a spanish tut. So i translated it with systran. But the method in the tut is not working :(. Im trying to unpack telock 0.98. Please help me. I always get this CRC messages.
psyCK0
11-22-2003, 08:32 PM
1. This is not a cracking forum.
2. There are tons of info on unpacking teLock available.


Olly plugin with Borland C++ builder 6.0

RCE Messageboard's Regroupment > Plugins > Olly plugin with Borland C++ builder 6.0
Teerayoot
11-23-2003, 01:37 PM
I need help or example that manipulate plugin within borland c++ builder with vcl included.

I want to write a Luncher plugin that can lunch anthor tool and make it ALWAY ALLTOP for debug game that run in fullscreen.

Help me .


Debugging with symbols: missing text of instructio

RCE Messageboard's Regroupment > General > Debugging with symbols: missing text of instructio
MazeGen
11-24-2003, 02:19 PM
Hi all,
I have a problem while debugging with symbols: All is working fine until jump is performed into included code (with using MASM's "include file.asm"). I can see only a right name of included file, also a line number, but I can't see a text-of-source-instruction itself and, additionally, Ctrl+F5 is not working.

Can anybody solve this? Or is it a bug? Thanks!
MazeGen
11-24-2003, 04:48 PM
Oh I got it, the problem lies in included file, which is not in the same directory as main file. Well, I have to figure out how to master it yet...
MazeGen
11-29-2003, 01:56 AM
I've tried a few things, read help file, scanned this forum, but I can't figure it out - still have the problem above.
It is not possible to copy all necessary files into one directory, since my project becomes very extensive - I use special directory for testing finished code, and I need to link different files from different directories, with using "include file.asm".
Please help...


Strings and buffers as local variables in subrutin

RCE Messageboard's Regroupment > General > Strings and buffers as local variables in subrutin
raZ
11-28-2003, 07:41 AM
Hi !!
I'm pretty new in asm32 and i'm trying to do something i don't know how.
I'm trying to declare a buffer and a string as local variables in a subrutine. Since global definition is like this:

.data
buffer db 200 dup (?)
myStr db 'my string here',0

i don't know how could i declare next variables inside my proc "calculate":
__________________________________________________ ____________________ _______
calculate proc, c1:DWORD,c2:DWORD

local buffer2 db 15 ;this lines gives me an error.
local myStr2 db 'other',0 ;this also generates an error.

... code ...
ret
calculate endP

Can help me?? Thank you!!


Minor and easy (but important!) feature request

RCE Messageboard's Regroupment > General > Minor and easy (but important!) feature request
1bitshort
11-28-2003, 04:38 PM
With the next release of OllyDbg, I would LOVE it if it would automatically add the name of an exported function as a comment at its first instruction, so that when you're looking at its code you can see that it's an exported function, and what it's name is. This is the only thing I feel that Win32dasm has over OllyDbg, so if/when OllyDbg adds this capability, i'll finally be able to stop using win32dasm :)
OllyDbg is already easily able to grab the names and addresses of exported functions so I'm hoping that this will be a fairly easy thing to add :)


How to install plugins?

RCE Messageboard's Regroupment > General > How to install plugins?
Art Bas
11-29-2003, 12:30 PM
Hello,

I'm a complete newbie and I don't know how to install Ollydump plugin into Ollydbg. Do I have to create a new folder in the folder that contains OllyDbg?

Please help me,

Musician
Musician_01@hotmail.com
Rheya
11-29-2003, 01:20 PM
hi Art Bas,
you just need to copy the plugin file into olly's directory on your disk, the same directory where there is OLLYDBG.EXE .
rheya.


How to trace?

RCE Messageboard's Regroupment > General > How to trace?
hi4321
12-01-2003, 02:17 AM
am following the tutorial:
start application using olly, followed by trace-into. this works fine.

tried same technique on big apps. takes forever!

any means to enable trace for specific portion of code? (hit trace?? not sure how it's used).

or enable trace for a feature. activate just before i try the feature and disable after that.

thanks!


logging certain function calls

RCE Messageboard's Regroupment > General > logging certain function calls
JH1
12-03-2003, 10:26 AM
Hi,

I would like to be able to view a log of all calls together with parameters to a particular function. What is the best way to go about this...can I achieve it with trace? I occasionally get an access violation in my prog and have narrowed it down to a particular function, I do not want to log anything else, just calls to this function.

Thanks in advance

JH
TBD
12-03-2003, 12:50 PM
you can put breakpoints on all callers to your "buggy" function or
add a SEH to pinpoint the location of access violation
JH1
12-03-2003, 01:22 PM
Thanks - conditional log breakpoints that don't pause the program was exactly what i was after.

JH


A few questions from a newbie

RCE Messageboard's Regroupment > General > A few questions from a newbie
seppuku
12-03-2003, 09:18 PM
Hullo,

debugging an application I see a few things I can't understand such as the following:

0040110F LEA EAX,DWORD PTR DS:[40332A] ; Structured exception handler
004010B3 PUSH DWORD PTR FS:[0]

I can't understand their meaning. Why does OllyDbg print "Structured exception handler" and also, what is FS:[0]?
Finally what do the PUSHFD and POPFD accomplish?

Thank you.
S.
seppuku
12-05-2003, 04:49 PM
Are my questions really so complex or simply no one cares about aswering???

S.
JH1
12-07-2003, 01:45 PM
Structured exception handling covered here: http://spiff.tripnet.se/~iczelion/Exceptionhandling.html

PUSHFD here:
http://www.online.ee/~andre/i80386/Opcodes/PUSHF-PUSHFD.html

JH1


Decoding instructions of type: PUSH DWORD PTR SS:[

RCE Messageboard's Regroupment > Plugins > Decoding instructions of type: PUSH DWORD PTR SS:[
JH1
12-04-2003, 11:24 AM
Hi,

I am writing a plugin to parse arguments to a given function, essentially by locating calls to the function then disassembling back, looking for PUSH instructions. I can handle simple instances of PUSH contant or PUSH register but I am not sure how to decode instructions such as: PUSH DWORD PTR SS:[EBP+8]. What fields of t_disasm will indicate this is happening?

Cheers

J


OllyDbg can be = TSearch?

RCE Messageboard's Regroupment > General > OllyDbg can be = TSearch?
Ricardo Dinucci
12-04-2003, 12:40 PM
Can i do the same things of TSearch like Found Pointer Matriz in Memory using OllyDbg?

What is TSearch?

TSearch is a cheat tool for games running under windows 9x/ME/NT/2000/XP

Games store their values for money, energy, etc in memory which they are running. TSearch is first used for finding the location of theses values in memory and secondly to edit them. If the game features Alt-Tab protection you can use the network option to search the games memory (2 computers needed, and a friend). You can Search for ASCII or Hex chains too using the Hex Editor and easily edit the memory.

But TSearch is not a simple memory searcher, it allows you to easily to defeat games which are using DMA (Dynamic Memory Allocation), the location of the values in memory change each time you start or even load a new game. You can even write your own scripts in asm and inject it into the game.
spongebob
12-04-2003, 05:14 PM
Hopefully a memory searcher can be added with a plugin.

See my thread: http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=482 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=482)
eedok
12-05-2003, 05:04 PM
You should use Tsearch and ollydbg together... Tsearch is good for quick fixes, Olly is for more complex things..
spongebob
12-11-2003, 08:09 PM
eedok, yes you can do this, but it can become cumbersome using 2 apps at once, and besides there can only be one debugger attached at a time.

It makes sense for Olly to have a mem-searcher because it would integrate so perfectly with the rest of the program.


Set Working Directory

RCE Messageboard's Regroupment > General > Set Working Directory
eet_1024
12-04-2003, 10:29 PM
Is there a way to have OllyDbg set the working directory of an app to something other than the directory that the app lives in?

currently I have to have my app do a
<pre> invoke SetCurrentDirectory, "E:\Some Directory"</pre>
focht
12-23-2003, 04:45 PM
Greetings!

Seems you are right ...
Ollydbg doesnt have an option to set the process working directory yet (i didnt found it).

Should be included in next version ;)
Suggestion: File -> Open -> "Open 32-bit exe file" dialog:

Add another edit control (with browse directory button to the right) below the "arguments" edit control.
This would just conform with microsofts windbg and possibly other gui debuggers.

Regards,

A. Focht


Save changes

RCE Messageboard's Regroupment > General > Save changes
Art Bas
12-06-2003, 03:49 PM
Hello,

Is it possible to save changes before leaving Ollydbg? For instance I have some line filled with NOP's and before leaving Ollydbg I want to save those changes.
What do I have to do to?

Art Bas

Musician_01@hotmail.com
JDog45
12-06-2003, 04:09 PM
Right click on the CPU window, copy to executable, all modifications, save file and then you're done..:)


Olly Quit

RCE Messageboard's Regroupment > General > Olly Quit
User
12-07-2003, 04:04 PM
Hi everyone: I've been using Olly since version 1.7 or so, with much satisfaction. And I've been using version 1.09d for a couple of months with no problems. Suddenly Olly will not work. It will load executables and go to an incorrect entry point and will state illegal instruction pass exception to program. I have completely removed olly file and reinstalled same problem. Any ideas.
best regards
User
User
12-07-2003, 10:20 PM
Hi all:
I found reason for the above problem. I had accidently changed a setting on the "Event" tab in Olly's debugging options selections. I had checked first pause at "Win Main" instead of having it at "Module entry point".
Regards
User


How to view return value from functions in run tra

RCE Messageboard's Regroupment > General > How to view return value from functions in run tra
hi4321
12-09-2003, 12:36 AM
Hi all,

I am looking thro a the run trace I have generated with Olly. Notice that the return value(usu. EAX?) from function calls are not logged in the trace.

Anyway to enable this?


New Ollydbg version

RCE Messageboard's Regroupment > General > New Ollydbg version
j_petrucci
12-11-2003, 09:06 AM
Hi to everybody!
Does anyone know when the next Ollydbg version (1.10 or maybe 2.00) will be released? I can wait no longer for that! :p

thanx
TBD
12-12-2003, 05:54 AM
Olly:

1.10
"I've planned to release final v1.10 in November, but now see no chances. So... December is still realistic"

2.0
"source is 1.22 MB long, so my progress is rather slow, but I'm more than satisfied with the quality"

so, "when is finished it will be released" :)

till then you can create some plugins (hint: TSearch like plugin)
1bitshort
12-12-2003, 01:44 PM
But there's a good chance that Ollydbg2 wont support Ollydbg1 plugins, so if I was a plugin writer I personally wouldnt be bothered writing any more plugins! But ... maybe Ollydbg2 WILL support Ollydbg1 plugins? I dont know, but I would be very surprised if it did :)
EsseEmme
12-12-2003, 08:20 PM
Plugins often do things that only in part depend from OllyDbg. Even if OllyDbg will change and with it its SDK, I'd expect not much work to port code from the current to the future release of the debugger.

Cya,
EsseEmme
j_petrucci
12-15-2003, 01:32 PM
Thanx TBD... I really hope to see v1.10 soon! December is almost finished... :)

Merry Christmas to everyone!!


Where to find Ollydump?

RCE Messageboard's Regroupment > Plugins > Where to find Ollydump?
j_petrucci
12-11-2003, 09:14 AM
Sorry, but I read from the posts that Ollydump reached version 2.20 (or 2.21?) and I can't find this version from the plugins/stuph. Does anyone can tell me where to download it from?

thanx
psyCK0
12-11-2003, 12:39 PM
http://dd.x-eye.net/file/

TBD: why dont you put the latest ver of OD in stuph?
TBD
12-12-2003, 05:48 AM
psyCK0: 10x for pointin out. lazy TBD ;)
presscat
12-17-2003, 02:53 AM
thanks a lot


How to LOG memory access?

RCE Messageboard's Regroupment > General > How to LOG memory access?
nexus
12-12-2003, 08:39 PM
How to LOG memory access?

It's easy to set a breakpoint on memory access, but I need only to log when and where that location is accessed. Is it possible?

Thanks
oh me anon
12-13-2003, 11:25 AM
?? u set a break point on access to a certain part of memory

it will break if and only if that part of memory is accessed

and you will have an entry regarding that break in log window like this
Log data
Address Message
004012CF Memory breakpoint when executing [004012CF]
"for this i set a memory bpt on cpu pane in code section"
004012D4 Memory breakpoint when writing to [004052F0]
"for this i set break point on data section where it was supposed to move a pointer ie i followed 4052f0 in dump pane and set a bpt there on that dword"

the code
004012CF |. A3 9C524000 MOV DWORD PTR DS:[40529C], EAX
004012D4 |. C705 F0524000>MOV DWORD PTR DS:[4052F0], <JMP.&USER32>;

if i am following your query i think you want this to be logged to some file
then right click in log window and click log to file and give a name to your file

if this is not what you are after then i dint understand your question
nexus
12-13-2003, 01:54 PM
Ok, I did'n explain well. I'm debugging a directX fullscreen application, so I <u>do not want</u>to break program execution, I only want to know where the memory is accessed. Thank you anyway for your reply.


How to analyse a binary module only once???

RCE Messageboard's Regroupment > General > How to analyse a binary module only once???
yaa
12-12-2003, 10:20 PM
Hello,

is there a way to analyse a binary module (application, dll, etc.) only the first time and afterwards utilize that analysis everytime OllyDbg restarts? I don't understand why OllyDbg re-analyses applications everytime the application is restarted .... if the applications binary hasn't changed why can't it use what is written in the UDD file generated previously????

yaa


Not update of access permissions on memory blocks?

RCE Messageboard's Regroupment > General > Not update of access permissions on memory blocks?
yaa
12-13-2003, 08:10 PM
Hello,

playing around with ollydbg I've seen that access permissions modified by ollydbg on memory blocks are not updated/shown in the memory window even asking to actualize the situation. Is this a know issue??? Or am I doing something wrong???

yaa


Hi All

RCE Messageboard's Regroupment > The Heap > Hi All
BuLLdoGG
12-14-2003, 09:29 PM
Newbie just saying Hi All Great Board


ollywindow on top ?

RCE Messageboard's Regroupment > General > ollywindow on top ?
Kos
12-18-2003, 03:53 PM
Hello,

Suppose I have a game with a very bad AI and an even worse pathfinding routine.
Suppose I want to make a better AI and .....
Suppose I want to use Ollydbg for this kind of "mod" making, then I start Ollydbg and run the game, but in finding the AI routines and pathfinding I want
to have the Ollydbgwindow on top, but I do not know how. The game window stays always on top and with alt/tab I'm a looking to the same return sequence.
How can I do this or can I do this?
Greetings,
Kos
P.S/ I do not want to crack this game, I like it but want to improve it.
Ricardo Narvaja
12-18-2003, 07:58 PM
With alt + f5 OLLYDBG is the topmost and with ALT + F5 again come back to normal.
If is a game with directX, can be troubles with image, you can freeze your computer.

Ricardo
Teerayoot
12-30-2003, 03:32 PM
NEVER FREEZED FOR ME.
JDog45
12-30-2003, 03:59 PM
Terrayoot, what happened to your website?


bug in olly 1.9d,

RCE Messageboard's Regroupment > Bugs > bug in olly 1.9d,
loveboom
12-19-2003, 06:51 AM
hello tbd!
ollydbg 1.9d bug
Test:http://tongtian.net/pediybbs/download.php?id=698&sid=627d1e480fe2 a5eda4c5515acf32cb2b
TBD
12-19-2003, 10:27 AM
loveboom: thanks for the report and for the test program.
i sent it to Olly, hope to see an explanation/bugfix.
arw
01-13-2004, 12:30 PM
I'm using 1.09d.
I saw somewhere that even revisions are more stable so should we be useing 1.08 or 1.09d? which is more stable/bug free.
I get a few program exceptions but maybe its because I'm not used to the program yet.
Regards
Anthony


Ollydbg vs. IDA

RCE Messageboard's Regroupment > General > Ollydbg vs. IDA
focht
12-23-2003, 12:07 PM
Greetings,

after a long time, i visited the website for IDA Pro Disassembler and Debugger (http://www.datarescue.com/idabase/).
I'm really astonished how well this product develops.
They even gave it a user mode debugger now. The internal scripting engine and the SDK is looking promising too.

I know both products came from different contexts .. ollydbg was (and is) a user mode debugger since the beginning. IDA was disassembler/analyzer tool but now seems to develop into user mode debugger direction too.

It would be nice to get some hints - what features of IDA might be good for ollydbg too.
Maybe they can be broken into some "wishlist", which ones can be implemented in ollydbg and which ones using plugins. Maybe the requests lead to a new plugin architecture (needed to implement feature xyz).

Just my thoughts...

Best regards
oh me anon
12-23-2003, 02:45 PM
well isaw the uses of win32graph that is integrated with idas use (a plugin iirc) and came to know that it uses some perl script (i dunno) well the graph was truly good if it could be integrated with olly then one can see a good analysis i beleive and win32graph is opensource or freeware some thing like that

ps: focht i wrote one post in code injection error(same olly injecting some code into coaxing the os to do some thing it wont do itself can you see it and put some queries)
none
12-25-2003, 06:02 AM
IDA pro is a good interactive *disassembler*.
Ollydbg is a good user mode *debugger*.

I hope Ollydbg can add some disassemble feature of IDA.
cobra1111
03-17-2004, 04:54 AM
simple is the best

i don't think OD should do some changes to IDA.
now the OD's disassemble function is enough.
OD is just a debugger.
the auther should do more hard to improve this function.

you can use IDA to do the hard disassemble work.

:)
Ricardo Narvaja
03-17-2004, 06:01 AM
IDA DISSASSEMBLER is the best dissasembler, but the debugger of IDA is pathetic, nobody can choose this poor debugger for work serious in cracking.

I think the debugger of IDA may be improved in futures versions, is a very very bad debugger today.

Ricardo


Greetings mates, thy needs help!!

RCE Messageboard's Regroupment > General > Greetings mates, thy needs help!!
doOdzZZ
12-23-2003, 04:29 PM
Hello there mates, i would like to inquire about some mathematical programmes cracking simple (calculater like). Any one care you help?

thanks for your time


Plugin SDK annotations (while working on .NET plug

RCE Messageboard's Regroupment > General > Plugin SDK annotations (while working on .NET plug
focht
12-23-2003, 06:57 PM
Greetings,

i'm currently working on a .NET plugin hub (yes the infamous microsoft DOTNET).
It basically creates a plugin architecture on top of a (mixed mode) proxy plugin to allow .NET assemblies to be executed as plugins (read: execute managed code in the context of unmanaged ollydbg debugger).
Besides the managed interface it provides access to ollydbg native plugin api (with few exceptions).

During the work i stumbled on a few problems which might be interesting for next ollydbg plugin SDK version:

NOTE: the plugin SDK i used is 1.08 (from homepage)

------------------------------------
PluginSDK: provide FPU Exception mask accessor

Seems that ollydbg is messing with the FPU exception mask which is unfortunate for system.windows.forms based code (in detail: system.font constructor)
See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q326219 for more explanation.

I manually fixed it (as suggested) by masking out FPU exceptions on plugin initialization.
It would be fine if ollydbg (plugin sdk) supplies the function itself to stay in sync (which debugger options checkmasks).
A thin wrapper around _controlfp() should be ok.

------------------------------------
PluginSDK: fixes for plugin.h wrapper generation

I'm using an open source interface parser which parses C/C++ header files and automagically generates stubs for different target languages.
To use ollydbg native (unmanaged) API in managed code, wrappers are generated.

I had to make the following changes to get the wrapper generation working:

- the "NREGSTACK" constant is redefined in line 742 (previous 641)
- commented out following prototype: extc uchar* cdecl Findknownfunction(ulong addr,int direct, int level,char *fname); because it's not contained in ollydbg.lib import library?! (.lib doesnt match .h?)
- changed all occurences of "base" identifiers in structs, function params/args to something other, because the parser generated code will contain the word too.
This is unfortunate, because "base" itself is a KEYWORD in other languages (like dotnet's C#) which causes a large amount of errors
- skipped union-based stuff, because the parser and target languages doesnt implement/support this construct. Therefore the managed use of ollydbg API is restricted to non-union based structs.

------------------------------------
PluginSDK: additional annotations for plugin.h

- include guards missing from plugin.h
- "const" modifiers are omitted where they should be in place (format string in addtolist, makes casting to "char*" necessary for const strings to avoid compiler warnings/errors)
- immediate return values are used unintrusive, symbolic constants like "TRUE" or "FALSE" for boolean values and enumerated error codes would help to improve code safety/readability
- might be related to borland's linker: the DLL entry-point is named "DllEntryPoint" (instead of using the "DllMain" or specifiy any custom one...)
This imposes several problems for VC++ generated executables: CRT init and static ctor/dtor stuff must use "DllMain"!
- exports are "cdecl" instead of the windows standard export convention for DLLs: "stdcall"
- "_export" keyword is obsolete (ok, already redefined for vc++ using __declspec(dllexport))
- symbolic constants are preprocessor #defines, better use enumerations (which help to improve code safety)
- integer parameters which use #define-style constants should be dropped in favour of enumeration type parameters
- #pragma pack(1) should be used with #pragma push/pop together on plugin structs only (not global, messes up internal plugin struct member alignment!)

Regards,

A. Focht

PS: I didnt forget scripting stuff ;)
When the base is done (plugin proxy/plugin manager/plugin interface) the first plugin will be a plugin which allows dynamically compiled code (.cs/.vb - C#/VB script files) to be executed. This gives access to almost all functionality of the .NET framework itself.


Mouse Wheel support?

RCE Messageboard's Regroupment > General > Mouse Wheel support?
none
12-25-2003, 06:08 AM
The "Select process to attach" window doesn't support mouse wheel.
Could you add this little feature?
none
12-25-2003, 06:10 AM
And that window can't resize. :(
focht
12-26-2003, 01:45 PM
Greetings,

you're right .. consistent mouse-wheel and resizable dialogs support would be fine.

While you're at it ... please add application .manifest file to ollydbg to support XP style/guidelines.

There are two methods to do this.

The more robust method is to compile the manifest as a resource in your
application. To do this, the manifest must appear as resource type
RT_MANIFEST (24) with id CREATEPROCESS_MANIFEST_RESOURCE_ID (1).
You must also ensure that the resulting XML file is an even
multiple of 4 bytes long. So for example, if your file is actually 597 bytes
you need to add padding spaces to make up the file size to 600 bytes before
compiling.

Second method is to supply xml file named Ollydbg.exe.manifest

Example:

<pre>
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="X86"
name="CompanyName.ProductName.YourAppName"
type="win32" />
<description>Your application description here</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="X86"
publicKeyToken="6595b64144ccf1df"
language="*" />
</dependentAssembly>
</dependency>
</assembly>

</pre>

Regards,

A. Focht


XP equivalent to hmemcpy

RCE Messageboard's Regroupment > General > XP equivalent to hmemcpy
Pompeyfan
12-26-2003, 04:48 PM
I found an old post on this, but the links are not valid anymore, can someone either post the information here, or email it to me at vinceandjane@hotmail.com.

Thanks.

Vince.
focht
12-26-2003, 07:13 PM
Greetings,

this Microsoft KB Link (http://support.microsoft.com/support/kb/articles/Q129/9/47.asp) might be useful for you...

Regards,

A. Focht
Ricardo Narvaja
12-27-2003, 05:46 AM
The tut of point h for XP is a point very similar to hmemcpy of w98, but in NT/2000/XP,the tut are translated to english and is in my ftp.
(ftp://ftp.
)

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

33-PUNTO_ H INGLES.rar

you discover your point H for your machine, and you use forever only tiping

BP [value of point h]

in 80-90 percent of programs work well and stop in the enter of the serial, name etc

Ricardo Narvaja
Pompeyfan
12-27-2003, 05:14 PM
Okay, thanks a lot, I've saved the MS article, and downloaded your ftp file Ricardo, I'll read through both later, thanks to both of you for your help.
Teerayoot
03-11-2004, 01:01 PM
Hey,Ricado ,i can't login to your Ftp server ,the password is incorrect.

I wanna to get some nice tuts from you.
Ricardo Narvaja
03-12-2004, 06:11 AM
This is a right password and user.

Don't use explorer for enter to FTPS, use a program made for this (flash FXP, wincommander, total commander, cute ftp, etc)

Explorer suck for work in FTPS

Ricardo


symbols or implib

RCE Messageboard's Regroupment > General > symbols or implib
idanski
12-26-2003, 07:21 PM
hi,
Some questions (or suggestions):

1) Is there any way to know in which function i'm in now (shown sometimes in the information bar in the CPU view)? I saw that this is working only in a few functions. even after i analyse the code...

2) It may be better to put lables in one line and the assembly in another: because if i want to see the name of the function/lable, then i must expand the first column. and it takes up lots of space...
For example, instad of this:

<pre>
77E7B332 kernel32.GetProcAddress |$ 55 |push ebp
77E7B333 |. 8BEC |mov ebp, esp
77E7B335 |. 51 |push ecx
</pre>

something like this (shown here without colors...):

<pre>
77E7B332 | |kernel32.GetProcAddress:
77E7B332 |$ 55 | push ebp
77E7B333 |. 8BEC | mov ebp, esp
77E7B335 |. 51 | push ecx
</pre>

3) It would be great to add an "input helper" to some edit boxes. for example: in the "Goto expression" dialog box: when i start writing a lable name, i'd like OllyDbg to show me all the lables that start with those letters.
another example is when i write a conditinal expression "MSG==WM_" -> i'd like to see all the messages known...

Thanks!
focht
12-26-2003, 07:45 PM
Greetings,

i agree with you, the "column style" representation of function labels could be better.
It took me some time until i found that "extend 1st column to see function name" feature... and yes, it take much column width.

windbg style example:

<pre>
ntdll!DbgBreakPoint:
77f75a58 cc int 3
77f75a59 c3 ret
77f75a5a 8bff mov edi,edi
ntdll!DbgUserBreakPoint:
77f75a5c cc int 3
77f75a5d c3 ret
77f75a5e 8bff mov edi,edi
ntdll!DbgBreakPointWithStatus:
77f75a60 8b442404 mov eax,[esp+0x4]
ntdll!RtlpBreakWithStatusInstruction:
77f75a64 cc int 3
77f75a65 c20400 ret 0x4
</pre>

To maintain the "column style" cpu view implementation of ollydbg it makes sense to implement it like you suggested (3rd column = function label)

The other feature you're thinking of is "intellisense", autocompletion on typing.
This feature is nice to have but should be on lower priority i think ;)
Maybe some plugin can implement such automagic behavior.

Regards,

A. Focht
idanski
12-27-2003, 07:09 AM
I guess you are right about the autocompletion. another suggestion is a "goto lable" that shows all the lables in a list, and lets the user jump to any one of the lable.


Ollydbg support XP Style UI

RCE Messageboard's Regroupment > General > Ollydbg support XP Style UI
focht
12-27-2003, 08:54 AM
Hello again,

as mentioned in an earlier thread, most of ollydbg "configuration" dialog property pages need to be reworked to support XP ui styles.

To see what i mean, save the following xml-file (code block) under "ollydbg.exe.manifest" and
place it in ollydbg directory.
Windows XP: start ollydbg and navigate to config dialogs.

<pre>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="X86"
name="Ollydbg"
type="win32"
/>
<description>Ollydbg debugger</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="X86"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
</pre>

The static controls on the property pages seem not to conform: custom colour assigned != dialog background colour.

For all the config options and settings a treeview/property page combo would be far better suited. It allows to group configuration settings in a tree while maintaining a slick user interface.

See here (http://www.codeproject.com/property/TreePropSheet/WinXP.png) for example.

Regards,

A. Focht.

PS: Would be nice if this board would support uploading/inserting small pictures (screenshots, 10-15K jpegs) to illustrate problems.


"Display Memory" like Command in OllyDbg

RCE Messageboard's Regroupment > General > "Display Memory" like Command in OllyDbg
Joe_Coolish
12-28-2003, 06:59 PM
Sup! i just d/l OllyDbg. I must say, that it is a very handy tool. especially since SoftICE doesn't support XP fully yet. I have been using SoftICE for long time, and have grown very fond of it's power and ease of use. But when I upgraded to XP, SoftICE stopped working, so I switch around and found this debuger. So my question is this, is the a command or a tool/plugin that does the same thing as the display memory comand? (example "DW ds:F1479000")

thanks for you help!
j_petrucci
12-28-2003, 08:42 PM
Hi!

I think you can easily look in the lower left part of the screen where the memory dump is displayed: you have to scroll or directly go to the interested location to see what's in it. Pressing the right mouse button you have many features like search data in memory.

I hope to help
MC707
12-30-2003, 06:55 AM
Joe_Coolish, DriverStudio 2.7 is working on XP. You just need to know how to install it :)
Maybe you may use that: right click on the address and select Follow in Dump. You'll see the data of this address.
Joe_Coolish
12-31-2003, 03:08 PM
Thanx. Yeah, that did it. But after you do that, you have to follow it into the memory map, and that is a pain. But it does work! Thanks!


Maybe a bug...

RCE Messageboard's Regroupment > Bugs > Maybe a bug...
j_petrucci
12-28-2003, 08:49 PM
Hi!

Recently I had to work on a program invoking some functions from MFC42.dll library: OllyDbg correctly displays names from functions imported from USER32,MSVCRT, but MCF42 are reference with <jmp MFC42#{some number}>. So I can't set breakpoints on these functions! Maybe OllyDbg hasn't them in its library or maybe am I doing wrong?
Anyway, IDA PRO 4.5 correctly import them after loading FLIRT signature for Visual C.

thanks in advance!
bye
focht
12-29-2003, 07:34 AM
Greetings,

what you are seeing is correct behavior.
Dump the export table of MFC42.DLL: 6000+ exports by ordinal.

Why?

You have faster load time associated with importing and exporting by ordinal.
Addionally, when exporting an API by ordinal, the linker does not need to store the exported API name in the exporting DLL.
This means a smaller export section, and potentially a smaller binary with less data to demand page in.
(to eliminate the API name, use the NONAME modifier when exporting by ordinal in linker .DEF file)

Getting the exported names for MFC isnt that hard - but for the correct version.
If you have installed VC++ (6.0) you got MFC sources, MFC42.DEF file with 6000+ exports by ordinals, exports by names, .PDB debug info files.
But beware: DLL hell is near, because there are different MFC42.DLL versions out, which export a different number of functions (thats why some people get the dreaded "ordinal #xxx not found in MFC42.DLL").

Ok, i would like to see (de)mangeled C/C++ names in ollydbg too but this is beyond the context of (current) ollydbg.
You already said it: IDA correctly imports AFTER LOADING FLIRT signature for MS runtime.
To implement such behavior, speak: translate ordinals to names, ollydbg needs a compiler/runtime signature database too.

Regards,

A. Focht
j_petrucci
12-30-2003, 07:24 AM
Hi Focht!

many many thanks for the very clear explanation! :) (you're a pretty ASM expert, huh!? :p)
In fact, after better looking at what IDA did, I realized this thing, and now I understand that from you, also. So, this is not a bug.

So...have nice holidays, and an Happy New Year!

bye
*guido*

PS: wasn't the 1.10 OllyDbg version planned for December by Olly !? ;p
Lord_Looser
05-12-2004, 10:18 AM
It's much easier if you use import libraries in OllyDbg.
open menu - Debug - Select import libraries - Add - select MFC42.LIB

example:
Names in mfc42
Address Section Type (Known) Name Comment
6C2A14C7 .text Export #1000_CSimpleList::AddHead
focht
05-12-2004, 02:05 PM
Hi,

yes it is - but you have own the import lib that _exactly_ matches the mfc version used.
For instance there exist several flavours of mfc42.dll (different version numbers/exprts, ansi versions, unicode versions, debug versions, localized versions...)

Though one could try to get MS Visual Studio and use the redist import libs that came with it or download Platform SDK...

But if the target app is late binding to unknown/custom version of MFC you're ****.

Easier would be IDAs approach of creating (FLIRT) signatures for all the MS runtime flavours (CRT, MFC, ...), which can be distributed freely and are _small_ of size (if i remember correctly those implibs can have some megabytes in size ...).

Regards

A. Focht


Help with point-h in my computer

RCE Messageboard's Regroupment > General > Help with point-h in my computer
Pompeyfan
12-29-2003, 08:12 AM
Okay, I have uploaded a screenshot to my website at http://members.optusnet.com.au/~vincewmb/Aussiepompeyfan/Olly.htm, and have been trying to follow the tutorial in 33-punto_ h ingles\Punto_H_english.mht.

Following all the steps in the tutorial 33-punto_ h ingles\Punto_H_english.mht, on my system I ended up with my point-h being at 77C72FFC 0FB650 02 MOVZX EDX,BYTE PTR DS:[EAX+2], and I ended up in GDI32, instead of USER32, I am running the latest version of Olly, and have XP pro on my PC, then when I tried following the steps for the Crackme2, I got this far, but not sure what to do from here, I seem to be in a different location to the tutorial, but I can see the serial of 47802 that I entered.

Could I have done something wrong so far?, if I haven't where do I go from here?
Ricardo Narvaja
12-30-2003, 05:38 AM
You use the cruehead crackme for discover your point h?

When stop in your point, not stop for an exception?
Do you have non standard keyboard? (two persons with a wireless keyboard has a similar trouble and don't function the tute on your machines)
Instead thousands users are using point h without trouble.

Are you making bad any step?

Ricardo
Pompeyfan
12-30-2003, 04:53 PM
No, when I load the cruehead crackme, I get a message that Module cracme has entry point outside of the code, anyway I proceeded, but then when I view names, I don't get the user32 translate message listed.
So I used another crackme, cant recall which one, I just tried a few till I found one with the translate message listed, I did see that your tutorial said you could use any, seems strange the one you suggested wouldn't work for me though.
I'll try it again, maybe I stopped for an exception as you suggest.
Have a pretty standard keyboard, so doubt it is to do with that.
Ricardo Narvaja
12-30-2003, 05:59 PM
The point H work in 90 percent of the crackmes, but in not all crackmes point H is easy to found, i suggest found the value in cruehead crackme is more easy in other crackmes, and with the value found in cruehead crackme, you can use in any crackme or program.
I think you have other cruehead crackme, the crackme of the tute is not compressed, look well, cruehead write many crackmes, download of my FTP the right crackme, or mail me and i send you the correct crackme of cruehead for the tute.

Ricardo
Ricardo Narvaja
12-30-2003, 07:12 PM
my mail is ricnar22@millic.com.ar

Ricardo
Pompeyfan
12-31-2003, 07:14 AM
I've tried this with a few crackmes, but keep bombing out, so I have emailed you asking you to send me the right Cruehead crackme, I must be using the wrong one.
I appreciate your help.
Pompeyfan
12-31-2003, 07:56 AM
Okay, I finally got there, as you can see from http://members.optusnet.com.au/~vincewmb/Aussiepompeyfan/Olly.htm, but I do think Olly isn't playing completely well on my system, thanks Ricardo for all your help :-)
Ricardo Narvaja
12-31-2003, 11:02 AM
well the F1-12 keys in OLLY only work if the window of olly is activated, when you click in the run button, you activate the window.
Click in any part of the OLLY window to activate, and next the F1-F12 are active again.

Ricardo Narvaja
Pompeyfan
12-31-2003, 04:45 PM
Ah, well that explains it then, thanks again. I have successfull completed the Cosh crackme tutorial, what version of Idesk should I get for the next tutorial, is it in your ftp folder?
Ricardo Narvaja
01-01-2004, 03:26 AM
in my FTP in

D:\FTPROOT\VIEJO CURSO\PROGRAMAS CURSO VIEJO

03-IDesk-260.zip

or 03-Idesk-260.exe

Ricardo Narvaja
Pompeyfan
01-01-2004, 07:23 AM
Thanks Ricardo, I've downloaded it to try out later, I must say your tutorials are very well written and easy to follow.
Pompeyfan
01-01-2004, 09:29 AM
Hmm, is this file aleady unpacked, as I have unpacked it with Procdump, and then Olly doesn't seem to like it at all, it then gives me the message "the procedure entry point could not be located in the dynamic link library WINMM.DLL"
Ricardo Narvaja
01-01-2004, 12:38 PM
Well you not unpack well, the file, the IAT is bad.

For the tute, is not necesary unpack, only reach the registration window, and put on the command bar

Bp [adress of your punto h]

Ricardo
Pompeyfan
01-01-2004, 04:26 PM
Okay, well I am new to unpacking, I guess I'd better read up on that a bit before doing it again.
I'll do the tut without unpacking for now then.
Pompeyfan
01-01-2004, 10:29 PM
Okay, I have followed the tut to this point for Idesk:

11) The program stops Idesk Module:

00402E0F 8A1E MOV BL,BYTE PTR DS:[ESI]

12) Trace with F8 to exit this routine (retn) and the program go to the check point of serial:

004C9DB6 A3 04B55200 MOV DWORD PTR DS:[52B504],EAX
004C9DBB A1 00B55200 MOV EAX,DWORD PTR DS:[52B500]
004C9DC0 3B05 04B55200 CMP EAX,DWORD PTR DS:[52B504]

But I'm not quite sure what I do at step 12, can you clarify this, I would really appreciate this, as it is the last step of the tut, with the previous tut I just kept pressing run till I got to the right point, this is different.
Ricardo Narvaja
01-02-2004, 06:30 AM
well there are different forms a program works with the serial, in any program put a bpm on acess in the fake serial and RUN is a good option, in others trace till the excution flow return to executable and trace for look the comparation.
The tut is not a lesson for learn all methods for catch serials, is only for show the utilization of point H and similarity with hmemcpy of win98, how stop and how copy the fake serial to the memory.
For a better lessons for catch serials there are thousands of tuts for hmemcpy of w98,now you can use point h , and next continue this tuts for the part of catch the serial.

Ricardo
Pompeyfan
01-02-2004, 09:18 AM
Okay, got it now, I didn't realise how many times I had to press F8, that was why I gave up before, this time I kept going till it took me to the relevant code, and I successfully found the serial:-)
Thanks again for your help.
Fauzt0
06-24-2004, 01:53 AM
I have a question...
is the serial for the crackme of cruehead v1.0 18??
because i think I found a Bug thik so if don't please tell me...
because when u was reading u'r tuto (ricardo) I could'nt find my H point so I read the Crackme code (assamble) and star to trace F7 and take to one point that compare 18 whith ???? so the program stop, I use The 18 as a serial and don't give me the Litle Window that Marks my mistake, Please Help

And I could't find my own
Fauzt0
06-24-2004, 01:55 AM
something I forgot To Mention it How do u know which librari takes u to u'r H point??? In Cruehead is Translate...

but it's no t located on this program...
Ricardo Narvaja
06-24-2004, 06:57 AM
Use this plugin for OLLY and this show automatically your POINT H and you can put BPX in the point easily only pressing a button.

This plugin by THE KLUGER is a good option for work with POINT H and the NEW POINT A for VISUAL BASIC 5 and 6, this plugin discover the value of the points and let put directly a bpx and any of this poits or quit if you desire is perfect for work with points.

download

http://tinyurl.com/395zo

Ricardo Narvaja
PD:The new point a for visual basic has a tut and help for cracking in visual basic a lot read if you don't understand the use of this incredible point


Learn Olly

RCE Messageboard's Regroupment > General > Learn Olly
MC707
12-30-2003, 04:46 AM
I'm a newbie with OllyDbg.
Tell me please where can I find detailed(!) info about OllyDbg?
j_petrucci
12-30-2003, 07:28 AM
Hi!

Some time ago, I started searching on Google " ollydbg tutorials ", and find some only on "underground" cracking sites.. you can start with them, by the way, right on this page (upper right corner, 'tutorials') you find three nice ones.
If you still can't find anything else, mail me and I'll send you all that I have.

bye
*guido*
MC707
12-30-2003, 09:46 AM
Thanks anyway but I was looking not tutorials but reviews of its opportunities.
MC707
12-30-2003, 09:57 AM
It is insulting - why on SoftIce a lot of documentation, and on Olly - it is not enough.
j_petrucci
12-31-2003, 12:47 PM
Yep MC707! You're right, every site, forum or tutorial about reverse engineering talks about SoftIce and how much it's better/faster/powerful than everything else: in my opinion, OllyDbg is good enough for the most cases, and, if you don't have to manage drivers, system components or kernel internals, you also don't need more than that. Maybe there many "conservationists" worshipping their first tool, and now can't live with or without it.

regards..
*guido*
pzalps
12-31-2003, 02:56 PM
j_petrucci

oh do you have ollydbg tutorials ?

i want ollydbg tutorials i am beginner

i collect ollydbg tutorials but i have few tutorials

plz give me ollydbg tutorials

iam sorry that my english is very bad

my mail pzalps@hotmail.com
j_petrucci
01-01-2004, 05:14 PM
pzalps, now I'm away from home till Sunday... I'll send what I have to you when I'll come back home, ok? in the meanwhile, try this tutorial site, it contains many many things! ;p http://zor.org/krobar (better download the already packed collections, not every single one)

A Happy New Year to everyone!

regards...
*guido*
j_petrucci
01-01-2004, 05:15 PM
sorry.. the html tag doesn't work fine, the URL is: http://zor.org/krobar
Pompeyfan
01-01-2004, 10:31 PM
This http://www.exetools.com/forum/forumdisplay.php?s=&forumid=1 forum seems to have a few Olly tuts, check it out.
pzalps
01-01-2004, 11:40 PM
j_petrucci

thanks your reply

i waiting for sunday your mail

pzalps@nate.com or pzalps@hotmail.com

and i check that you known 2url
Ricardo Narvaja
01-02-2004, 06:34 AM
If you are spanish i have 168 tuts and more of 100 contest with tuts, in my FTP, and in the site of crackslatinos.

http://www.crackslatinos.hispadominio.net/

section members

Ricardo
pzalps
01-02-2004, 07:20 AM
Ricardo Narvaja thanks your care my reply

But i visit your ftp site 1 month ago

Your tut is very good and huge but i can't read

I translate your tuturials translate program

But translate program is not good and i can't understood

so i found English tut ^^
pzalps
01-02-2004, 01:15 PM
I am sorry that my english is bad
MC707
01-05-2004, 06:05 AM
Thanx a lot 2 j_petrucci & Ricardo Narvaja! It would be exellent if they were in english.
nsolanoc
01-21-2004, 02:10 PM
<u>Ricardo Navaja:</u>

Còmo me hago miembro de la lista Cracklatinos?

soygenial7012@hotmail.com
Ricardo Narvaja
01-21-2004, 04:37 PM
Subscribirse: crackslatinos-subscribe@gruposyahoo.com.ar
Borrarse de la lista: crackslatinos-unsubscribe@gruposyahoo.com.ar
Moderador de la lista: crackslatinos-owner@gruposyahoo.com.ar

Página de CRACKSLATINOS
http://www.crackslatinos.hispadominio.net/

Ricardo Narvaja
alan
05-12-2005, 03:46 PM
Could someone tell me, in English:

1) How to register on the site:

http://www.crackslatinos.hispadominio.net/

2) How do I navigate to the Ricardo's tutorials?

Regards,
Alan
Ricardo Narvaja
05-13-2005, 11:23 AM
http://www.ricnar456.dyndns.org/vfolder.ghp

go there (only NUEVO CURSO (OLLYDBG) more of 400 tutorials now

Ricardo
Ricardo Narvaja
05-13-2005, 11:24 AM
http://www.ricnar456.dyndns.org/vfolder.ghp

go there (only NUEVO CURSO (OLLYDBG) more of 400 tutorials now

Ricardo
arjuns
05-13-2005, 03:27 PM
Ricardo are they all in English , if they are not what language do ther are ?
and how to convert it into english..
...............Please help
Thanks in advance
Ricardo Narvaja
05-13-2005, 04:01 PM
are 99 % in spanish only 1 % in english.

But have many pictures, you need a good translator i think.

Ricardo
arjuns
05-13-2005, 04:25 PM
do you please tell me the name of any translator ?
is there any software that translate or Web site?????
arjuns
05-13-2005, 04:28 PM
VEry hard to understand spenish.......
Ricardo Narvaja
05-13-2005, 07:51 PM
i don´t speak english well, for tell you a name of a spanish to english translator, i only appreciate the english to spanish translators
Maybe any english speaker can tell you a name of a good translator spanish to english.

Ricardo
alan
05-14-2005, 06:55 AM
There are several sites on the Web where you can type some Spanish and get an understandable English translation.

Here's an example from one of Ricardo's tutorials:

Spanish:
El termino p-code no es nuevo ni puede decirse que sea un invento de Microsoft,

English:
The I finish p-code is not new neither can be told that be an invention of Microsoft,

http://ets.freetranslation.com/

Regards,
Alan
squareD
08-22-2005, 11:06 AM
@Ricardo

Please give me your email adress...

I'd like to send you an email to get username and password for this website.

http://www.ricnar456.dyndns.org/vfolder.ghp

Regards,
magic
Ricardo Narvaja
08-22-2005, 11:15 AM
ricnar456@yahoo.com.ar

there are 500 tutorials now


Disasm

RCE Messageboard's Regroupment > General > Disasm
xdream
01-01-2004, 10:32 PM
Has anyone compiled olly's disasm/assemble to a dll i would really like to use it with my asm project. Thanx
focht
01-02-2004, 10:52 AM
Greetings,

if i understand you correctly, you want to use that functions written in C in your assembly program.

First you need a decent C/C++ compiler to produce a dynamic link library from the source files.
Assuming you have no commercial one available (VC++ ...) there are a few good and free C and C++ (optional) compilers available.

1) LCC-Win32 - Based on the retargatable LCC.
2) Borland free compiler - http://www.borland.com/bcppbuilder/freecompiler
3) GNU ports - MinGW, Cygwin...

The Borland product requires a free registration and also comes optionally with a debugger (you'll have to download it separately).
GNU ports are well maintained and confirm to ANSI C.
MinGW is a Win32 compiler and you can actually develop GUI programs with it.

Though, its a bit complecated to work with command line resource tools.
If you need a decent IDE with MinGW as backend, get Bloodshed compiler from
www.bloodshed.net.

For the DLL-interface itself:

Normally you don't need a .def/.exp file at all (these are legacy methods). Instead, simply add "__declspec(dllexport)" to the declarations (in disasm.h):

extern "C"
{

__declspec(dllexport) short __stdcall foo(short x);

...

}

And the linker will automatically export it.

If you really need to use a .def file, the easiest method is to specify:

EXPORTS
foo

Regards,

A. Focht
xdream
01-02-2004, 10:10 PM
I dunno howto do it :(
focht
01-03-2004, 04:33 PM
Greetings,

uhm ... whats the problem with the learn-by-doing method?
If someone supplies the result you will never learn something new nor understand how things work.

1) Get tools to compile a dynamic library from C sources:

Download a free C/C++ compiler - it should be bundeled with some development environment to make things easier

http://www.bloodshed.net/dev/devcpp.html

Dev-C++ 5.0 beta 8 (4.9.8.0) (12 MB) with Mingw/GCC 3.2
Dev-C++ version 4.9.8.0, includes full Mingw compiler system (GCC 3.2) and GDB 5.1

Install the stuff.
Download any latest service packs or updates to the product:

Latest update : version 4.9.8.5
http://bloodshed.net/dev/devcpp4985.zip

Now you are ready to setup a project.

2) Make a windows DLL project

* use the IDE's wizard to create a DLL project
(project new -> DLL)
* fill in project name ... for instance "disasm"
* set preference to "C" (the supplied disasm sources are C only)
* now save your project into some subdirectory you created (e.g. "disasmlib")

The wizard created some files for you.
You can "saveall" to really save em to disk.

Of course you can already compile it. It will produce a DLL with some dummy function exported.

Now you are ready to integrate olly's disasm sources.

3) Import olly disasm sources and modify to get things working

* unpack the disasm.zip archive into your project directory
* add the necessary *.c and *.h files to the project (context menu "add to project")
In this case you need to add: asmserv.c, assembl.c, disasm.c, disasm.h

Now if you try to build the project you get errors (of course)..
Hint: always "rebuild all" to clean up any remaining object files

To fix the errors you need to modify the main header file "disasm.h":
You need to remove or comment out the following construct:

<pre>
#if (char)0xFF!=255
#error Please set default char type to unsigned
#endif
</pre>

This is not understood by most compiler preprocessors.

The pow10l function is not supplied by most compiler libs, add the following to disasm.h header file to work around it:

<pre>
#define pow10l(a) pow(10.,(a))
</pre>

add code (top of disasm.h) to export the symbols/functions correctly:

<pre>
#if BUILDING_DLL
# define DLLIMPORT __declspec (dllexport)
#else /* Not BUILDING_DLL */
# define DLLIMPORT __declspec (dllimport)
#endif /* Not BUILDING_DLL */
</pre>

Append the "DLLIMPORT" macro to all functions that should be exported:
e.g. "int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,
int constsize,char *errtext);"
becomes "DLLIMPORT int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt, int constsize,char *errtext);"
and so forth...

(you find em at bottom of disasm.h file)

In your dllmain.c file (generated by IDE) remove the include stuff and replace it with the include stuff from disasm-package "main.c":

<pre>
#define STRICT
#define MAINPROG // Place all unique variables here

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <dir.h>
#include <math.h>
#include <float.h>
#pragma hdrstop

#include "disasm.h"
</pre>

Remove the dummy function (generated) from dllmain.c too.
Now your dllmain.c source file contains only a DllMain() which is ok.

To force the compiler to "char = unsigned char" option, add the "-funsigned-char
" option to the compiler parameters (project options)

Voila ... you are able to compile the sources to a clean win32 dll.
If you dump the exports of the newly created "disasm.dll" (using some PE tool like dependency walker) you will see all exports fine.

To really verify if things work you should create a simple C console client, which consumes the dll.
It is not that hard ... ;)

Best Regards,

A. Focht


BAD OLLYDMP

RCE Messageboard's Regroupment > Plugins > BAD OLLYDMP
Ricardo Narvaja
01-03-2004, 10:44 AM
I see Gigapede is not making more OLLYDMPS, but the new 5 or 6 versions of OLLYDMP only work well in ENGLISH XP, in other languajes (SPANISH XP is mine) the dump is a disaster, not dump a UPX, nothing.

We use old versions of ollydmp, this go well in ANY languaje.

If Gigapede read this, i suggest if he make a new OLLYDMP, he can test the possibility of work in all languages of S0.

Thanks
Ricardo Narvaja
Gigapede
01-03-2004, 02:10 PM
Hi Ricardo.
I do not think to quit development of OllyDump, but I'm too busy to get time.
and I'm sorry I don't know how to test all languages.
Could you recompile it in your environment ?
You can freely modify the source code and release it.

Or give me some advices.

Thanks
Gigapede
Ricardo Narvaja
01-03-2004, 07:27 PM
I made a UPX dump with OLLYDMP 1.11, 2.00 and 2.01 and work well, but with upper versions, do not recognice well the names of apis i think, and the dumped, not have all the dlls, in my example the dumped with 1.11 has 8 dll, and the dump with 2.21, has only two dumps, and when i load the dumped in olly only 2 dll apear and the message -Import Lookup Table outside .idata-

LOG OF UPX DUMPED WITH 1.11

File 'D:\Documents and Settings\Ricardo\Escritorio\katarfirstcrackme\jeje .exe'
New process with ID 000008A8 created
004011A8 Main thread with ID 00000934 created
00400000 Module D:\Documents and Settings\Ricardo\Escritorio\katarfirstcrackme\jeje .exe
733A0000 Module D:\WINDOWS\System32\MSVBVM60.DLL
770F0000 Module D:\WINDOWS\system32\OLEAUT32.dll
77180000 Module D:\WINDOWS\system32\ole32.dll
77BE0000 Module D:\WINDOWS\system32\MSVCRT.DLL
77C40000 Module D:\WINDOWS\system32\GDI32.dll
77D10000 Module D:\WINDOWS\system32\USER32.dll
77DA0000 Module D:\WINDOWS\system32\ADVAPI32.dll
77E40000 Module D:\WINDOWS\system32\kernel32.dll
77F40000 Module D:\WINDOWS\System32\ntdll.dll
78000000 Module D:\WINDOWS\system32\RPCRT4.dll
004011A8 Program entry point

LOG OF UPX DUMPED WITH 2.21

File 'D:\Documents and Settings\Ricardo\Escritorio\katarfirstcrackme\jeje 2.exe'
New process with ID 00000D6C created
004011A8 Main thread with ID 0000070C created
00400000 Module D:\Documents and Settings\Ricardo\Escritorio\katarfirstcrackme\jeje 2.exe
Import Lookup Table outside .idata
77E40000 Module D:\WINDOWS\system32\kernel32.dll
77F40000 Module D:\WINDOWS\System32\ntdll.dll
004011A8 Program entry point

View - MEMORY of dump with 1.10
Memory map
Address Size Owner Section Contains Type Access Initial Mapped as

00400000 00001000 jeje 0 PE header Imag R RWE
00401000 00006000 jeje 0 UPX0 Imag R RWE
00407000 00002000 jeje 0 UPX1 code Imag R RWE
00409000 00001000 jeje 0 .rsrc data,imports Imag R RWE
0040A000 00001000 jeje 0 .xur Imag R RWE
00410000 00103000 0 Map R R
00520000 00175000 0 Map R E R E
00820000 00001000 0 Priv RW RW
00830000 00004000 0 Priv RW RW
00840000 00003000 0 Map R R \Device\HarddiskVolume2\WINDOWS\System32\ctype.nls
00850000 00003000 0 Priv RW RW
00860000 00010000 0 Priv RW RW
00C60000 00003000 0 Priv RW RW
733A0000 00001000 MSVBVM60 7 PE header Imag R RWE
733A1000 000FD000 MSVBVM60 7 .text code,imports Imag R RWE
7349E000 0000D000 MSVBVM60 7 ENGINE code Imag R RWE
734AB000 00007000 MSVBVM60 7 .data data Imag R RWE
734B2000 00031000 MSVBVM60 7 .rsrc resources Imag R RWE
734E3000 00010000 MSVBVM60 7 .reloc relocations Imag R RWE
770F0000 00001000 OLEAUT32 7 PE header Imag R RWE
770F1000 00081000 OLEAUT32 7 .text code,imports Imag R RWE
77172000 00002000 OLEAUT32 7 .data Imag R RWE
77174000 00001000 OLEAUT32 7 .rsrc resources Imag R RWE
77175000 00006000 OLEAUT32 7 .reloc relocations Imag R RWE
77180000 00001000 ole32 7 PE header Imag R RWE
77181000 000F9000 ole32 7 .text code,imports Imag R RWE
7727A000 00006000 ole32 7 .orpc code Imag R RWE
77280000 00007000 ole32 7 .data data Imag R RWE
77287000 00002000 ole32 7 .rsrc resources Imag R RWE
77289000 0000E000 ole32 7 .reloc relocations Imag R RWE
77BE0000 00001000 MSVCRT 7 PE header Imag R RWE
77BE1000 00047000 MSVCRT 7 .text code,imports Imag R RWE
77C28000 00007000 MSVCRT 7 .data data Imag R RWE
77C2F000 00001000 MSVCRT 7 .rsrc resources Imag R RWE
77C30000 00003000 MSVCRT 7 .reloc relocations Imag R RWE
77C40000 00001000 GDI32 7 PE header Imag R RWE
77C41000 0003B000 GDI32 7 .text code,imports Imag R RWE
77C7C000 00001000 GDI32 7 .data data Imag R RWE
77C7D000 00001000 GDI32 7 .rsrc resources Imag R RWE
77C7E000 00002000 GDI32 7 .reloc relocations Imag R RWE
77D10000 00001000 USER32 7 PE header Imag R RWE
77D11000 0005B000 USER32 7 .text code,imports Imag R RWE
77D6C000 00002000 USER32 7 .data data Imag R RWE
77D6E000 0002B000 USER32 7 .rsrc resources Imag R RWE
77D99000 00003000 USER32 7 .reloc relocations Imag R RWE
77DA0000 00001000 ADVAPI32 7 PE header Imag R RWE
77DA1000 00067000 ADVAPI32 7 .text code,imports Imag R RWE
77E08000 00005000 ADVAPI32 7 .data data Imag R RWE
77E0D000 0002C000 ADVAPI32 7 .rsrc resources Imag R RWE
77E39000 00005000 ADVAPI32 7 .reloc relocations Imag R RWE
77E40000 00001000 kernel32 7 PE header Imag R RWE
77E41000 00076000 kernel32 7 .text code,imports Imag R RWE
77EB7000 00003000 kernel32 7 .data data Imag R RWE
77EBA000 00073000 kernel32 7 .rsrc resources Imag R RWE
77F2D000 00006000 kernel32 7 .reloc relocations Imag R RWE
77F40000 00001000 ntdll 7 PE header Imag R RWE
77F41000 0006E000 ntdll 7 .text code,exports Imag R RWE
77FAF000 00004000 ntdll 7 ECODE code Imag R RWE
77FB3000 00005000 ntdll 7 .data data Imag R RWE
77FB8000 00032000 ntdll 7 .rsrc resources Imag R RWE
77FEA000 00003000 ntdll 7 .reloc relocations Imag R RWE
78000000 00001000 RPCRT4 7 PE header Imag R RWE
78001000 00070000 RPCRT4 7 .text code,imports Imag R RWE
78071000 00006000 RPCRT4 7 .orpc code Imag R RWE
78077000 00001000 RPCRT4 7 .data data Imag R RWE
78078000 00001000 RPCRT4 7 .rsrc resources Imag R RWE
78079000 00005000 RPCRT4 7 .reloc relocations Imag R RWE
7F6F0000 00007000 7 Map R E R E
7FFB0000 00024000 7 Map R R
7FFDE000 00001000 7 data block o Priv RWE RWE
7FFDF000 00001000 7 Priv RWE RWE
7FFE0000 00001000 7 Priv R R

Memory map of dump with 2.21

Address Size Owner Section Contains Type Access
00400000 0000C000 jeje2 PE header Imag R RWE
77E40000 00001000 kernel32 PE header Imag R RWE
77E41000 00076000 kernel32 .text code,imports Imag R RWE
77EB7000 00003000 kernel32 .data data Imag R RWE
77EBA000 00073000 kernel32 .rsrc resources Imag R RWE
77F2D000 00006000 kernel32 .reloc relocations Imag R RWE
77F40000 00001000 ntdll PE header Imag R RWE
77F41000 0006E000 ntdll .text code,exports Imag R RWE
77FAF000 00004000 ntdll ECODE code Imag R RWE
77FB3000 00005000 ntdll .data data Imag R RWE
77FB8000 00032000 ntdll .rsrc resources Imag R RWE
77FEA000 00003000 ntdll .reloc relocations Imag R RWE
7F6F0000 00007000 Map R E R E
7FFB0000 00024000 Map R R
7FFDE000 00001000 data block o Priv RWE RWE
7FFDF000 00001000 Priv RWE RWE
7FFE0000 00001000 Priv R R

VIEW-MEMORY DUMP WITH 2.21

Are very different, snif.
Is posible ollydmp has a posibility of read the system dlls of diferent carpet (not system 32), configurable, and in this carpet i can put the english dlls?

Ricardo Narvaja
focht
01-04-2004, 08:54 AM
Greetings,

well the message 'Import Lookup Table outside .idata ' indicates there went something wrong.
The different module list and memory map is just the result of it.

On your target system (Windows XP) try to gather some info *before* you dump:

1)

Compare both (1.11 and 2.21) plugin main screens -> menu item "dump debugged process".
Does the sections view match?
What values differ?

2)

Did you select "Rebuild import" option? what method (1,2)?
Hint: rebuild was *not* implemented in 1.11.

Enable "Search Log" in ollydump options menu.
Copy all log output from the plugin (imports API search results.) and post it here.
That might show potential problems ...

I suspect the problem in the IAT rebuilding engine ;)

Regards,

A. Focht
focht
01-04-2004, 08:59 AM
Appendix:

After enabling "Search Log" in ollydump options menu, you actually have to dump the process to get all the IAT rebuild log messages.

Regards,

A. Focht
Gigapede
01-04-2004, 10:40 AM
::Ricardo
2.21 is beta and experimental version, so it doesn't work well.
You'd got it by directory digging.
You should use 2.20.
I don't use 2.21.

OllyDump gets dll info from OllyDbg.
I don't think the Language is the problem.

::focht
Thanks.
You know a lot than me.

Gigapede
focht
01-04-2004, 11:32 AM
Greetings,

AFAIK the main difference between 2.20 and 2.21 is the added VBOX recognition in GetRealApiAddress() of IAT rebuild engine.
The other ones are only cosmetic nature (i diff'd the source files).

V2.20 should same (dis)behavior, because ricardos target is UPX'd.

To track down the problem:

The IAT logging may produce a huge amount of data (due to different recognition algorithms), so enable "log to file" option in ollydbg's log window.
After dump, close the log file.

Now search the log file which packer signature gets recognized either "found [...] signature" or that last signature search "[...] search" line before any "found ... import".

Next, search for "OllyDump -- Import Table" line and scan through the following lines.
Look if any of the "missing" DLLs (msvcrt, ...) are referenced here.

Regards,

A. Focht


Isdebbugerpresent

RCE Messageboard's Regroupment > General > Isdebbugerpresent
Pompeyfan
01-05-2004, 04:47 PM
I have tried using this pluggin, but if it doesn't work for a particular program, is their any other methods you can use to bypass the programs protection?
focht
01-05-2004, 07:50 PM
Greetings,

maybe you misunderstood the meaning of the plugin?
The plugin only allows to fake results of IsDebuggerPresent() API call.

kernel32!IsDebuggerPresent:
77E72740 64:A1 18000000 MOV EAX,DWORD PTR FS:[18]
77E72746 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
77E72749 0FB640 02 MOVZX EAX,BYTE PTR DS:[EAX+2]
77E7274D C3 RETN

Matt Pietrek documented fields of TIB in his May 1996 article in MSJ.
There is TIB for each thread running in Win32 system, and in all Intel-based Win32 implementations, FS register points to TIB.

obtain win32 TIB address of active thread: FS:[18]
obtain win32 PEB (program environment block) address: [TIB+30]
obtain debugged flag: [PEB+2]

Pseudocode:

<pre>
BOOL WINAPI IsDebuggerPresent(void)
{
return NtCurrentTeb()->Peb->BeingDebugged;
}
</pre>

There are literally dozens of methodes to detect user/kernel mode debuggers.
These are beyond the context of the plugin.

Describe what your target is packed/encrypted with and someone *might* help you.
Something more information than "doesnt work" would improve quality of help, of course.

Regards,

A. Focht
TBD
01-06-2004, 03:57 AM
focht: i want to thank you for supporting the forum with your detailed explanations.

maybe, someday, we will gather all the posts and make a FAQ. anyone intrested ? :)
Pompeyfan
01-06-2004, 08:57 AM
1tox latest version 2.63 is what I was working on, it wont let me run it in Olly, even if I try to hide it with the Olly "is debugger present" pluggin, checking with Peid, it shows that the protection is Armadillo 1.xx-2.xx & Silicon Realms Toolworks.
I'm not interested in keeping the program, I just started working on it because I found other 1tox Olly tuts for earlier versions, and once I started working on this one, I couldn't let it go, as I saw it as a means to increase my knowledge, once I've cracked it I'll delete it from my system.
focht
01-06-2004, 10:30 AM
Greetings,

of course it works as expected.
If you "hide" in IsDebuggerPresent plugin, it will correctly fake the return value thus bypassing this check.
As you already stated: this is not the only anti-debugging trick used.

The protector itself creates a second instance of the process (suspended), with the first instance as "debugger" or "controller" you might call it and the second instance as debuggee.
bpx DebugActiveProcess() and you will see what i mean...
WaitForDebugEvent() and ContinueDebugEvent() synchronize the "communication" between both processes.

There exist some tutorials how to cope with such protecttion, google em.
I know there are some (good) spanish ones.
Free online translators might be sufficient to extract the useful information.

Regards,

A. Focht
Pompeyfan
01-06-2004, 05:11 PM
Actually, I had noticed this, I did set a breakpoint on it, and noticed other instances of is debuggerpresent, can you give me a link to a good tut, even if Spanish, and I'll get it translated?
focht
01-06-2004, 06:23 PM
If the email address on your homepage *****wmb@optusnet.***.** is valid, i will send the links to you.
As you might know, posting such stuff/links is not permitted here ;)

Regards
Pompeyfan
01-06-2004, 06:40 PM
Yes, that email is valid, please do send, I would really appreciate that.
Pompeyfan
01-07-2004, 05:07 PM
Hey, that translator site works well, have downloaded a lot, and translated, will read through this arvo, thanks a lot :-)
mcnorth
01-20-2004, 10:58 PM
"maybe, someday, we will gather all the posts and make a FAQ. anyone intrested ? :)"

Yup, I'd be interested in that:)


How does Ollydbg calculate 32bit values of segment

RCE Messageboard's Regroupment > General > How does Ollydbg calculate 32bit values of segment
1bitshort
01-06-2004, 05:25 AM
In Ollydbg when you look at the segment registers you might see something like this:
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS 003B 32bit 7FFDE000(FFF)

Does anybody know how OllyDbg is able to calculate 7FFDE000 from 3B, and 0 from 23, 1B etc?? I see no correlation

Thanks for any help
focht
01-06-2004, 06:28 AM
Greetings,

what you are looking at is 32 bit protected mode (and virtual 86 mode to some extend, DOS/BIOS legacy code emulation).

Memory handling in protected mode is not easy to understand, partly because a number of similar items exist in both the segment mechanism and the paging mechanism, often with just enough difference that unless you work with it constantly, you usually need to look things up again to be sure of exactly how each part works.

Win32 makes virtually no use of segmentation at all.
The segments are always set up to allow addressing of the entire 4Gig address space.
Within that address space, there will frequently be parts that 1) aren't present at all, and 2) are only accessible in specific ways.
Certain parts will be executable only, others read only, others read/write, some generally won't be accessible at all unless you happen to have 4Gig of RAM installed.

Now to the values itself:

0x23 consists of the selector 0x20 and the privilege level 3 (this is for user mode).
The selector 0x20 is an index into a table called the global descriptor table (GDT) containing segment descriptions.
The most common one is Base 0, Length 0xffffffff and some flags for right
management etc.

Now armed with that knowlegde we can decode the "rows"

[segment reg] [selector value] [segment size bit = 16/32 bit] [segment base address] [sizeof segment]

If you really want to know more: get some protected mode primers

http://www.internals.com/articles/protmode/protmode.htm might be useful...

More? -> google is your friend ;)

Regards,

A. Focht


Multiple STEP_OVER in a row

RCE Messageboard's Regroupment > Plugins > Multiple STEP_OVER in a row
psyCK0
01-06-2004, 09:04 AM
Hey all,

Need some plugin help: I need my plugin to do a "step over" two times in a row.
I try:
<pre>Go(Getcputhreadid(), 0, STEP_OVER, 0, 1);
Go(Getcputhreadid(), 0, STEP_OVER, 0, 1);</pre>and<pre>Sendshortcut(PM_MAIN, 0, WM_KEYDOWN, 0, 0, VK_F8);
Sendshortcut(PM_MAIN, 0, WM_KEYDOWN, 0, 0, VK_F8);
</pre>

but only one step over is executed. I suppose thats because olly dosnt have the time to execute the second one... Is there any good way to get this to work?
focht
01-06-2004, 11:09 AM
Greetings,

in short: you can't do it that way.
This is one shortcoming i noticed too when with such stuff some time ago.

The problem is as follows:

(i guess you are hooking into mainloop() callback listening to events)

ollydbg itself sits in an event loop, calling WaitForDebugEvent() / ContinueDebugEvent() to synchronize with the debuggee.
When the debugging event occurs, the system suspends all threads in the process being debugged and notifies the debugger of the event.
Ollydbg then propagates it to all connected plugins.

Pseudecode:

<pre>
while( debuggee_alive)
{
WaitForDebugEvent( &de,INFINITE)
if( de.dwDebugEventCode == EXCEPTION_DEBUG_EVENT)
{
update_internal_stuff()

for_all_loaded_plugins
{
call_plugin_mainloop( &de)
}
}

if (de.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT)
{
debuggee_alive = false;
}

ContinueDebugEvent( de.dwProcessId,de.dwThreadId, DBG_CONTINUE);
}

</pre>

Now as you see, the event propagation to plugins is synchronous.
Even if you call an asynchronous method (posting message whatever) which causes DEBUG_EVENTs, the debuggers main loop can't be entered twice that time (no reentrancy) because the debuggers loop thread waits for the call to the plugins mainloop() to return!

Currently i think there is only one way to get around that limitation:
You need to separate each call between debug events.

Make some kind of internal command queue, where you store command sequences.
When your plugin gets the debug event (after issueing command), dequeue the next command - only one command at a time!
This gives the ollydbg the chance to execute the debugger loop itself and to pump messages in other gui threads (if any).
Your go/singlestep command causes another DEBUG_EVENT to be issued which in turn lets the debugger call the plugins mainloop(). Voila. Synchonized.

Of course i might be wrong with my assumptions ... if so the author of ollydbg should clearify it ;)

Regards,

A. Focht
psyCK0
01-06-2004, 06:12 PM
Thanks for the info. =) It really doesn't make it any easier for me, but at least now I know....
psyCK0
01-07-2004, 12:34 PM
Do you happen to know why olly wont take commands from another thread in the plugin? If I create a new thread and pass it the value of Getcputhreadid() and then run Go() using the passed value olly doesnt react?
focht
01-07-2004, 04:33 PM
Greetings,

well maybe ;)

As i explained above, ollydbg has a debugger loop (in fact, ollydbg itself is single threaded).
If you issue commands from the plugin's callback, they will be processed within the context of the thread that called the plugin callback (ollydbg's main thread).
This has the consequences as explained in my previous post (issueing commands in row)

You are spawning a separate (command) thread, unknown to ollydbg, to issue commands.
This imposes several penalties under windows operating systems due to its design.
As you might know, message queue (and all associated window objects) belong to thread that created them.
One cannot take out actions (like redrawing) by directly calling gui API functions on another thread context (it might work sometimes but often fails).
This is why one need to synchronize these actions to the right thread context (using SendMessage/PostMessage calls).

Imagine, what *might* happen if you call one of ollydbg's exported API functions.
Maybe the function is complex.
Imagine, the function does some stuff which invalidates internal data, structures ... and the gui stuff (forms/windows) itself.
Guess - the function calls gui/control functions implicit - uh oh wait ... Remember which thread context we are? Yike!
Not the one, that created the windows nor executes the main message loop.
Usually, applications become unstable at this point.

Maybe ollydbg maintains some state variable (which gets updated while/after processing main debugger loop) or checks the thread context before calling any gui stuff (which is tedious, because the plugin API isnt designed to be "multithread safe").

Only the author knows, how the stuff in ollydbg's exported API is exactly implemented.
Some functions may implicitly call gui APIs - some functions might not.

My advice: DONT call any ollydbg API functions from a thread context, unknown to ollybdg itself (that is any thread, not created by the main program itself)!
It will lead to side effects, things dont work as expected and finally ollydbg might become unstable.

Just issue the commands one-by-one each time the debug event callback gets called.
Maintain some internal state machine or command queue to implement this behavior.

Regards,

A. Focht.


language packs?

RCE Messageboard's Regroupment > Plugins > language packs?
kerk
01-06-2004, 08:23 PM
Good day. Big thanks for Olly it's really nice :) How you think about support language packs? Of corse i understand real professional not need it... but for newbie as me it's good. English-it's international language, but seeeng native language just as part interface pretty. How i can add my own language?

(Without reversing please, i hope we are have different way :)
focht
01-07-2004, 04:58 PM
Greetings,

well application localization is a good point - but in my opinion should be given a low priority on TODO list (long term issue).

If i look at ollydbg, most string literals referenced from code reside in .data.
Multilanguage imposes that you load/resolve resources dynamically at runtime depending on the current locale.
There are several strategies to implement this behaviour:
- putting resources into separate resource dlls.
- use text files which map identifiers to strings (while the default/neutral locale is compiled into the executable itself).
- ....

In short: You can't do it right now until ollydbg implements some sort of resource manager to load/resolve the text strings, menus, .... at runtime.

Regards,

A. Focht
kerk
01-07-2004, 05:59 PM
I think text files is best chouse, as very easy add localization. Yes, you absolutely right for giving localization low priority...but localization do it Olly more popular.This mean more friendly interfase (smaller time for do it task), may be more users, more knowlege and tricks, more plugins...in future

Of course,i can do it with some programm.. but always for new version need new patch, and old usually not working and it's unofficial. Often occur in duplicate with errors. But with built-in support old localization working fine in new version, may be need translate else 1-3%

...
May be i'm wrong: if this feature really need only for me - please just forget about it :)

With respect, Kerk


Olly tuts

RCE Messageboard's Regroupment > General > Olly tuts
Pompeyfan
01-08-2004, 08:39 AM
Thought I would share a good source of tuts for newer users of Olly, it is at hxxp://cracking.accessroot.com/, I'm finding them very easy to follow.
MC707
01-08-2004, 10:06 AM
They are VERY simple. For maxnewbies. Crackers & Reverse-Engeneerers do not write so.


Using OllyDbg

RCE Messageboard's Regroupment > General > Using OllyDbg
spud
01-09-2004, 03:26 AM
Hi all
Please forgive me as I have just posted a question into the wrong forum, I am a total newbie to all of this "Sorry" Please could someone tell me if there are very basic tutorils on using OllyDbg and the concepts of debugging with this tool. I would be very greatful if anyone can help. Thanx
TBD
01-09-2004, 04:04 AM
there is a link in the "OllyDbg tuts" post. also a simple google for "OllyDbg tutorial" and you will find some
Pompeyfan
01-09-2004, 08:09 AM
Also, check here hxxp://www.exetools.com/forum/forumdisplay.php?s=&forumid=1


Olly automation project...

RCE Messageboard's Regroupment > Plugins > Olly automation project...
psyCK0
01-09-2004, 03:36 PM
After beating my head against the wall that is Olly automation I now officially give up. If anyone is intrested in continuing this work you can download the source at http://members.chello.se/psycko/ollyscript.zip .

The reason I gave up is that it seems that there is no working way to synchronize the active scripting engine with Ollys debug loop. Even though a command queue is possible to implement, the responses from Olly to the script would be meningless.
For example this script would not work properly:<pre>dim x
x = OllyDbg.EIP
while x < 402000h
OllyDbg.StepOver
x = OllyDbg.EIP
wend
</pre>

If you need some more info on my code you can mail me at bik78_NOSPAM_@mail.ru(remove _NOSPAM_).

Hope someone else does a better job of this then I did... =(
sgdt
01-09-2004, 04:00 PM
What I did was cheat, have seperate event functions for each stage. Instead of a "while" loop, an "if" condition to go to the next function.

The end result may seem to be more script work, but it actually comes out with the scripts being more understandable. It's quite common to have a well described function name being more readable than several lines of comments describing what in-line code is doing.

I haven't had a chance yet to look in depth at your code, but from what I did look at, it seems complete and very well written.

IMHO, I would concentrate less on what your engine can't do, and more on what you can do. In otherwords, don't give up. It may be just a mater of altering expectations.
psyCK0
01-09-2004, 04:37 PM
Ok, consider this:
<pre>OllyDbg.StepOver
if OllyDbg.EIP = 402000h then
'Do something
end if
</pre>
In this script, the StepOver method executes and sends a Go(... STEP_OVER ...)
to Olly. But the value of EIP is not updated until next iteration of the debug
loop so the value of eip before and after the "OllyDbg.StepOver" call is the
same. In fact, the whole script is executed before Olly reacts to the first
command. That must be because the plugin is running in the same thread as Olly, so the whole script engine business is run before the plugin returns control to Olly... Thats the issue I find difficult to resolve...
focht
01-09-2004, 05:51 PM
Greetings,

>In fact, the whole script is executed before Olly reacts to the first command.
>That must be because the plugin is running in the same thread as Olly, so the whole script engine business is run before the plugin returns control to Olly...

That is the consequence of the design of ollydbgs main debugger event loop.
Hope you "enjoyed" my explanations in the "STEP_OVER" message board thread ;)

The only chance to get around this limitation is to not execute the script at once but design the script evaluation around the debuggers event callback mechanism.
Like single stepping the script itself, each step gets driven by a separate debug event plugin callback call (e.g. a finite state machine).

Currently i dont think there's a chance to "fix" this problem at root (ollydbg) because the plugin processing architecture would severe break.
Imagine, what happens to other plugins, if one plugin "captures" exclusive control of the debugger flow itself. No way.
Even if ollydbg itself exposes some automation model - the problem would remain.
There can only be one debug event loop, which gets driven by the debuggers main thread.

Regards,

A. Focht
sgdt
01-09-2004, 06:09 PM
What he said, I think...

Have a string or function pointer called "OnNextBreak", and a action (Run, step, interactive, etc.). When the script function returns, it issues the Go based on the specified action and returns. When the internal plug-in state changes (ie. a break or exception), the apropriate function in the script is called.

function Step5(n)
{
if (OllyDbg.EIP < 402000h)
{
OllyDbg.Step; // Only sets flag, doesn't actually call Go.
}
else
{
OllyDbg.OnNextBreak = "Step6";
OllyDbg.Run; // Only sets flag, doesn't actually call Go.
}
}

In this case, the "OnNextBreak" (or "OnException", etc.) are used by the plug-in to determine which script function to call, while the action (Run, Step, etc.) are used after the script function returns to determine what to do about it. Interactive stops it from doing anything.
focht
01-09-2004, 07:05 PM
Hi again ;)

There might be a chance to implement this...

As i said above, the script should not be executed at once in the plugin's debug event loop (e.g. doing IActiveScriptParse::ParseScriptText, IActiveScript::AddNamedItem + IActiveScript::SetScriptState(SCRIPTSTATE_CONNECTE D)).

You might know there exist the possibily to not only hosting script sites but host debugging site too, called "active scripting debugging".
This is usually done by implementing IActiveScriptSiteDebug, IProcessDebugManager, IDebugApplication, IDebugDocumentHelper interfaces (among lots of other stuff).

By default external script debuggers can debug any script run by Active
Scripting.
The M$ Script Debugger is one example of an external debugger, but
you can write your own (like this one http://www.dreamcompany.com/dsd.html though its commercial)

Get the idea?
Single stepping through scripts by implementing your own script debugger engine.
That way you can synchronize "single line" script statement evaluation/execution with olldbg's main debugger event loop.

I might point you to following stuff: "Active Scripting APIs: Add Powerful Custom Debugging to Your Script-Hosting App"
http://msdn.microsoft.com/msdnmag/issues/1200/active/default.aspx
It also contains a sample of a script host and debugger.

An invaluable resource around active scripting:

http://www.mindspring.com/~mark_baker/

(check out "FAQ online version")

Tons of useful stuff and snippets/examples.

Regards,

A. Focht
psyCK0
01-10-2004, 06:34 AM
focht: intresting info, thank you. i was thinking of single-stepping for synchronization, but didnt think of the debugger interfaces. =) We will see where it all leads...
psyCK0
01-13-2004, 02:02 PM
Progress notes:
I abandoned the whole Active Scripting idea altogether. Even though
in the begining the idea seemed really nice, I never managed to get Olly
and Active Script engine working together.

I am now working on a custom asm-like scripting language for Olly.
At the moment the project is progressing well and the engine is already
capable of running scripts such as: <pre>// Test script
var x // Create a variable named x
mov x, 0
start:
sto // Execute OllyDbg step-over
add x, 1
cmp x, 5
jne start
</pre>

I hope to be able to release the first version (which will be able to read / write register values,
step through code and set breakpoints) some time quite soon.


Assembly incorrect for the written code

RCE Messageboard's Regroupment > General > Assembly incorrect for the written code
yaa
01-09-2004, 03:42 PM
Hello,

writing code and studying the compiled exe inside OllyDbg I have code that seems to be compiled to generate incorrect assembly. This happens in release mode ... in debug mode the assembly seems to be what I would expect. BTW I'm using VC++ 6.

<pre>while((boRet = GetMessage(&sttMsg, NULL, 0, 0)) != 0)
{
if (boRet == -1)
{
// handle the error and possibly exit
}
else
{
if(!IsDialogMessage(g_hDlg, &sttMsg))
{
TranslateMessage(&sttMsg);
DispatchMessage(&sttMsg);
}
}
}</pre>

This code seems to produce the following:

<pre>004011EB PUSH 0 ; /MsgFilterMax = 0
004011ED PUSH 0 ; |MsgFilterMin = 0
004011EF LEA EAX,DWORD PTR SS:[ESP+C] ; |
004011F3 PUSH 0 ; |hWnd = NULL
004011F5 PUSH EAX ; |pMsg
004011F6 CALL ESI ; \GetMessageA
004011F8 TEST EAX,EAX
004011FA JE SHORT Dummy.0040124A
004011FC PUSH EBX
004011FD MOV EBX,DWORD PTR DS:[<&USER32.DispatchM>; USER32.DispatchMessageA
00401203 PUSH EBP
00401204 MOV EBP,DWORD PTR DS:[<&USER32.IsDialogM>; USER32.IsDialogMessageA
0040120A PUSH EDI
0040120B MOV EDI,DWORD PTR DS:[<&USER32.Translate>; USER32.TranslateMessage
00401211 /CMP EAX,-1
00401214 |JE SHORT Dummy.00401236
00401216 |MOV EDX,DWORD PTR DS:[403048]
0040121C |LEA ECX,DWORD PTR SS:[ESP+10]
00401220 |PUSH ECX
00401221 |PUSH EDX
00401222 |CALL EBP
00401224 |TEST EAX,EAX
00401226 |JNZ SHORT Dummy.00401236
00401228 |LEA EAX,DWORD PTR SS:[ESP+10]
0040122C |PUSH EAX
0040122D |CALL EDI
0040122F |LEA ECX,DWORD PTR SS:[ESP+10]
00401233 |PUSH ECX
00401234 |CALL EBX
00401236 |PUSH 0
00401238 |PUSH 0
0040123A |LEA EDX,DWORD PTR SS:[ESP+18]
0040123E |PUSH 0
00401240 |PUSH EDX
00401241 |CALL ESI
00401243 |TEST EAX,EAX
00401245 \JNZ SHORT Dummy.00401211</pre>

Which I'd say is not correct since all the calls to GetMessage, IsDialogMessage, TranslateMessage and DispatchMessage are out of the loop.
Anyone got an idea?

yaa
yaa
01-09-2004, 04:08 PM
Sorry just noticed the function addresses are saved in the registers ... the functions do get called.

yaa


How to debug DLL ?

RCE Messageboard's Regroupment > General > How to debug DLL ?
jadesk99
01-10-2004, 08:34 PM
Can not Olly debug DLL ?
Let me know how to debug DLL code with Olly !

Thanks
Ricardo Narvaja
01-11-2004, 01:02 AM
In Nt/2000 and XP olly can debug all DLLS.

Run the principal program (the program use the dll you can debug) and put in EVENTS the mark in STOP IN DLL LOAD.
Olly stop in the load of any dll, go to view-executables, right click FOLLOW ENTRY and you can view the entry point of the dll, you can put a BP here, or a BPM in the code section of the dll, and you can debug the dll.

Ricardo
oh me anon
01-11-2004, 06:25 AM
well ihave a template program written with just LoadLibrary and GetProcAddress coded in it and if there are dlls that i need to study and no app that uses it
i open this proggie in olly and supply the name of Dll and say load
and ricardo has said how to do the other things once it has loaded
view-->exemodules--->follow --->analyze ---> then what ever you like to do ;)
MrWizard
01-19-2004, 06:31 AM
I use a simple template program as well, you can download it at http://www20.brinkster.com/qweerdy/ (It's called DllLoad)
It takes the DLL to load as a commandline argument, and it loads the DLL without calling DLLMain. That way you don't have to set OllyDbg to break on every Dll load.
As soon as the DLL is loaded it hits a built-in breakpoint and you can start exploring the DLL.
mcnorth
01-20-2004, 01:40 AM
MrWizard. Thanks for sharing that!

If I may be so bold as to ask a stupid question, how do you tell it what dll to load? I loaded it in Ollydbg and it looks like it breaks on "GetCommandLineA". What next? Or is that wrong already? I'm really new at this (as if you couldn't tell) and since it is all a real struggle for me I'd appreciate some instruction.

Thanks
TBD
01-20-2004, 07:05 AM
mcnorth: here are the steps:

* open OllyDbg
* load dllload.exe
* enter in Debug|Arguments the name of the DLL
* F9 (run)
* dllload will stop after loading the DLL (by using a int3)
* now you have the DLL loaded and do whatever you want (ALT+E - View modules to see it, usually red marked)
oh me anon
01-20-2004, 12:29 PM
that link doesnt seem to work

but a small observation i had during my own coding of one such program

instead of using int3 using jmp eip (db 0ebh,db 0feh) works better as if you have check marked int3 in the option ignore(pass to program following exceptions in debugging options--exceptions f9inng the program would terminate without one being able to do any thing)
TBD
01-20-2004, 12:47 PM
oh me anon: link is working ;)

it is a simple LoadLibraryEx,"dll_name",0,DONT_RESOLVE_DLL_REFERENCES and INT3 after.
naceur
01-20-2004, 02:17 PM
please step by step
mcnorth
01-20-2004, 02:58 PM
TDB:

Thanks!


[plugin] Labelmaster 0.1

RCE Messageboard's Regroupment > Plugins > [plugin] Labelmaster 0.1
Joe Stewart
01-12-2004, 03:32 PM
Labelmaster is an OllyDbg plugin that can import/export user-defined labels and comments in batch. It's useful for transferring manual analysis from one file to another when editing or unpacking an EXE file. (The .udd file containing all your analysis work is tied to the CRC of the file you are examining).

http://www.joestewart.org/tools/Labelmaster-olly-plugin.zip

Tested on Win2K only.
TBD
01-13-2004, 04:09 AM
Joe Stewart: thanks. very nice done !


About upcoming ollydbg 2.x APIs ..

RCE Messageboard's Regroupment > Plugins > About upcoming ollydbg 2.x APIs ..
focht
01-12-2004, 03:43 PM
Greetings,

good to see that olly has resumed work...

<pre>
I've started work on version 1.10. This final version is mostly a bugfix with updated documentation.
Please note that this is the last chance to make feature requests. If you
need extended plugin functionality or new exported functions, please tell me
now! Remember, internas of v2.0 will be completely different and incompatible with v1.10!
</pre>

I would like to discuss issues about upcoming ollydbg APIs (plugin architecture, exported functions) here
at the public message board.

Though its good to mail olly, a public community discussion would be far better suited - due to missing mailing list (one cannot see what others mailed/requested).

I'm pretty sure there are people who can comment the stuff, give examples how things could be done *hint*...

"internas of v2.0 will be completely different" ... What impact has this statement on the plugin API?

Regards,

A. Focht
comrade
01-17-2004, 08:48 PM
Who is A. Focht?


extra copy plugin problems and one feature request

RCE Messageboard's Regroupment > Plugins > extra copy plugin problems and one feature request
oh me anon
01-13-2004, 04:58 AM
i today dld that extra copy plugin to try it out coz i needrd to rip some code

even though it has been written that copy to clipboard (alt+shift+f11) bug has been fixed i still find that it copies one or two lines properly but if i select a block to copy it crashes

and it can paste in one instance of olly only

i mean i had a dummy exe running and i wanted to copy the asm to it from anothere instance of olly running the original exe but i couldnt do it
all i could do waste paste code (yes it corrects the relative address )in some place in the same exe

so i had to resort to binary copy and paste and edit those e8 calls and all those relative address hope regon you could implement this
focht
01-14-2004, 04:07 AM
Greetings,

>i still find that it copies one or two lines properly but if i select a block to copy it crashes

Didnt encounter it yet. Would be nice if you post some code block sample (do binary copy whatever) that crashes the plugin for sure.

>and it can paste in one instance of olly only

This is by design. The plugin checks its internal data strutures, a table of (modified bookmark structure) and enables/adds menu items on demand.
How would the other plugin instance know of the data? There are process boundaries.
Unless the plugin implements some sort of shared memory data block or other kind of IPC communication, it can't know of the "private" process data.

The other way would be to register a custom clipboard format and only rely on on this data (without having private table data) when doing copy/paste operations with clipboard api.

Regards,

A. Focht
oh me anon
01-14-2004, 06:38 AM
hey focht i dunno if i could code some thing that may reproduce the behaviour

but i tried copying it today too after your reply and it failed again so please see the screen shots at here
http://www.geocities.com/anonyscrollmouse/index.htm

the idea is good it labels the jump locations and it jumps there
if this could be pasted to some file then it will be as good as idas asm output file option

hope it may help
focht
01-14-2004, 05:06 PM
Hi again,

well i now encountered some anomalies too but couldnt reproduce the behaviour.
I took a glance at the plugin source code and i think it contains some crash potential :)

<pre>
void copyToClipboard(void *item)
...
for(ii=0;ii<NumberL;ii++){

....
if(findLabel(pb->index)==0)
n+=7;//Length of label

n+2; //2 spacesbefore command
}
</pre>

"n+2" has no effect at all. use "operator+=" -> n+=2;

<pre>
void copyToClipboard(void *item):
....

if ( !OpenClipboard(NULL) )
{
....
}
if( !EmptyClipboard(NULL) )
{

}
</pre>

Good way to trash the local stack.
WIN32 API function prototype is: "BOOL EmptyClipboard( VOID)";
With the call "!EmptyClipboard( NULL)" you are corrupting your local stack.
"NULL" gets pushed as param but gets not cleaned by callee (win32 api is stdcall) because the function has NO PARAMS.

<pre>
if ( SetClipboardData( CF_TEXT, clipbuffer ) == NULL )
{
MessageBox(hwmain,"Unable to set Clipboard data", "ExtraCopy plugin",MB_OK|MB_ICONINFORMATION);
CloseClipboard(hwmain);
return;
}
CloseClipboard(NULL);
</pre>

Same applies as EmptyClipboard().
Will trash stack.
Please lookup WIN32 API prototypes at least on MSDN website!
NULL != VOID

<pre>
extc int _export cdecl ODBG_Pluginshortcut(int origin,int ctrl,int alt,int shift,int key,void *item)
{
....
if(alt!=0 && ctrl==0)
{
.....
}
else
return 0; // Shortcut not recognized
};
</pre>

Notice the problem? Not all paths return a value ;)

Thats all i found at that time..
The Author should fix these bugs.

Regards,

A.Focht
oh me anon
01-15-2004, 05:42 AM
well i now encountered some anomalies too but couldnt reproduce the behaviour
yep that is another problem it crashes arbitarily

so all we can do now is wait till regon comes here and reads these posts and starts to do some thing about it ;)
hey TBD have you got his address so that we can mail him
TBD
01-15-2004, 07:38 AM
oh me anon: it is available in the readme.txt :)
... also you can do the changes and release a new version based on regon work
Regon
01-15-2004, 06:20 PM
Most of mystakes and bugs is now removed but is not time for finish it...
I'll have time next month at last, so be patient.
I'll release new version with more features.

>"n+2" has no effect at all
silly bug :(

About parameter void I know, but I maked it because It couldn't compile without parameter. Why? I don't know.
Nevertheless after time I solve this too, if I remmember well :)

Thanks for all reported bugs!

By the way no body send to me bugs up to this day.
This was my first work in C because nobody was able to do something this for the others.

I'm sorry for my english
Regon
02-26-2004, 11:02 PM
Try this version:
ExtraCopy1.2beta.zip (http://www.regon.wz.cz/ExtraCopy1.2beta.zip)

Repaired some bugs
added:
Copy from the clipboard
- is tested for MASM syntax, nubers are expected in hex format: 20=20h=0x20
Options
Delete labels/comments


Setting register contents?

RCE Messageboard's Regroupment > Plugins > Setting register contents?
psyCK0
01-13-2004, 03:18 PM
Hey,

How do I set register contents by using plugin APIs? I use Expression() to get them, but how do I write them back?
focht
01-13-2004, 05:14 PM
Greetings,

well register contents make only sense in context of a thread.
Look at the t_thread descriptor documentation

<pre>
reg - excerpt from context that contains CPU registers sorted in a natural way.
Valid only when regvalid is non-zero. If you need to modify register, stop
application if necessary, check that regvalid is non-zero, apply your changes
and set reg.modified to 1.
Do not change single step flag or debugging register DR6;

regvalid - flag indicating that reg contains actual contents of thread's registers;
</pre>

Use Plugingetvalue(VAL_THREADS) to get the pointer to the table of threads.
You should (of course) only make modification the context structures if thread is in suspended state.

Hope this helps.

Regards,

A. Focht


[plugin] OllyScript v0.2

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.2
psyCK0
01-14-2004, 02:04 PM
Hello all,

Now its time to release the first version of my scripting plugin.
If it is buggy please bear with it. I have some exams this weekend
but I will fix the bugs (that are certain to appear) next week.

Go to http://ollyscript.apsvans.com for information and download.

TBD: please put a link to the page in the plugins section, not
the .zip. The reason for this is that I want to see the download counter. =)
sgdt
01-14-2004, 03:28 PM
I was wondering about a couple of potential features.

I guess first would be the ability to set (and unset) HW Breaks, and the second would be continuing from exception.

It was unclear from the documentation on how to go interactive from the script. I assume it would just be end of script (maybe a label at the end that could be jumped to). This is important to mention, as then the user can execute the OllyDump plug-in or what not.
psyCK0
01-14-2004, 04:06 PM
Yep, a small mistake:

EOB example:
eob SOME_LABEL // jump to label
eob $ // go interactive

Hmm, this will be changed/improved.
focht
01-14-2004, 04:14 PM
Greetings,

if one is looking for extension/scripting languages there are lots of options.
For lightweight choices there are:

lua - http://www.lua.org/
angelscript - http://www.angelcode.com/angelscript/
nasal - http://www.plausible.org/nasal/
io - http://www.iolanguage.com/
tinyscheme - http://tinyscheme.sourceforge.net/home.html

When a new project starts, i always look for "tools of trade" ... frameworks, tools, libraries that can be (re)used/extended with minimal work (if oss license permits).
Though i appreciate your work i suggest to have a look at the stuff to learn from.

Embrace and extend ;)

Regards,

A. Focht
psyCK0
01-14-2004, 04:36 PM
I was thinking of using lua for this, but it felt like an overkill...

So now, because I dont want to rewrite all this a third time, I'll have to continue with this notation I invented. I hope it will be adequate for the purpose. =)
TBD
01-15-2004, 04:47 AM
psyCK0: very nice !

some suggestions:
* some commands to inform users about progress/actions/...
e.g. log "text" -> display in Log Window "OllyScript: text"
* cannot see .osc files on Run script. must switch to All files. i will do more tests.
* toolbar/window with latest plugins used
* editor with debugging :) for writing scripts

that's it for start.

one more thing: if you want i can create a separate forum for OllyScript.
i know you want to have a separate board but it is more easier for users and you to keep track (i hate to have to look on 10 forums a day :)

once again, very nice and keep up the good work.
psyCK0
01-15-2004, 07:35 AM
TBD I really dont think there is enough interest for a separate forum. I will remove my forum from my site, and use this thread instead. =) Thank you for your suggestions!
TBD
01-15-2004, 07:40 AM
psyCK0: your call. i was thinking a place in this board to gather scripts for OllyScript [ODS] and place for sharing and not start searching on the entire board: "where was that nice script that does ..." :)

i hope that you work on ODS and not get tired ;) it has potential.
psyCK0
01-15-2004, 09:18 AM
TBD ok, you are the board admin. =) Maybe we can try to set up a board section and see if it is used? Anyway, I will post the "incredible UPX OEP finder script!" =)

I will continue developing this plugin for some time at least, there seems to
be an interest in it...
TBD
01-15-2004, 12:08 PM
psyCK0: here ya go :)
Anonymous
01-18-2004, 08:39 AM
I tried the following but it gave me an error:
var x
reg x,esp
lable1:
sti
cmp x,esp
je lable1
ret
the error msg. was "esp" isn't declared and isn't a number.
psyCK0
01-18-2004, 09:54 AM
Hey!

At the moment the plugin can't handle register names in cmp.
This will be fixed in 0.3 or 0.4.

For the time being, please use something like:
<pre>var x
var y
reg x,esp
lable1:
sti
reg y,esp
cmp x,y
je lable1
ret </pre>
Anonymous
01-18-2004, 09:54 AM
Greetings,

the "compare" operator currently accecpts either op1=var,op2=var or op1=var,op2=constant.
You must declare/load a second variable to work around this limitation.

Well script line on error would be needed feature too...

Regards,

A. Focht
psyCK0
01-18-2004, 10:00 AM
Script line on error is also in the implementation queue. =)
I hope to get this plugin more useful till the next version,
0.2 was released mostly to see if there is any interest in such
a plugin.
focht
01-18-2004, 10:16 AM
hehe ... nice intersection :)

Anyway i noticed the input trimming stuff needs to be reworked.
Especially trim() is prone to access violations.
Your are using iterators without checking its validity.

<pre>
string trim(const string& sData)
{
if (sData.size() > 0)
{
size_t iFirst = sData.find_first_not_of(" \t");
size_t iLast = sData.find_last_not_of(" \t");
return (sData.substr( iFirst, iLast - iFirst + 1));
}
else
return "";
}
</pre>

Image if i input a single line with a space " " in it. It will break for sure...

Here is how i would code this (accepts even more whitespace stuff)
<pre>
std::string trim(const std::string& s)
{
std::string::size_type left = s.find_first_not_of(" \t\f\n\r");
if( left == std::string::npos )
{
return std::string();
}

std::string::size_type right = s.find_last_not_of(" \t\f\n\r");
return s.substr( left, right-left+1 );
}
</pre>

Regards,

A. Focht
focht
01-18-2004, 10:35 AM
Another one ...

the conditional jumps return script error in Process() function if jump condition is not met.
Is this intended? Probaly not.

Another Hint .. you are using "0" and "1" integer return values from most functions to use them as bools.
e.g. int xxx() { if( ..) return 0; else return 1; }

if( xxx())

This is dangerous and slightly misleading because the meaning of "TRUE" is not always "1" (i've seen compilers that emit "-1" code for 'true'). One might safely assume that any non-0 is "true".

Nowadays every modern compiler has "bool" type ... if a function returns a bool value i would make it explicit ;)
ex: bool foo() { if( ..) return true; else return false; }

Regards,

A. Focht
psyCK0
01-18-2004, 11:38 AM
focht Thank you for the tips!

Especially trim() is prone to access violations
trim will be reimplemented as you suggested.

the conditional jumps return script error in Process() function if jump condition is not met.
Yeah, thats a bug that is already fixed. Will be OK in 0.3

Nowadays every modern compiler has "bool" type
Thats what comes out of not doing a proper analysis/design.
I started using integers because I thought I'd use them as
status codes, which I never did. I've been thinking of changing
them to bools. I think I'll do it for 0.3.

Also the REG command is plain stupid. In the next ver MOV will
be able to do all REG does and more. REG will stay for backward
compatibility only.

Any more good suggestions on design?
focht
01-18-2004, 04:54 PM
Uhm well ...

usually i would point out a good lexical scanner/parser framework (including dynamic BNF) ...
But i know you dont have time and want results :)
If you still interested you might look into boost's "spirit" library at http://spirit.sourceforge.net/

Boost is IMHO the best OO framework around ... http://www.boost.org/
I use it regularly in my projects (i code for a living).

For other suggestions .. well.
In every project turn compiler warn level to 4.
This catches most of the bugs usually encountered (uninit vars, control paths ...)
I even use "treat warnings as errors" in my projects (i disable too noisy ones with pragmas).

For the "processing" of commands itself i would simply use a function pointer table or map.
Not that i dont like if( command == xxx) .. else if( ...) ... approach but the more commands you implement the more the function will grow.

example (simplified version):

<pre>
// declare function ptr with one arg
typedef bool (*PFCOMMAND)(const std::string& arg1);
// prototype our command lookup map
typedef std::map< std::string, PFCOMMAND> command_map;
// instance of command map
command_map commands;

// insert entries into "commands"
void addCommand( const std::string& name, PFCOMMAND routine)
{
commands[name] = routine;
}

// call subroutines via "commands" lookup
bool callCommand( const std::string& name, const std::string& arg)
{
bool result( false);

// use the string to look up the pointer to subroutine
command_map::const_iterator citer = commands.find( name);
if( citer != commands.end())
{
// we found it, get function pointer
PFCOMMAND cmd = citer->second;
// call subroutine
result = cmd( arg);
}
else
{
// no match for given name, use error callback
....
}

return result;
}

You can now

addCommand( "cmp", &CompareHandler)
....

result = callCommand( command_str, arg1) ...
...

and so on..

</pre>

I hope you get the idea ;)

Regards,

A. Focht

PS: remove REG ;) there arent that many scripts written to keep zombies alive forever...
psyCK0
01-18-2004, 08:03 PM
Hey Focht,

usually i would point out a good lexical scanner/parser framework (including dynamic BNF)

I felt it'd be an overkill for this project... I've never done it before,
so it'd take me too much time just to learn (even though I've taken a
course in compiler theory =)). I don't even write C/C++ that much, I work
with Java mostly...

For the "processing" of commands itself i would simply use a function pointer table or map

Great idea! I was getting tired of this ugly giant if. =)

Thanks for your ideas!


OllyDbg tutorials

RCE Messageboard's Regroupment > General > OllyDbg tutorials
Nilrem2
01-14-2004, 02:17 PM
OllyDbg tutorials
--------------------------

http (http://cracking.accessroot.com/)
A good collection of tutorials for OllyDbg, updated often, sign up for the mailing list to be notified of new tutorials.

P.S. As far as I know this post is allowed.

edited by TBD
Tyko
02-01-2004, 09:31 PM
Very good tut :)
Nilrem2
02-02-2004, 08:02 AM
Thanks.
jddakid
02-13-2004, 01:10 PM
can i ad also i found a lot of great tutorials at http://biw.rult.at/index.php?page=tuts hope it helps have a good day.
husler
03-17-2004, 02:59 AM
i'm very interested in ollybdg, but i'm new to this, is there anything for beginner? where can i start as beginner?...thanx help
TBD
03-17-2004, 04:24 AM
thread locked. there are a lot of tutorials on the net, use google !


Logging all CALLs and RETNs

RCE Messageboard's Regroupment > General > Logging all CALLs and RETNs
JH1
01-15-2004, 01:31 PM
Hi,

Is there a way I can log (i.e. trace) *only* CALL and RETN instructions - this would be very useful for getting a grip on what a large module is doing. And if I can do this, is there away to determine the parameters (or at least how many DWORDs) have been supplied to the function? I thought of examining the target function's epilog to see how many DWORDs it cleans the stack up by (obviously this assumes the calling convention). Does anyone have any thoughts on this? Am I faced with writing a simple plugin or is trace sufficient for my needs?

Cheers

JH
psyCK0
01-15-2004, 04:04 PM
i hope you will be able to do that in the next version of my ollyscript
plugin... Coming next week i hope. No other way afaik.


OllyDbg 1.10 is coming...

RCE Messageboard's Regroupment > General > OllyDbg 1.10 is coming...
j_petrucci
01-15-2004, 02:50 PM
Hi guys!
I just write to inform you that Olly has come back from the holidays and started working on version 1.10! check http://home.t-online.de/home/Ollydbg/
So it's time to tell him what are our features request.. mail him (Ollydbg@t-online.de) our proposals and the ones from the thread in this forum...

warm regards
*guido*
MC707
01-16-2004, 08:44 AM
And when it'll see the light?
Crick
01-16-2004, 09:28 AM
And when it'll see the light?
Plz!
check http://home.t-online.de/home/Ollydbg/
MC707
01-16-2004, 10:00 AM
After a long busy year of hard work and three weeks of Christmas vacations, I've started work on version 1.10. This final version is mostly a bugfix with updated documentation

It is strange, but I didnt find anything about date...
TBD
01-16-2004, 10:03 AM
MC707: it will come when it is ready :)

for all that ask for date of release:
as Oleh is working on this in his spare time and for free there is no deadline ! - so please do not ask this anymore

if I know any new informations that are not available on the OD homepage I will post here, so you will be keep updated as soon as is something new.

thank you !
MC707
01-17-2004, 04:37 AM
Thnx for reply. Sorry to disturb you.
Waiting...
p.s. But if you posted "new olly is coming" you could explain it.


On exception handling in coming version of OS

RCE Messageboard's Regroupment > OllyScript > On exception handling in coming version of OS
psyCK0
01-16-2004, 11:33 AM
On exception handling in coming version of OS: I would like to know what you
ppl think. I was thinking of implementing it as I did with breakpoints (a jump
to a new place in script on breakpoint) and allowing to use new commands to
script "shift+f7" and "shift+f9".
Any more requests on exception related functionality?


OllyDbg pauses in another process...? WinXP CZ

RCE Messageboard's Regroupment > General > OllyDbg pauses in another process...? WinXP CZ
jumbus
01-17-2004, 03:28 PM
Hello, I have small problem with OllyDbg. I used Win98 for years and now migrated to XP. When I used pause button in OllyDbg in Win98 (debugging simple programm, hello world for example), it always stopped in process I debugged. Now in XP it seems, that pause button stops in another process (while debugging hello world it stops in webwasher.dll. I thing I can see the name of currently debugged process in the tray of OllyDbg. Oh, I use Windows XP, SP1, czech language. I also use 1.09d, but this problem exist in all versions I have. I am always logged as Administrator, so I have all rights it needs.

Any ideas? Maybe I only cannot use OllyDbg properly..... Sorry for my bad english.

Jumbus
focht
01-17-2004, 06:22 PM
Greetings,

>Now in XP it seems, that pause button stops in another process (while debugging hello world it stops in webwasher.dll.

i think you mix some things up here :)
Pausing a process actually means suspending all threads of the process.
The debugger usually shows the call stack of the last active thread (which is suspended too) when finishing "pause" command.

"webwasher.dll" IS NOT A PROCESS. Its just a dynamic library, where some exported function got called at the time, the debugger paused the process.
The point, where the debuggee pauses may be abitrary, well even the thread (if its multithreaded) may differ on each pause.

Just set a breakpoint where interested and resume the program.
Of course you can "manually" walk the call stack up to reach some higher level function - "step out".

Regards,

A. Focht
Ricardo Narvaja
01-17-2004, 09:19 PM
In w98 OLLYDBG is very limited and you cannot trace into system dlls, when you pause you are in the same process opf the executable but in a dll, with call stack or in the stack better, you can view the call of the executable and with this information you can return to the exe, or try DEBUG-EXECUTE TILL USER CODE or DEBUG TILL RETURN for more quicly return.

Ricardo
oh me anon
01-18-2004, 12:54 PM
well in most of the cases you can use the alt+f9 (return to user code)
and olly will return from the paused dlls process to the next instruction in your hello world

but if it has stopped in message pump then till there is no message to be processed it will be pusing at some return in dlls as it goes on infinitely
jumbus
01-18-2004, 03:22 PM
Thanx for all answers wery much, but it doesn't helped me. If I use Windows 2000 EN, everything is OK, OllyDbg stops where I expect and I can use commands like EXECUTE TILL USER CODE (if OllyDbg stops in some Dll), but if I login into my XP cz and use Pause Button, it always stops in dll program doesn't call (webwasher.dll is part of AD killing software known as webwasher, no other process use it), so EXECUTE TILL USER CODE doesn't step anymore. Nowhere to step. I will make some screenshots, memory dump etc and send URL to this forum to explain what's going on.

And, of course, sorry for my bad English and mistakes, misprints,.... :-)

Regards,

Jumbus
Ricardo Narvaja
01-19-2004, 05:11 AM
Go to view-memory and put a Breakpoit memory on acess in a section you are working and run, olly stop in the executable again.

Ricardo
Ricardo Narvaja
01-19-2004, 05:15 AM
Look in the stack, when you are paused, go down to the stack and look the RETURNS TO ......

Search for the first RETURN TO .... the executable jeje

Example

RETURN TO 7663556773
753555637
456635
133425
RETURN TO 456789

this is the first RETURN TO executable zone

GO TO 456789 and put a BP in this place and in the next line and run olly stops when return to the executable.

Ricardo
Ricardo Narvaja
01-19-2004, 05:19 AM
When you work with softice and stops in a dll, you can press f12 many times, to return to the executable, olly is equal in XP, you are not practical in this method because in 98 olly dont'stop in dlls, but with one or two tries you learn how to return easy.

Ricardo
jeduardoc
02-07-2004, 12:56 AM
hola yo soy nuevo en esto y me gustaria que alguien con esperiensia me ayudara , pues mi victima esta bien dura y creo que solo alguien con mucha esperiencia puede desifralo.....

el soft es muy pequeno pero esta bien almado....si hacerta un desafio escrivame para mandarselo

cualquier ayuda la agradesere
jumbus
02-28-2004, 05:34 PM
Hello, thanx for all answers. I found the solution. If anybody has this problem, simply go to Debugging options, choose Registers card and check all checkboxes here. Now OllyDbg pauses where i expect (same place as in Windows2000 EN) and I can execute to user code and continue debugging.

Thanx to all who answered me and sorry for my bad english of course. :-))

Regards,

Jumbus


help!!!

RCE Messageboard's Regroupment > Plugins > help!!!
mike
01-17-2004, 07:45 PM
i have ollydbg 1.09 step4 and ollydump 221b.
How can i install the ollydump dll in ollydbg?
i can't made it work.
thanx
Ricardo Narvaja
01-17-2004, 09:14 PM
In OLLYDBG go to OPTIONS-APPEARENCE-DIRECTORIES and in PLUGIN PATH, put the path of dll of ollydmp and other dlls of plugins.

Ricardo Narvaja
mike
01-18-2004, 09:05 AM
thanx men you saved my ass!!!!


hardware bp

RCE Messageboard's Regroupment > General > hardware bp
naceur
01-18-2004, 05:54 AM
please what you mean with hardware breakpoint and there is an equivalente with win98 ( way is not possible ?)
naceur
01-18-2004, 05:55 AM
please what you mean with hardware breakpoint and there is an equivalente with win98 ( way is not possible ?)
Ricardo Narvaja
01-18-2004, 07:43 AM
If you are and OLLYDBG user don't think more, change to XP, is a different world for ollydbg, in 98 ollydbg is very very limited, not only for not have HARDWARE BPX.

CHANGE TO XP realliy and forget 98

Ricardo Narvaja
focht
01-18-2004, 08:37 AM
Greetings,

by reading ollydbg FAQ one can get a short answer ;)

<pre>
Can I set hardware breakpoints under Windows 95? - No! Windows 95/98 doesn't update debug registers when switching tasks or processing interrupts. This means that hardware breakpoint you set in debugged program will appear in all other processes, including OllyDbg and operating system itself. Note that 95-based Windows ME does support HW breakpoints.
</pre>

Ok ... for interested one i might explain this statement a little bit more ;)

From the 386 processor on, there exist 32 bit registers for implementing hardware breakpoint without using an in-circut emulator.
The debug registers are DR0-3, DR6 and DR7.

DR0 to 3 are the four linear addresses watchpoints and DR6 (status register) and DR7 (control register) are used for indicating type and size of the different breakpoints. Breakpoint comparisons are made before physical address translation occurs.

Ollydbg uses the thread context approach to modify hardware bpts (which is the preferred one).
User-level debug registers exist per thread. DR0..3, DR6 and DR7 can be accessed by supplying CONTEXT_DEBUG_REGISTERS flags to GetThreadContext() call.
Breakpoints operate per thread (normally - exception comes later ;) )

If one read intel manuals you might come across the DR7 L[n] (local enable) and G[n] (global enable) flags/bits.

The low-order eight bits of DR7 (L0 through L3 and G0 through G3) selectively enable the four address breakpoint conditions.
There are two levels of enabling: the local (L0 through L3) and global (G0 through G3) levels. The local enable bits are automatically reset by the processor at every task switch to avoid unwanted breakpoint conditions in the new task. The global enable bits are not reset by a task switch; therefore, they can be used for conditions that are global to all tasks.

The LE and GE bits control the "exact data breakpoint match" feature of the processor. If either LE or GE is set, the processor slows execution so that data breakpoints are reported on the instruction that causes them. It is recommended that one of these bits be set whenever data breakpoints are armed. The processor clears LE at a task switch but does not clear GE.

Armed with this knownledge one might understand the statement.
The thread context structure data itself are just a snapshot of the thread's values at the time it got suspended.
If olly says "doesn't update debug registers when switching tasks or processing interrupts" it probably means the DRx data register contents that got modified by a thread arent restored on next thread switch (using per thread context data).

Now one might ask why exist per thread "local data" when debug register contents are "global resource"?
Well i dont know ... it might be due to some braindamaged engineers at [censored].
I dont even consider Win9X an operating system (diehard NT fan for almost a decade now) ;)

Regards,

A. Focht
naceur
01-18-2004, 11:11 AM
very thanks RICARDO "vous etes le roi des tut"
naceur
01-18-2004, 11:12 AM
and thx to focht


[plugin] OllyScript v0.3

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.3
psyCK0
01-19-2004, 11:24 AM
A brand new version of the OllyScript plugin is now available for download!
Lots of new commands, bugfixes, many improvements and a fantastic UPX OEP
finder script (find OEP in less then 24 hours! =)) ) are included! Also large parts of the code are redone.
Grap your copy at http://ollyscript.apsvans.com .

Please post suggestions for future improvement here!
<pre>What's new in v0.3?
-------------------
+ New commands:
and, esti, esto, eoe, log, or, shl, shr, xor
+ MOV command now supports registers and memory addresses as source and destination.
It also supports long hex strings in this form: #DEADBEEF1234567890ABCDEF# .
+ Exceptions can now be acted upon like breakpoints were in v0.2.
+ Error handling. Error messages now include code line number,
the bad command and eventually an error description. Line
numbers are not completely accurate when comments are present.
This is to be fixed some other time.
+ New example script: UPX.osc

# JE/JNE no longer show errors when the jump is not taken.
# Open script dialog now sees .osc files.
# You can now use UPPERCASE for commands if you like it better.

- REG command removed. Use MOV instead.</pre>
focht
01-19-2004, 02:15 PM
Greetings,

Please post suggestions for future improvement here!

as you wish ;)

1.)

Sample UPX finder script contains "rmem x, eip" command which isnt understood ;)
Should probably be "mov x,eip".

2.)

I've seen stdafx.h/cpp files that means the project was initially setup to use precompiled headers.
When looking at *.cpp files i see windows.h and other headers included each time. This slows down compilation.

I would prefer to use stdafx.h consistently (inclusion in every *.cpp file) dropping the other ones.

StdAfx.h:

#define STRICT
#include <windows.h>
#include <stdio.h>
#include <fcntl.h>
#include <io.h>

// STL stuff
#include <iostream>
#include <fstream>

#include "plugin.h"

3.)

guicon: having stderr/stdout console is good but i'd like to have a separate native gui logging window (some edit control).
All output (error, warning, informational) should go there (support copy/paste functionality to quickly save errors).
Show/Hide window via plugin sub menu.
Maybe a separate command line (edit control) can be added to bottom of window (or splitter window) too.

4.)

Introduce a "script directory" property.
Save into ollydbg.ini file section.
Use some plain configuration/options dialog to configure this setting (and possibly other following).
File open dialog should use this directory as initial working dir.

5.)

There are some warning level 4 errors:

- unreferenced arguments
- vars initialized but not referenced
- vars used but not initialized
- unreachable code

6.)

There is a bug when script execution is finished.
If the debuggee terminates (script execution finished by DoRET), gets loaded again and exceptions are propgated thru ollydbg main loop,
the DoRET() is executed every time, popping the msg box "finished" up. very annoying.
You should not rely DoRET() on "EOB_row==-1" because script end is already reached, use some other flag.

ODBG_Pluginmainloop()
-> OnException(edi.ExceptionRecord.ExceptionCode);

<pre>
bool OnException(DWORD ExceptionCode)
{
if(EOE_row > -1)
{
script_pos = EOE_row;
return true;
}
else
return DoRET();

return false;
}

-> DoRET()

...
script.clear();
script_pos = 0;
EOB_row = -1;
</pre>

7.)

Some ability to pause/break the script.
If i "pause" in ollydbg the script continues to run.
Some shortcut or menu item to break script execution on next command to process.
"Resume", "reset" would be needed too then.

8.)

ollylang.cpp: would be nice to wrap this thing into some classes before this files becomes too big.
global variables like string errorstr, string command, args, op1, op2 ... should be avoided...
If your command handlers need to reference args, just supply them. Change function pointer signature to accept an array/set of argument strings.
E.g. typedef bool (*PFCOMMAND)( const std::set< std::string>& args );
Parse the arguments itself before supplying them, regardless of command opcode.
The command function handler itself should then check the number, valid values of supplied args.

9.)

Some files referenced in vc++ project file doesnt exist.
Either remove them or update (relative) path: plugins.hlp, script.txt

10.)

There is a post build event in debug build, in release mode not.
"copy.bat" it is (of course not found) -> build error

Thats all on quick review ;)

Regards,

A. Focht
psyCK0
01-19-2004, 02:55 PM
Hey!

1. Fixed and reuploaded.
2. Percompiled headers broke down somehow and had to be removed. Queued.
3. guicon is used while debugging only, not in release... However maybe I should
implement some kind of log window or use OllyDbgs. Queued.
4. Queued for v0.4
5. Queued for v0.4
6. Not good at all... There will have to be a v0.31 tomorrow then... =) Maybe you could give me a bit more exact explanation on how to reproduce this?
7. Queued for v0.4
8. As I said before, this is the result of not doing a proper design work.
Actually I was thinking of some kind of OO implementation of all this, but
didnt come up with any good-looking object model. Queued.
9. Fixed and reuploaded
10. Fixed and reuploaded

Thanks for the through examination of the project! You are like
my quality assurance department. =))
focht
01-19-2004, 03:21 PM
Hi again,

2.) Some infos what the problem is?

Hint: sometimes PCH generation/use options get lost.
.cpp file -> context menu "properties" -> "config properties" -> "c++" ->
"precompiled headers" -> "create/use precompiled header"
change to "use precompiled header /Yu" for every .cpp file, except stdafx.cpp.
For stdafx.cpp use "create precompiled header /Yc".

Make sure that every .cpp file has "#include "Stdafx.h" statement as first include.

3.) ok. there exist some lightweight win32 gui frameworks. ATL/WTL template libaries are best for this ;)

http://www.codeproject.com/wtl/
http://www.codeproject.com/atl/
http://www.codeguru.com/atl/index.shtml

6.)

I used simply UPX packed program, started script (it ran in background).
Somewhere the main gui of program pops up. I exit the program. Reloaded it.
On load there are some exceptions (ok). This is where the msgbox begins to popup.

Regards,

A. Focht
psyCK0
01-19-2004, 03:55 PM
OK, thanks, Ill check...

Also about UPX script (to all who are interested):
The script examplifies a concept only. It's quite useless
for actually finding the OEP of an UPX-packed PE because it
would take ALOT of time to do that!
Anonymous
01-23-2004, 02:21 AM
please include sub instruction the next version.Thanks
psyCK0
01-23-2004, 01:42 PM
Will be done. Until then you can use ADD with a negative number:

add eax, FFFFFFF0

is the same as

sub eax, 10
arz
01-25-2004, 10:03 AM
nice plugin thnx,

probably just my stoopidity but I coundn't get the equivelent of
sub eax,4 (add eax,FFFFFFFC) to work.

hope you don't mind but I just added a SUB function to your sources and
recompiled it. nothing special about the func it, it's just a copy of your
ADD func(replacing the + with - of course).
psyCK0
01-25-2004, 11:40 AM
yeah... 0.4 will include SUB among MANY other things. =)


How to look for in the Export table of a DLL ?

RCE Messageboard's Regroupment > General > How to look for in the Export table of a DLL ?
Whiskey
01-19-2004, 01:28 PM
Hi,
i want to look in the Export Table of a Dll that i loaded into OllyDBG but i dont know how....

Can someone say me if it is possibel and if it is how?

Greetz
Whiskey
focht
01-19-2004, 02:22 PM
Greetings,

"executable modules" window -> select module you want export/import table to show -> right click (context menu) "view names".
Shortcut "Ctrl+N" will show table too depending on current module context.

Regards,

A. Focht
Whiskey
01-19-2004, 02:45 PM
But if i do so, i dont see anything in the Executable Modules window...

i load the dll over:
view-->file

i hope someone can help me...

greetz
whiskey
focht
01-19-2004, 03:00 PM
Greetings,

no you cant do it this way.
"view" -> "file" will only show a binary dump of the file.

You must load the dll using executable file so ollydbg can analyze it.
Just open the .exe file which consumes the dll and then do the actions.

You might use some custom made exectable too, which simply does LoadLibrary() to load it into ollydbg.
Look here for example loader:

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=533
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=533
)

Regards,

A. Focht
Whiskey
01-19-2004, 03:20 PM
Thank u for your suport, one last question.

Must the application that loads the Dll, know which Function the Dll have?

Or can i make a programm that dont do anything else then load the libraray?

Greetz
Whiskey
focht
01-19-2004, 03:37 PM
Hi again,

no, a simple LoadLibrary call will be sufficient for you task.
If you want to trace/step the dll "alive" then you need to call an exported function with appropriate calling convention/parameters.
A Dll usually has an entry point to initialize runtime stuff, setup global variables etc. that gets called on loader events.

Regards,

A. Focht
naceur
01-20-2004, 02:14 PM
please step by step


Interesting script for OllyScript...

RCE Messageboard's Regroupment > OllyScript > Interesting script for OllyScript...
psyCK0
01-20-2004, 07:05 PM
Dunno if I can publish it here but check this thread:
http://www.exetools.com/forum/showthread.php?s=&threadid=3242


diff use in os system of OD

RCE Messageboard's Regroupment > General > diff use in os system of OD
naceur
01-21-2004, 01:43 PM
is there different use of olly in win2000 nt than winxp?


using breakpoints in a plugin

RCE Messageboard's Regroupment > Plugins > using breakpoints in a plugin
JH1
01-22-2004, 08:33 PM
Hi,

I am trying to write a simple plugin that logs calls to some of the functions exported by certain dlls. I have got as far as capturing LOAD_DLL_DEBUG_EVENT events in ODBG_Pluginmainloop so I can check to see if the dll contains the function I am interested in via GetProcAddress. I am unsure what to do next...if I set breakpoints, how does my plugin know when they are actually reached? (i.e. couldn't find a call back function). And I don't want the user to have to resume from the breakpoint, i want this to be automatic. Does anyone have any suggestions?

Cheers

JH
psyCK0
01-22-2004, 10:24 PM
In

extc void _export cdecl ODBG_Pluginmainloop(DEBUG_EVENT *debugevent)

do

EXCEPTION_DEBUG_INFO edi = debugevent->u.Exception;
if(edi.ExceptionRecord.ExceptionCode == EXCEPTION_BREAKPOINT)
// Breakpoint reached

Then unset BP and resume using Sendshortcut ..

Was thinking of incorporationg this functionality in OllyScript,
maybe we could cooperate?
JH1
01-23-2004, 07:23 AM
Thanks for the info, this is exactly what i was after. Didn't look into EXCEPTION_DEBUG_INFO events enough the first time.

I am still getting to grips with the Ollydbg plugin API but I am all for collaboration to produce useful plugins, I'll knock up the dll function logger then post a copy, maybe you can cannibalise some of it for ollyscript.

Cheers

JH
JH1
01-23-2004, 02:24 PM
ok, i have ran into more problems...

i am not so sure how to get the status of the registers at the point which the breakpoint occurs. Once I have identified an EXCEPTION_BREAKPOINT, my pseudocode is as follows:

(thread*) t = Findthread(debugevent->dwThreadId); // locate thread
ulong esp = t->reg.r[REG_ESP]; // get esp
ulong eip = t->reg.r[REG_EIP]; // get eip

Well eip and esp are always wrong. eip is typically something in ntdll.dll (77f8ae5a - the retn from ZwMapViewOfSection) and esp looks like its several stack frames off.

Anyone have any suggestions? Is this a thread issue?

Cheers

JH
psyCK0
01-24-2004, 07:53 AM
Try using Findthread(Getcputhreadid());
JH1
01-26-2004, 08:10 AM
Ok, i tried that and the same thing happens...if i look at:

debugevent->u.Exception.ExceptionRecord.ExceptionAddress

then this gives me the correct address (i.e. the breakpoint occured where I expected it to), however, getting eip either through Findthread(Getcputhreadid()); or Findthread(debugevent->dwThreadId); always gives me EIP in ntdll.dll. Typically ESP is a few stack frames off.

Any other ideas?

Thanks for your help

JH


[plugin] OllyScript v0.4

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.4
psyCK0
01-25-2004, 11:07 PM
A new, improved and extended version of OllyScript is now available for
download at http://ollyscript.apsvans.com . =)

From "What's new?" in readme.txt:
<pre>
Some parts are recoded and some requested features are implemented.

+ You can now pause / resume and reset the script from the plugin menu.
Pausing can also be done in script.
+ Now commands:
ASM, BPHWS, BPHWC, BPRM, BPWM, FINDOP, MSG, PAUSE, SUB
+ Special variable $RESULT introduced
+ Last script directory now remembered

# UPX OEP finder script is now redone and really useful =)
# UBP is replaced by BP. Functionality is the same though. Please
use BP in future scripts (for now UBP still works).
# Bug that made OllyScript continue execution even thoigh OllyDbg
has been restarted is fixed.
</pre>
TBD
01-26-2004, 04:07 AM
psyCK0: nice stuph !

suggestion:
* add commands to add/remove labels/comments (would be nice in UPX.osc to add comment - "UPXex program OEP" )

readme.txt: "Already lots of scripts have been written" - where are they ? :)
psyCK0
01-26-2004, 07:23 AM
Hey TBD,

1. How do you mean add/remove labels/comments?
2. For the scripts check exetools. Mostly it's unpacking stuff. =)
TBD
01-26-2004, 08:04 AM
psyCK0:

> add/remove labels/comments
labels:
C code: insertname(addr,NM_LABEL, "text")
OSC command: addl text - add label

comments:
C code: insertname(addr,NM_COMMENT, "text")
OSC command: addc text - add comment

purpose: good on finding automated things made by scripts
(e.g. addc "UPXed program OEP" before ret in UPX.osc)
lownoise
01-26-2004, 08:42 AM
Great work psyCK0,

Rewrote my aspack script with hardware breakpoint.

eob Break
findop eip, #6175#
bphws $RESULT, "x"
run

Break:
bphwc $RESULT
sto
sto
sto
sto
log eip

ret
psyCK0
01-26-2004, 09:14 AM
lownoise: nice to see you found this place =)
Great script btw! Thinking of writing one for dillo, but
its a bit more complicated..

TBD: Now I got it. Will be done in 0.5!
lownoise
01-26-2004, 10:03 AM
TBD Don't know if it's allowed to post these scripts here?
psyCKO If you've looked in the history of this forum you'll see some other posts of me =}
Will look forward to see your dillo script

Neolite

eob Break
findop eip, #FFE0#
bphws $RESULT, "x"
run

Break:
bphwc $RESULT
sti
log eip
ret
lownoise
01-26-2004, 10:09 AM
psyCK0 future request :Breakpoints on api
lownoise
01-26-2004, 10:11 AM
Was i drunk? future ---->feature
psyCK0
01-26-2004, 12:38 PM
BP on API: Queued for 0.5
lownoise
01-26-2004, 04:07 PM
Thanks, It looks like your script plugin will be very usefull for some of us -)
Anonymous
02-03-2004, 11:13 AM
Hiya,
I know I'm going to kick myself :), can someone point out the error in this,
where address is obviously substituted with real address. All I get is the hw bp set, runs to address and doesn't clear the hw bp or set the next bp.
tia

eob clrbp0
bphws address, "x"
run
clrbp0:
bphwc address
sti
bp api
run
ret
psyCK0
02-04-2004, 07:44 AM
Anonymous: the eob command acts strangely i think... will be better implemented in 0.5. Anyway, add "eoe drbp0" just after your "eob drbp0".. Also a "ret" after "run" might be a good idea (try it out).

Hope it helps.
Anonymous
02-04-2004, 08:37 AM
Hiya,
Well transfer execution on next exception is no good to me, an exception is what I'm looking to avoid. No probs I can live without it and look forward to 0.5, thanks and keep up the good work.
regards
psyCK0
02-04-2004, 10:17 AM
I see.. Well, it will be fixed in v0.5.
psyCK0
02-06-2004, 10:58 AM
Anonymous could you please mail me URL to the target?
I can't reproduce this behaviour here....

ollyscript at apsvans dot com
Anonymous
02-06-2004, 04:46 PM
Sincere apologies it appears the problem is indeed app specific. Will do some checking as I should have before posting.
regards
Anonymous
02-06-2004, 09:49 PM
Pls add CTRL+F7,F8,F9,F11,F12


LOOPD - help

RCE Messageboard's Regroupment > General > LOOPD - help
dandy
01-26-2004, 03:57 AM
I came across the command (LOOPD), I figure it loops until something happens, but what is it that happens? much thanx, sorry for my bad english

I searched the help and google. no luck.
Ricardo Narvaja
01-26-2004, 05:48 AM
THE loop continue till ECX=0, ecx is decremented in the test and continue looping till ECX=0.

Ricardo


[new] Preliminary beta of v1.10

RCE Messageboard's Regroupment > Announcements > [new] Preliminary beta of v1.10
TBD
01-26-2004, 08:07 AM
beta110a.zip (http://home.t-online.de/home/Ollydbg/beta110a.zip)

check the what's new on Olly's page for changes
psyCK0
01-26-2004, 08:59 AM
=)))))
pzalps
01-26-2004, 05:46 PM
thank you

olly is my pleasure !!
JDog45
01-27-2004, 12:31 AM
Very nice. Thank you very much!!


CommandBar v3.00.108

RCE Messageboard's Regroupment > Plugins > CommandBar v3.00.108
Gigapede
01-26-2004, 11:08 AM
I updated CommandBar v3.00.108.

Now it can accept command macro.
Please try it.

http://dd.x-eye.net/file/cmdbar300108.zip
This includes DebugPlugin like macro.
Load OllyDbg in OllyDbg and type "mac DebugPlugin" on CommandBar, then GO!

thanks.
pzalps
01-26-2004, 11:50 AM
thank you updated commandbar

i'm happy ^^*
JDog45
01-27-2004, 12:33 AM
Thanks for the update!
j_petrucci
02-05-2004, 05:22 PM
Hi Gigapede, many thanks for your wonderful plugin...

TBD.. did you update the Stuph page with the newer version?
TBD
02-06-2004, 04:03 AM
j_petrucci: thanks for reminding me :)
oVum
02-19-2004, 02:35 AM
Strange,I put Cmdbar.dll in olly folder but nothing happens when i load olly,I also can't get cmdline working
Anyone know how to fix please?

oVum
Ricardo Narvaja
02-19-2004, 05:43 AM
In Aappareance-directories plugins change the path wrong to the right path to the dll of the plugin.

Ricardo
Gigapede
02-24-2004, 10:46 AM
::TBD

The name/description of CommandBar is updated but file isn't in stuph page.
Please update it.
TBD
02-24-2004, 12:22 PM
Gigapede: oops. sorry. it is updated now. hope that I get it this time :)
HaRdLoCk
06-23-2004, 02:46 PM
the plugin is great - but how do make it not loose the focus when i trace? for example i write into the bar d eax and then press F8 - i have to use the mouse to get into the bar again. is there a fast key for that or can u maybe add this "no-loose-focus" feature? ;-)
Gigapede
07-12-2004, 09:14 PM
It can get focus by Ctrl+D.


SSE registers

RCE Messageboard's Regroupment > General > SSE registers
comrade
01-26-2004, 06:20 PM
movups xmm1,[mem]

its disassembled fine, but I cannot seem to find display of SSE register in OllyDbg. Only MMX/3DNow!/FPU
oh me anon
01-28-2004, 08:32 AM
you cant see xmm1 register comrade
have you tried this
debugging option (alt+o)----->registers----checkmark decode sse registers

xmm0 1.020219e+34, 1.743804e-39, 9.219563e-41, 1.742610e-39
xmm1 1.024959e+34, 1.743826e-39, -NAN FFFFFFFF, 1.010113e+34

hope this helps
comrade
01-29-2004, 01:15 AM
thanks!
comrade
01-29-2004, 01:50 AM
What about SSE2 registers?
oh me anon
01-29-2004, 01:52 PM
hey comrade ollys help file says it all
SSE (Streaming SIMD Extentions) instructions were first introduced by Intel for Pentium III processor. They allow for simultaneous processing of up to 4 single-precision floating-point operands. OllyDbg 1.06 disassembles and assembles SSE commands and can display and modify the contents of 128-bit SSE registers. This task is not as trivial as it looks at the first glance. The main problem is the lack of debugging support in all actual versions of Windows, that is, Debugger can't get these registers from the OS. To overcome this limitation, OllyDbg injects and executes small piece of code that reads or updates SSE registers within the debugged thread. This operation is slow and dangerous, and I recommend to disable decoding of SSE registers unless absolutely necessary. Run trace doesn't save SSE registers to the log.

Notice that SSE2 (Pentium 4 extentions) is not supported.


Unpacked executable won't break

RCE Messageboard's Regroupment > General > Unpacked executable won't break
riptide
01-28-2004, 07:59 AM
First I'd like to say that OllyDbg is really an awesome tool... Very powerful.

I used OllyDbg to unpack a program that was packed with an unknown packer. Different file identifiers said it was packed with different packers... some said yoda's cryptor and some said ASPack. Either way, it won't unpack with those unpack tools, so I used OllyDbg to trace through the code until it unpacked itself, and used OllyDump to dump the code to a file. OllyDump also has the functionality to rebuild the import table, but I still had to modify it a bit by hand to get the program to run correctly.

Now the program runs perfectly, however for unknown reasons, when I run the unpacked executable in OllyDbg, no breakpoint actually breaks. The program just runs from start to finish. If I pause the program in Olly, I'm able to see the current memory, stack, registers, etc. It all looks good, but Olly just won't break on any breakpoints. Any ideas why?
oh me anon
01-28-2004, 08:24 AM
are you using w9x then it may probably be because it plays with sidt hooks int3 and moves an iretd at the start of int3 handler
see daemons site for all kinds of tricks like this but all of them mostly work on 9x only

apart from this if you are setting bpts at what olly says as data section they probably wont be preserved every time you restart them you have to set them anew

i dunno if any of these or the cause may be you could explain it a little more
riptide
01-28-2004, 09:00 AM
I'm running on XP Pro. I did check the flags on the .text section after I unpacked the executable, and it is set to be executable.

Hmm... explain it more... what do you want me to explain?

What I'm doing is just opening Olly with the program that is unpacked on disk. As soon as the program is loaded, it executes straight through even though I have Olly set up to break at the entry point of the main module. This is the only program that does this. Is it possible for there to be a problem in the PE header that would prevent Olly from breaking but the executable still run perfectly?

If there's anything specific you want to know about it, just ask.
riptide
02-07-2004, 06:32 AM
I found out that the Resume Flag is set when the program loads up.
If the Resume Flag is set as the program loads, then it would prevent the debugger from breaking, correct?

Is there something in the exe's header that could set this flag?
focht
02-08-2004, 12:48 PM
Hi,

could you please explain what "Resume Flag" means in the context of ollydbg?
If the debugger loads a target it has full control over the debuggee because all of its threads are initially suspended.
There is no automagic flag in PE that tells the debugger to "start over".
You might check ollydbg "events" and "SFX" debugging options to make sure it isnt trying to trace some entry at startup.

Regards,

A. Focht
riptide
02-08-2004, 07:01 PM
Oops, I meant to say Restart Flag. It's bit 16 in the flags register.

I'm not sure this is the problem, but it seems to always be set. When I read about the restart flag, it said that debuggers(in general) use it to determine when they have already executed an instruction due to a break so that they don't execute the same instruction twice.

I'm able to pause execution in the process in question, but the problem is that if I try to single-step in code or set breakpoints or anything, it just executes straight through and never stops. When I did pause execution, the flags register was set to 00010202. I tried this multiple times all with the same result, and as soon as I step another instruction, the entire executable runs till finish without stopping. The one time that it did not do this is when I changed the flags register from 00010202 to 00000202 and then stepped.

I have Olly set up to break on entrypoint of the main module. It should break as soon as the executable loads, but it doesn't. This is what makes me think that the restart flag is being set as the main module is loaded. Is the flags register set to a value stored within the executable upon load?
focht
02-08-2004, 08:00 PM
Greets,

are you sure it breaks at earliest possible point (without executing any bits of debuggee code)?
The EFLAGS value has no correlation with PE header.
It can be modified by debugger and - of course - by debuggee itself. But it has to execute code to do this.

The comment of 'oh me anon' is seams very reasonable: "and moves an iretd at the start of int3 handler"

IRETD is the way to change the RF flag.
If the return stack is adjusted with EIP, CS, and EFLAGS (with RF set in the EFLAGS image) then executing an IRET causes popping the RF flag into EFLAGS.

Break directly at the PE header entry (OS loader system breakpoint), dont let ollydbg execute "startup" code to get to the main entry

Regards,

A. Focht
oh me anon
02-09-2004, 02:47 AM
hehe if it sets an iretd and hooks int3 it wont brerak anywhere at all coz ntdll.dll debug break itself will be hooked and then it will prevent from stopping at entry point
only way is dissemble and deadlist but he didnt seem to like my explicit implication that you dont make any sense comment
so i stopped posting

btw if it is nt one cant grab the sidt the proggy will crash it only works on 9x and also only after executing some of the debuggy code and it will do break for the first time when the iretd isnt installed but wont break any other subsequent times till you reboot

using extend code to include extarctor ,trace realentry blockwise
etc may work
or the best way is to examine pe header and find entry point use ctrl+g -->ep and use new origin here or hard code a cc there and force it to break for the firsttime after reboot and trace from there


[tool] olly2html.pl - Advanced OllyDbg ASM To HTML

RCE Messageboard's Regroupment > Plugins > [tool] olly2html.pl - Advanced OllyDbg ASM To HTML
Joe Stewart
01-28-2004, 03:35 PM
This is a Perl script which parses ASM dumps created with the Copy->To File function and outputs HTML pages. It is similar in concept to an existing tool called oa2h, but this version has the following features:

1) Subroutine names are derived from comments (if present)
2) Outputs separate HTML pages for each subroutine, plus a master index
3) Cross-links calls and jumps with HREFs
4) Automatically figures out exported column widths; no editing of the ASM file is needed.

You can download the script from
http://www.joestewart.org/tools/olly2html.pl

You can view sample output from olly2html here:
http://www.joestewart.org/labelmaster-html/
psyCK0
01-28-2004, 08:03 PM
Great tool! =)

What I'd like to see is the ability to not write out addresses.
That'd be useful for ripping asm code.
TBD
01-29-2004, 03:43 AM
Joe Stewart: great stuph. thanks for sharing !


Deletenamerange?

RCE Messageboard's Regroupment > Plugins > Deletenamerange?
psyCK0
01-28-2004, 10:18 PM
Hey!

Looked at the source of Gigapede's nice plugin and found lots of calls to
Deletenamerange, for example after breakpoints are set... Don't really
understand what that function is for... Can someone please explain?

More specifically I want to set bp on api calls... Maybe there are any ideas
on how to do that?


Log conditional breakpoint API?

RCE Messageboard's Regroupment > Plugins > Log conditional breakpoint API?
abs0
01-31-2004, 07:53 PM
Hi, is there an API call in the current olly debug plugin system that will alow me to set the Log Conditional Breakpoints?
Thanks
oh me anon
02-01-2004, 01:39 PM
abso to set conditional log break point
you need to use shift+f4
in the popup you have to type the condition you like and then
you need to use those radio buttons for logging
then in the log window you will see some thing like this according to the options and conditions you selected

Log data
Address Message
00432528 COND: uMsg
00432528 CALL to PostThreadMessageA
ThreadId = 1F4
Message = WM_NULL
wParam = 0
lParam = 0
00432528 COND: uMsg = 00000000
00432528 CALL to PostThreadMessageA
ThreadId = 1F4
Message = WM_NULL
wParam = 0
lParam = 0
00432528 COND: uMsg = 00000000 WM_NULL
00432528 CALL to PostThreadMessageA
ThreadId = 1F4
Message = WM_NULL
wParam = 0
lParam = 0
00432528 COND: uMsg = 00000000 WM_NULL
00432528 CALL to PostThreadMessageA
ThreadId = 1F4
Message = WM_NULL
wParam = 0
lParam = 0
00432528 COND: uMsg = 00000000 WM_NULL
00432528 CALL to PostThreadMessageA
ThreadId = 1F4
Message = WM_NULL
wParam = 0
lParam = 0
abs0
02-02-2004, 12:48 AM
Is there any way to code it into a plugin?
focht
02-06-2004, 07:06 PM
Dont think so ...

maybe you request this breakpoint type to be fully supported in next plugin API version.

Regards,

A. Focht


Plugin load path problem / implicit dll linkage

RCE Messageboard's Regroupment > Plugins > Plugin load path problem / implicit dll linkage
focht
02-01-2004, 01:09 PM
Greetings,

while working on plugin which is splitted into some dlls with implicit linkage, i'm facing the problem of OS loader dll search path.

Usually this wouldnt be a problem - if one puts _all_ the custom dlls into ollydbg main app directory.
But this is tedious.
Due to the increasing number of plugins i use a subdirectory ".\Plugins" and pointed ollydbg "plugin path" option to it.

This doesnt work on plugins which have additional custom dlls implicitly linked.
They dont get found by OS loader (of course).

Ollydbg iterates thru all the *.dll files in specified plugin directory and tries to load em using LoadLibrary().

LoadLibrary() uses the following paths to look for additional (implicit) modules :

- directory from which the application loaded.
- current directory.
- system directory.
- 16-bit system directory.
- windows directory.
- directories that are listed in the PATH environment variable.
- redirection file (which overrides given path to match app directory first)
- _BaseDllDirectory (using new Set/GetDllDirectory() APIs, XP SP1+)

As you see the "custom" plugin directory is never by searched by loader.

A (backwards) portable solution would be using SetCurrentDirectory() to plugin directory before calling LoadLibrary().
This gets the plugin the chance to resolve implicit dll references.
The current directory can be later be restored back to old value.
(any custom dll must not use delay load feature)

For now i have to use the "ugly" way to dump the additional dlls into ollydbg directory or modify PATH env variable for additional plugin path.

Would be nice if ollydbg has option to influence plugin loader mechanism to include plugin directory to resolve implicit references.

Regards,

A. Focht

PS: explicit dll linkage is _not_ an option for me.
oh me anon
02-01-2004, 01:25 PM
hey i think he has addressed this problem in 1.10 beta if i remember correctly
the whats new page one minute ill see

;(
dunno the points you raise are different it seems he wrote about .udd directory
OllyDbg haven't checked that .udd directory specified in .ini file really exists. Reported by Phong Tran;
focht
02-01-2004, 02:55 PM
Hi again,

i just reviewed the 1.10b code.

Before the LoadLibrary() call ollydbg just prepends the full plugin directory path to the filename.
The working directory itself is not touched.

Hopefully next version there is an option to resolve the implicit loader issues. Temporary SetWorkingDirectory() while loading plugins preferred.

Regards,

A. Focht


Sendshortcut - ALT key state (needed for close deb

RCE Messageboard's Regroupment > Plugins > Sendshortcut - ALT key state (needed for close deb
focht
02-04-2004, 08:15 PM
Greets,

while coding on my COM wrapper to mimic ollydbg plugin interface i stumbled across "close debuggee".

From ollydbg help:

>Alt+F2 - close, closes debugged program. If program is still active, you will be asked to confirm the action.

Well the script pauses the debuggee before so messagebox is no problem at all.
But how do i tell ollydbg to close the debuggee?

plugin.h:

extc void cdecl Sendshortcut(int where,ulong addr,
int msg,int ctrl,int shift,int vkcode);

No "alt" state :(

Any ideas?

Regards,

A. Focht
oh me anon
02-06-2004, 04:05 PM
there are no referances to send shortcut in olly
i dunno i did alt+f2 to try it out
it GetKeyState
004377CD . E8 1C1F0700 CALL <JMP.&USER32.GetKeyState> ; |\GetKeyState
then picks up this from stack
004377E8 . 8B95 C4F6FFFF MOV EDX, DWORD PTR SS:[EBP-93C] ; |
004377F6 . E8 158AFFFF CALL OLLYDBG.00430210 ; \OLLYDBG.00430210

and here it calls this proc this also has referance to _sendshortcut+2c
00430210 /$ 55 PUSH EBP

cmps here
004303DA JMP OLLYDBG.0043092C
004303DF CMP EAX, 104
004303E4 JNZ SHORT OLLYDBG.00430416
004303E6 CMP EDX, 71
004303E9 JNZ SHORT OLLYDBG.00430416

pushes 1
and calls this
004303ED |. E8 AA320400 CALL OLLYDBG.0047369C ; \OLLYDBG.0047369C

and it puts out the message box
|hOwner = 00000984 ('OllyDbg - Assassination.exe -...',class='OLLYDBG',wndproc=00430A54)
|Text = "Process 'Assassination' is active. If you terminate it now, process will be unable to clean up and write unsaved data to disk. Do you really want to terminate active process?

Note: you can permanently disable this warning in Options |"...
|Title = "Process still active"
\Style = MB_YESNO|MB_ICONQUESTION|MB_DEFBUTTON2|MB_TASKMODA L

so i think u can try using this 71 whatever and use that sendshortcut and see

hope this helps in some way

else reply ill edit this post
focht
02-06-2004, 07:01 PM
Greets,

uhm well i found other methods to emulate ALT (VK_MENU) key combinations from plugin/script engine without sendshortcut...

keybd_event/SendInput
SendMessage/PostMessage( ..., WM_KEYDOWN ...)

Anyway .. the "close debuggee" functionality is not really necessary to be accessible from script namespace
So i stick without it... for now ;)
oh me anon
02-07-2004, 04:54 AM
k i was thinking of using FindWindow,SendMessage WM_COMMAND
combined with this 104 and 71 as clicking yes closes the debuggee
psyCK0
02-07-2004, 09:06 PM
I've also stumbled across that limitation... Would be nice to have
an "alt-state" as "Execute to user code" also uses it...

focht: I hope you are planning on making your COM-wrapper public when you are done? =)


Where can one recommend features?

RCE Messageboard's Regroupment > Plugins > Where can one recommend features?
abs0
02-04-2004, 09:57 PM
Hi, I want to recommend a feature to the author but his mail box is full, does anyone know where I can post or send a mail with a new plugin feature request.
Abs0
TBD
02-05-2004, 03:34 AM
abs0: you can post it here. usually Olly checks the forum.
abs0
02-05-2004, 08:10 PM
I just wanted a way to have a function called if a breakpoint was hit.


How does Olly convert Floats to hex ...etc?

RCE Messageboard's Regroupment > General > How does Olly convert Floats to hex ...etc?
spongebob
02-05-2004, 10:31 PM
In the memory display of Olly you can change the display from like Hex/32bit float/ascii ..etc

I need some ASM source for doing float to hex conversion, and back.

Or a C++ dll if you don't have ASM.

Many thanks.


List of Function Names for user32, shell32, ect

RCE Messageboard's Regroupment > General > List of Function Names for user32, shell32, ect
dandy
02-07-2004, 05:13 AM
Is there a source on the net somewhere that lists all the functions and a definition of what they do for all the main DLL's like User32 ect ect? like GetDlgItemTextA function in User32, ect ect. much thanx
oh me anon
02-07-2004, 05:29 AM
win32.hlp lists almost all of the apis in al major dlls
or the sdk in msdn google win32.hlp
lcc by jacob navia or borland has them for download
and put that file in olly dbg open api help file link and u can use ctrl+f1 to read about almost all functions in those dlls


[plugin] OllyScript v0.5

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.5
psyCK0
02-07-2004, 10:12 PM
Ollyscript v0.5 can now be downloaded at:
http://ollyscript.apsvans.com

New features like API breakpoints, run-to-return, module info etc. are implemented.

From readme.txt:
+ New commands:
CMT, GMI, GPA, LBL, RTR, RTU
+ New example script - tElock 0.98 OEP finder.

Comments please!!! =)
Ricardo Narvaja
02-08-2004, 09:07 AM
The plugins for 0.4 are compatibles in 0.5?

Ricardo
psyCK0
02-08-2004, 09:35 AM
Yeah, everything is compatible and will be in the future. =)
Ricardo Narvaja
02-08-2004, 10:49 AM
If you can improve the next version with the BPMs

BPM ON ACCESS

and in more extension of FF bytes only

BPM start, end

for put BPM in sections or big blocks

Ricardo
Ricardo Narvaja
02-08-2004, 10:54 AM
You are making a good work, FELICITACIONES jeje (in spanish)

Ricardo Narvaja
psyCK0
02-09-2004, 08:59 AM
Bugfixed v0.51 uploaded.

Ricardo Narvaja: thx =)
Ricardo Narvaja
02-09-2004, 10:43 AM
i make a script with a cmp and next a jne, and the values of the comparation are not equal, but the jne never jump, is a bug?

Ricardo Narvaja
psyCK0
02-09-2004, 12:13 PM
Ricardo Narvaja: could you please mail the script + url to the target to ollyscriptNOSPAM@apsvans.com (remove NOSPAM) so i can have a look?

Just tested this and it works:

var x
var y
mov x, 1
mov y, 2
cmp x, y
jne NOT_EQUAL
msg "x == y"
ret

NOT_EQUAL:
msg "x != y"
ret
Ricardo Narvaja
02-09-2004, 02:51 PM
Is not a useful script is only a try, use a upx packed program for example.

var pirulo
eoe Break
msg "Please set a memory breakpoint on the section start on 401000 and then press the button of this message"
run

Break:
GMI eip, CODEBASE
mov pirulo,$RESULT
log pirulo
cmp pirulo, 401000
jne siga
msg "equals"
ret

siga:
msg "not equals"
run

in the log pirulo=408000 and are different of 401000 but the msg say equals

Supressing the msg the script only can stop in BPM execution of 401000 section and not in BPM r or w.
Ricardo Narvaja
psyCK0
02-10-2004, 07:16 AM
Ricardo Narvaja: you were right, that was a bug... Fixed now.

v0.52 uploaded.

Supressing the msg the script only can stop in BPM execution of 401000 section and not in BPM r or w.
Not sure what you mean??
Ricardo Narvaja
02-10-2004, 07:28 AM
Well is not useful jeje

The idea is when unpack a program, the packer stops first in BPM READ or BPM WRITE when unpacking and when is unpacked jump to oep and stop in BPM on execution.
The idea is when stop for bpm see the codebase of the current eip, and if is not 401000, is a bpm R-W, and run without stop, and when the codebase are 401000, you are on BPM X (on execution).
This is the idea quittting the msgs, but is very slow for find oeps, but i put here for example of the bug only.

Ricardo
Ricardo Narvaja
02-10-2004, 09:18 AM
Spupresing the msgs "equals", and "not equals", the other msg is necesary

Ricardo
psyCK0
02-10-2004, 10:55 AM
How do you mean? Is it still buggy???
Ricardo Narvaja
02-10-2004, 11:06 AM
Not, i only explain the script

Ricardo
psyCK0
02-11-2004, 09:22 AM
A mailing list for the plugin is now available at:
http://mail.apsvans.com/mailman/listinfo/ollyscript_apsvans.com

New versions, bugfixes, general discussions, script sharing etc.
helloword
02-14-2004, 04:38 PM
It shoult be nice :
- to have a feature that excecute the script step by step
- possibility to edit the script in Ollydbg sofware directly
- to have a separate folder to store all scripts

Good work : ) follow in that way, we like that.
psyCK0
02-14-2004, 06:34 PM
- to have a feature that excecute the script step by step

How do you mean exactly? Like a "step" command on the plugin menu?

- possibility to edit the script in Ollydbg sofware directly

Noted for the future... Don't think its really that important?

- to have a separate folder to store all scripts

Noted. Will be implemented in v0.6.
helloword
02-15-2004, 04:54 AM
Step by step
Possibility to debug the script line by line to have an idea how the script is behaving.
loveboom
02-17-2004, 02:00 PM
If you can improve the next version with ......
bp<-->bc?
bprm<-->bprmc??
like sice bp addr, do something
tc command
psyCK0
02-18-2004, 06:14 AM
loveboom: noted, will see what i can do =)
helloword
02-18-2004, 08:51 AM
Plesa can you implement the function 'New origine here CTRL+GRAY*'.
psyCK0
02-18-2004, 02:53 PM
helloword: you can use mov to move values in to EIP


Who is Oleh Yuschuk?

RCE Messageboard's Regroupment > The Heap > Who is Oleh Yuschuk?
tlo
02-08-2004, 07:00 PM
Where is he living? Occupation? Does anybody know? Just wondering...
focht
02-08-2004, 08:41 PM
Hello,

lets just do some social engineering before the riddle gets solved ;)

Lets assume "oleh yuschuk" is his real name.
"oleh" sounds like a slavonic possibly russian name.
A quick google search reveals it is used as russian surname _and_ first name.
The surname "yuschuk" sounds to me like a german transcription because of the "sch" (english would use "yushuk").
Russian counterpart is "ж" (html entity is ж )
(i know a bit russian .. years ago i was forced to learn it hehe)

Another hint comes from his homepage provider: it's "t-offline" .. oh sorry i meant "t-online" *lol*, _the_ german provider.
If one carefully searches the web there are more hints (make it up urself).

So he might be with people that have "weisswurst" (veal sausages, cooked in hot water) and "leberkaes" (sort of baked spam) as their staple food ... not forgetting "weissbier" (wheat beer).

Of course i could be wrong at all .. but well. It was fun ;)

Regards,

A. Focht
psyCK0
02-09-2004, 07:11 AM
You are right on most of the points above. However, Ollys full name got to be "Олег Яшук" (no "ж" involved =) ). It definitely sounds russian, but he might as well be from Ukraine or Belarus.

After the fall of the Soviet Union some Russians imigrated to Germany... Many of those were well-educated, engineers etc. Maybe Olly is one such immigrant?

Ollys English is fluent, which is not usual with russians (language was not really one of the major subjects at school because travel was erstricted). This might mean two things: either he learned it by working with computers or he's been to germany longer than from 1990.....
TBD
02-10-2004, 05:46 AM
hehe, you are both right :)

he is a great guy - he drove more than 200km to meet me when I was in Germany - and this twice !

he showed me OD2.0 pre alpha last year and the plugin architecture 2 years ago.
shERis
02-10-2005, 04:00 PM
Olly had his address at his homepage for a while ....

He lives near a great old city at a great river called Main in Germany.

If you want, then I can give you his address ....

Olly really is a very great guy, I love his work, it makes my work easier.
Many thanx to him.

~hERi~


Log trace doesn't show erased in beta 110

RCE Messageboard's Regroupment > Bugs > Log trace doesn't show erased in beta 110
britedream
02-09-2004, 12:28 AM
I noticed that erased bytes in some asprotected targets are not

shown in the logtrace of beta110 as with previous versions. but shown only in the log file.

britedream


Display bug...

RCE Messageboard's Regroupment > Bugs > Display bug...
Nach
02-09-2004, 07:37 AM
Hi everyone, i m new, with OllyDbg, but I unfortunately can not use it :
Every time I run a program, the runned program windows, is not displayed correctly: it s like a idle windows, which display what was previously before... very hard to explain !
It s like a window of a crashed program, which display every things that you pass by.
moreover, the mouse pointer is with a hourglass when I pass it by the executable window.

I really hope that someone can help me to fix this problem.

Here are some precious info about my system:
*OllyDbg 1.09b (but it s the same problem with all release)
*Pentium 4 mobile Hyperthreading 3.06 Ghz
*512 Mo
*Windows XP pro
*Nvidia Go 5200 64Mo

In advance, txx a lot.

Fred
Nach
02-09-2004, 08:49 AM
Ok, it s me again !!

After some test and essay, I finally find a solution to my problem :

If you have the same problem try to disable PandaAntivirus permanent proctection... It seems that there is a conflit between this 2 soft, that I really cannot explain !

Bye


about conditional breakpoint?

RCE Messageboard's Regroupment > General > about conditional breakpoint?
mike
02-12-2004, 09:52 AM
i want to make olly stop when the context in eax is b53fac9.
How can i do that?
I tried some form but nothing work (eax == b53fac9 eax=b53fac9 and other but nothing)olly treat this us an"always" bp.
Ricardo Narvaja
02-12-2004, 10:08 AM
1) olly do not accept the value b53fac9 (starting with letters), the correct form is 0b53fac9.

In CONDITION put eax==0b53fac9

and the first mark in PAUSE PROGRAM-ON CONDITION

Ricardo Narvaja


CreateProcessA - some question

RCE Messageboard's Regroupment > General > CreateProcessA - some question
Jabb
02-13-2004, 08:50 AM
I have some trouble: one process creates another via function CreateProcessA. I need break in entry point of this second process or to set breakpoints there. How can I do this without entering kernel32.dll and ntdll - it's a stupid way,I think ;)
Ricardo Narvaja
02-13-2004, 09:25 AM
When Stop in CreateProcessA, Execute Till Return, open PUPE and in the ENTRY POINT of a new process replace the two first bytes for EB FE (an infinite loop) and continue Run the original program, the process created will be looping in the EP, and you can atach with other OLLYDBG and change the bytes for the originals, and continue runnning too.
Other method is replace the byte of the ep for CC, and configure ollydbg for JIT (JUST IN TIME DEBUGGER), when the new process enconuter the CC, and make exception, OLLYDBG automatically atach, and stop in the EP of the new process, but i think the first is more clean option.

Ricardo
oh me anon
02-13-2004, 09:43 AM
`| (thumbs up) ;) ricardo
one more way i think could be to use create suspended flag i mean modifying the flag that is passed to createprocessA and writeprocmem ebfe or cc and attach it

or open up the creted processor in some hexedit and put cc or
eb fe


16 new scripts for OllyScript

RCE Messageboard's Regroupment > OllyScript > 16 new scripts for OllyScript
psyCK0
02-14-2004, 06:34 AM
Scripts updated on the OllyScript site:

http://ollyscript.apsvans.com
psyCK0
02-25-2004, 06:05 AM
21 now...


"find command sequence" feature in plugi

RCE Messageboard's Regroupment > Plugins > "find command sequence" feature in plugi
focht
02-14-2004, 09:11 AM
Greetings,

while working on my OllydbgScript COM wrapper i came across "search command sequence".
Usually one uses "CTRL+S" to find sequence of commands.
The current functionality of ollydbg allows for "imprecise pattern search" - a nifty feature.

I'd like to see this functionality exposed in plugin API.
like: "int Findcommandsequence( ulong startAddr, const char* sequence);"
Command sequences itself should be delimeted by predefined char (like "|").

Currently my wrapper implements this functionality at basic level using a combination of
Assemble, Findmemory, Disassembleforward, binary search with imprecise opcode mask which allows "popad | jnz offset" searches.
(*g* yes i looked at the ollyscript scripts floating around to get some ideas).

Another problem when using imprecise syntax is operand size for conditionals: short/long jumps.
Currently "jnz OFFSET" assembles to short jump.
If the opcode sequence uses long jump no avail ;-(
Please add operand for "short/long" differentiation...

Of course there would be no problem at all if "search for command sequence" is exposed via plugin API so i dont need to reimplement this. :)

Regards,

A. Focht
psyCK0
02-14-2004, 06:31 PM
focht: I think you'd better mail your request to Olly... I've asked him to include some stuff in the next plugin API and he said I could mail him if I wanted something more included... Dont think he reads this forum very often...

imprecise opcode mask which allows "popad | jnz offset" searches
Damn, your wrapper sounds awesome! =)
focht
02-14-2004, 07:22 PM
Hi,

>I think you'd better mail your request to Olly...

i might think about it ... ;)

> Damn, your wrapper sounds awesome! =)
Well the wrapper is about 10% of the whole project thats why it takes so long.
I'm looking forward to release milestone one in a few weeks.

Features:

- full blown ActiveScript development environment, featuring syntax highlighting editor and integrated debugger (threads, locals, callstack, watch, immediate, breakpoints)
- almost any ActiveScript capable language supported (VBScript, JScript, PerlScript, PythonScript tested so far)
- ability to call ollydbg through COM wrapper, parts of plugin's API exposed (yes, i solved the reentrancy/thread problems with ollydbg plugin API - a nifty solution ;)

Oh well ... the IDE+debugger run in the context of ollydbg itself (loaded through a hub plugin) .. if i dont mentioned it ;)

I converted some of the ollydbgscript scripts to test it ... they work as expected though i lack the real targets ;)

If this board would support uploading pictures i would post screenshot ... but well ;)

Regards,

A. Focht
psyCK0
02-14-2004, 08:13 PM
Sounds like my project is doomed. =) Well, it is a bit of a hack anyway.

Waiting to see the nifty solution, that problem was what made me abandon the whole COM wrapper idea...
Suggestion: why limit this to scripting OllyDbg? If it is as good as it sounds, maybe you should make it use plugins (one plugin to script OllyDbg and the ability to write own plugins to script other applications)? Just a thought. =)
focht
02-14-2004, 09:03 PM
Hi again,

>Sounds like my project is doomed. =) Well, it is a bit of a hack anyway.

Hehe ... well that activescript problem bugged me .. until i decided to take on the challenge (i love challenges).
When i found a solution i thought i might be cool to build a complete solution with IDE and debugger around it.
At the time the project grow bigger and bigger ... and now it consumes almost all of my spare time...
The IDE and debugger outlived the ollydbg wrapper soon.

To answer your question:
>Suggestion: why limit this to scripting OllyDbg

It has already been done ;)
The IDE and integrated debugger are cleanly separated projects (DLL) and work standalone without ollydbg.
There is only a small DLL api exposed to initialize, setup gui and run/shutdown the message pump thread.
The hosting app doesnt even need a message pump.

I use a tiny gui app to call the APIs and host the IDE for testing purposes.

For ollydbg case there is a "proxy" plugin, which setup the IDE/debugger DLL.
Additionally there is a small special COM api exposed which help to implement alertable wait functions for ollydbg (e.g. interruptable sleeps, waits for events...).
This hidden COM interface is just optional .. if no COM server implements it, it is not used.

Ollydbg wrapper itself is mapped into scripting namespace using named items.
The mapping of "default" COM servers is completely transparent.
(using config table with "name" -> "ProgID" mapping and TypeLib loader).
No hardcoded stuff ...

Regards,

A. Focht

Here is a screenie/preview (thanks to google i quickly found a free pic hoster)

http://mars.walagata.com/w/focht/ASDevEnv.JPG
psyCK0
02-15-2004, 04:43 PM
Looks awesome. Your work will surely be the IDA of scripting. I hope mine will stay the W32DASM. =)

Looking forward to viewing your source code (or will it be released?).
TBD
02-16-2004, 04:06 AM
focht: wow! looking very professional !
looking forward for a release :)


BMSG breakpoint

RCE Messageboard's Regroupment > General > BMSG breakpoint
pzalps
02-19-2004, 03:02 PM
" bmsg <handle> wm_lbuttonup"

how to express that in ollydbg?
oh me anon
02-20-2004, 03:56 PM
hey pzalps are you searching for this i dont use sice so dunno what you are aiming for

if the following is what you are searchingthen do this
goto window and set msgbreakpoint on winproc

Breakpoints, item 0
Address=00489E94
Module=OLLYDBG
Active=Log "<WinProc>" when [ESP+8]==WM_LBUTTONUP
Disassembly=PUSH EBP

Log data
00489E94 COND: <WinProc>
00489E94 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000D54 ('Run trace',class='ARTRACE',wndproc=00489E94,parent=000 00D18)
Message = WM_LBUTTONUP
Keys = 0
X = 412. Y = 90.
00489E94 Conditional breakpoint at OLLYDBG.00489E94

hey TBD this post had topic closed on it when i saw it first some hours back now its open and i see it has been edited by you what was the problem
pzalps
02-20-2004, 04:26 PM
Thank you for your help

This topic closed was my fault that i misstake push button
oh me anon
02-21-2004, 01:53 PM
np ;) you push the button ?? which button ??
anyway does this work like sice does with bmsg ??


Faults off

RCE Messageboard's Regroupment > General > Faults off
OleB
02-20-2004, 05:06 AM
Is there a way to turn off crc check in Olly?
Like pressing "R" and write "faults off" in Softice?
Ricardo Narvaja
02-20-2004, 02:11 PM
IN DEBUGGING OPTIONS-EXCEPTIONS youa have the possibility of OLLY don't stop in diferent exceptions listed and non listed too, with the option ADD NEW EXCEPTION.

Ricardo
OleB
02-20-2004, 07:37 PM
I have reversed a program called Musarc that I had on an old CD. It expired november 1997. But it has a crc check that dosent alow changing of the code. It will just stop working. In softice it can be fixed with the faults off command I read in a softise tutorial. But I can't get softice to work on my w2000.
sgdt
02-20-2004, 11:41 PM
If your on W2K, couldn't you place a hardware read breakpoint on the code you modify so you can spot who is doing the CRC and NOP it?


The disassembly code of all executable modules

RCE Messageboard's Regroupment > General > The disassembly code of all executable modules
shliu
02-20-2004, 06:01 AM
How to put the disassembly code of all executable modules together in the same window?

Now I have to manually copy / paste the disassembly code of each executable modules to a file.

Do I have any else choice?

Thanks.


Error 11 etc..

RCE Messageboard's Regroupment > General > Error 11 etc..
WebRIPPER
02-20-2004, 10:42 AM
I can't get it work !!!
It always halt with "error 11" message. What to do?
In SoftICE it does not happens with the same programs. Maybe I miss something in settings?
WebRIPPER
02-20-2004, 10:57 AM
Now it's something new (after restart)
ERROR_CLASS_DOES_NOT_EXIST (00000583) ??? Why??? There are all clases there
Ricardo Narvaja
02-20-2004, 02:09 PM
Never in my life OLLYDBG tell me ERROR 11, and i have 185 tutorials and 150 challenges, do you use Panda Antivirus, the enemy of OLLYDBG?

Ricardo
WebRIPPER
02-22-2004, 06:27 AM
No, there is TrendMicro installed on the machine... So what 's the problem?
oh me anon
02-22-2004, 07:14 AM
greets

well as far as i know ther is no error level 11 string in olly
the nearest string is

Text strings referenced in OLLYDBG:.text, item 1860
Address=00447BF3
Disassembly=PUSH OLLYDBG.004B3E3A
Text string=ASCII "(Last error = %s)"

does the popup belong to olly or does it belong to application

what does it say actually

what are you doing to get it

all this info may help us help you

just by saying woahhhhhhhh i got err0r 11 doesnt make a cleare picture

and if you have panda antivirus many say it tinterferes with the debuggers process so ric asked if you have it installed

so instead of asking "i have trend micro whats the problem"
why dont you try disabling it for some time run olly and see if this probalem goes off if not tell that tooetc etc

blind questions does not get any replies or gets at the most blind replies

regards
WebRIPPER
02-22-2004, 07:51 AM
Thank you for response, as following:
1) The problem is with application debugged, but not with Olly
2) The application running in debug mode, using Olly just halted after a couple of seconds, so it is impossible to debug.
3) When the appliction halted it can be ERROR_CLASS_DOES_NOT_EXIST (00000583) or
ERROR_SUCCESS (00000000) last error state
4) While this the stack is
Call stack of thread 000009EC
Address Stack Procedure / arguments Called from Frame
01CFFE48 77F5C454 Includes 7FFE0304 ntdll.ZwTerminateProcess+0A 01CFFF40
01CFFE4C 77E798EC Maybe ntdll.ZwTerminateProcess kernel32.77E798EA 01CFFF40
01CFFF44 77E7990F ? kernel32.77E79895 kernel32.77E7990A 01CFFF40
01CFFF58 004545FA ? kernel32.ExitProcess hb3.004545F4 01CFFF54
01CFFF5C 00000002 ExitCode = 2
01CFFF64 00454542 ? hb3.00454557 hb3.0045453D
01CFFF74 0043C453 hb3.00454535 hb3.0043C44E
5) I have trendmicro, but I do not think that it the problem
6) ntdll halt string is 77F5C448 >/$ B8 01010000 MOV EAX,101
77F5C44D |. BA 0003FE7F MOV EDX,7FFE0300
77F5C452 |. FFD2 CALL EDX
77F5C454 \. C2 0800 RETN 8
7) That's all folks :). So I'm wonderring what is the problem here 'cos in SoftICE this does not happens, but I prefer to use Olly (love it)...
8) Thanks to all
oh me anon
02-22-2004, 08:46 AM
does it create any exception if you want to know do this
alt+0 debugging options,exceptions ,add last exception

it will be grayed if ther was no exception else if it is enabled the top most is the recent exception
if you want you can allow olly to pass it to the applications handler rather than letting olly handle it

it saves you pressing shift+f9 umpteen times

are you attaching it
or are you loading it

does it stop on entry point have you read its pe header entry point
is it packed have you unpacked it

if sice can work on this app (if it is an app and not some driver)
then olly can work with it too and better than sice
WebRIPPER
02-22-2004, 09:40 AM
I added 0-FFFFFFFF in skip error on debug option- nothing (still halting)
How to post to app handle?
I'm load it
the application in unpacked
So still problems, what to do>? Something I missed?
focht
02-22-2004, 11:10 AM
Greetings,

the problem is that one win32 API call returns ERROR_CLASS_DOES_NOT_EXIST (00000583) and the thread/program terminates upon (due to application error handling).
The error code could be related to window classes (registered atoms) but it can be anything other too.

At first you must identify the API call that caused the last error code.
To do so, set a conditional breakpoint at ntdll.RtlSetLastWin32Error.
Condition "[ESP+4] == 0x583" (first arg is win32 last error code).

Let the program run and watch it stop.
Collect all data - especially the call stack - and post it here.

View -> callstack
"show arguments"
copy whole table to clipboard.

With this information we might help you...

Regards,

A. Focht
WebRIPPER
02-22-2004, 11:37 AM
Here the dump
Call stack of thread 000014C4
Address Stack Procedure / arguments Called from Frame
01CFFF64 00456115 ntdll.RtlSetLastWin32Error hb3.0045610F 01CFFFB4
01CFFF68 00000000 Error = ERROR_SUCCESS
01CFFF74 0045387E hb3.004560B3 hb3.00453879 01CFFFB4
01CFFF78 0043C3D6 hb3.00453879 hb3.0043C3D1 01CFFFB4
oh me anon
02-22-2004, 11:56 AM
ERROR_CLASS_DOES_NOT_EXIST (00000583)

Condition "[ESP+4] == 0x583" (first arg is win32 last error code).

01CFFF64 00456115 ntdll.RtlSetLastWin32Error hb3.0045610F 01CFFFB4
01CFFF68 00000000 Error = ERROR_SUCCESS

sort of messup some where where ????

btw why dont you try following the calls using show calls or going to stack following it to dissembler and break pointing the return and see if olly breaks
WebRIPPER
02-22-2004, 12:16 PM
That's what it return to me with condition [ESP+4] == 0x583
focht
02-22-2004, 02:49 PM
Hi again,

as "oh me anon" already mentioned - there is something messed up.

Ollydbg should never break on conditional if arg0 = 0 (Error = ERROR_SUCCESS)

Next try: do a conditional log breakpoint.

Condition: "[esp+4] == 0x583"
Explanation: "lasterror code"
Expression: "[esp+4]"
decode: assumed by expression
Pause program/log: on condition

Run the program.
If that doesnt work (breaks even if lasterror != 0x583), try condition "[esp+4] != 0".
It will break/log on every API error encountered.

Dont come back until lasterror code "00000583" is logged ;)

Regards,

A. Focht
Ricardo Narvaja
02-23-2004, 02:00 AM
I think is a antidebugger code in the program.

The program can generate the errors.

1)I try disabling all breakpoints and all hardware BPX, enabling the plugin IsDebuggerPresent for hide of detection for this api
2)You can use WindowsHacker for hide the windows of olly to hide detection for the name of the Window of OLLYDBG.
3)Also you can rename the exe of ollydbg for hide of detection for name of the process
4)You can create a infinite loop in the EP of program and when is looping, atach the olly for hide detection of api Process32first, Process32Next (ACProtect method), this detect the process who load the process of the program, and if olly load the program is detected how the program who create the process.(if you atach a program looping in your EP olly is not detected how creator of the process)

If you try all of this options and continue the problem try
HE RaiseException if the program stop look if there are a conditional jump to skip this api and run the program.

Ricardo Narvaja
oh me anon
02-23-2004, 03:26 PM
hey ricardo ,

just to be sure i want to know this coz i dont use sice

and you seem to be doing some good job writing so much tuts
if this is antidebug then how come sice can handle it with aplomb
and not show his error 11

any ideas if sice has some extra capability to by pass antidebug
;(

i have my doubts like this

1) he hasnt set any break points so itmust be running in full steam
2) he must have f9 ned it and it and pressed some check the message box is result of his doing not ollys
3)it has to stop in the entry point of packer atleast if it is packed
there is no way that it can execute all by itself
4) if it is executing by itself then the ntdll.dll debug break must be screwed up without screwing it up each and every exe must stop at some entry point wherther it is original or packers or some devils entyr point isnt it
5) without executing any code in application no antidebug worth its salt is going to help
6) there is no way i think to find if the app is running in the contextof debugger during loading process (am i right or wrong
any one reading this may comment on this point

can the system determine if an app is running in the context of debugger and take evasive action without running any of its code

7) ???? what else i dunno but i firmly believe if sice can handle it then olly must be able to handle it

all and any comments are welcome
WebRIPPER
02-23-2004, 04:02 PM
OK, thanks to all.
There are two options:
1) new version of Olly solved the problem
2) IsDebuggerPresent plug in make it's work ...

Nice day to all
Ricardo Narvaja
02-23-2004, 09:00 PM
Yes is possible execute code, before reach the entry point, look the dll when are charging and put BP in ENTRY POINT of dlls and i see one program with this protection, it has a dll special, this was executed before reach the EP, and test the CRC32 and send a messageboxa with a ridicoulous error.

Put the mark OLLY stop in load of each dll and you don't look of ssystem dlls, look the dlls of the program (in the folder of the program), and put a bpx in the entry point and llok how execute code of the dll easily

Ricardo
oh me anon
02-25-2004, 02:45 AM
by entry point you mean the entry point of exe not the packer

in that proggie you mention does the unpacker routine gets executed which then might have executed the dll

then it still falls under executing user code

coz the dll is mapped to space by zwMapFileView calls int 2e
and then it returns that is all i ve seen tracing the loading process
no where i have seen some code being executed

can you point me to the proggie or sample you talk about

if its off limits then gimme your mail so ill mail you
Ricardo Narvaja
02-25-2004, 07:36 AM
EP is the first line executed in a pcked program, and OEP is the original enty point when you unpack a file, you may found the OEP, but this is not the first line executed, the packer unpack befores the program.
In the program i see the dll is executed before the olly stop in the EP, and no line of the program are executed, and in the dll the program check for crc32, etc, and a messagebox say ERROR XXX and exit, and no line of the exe was executed.
The tut is in my ftp and mi mail is ricnar22@millic.com.ar and the program was part of a weekly contest of crackslatinos mail list.
When you change only a byte the dll check crc32 and messagebox say error and exit program, before the exe are excuted, the packer unpack, and before OLLYDBG execute one only line of code of the exe and exits before reach the OEP.

Ricardo
Ricardo Narvaja
02-25-2004, 07:37 AM
Sorry EXIT before reach the EP.

Ricardo
Ricardo Narvaja
02-25-2004, 07:40 AM
I think my english is very bad but is very simple, a dll is executed before the exe start, and block the program and no line of the exe was still executed.

Ricardo
oh me anon
02-25-2004, 01:57 PM
so basically what you are trying to say is the unpacker routine executes the dll and exits if the crc is not ok
before reaching 401000 (i assume it will be 401000 as it is the address for most exe)
===============================================

-------olly stop here (404567 for example entry point for unpacker)
--------------------|
--------------------|
-------------unpacker routine
--------------------|
--------------execute dll ------->check crc ------------> not ok
------------------------------------------|-----------------------|
------------------------------------------ok------------ error msg box
------------------------------------------|------------------------|
-------------------------------jmp to entry point------------exit
------------------------------- (maybe 401000)

===============================================

any way ill mail you ill like to look at it
Ricardo Narvaja
02-25-2004, 02:07 PM
No no, you dont, understand me.

With your grafic explain better

--------------execute dll ------->check crc ------------> not ok
ok error msg box ----------------------------------------------|-----------------------
-------olly stop here (404567 for example entry point for unpacker)
--------------------|
--------------------|
-------------unpacker routine
--------------------|
------------------------------------------|-----------------------|
-|
-------------------------------jmp to entry point---------- exit
------------------------------- (maybe 401000)
===============================================
Ricardo Narvaja
02-25-2004, 02:09 PM
The program execute dll and olly NO EXECUTE and NO REACH THE EP (in your exmaple 404567)
If the check are good olly stop in 404567, unpack next and go to OEP.
If the check are bad OLLY NEVER EXECUTE 404567, the dll exit before.

Ricardo
Ricardo Narvaja
02-25-2004, 02:14 PM
Digo yo, no hay nadie que hable español que explique en ingles que el programa ejecuta una dll antes de llegar al EP, que olly nunca lo arranca si el crc esta mal, pues la dll te hace salir del programa ANTES DE QUE OLLY PUEDA LLEGAR AL EP?

CHEQUEO DE DLL

SI ES NO OK ----------> EXIT
SI ES OK ---------------> OLLY PARA EN EL EP

DAS RUN

UNPACKER

OEP

Esa es la secuencia espero que alguien lo entienda

Ricardo
oh me anon
02-25-2004, 02:20 PM
hehe ricardo
google gave me this
Say I, is nobody speaks Spanish who explains in ingles that the program executes a DLL before arriving at the EP, that olly never takes it if crc this badly, because the DLL makes you leave the program BEFORE OLLY CAN ARRIVE At the EP? DLL CONTROL IF ----------> EXIT IS noncOk IF ---------------> OLLY FOR IN EP DAS RUN UNPACKER OEP That IS OK is the sequence I hope that somebody understands Ricardo to it

ok ok i got it any way ive sent you a mail
Lord_Looser
02-26-2004, 03:14 PM
Would it be useful if you suspend all process’ threads before you debug? So the process could not detect any changes ?!?
sgdt
02-26-2004, 03:45 PM
This is, more than anything, the reason I'm so glad Olly now can debug DLLs.

Way cool find, btw. I knew PE loader had to load the DLLs to resolve things like where they would reside in memory and IAT, but it never occured to me it would execute any of the DLLs code. Could come in VERY usefull. Think of an INSTANT pop to debugger on a process creation that uses a DLL you want to watch, or better yet, instant pop on things using WinSock or what not. Very usefull indeed!

I wonder... If a packed program needed additional DLLs that the packer didn't need, wouldn't they have to be loaded in on a CORRECT IAT (before scrambling)?

Lots of possibilities... :)
oh me anon
02-27-2004, 03:46 AM
hey ricardo it uses this way to do what you have said

it calls the dllentrypoint and does what you suggest to execute before going to entry point

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllpr oc/base/dynamic_link_library_entry_point_function.asp (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/dynamic_link_library_entry_point_function.asp)

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllpr oc/base/dllmain.asp (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/dllmain.asp)
Ricardo Narvaja
02-27-2004, 05:59 AM
very good jeje

Ricardo


how to set breakpoint on memory range > 4 bytes

RCE Messageboard's Regroupment > General > how to set breakpoint on memory range > 4 bytes
ddif
02-20-2004, 10:24 PM
the MR command seems only support less than 4 bytes of length.
Is there a Ollydbg command like BPR in Softice? Or i misused MR command?
oh me anon
02-21-2004, 01:50 PM
have you tried using view --->memory --->set break point on access
set memory break point on access or set memory breakpoint on write
olly stops when the code or resource or what ever is accessed or written to

or you can use run trace set condition

ctrl+t and specify it to pause in a range

you can combine and club other conditions also

like when eip > 401020 && eip < 401030 eax== 345678
and command is one of mov r32,imm mov r16,word ptr ds:[***]
etc

hope this helps
ddif
02-21-2004, 08:55 PM
thanks a lot, it works nicely when i "set break point on access" on a heap range.


UDD File Format

RCE Messageboard's Regroupment > Plugins > UDD File Format
asdf
02-21-2004, 06:09 AM
Hey,

Anyone have the full and correct File format of the .UDD files of ollydbg ? I know it in big but there are few fields that im not 100% sure of.

Thanks in advanced, asdf
TBD
02-23-2004, 10:23 AM
asdf: i have an older version of UDD format, somewhere.

what do you plan to do with ? i think you can ask Olly for this if you plan to create a tool.


Is this possible with OllyScript?

RCE Messageboard's Regroupment > OllyScript > Is this possible with OllyScript?
Anonymous
02-21-2004, 08:08 PM
I'm needing to log an ascii string pointed to by a register, i've been toying around with the source for a few minutes but am having no luck.

How can I output an ascii string at (register) ?

luck
psyCK0
02-22-2004, 05:21 AM
Not possible at the moment I'm afraid...
Ill try to include it in v0.6
Anonymous
02-22-2004, 12:41 PM
and the possibility to do a binary edit ? cause the asm syntax jmp eip don't work with olly also i must do binary edit and replace by EBFE
psyCK0
02-23-2004, 05:40 AM
Read the readme section on MOV more carefully. =)


does asprotect make trace conditions fail???

RCE Messageboard's Regroupment > General > does asprotect make trace conditions fail???
yaa
02-21-2004, 09:32 PM
Hello,

I've been playing with an notepad protected with an older version of asprotect and have noticed that trace conditions seem to fail ... in other words tracing does not stop even if a stop condition is met. I'm using windows 2000. Can anyone confirm that this behavior is due to asprotect???? I have repeated this thing various times always failing. With other applications (not asprotected) tracing conditions work just as expected.

yaa
oh me anon
02-22-2004, 03:35 AM
single step through some parts and find out if its clearing debug registers or if it is self checking for int 3s etc etc

there are hell lot of antidebugging tricks to really explain it out here and this forum isnt meant for it also

any way get ricardos tuts in spanish and push them through some online translator discard the rubbish texts and concentrate on some codes to understand what he is saying youll get through most of the unpacking stuff
or best but tedious way is to single step through evry useless command of it to really know how it works if you single step through it once or twice from next time onwards just by looking at dissembly youll come to know what can be happening

like repne scasb not ecx block means mostly it getting text length of some string lets skip it ;)
yaa
02-22-2004, 07:30 AM
oh me anon, which in the cpu pane are the debug registers???? Also, is tracing implemented using memory/hw breakpoints????

yaa
oh me anon
02-22-2004, 08:53 AM
q no 1 ) right click on register pane and click view debug registers

q no 2) logially olly cannot do some magic zee boom ba stop here to pause when your condition is met so it must be using the available resources only like memory bpt hardware bprt one shot bpt like hit trace etc etc dont you think may be iam wrong but probably not


BETA 2 of OLLYDBG 1.10

RCE Messageboard's Regroupment > General > BETA 2 of OLLYDBG 1.10
Ricardo Narvaja
02-23-2004, 02:04 AM
is in the page of olly for download

http://home.t-online.de/home/Ollydbg/beta110b.zip

Vesrion 1.10b - second beta

Download v1.10b now - still raw, for troubleshooting only, includes plugin.h and sources of cmdline.dll that demonstrate usage of ODBG_Plugincmd().

There is a big useful new feature: OllyDbg now can debug standalone DLLs. Just drop DLL into OllyDbg and see what happens. A brief walkthrough is available here. Also new is a SEH chain window. Other changes:

A very useful option to remove analysis from selection (shortcut: Backspace);
Attach window is resizeable (and even maximizable);
New stack commands: push doubleword and pop doubleword;
Option to copy all registers to clipboard.

Removed bugs:

Assembler supports simplified form of IMUL: IMUL reg,const. This command is disassembled as IMUL reg,reg,const. One cannot search for IMUL using imprecise register (IMUL R32,CONST - use IMUL R32,R32,CONST instead). Reported by Alexandr Yakubtchik.
Disassembler used address size instead of operand size to decode size of immediate offset (JMP FAR ssss:oooooooo). Reported by Karel;

Tabs in source text in Disassembler comments and info pane were displayed as small rectangles. Now they are extended to at most 8 spaces. Reported by Karel;

ARPL was decoded with 32-bit size of operands (correct decoding is ARPL r/m16,r16). Reported by Karel;
OllyDbg now should correctly work in multi-monitor configurations, but I am unable to verify this. Please check! Reported by Roel Verdult;
2-byte INT 3 (CD 03) was processed incorrectly. Reported by roticv.
That's all, enjoy and don't forget to report bugs! Unfortunately I'm very busy now and cannot answer to you emails instantly, sorry. But, earlier or later, I'll read then all :)
pzalps
02-23-2004, 05:36 AM
It's my pleasure

thank you :)
yaa
02-23-2004, 01:56 PM
Oleh ... my hero!!

yaa
mango
02-23-2004, 03:26 PM
Nice one Oleh :)
Gigapede
02-24-2004, 10:32 AM
"Copy all registers to clipboard" doesn't copy EAX register.

debug standalone DLLs is very nice !
sgdt
02-24-2004, 10:18 PM
Debugging standalone DLLs is a awsome feature! It saves a lot of work of creating "loader" programs, very much appreciated!

Again, Thank You!

(the other stuff is cool too!)
psyCK0
02-25-2004, 06:08 AM
Thank you Olly! =)

Ne1 tried the DLL loader? Where does it stop? On the Entry point? In DLLMain?
TBD
02-25-2004, 08:32 AM
psyCK0: check Load DLL Tutorial (http://home.t-online.de/home/Ollydbg/Loaddll.htm) for more information (at the end there is "Details and sources")
Lord_Looser
02-27-2004, 05:53 PM
Please add showing TOP_LEVEL_EXCEPTION_FILTER too
In Win2k kernel32.dll you can see for each thread it always saved at the same address 77ECA1F0.

SetUnhandledExceptionFilter:
77E9BAA3 mov ecx,dword ptr ss:[esp+4]
77E9BAA7 mov eax,dword ptr ds:[77ECA1F0]
77E9BAAC mov dword ptr ds:[77ECA1F0],ecx
77E9BAB2 retn 4

thanks
GreenLink
08-19-2005, 03:11 PM
Hello
Somebody can send me OllyDBG 1,1 to:
greenlinkrpg@gmail.com?
Thanks!
Byes!
oh me anon
08-19-2005, 04:03 PM
get it from here ollydbg.de you should have obviously googled before
posting that the address is there in first page first hit :(

hey tbd when are you going to repair the search settings in the forum ??
simple
08-26-2005, 11:55 PM
Hi,

it would be nice to put some tabbed windows instead od MDI?

Thanks.


how to disable windows?

RCE Messageboard's Regroupment > General > how to disable windows?
mike
02-23-2004, 02:01 PM
i want to know how can i found out the correct call that makes a window.I know that i can't set a BP on the handle of the window but there should be another way to do it.
Anybody knows how???
Thanx
oh me anon
02-23-2004, 02:38 PM
what are you asking (correct call that makes the window ???)

CreateWindow, CreateWindowEx,

how do you mean by setting bpt on handle
setting bpt for what (messages,mouse movement ,keyboard,creation,destroying ????)

have you tried looking into windows window on olly
and right clicking on it

you will see a message breakpoint on any windows on <winproc>

there is a big drop down box for all kind of messages

see stack details of some arbitary exe i loaded it vb ;)
/CALL to Assumed WinProc from USER32.77E13EAD
|hWnd = 001402FE ('CRC 32 Algorithm Test',class='ThunderRT6FormDC')
|Message = WM_COMMAND
|Notify = MENU/BN_CLICKED... ID = 1.
\hControl = 000902E2 ('Check',class='ThunderRT6CommandButton',parent=00 1402FE)

here is the log window details
Log data
Address Message
6A9EFFCB CALL to Assumed WinProc from USER32.77E13EAD
hWnd = 001402FE ('CRC 32 Algorithm Test',class='ThunderRT6FormDC')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 000902E2 ('Check',class='ThunderRT6CommandButton',parent=00 1402FE)
6A9EFFCB Conditional breakpoint at MSVBVM60.6A9EFFCB

hope it helps your

i saw the topic name after i posted this
disabling windows ???? the content inside topic is different
exactly what are you trying to do
look into show window sw_show, sw_shownormal,sw_hide,sw_maximised etc etc
mike
02-23-2004, 07:58 PM
i tell you what i mean.
I have a progy that use an introductory window.
On that window you have to push an OK button to continue.
I want to overtake this introductory window .
And i guess there should be a call to this window that i can erase it
I hope it is clear now what i want to do
Thanx
mike
02-24-2004, 07:27 PM
nobody knows???I am disappointed!!!
sgdt
02-24-2004, 10:14 PM
OK, assuming you don't want to just take out the creatwindow, or immediately post a WM_CLOSE message to it, or post a "OK" event, why don't you just redirrect its WM_PAINT to jump to the code that handles the "OK" button?

Personally, I'd just nop the createwindow or post a "OK" button press to it.
oh me anon
02-25-2004, 02:36 AM
hehe mike ,

the question you ask isnt not knowable but off limits and it requires some sort of reinng with the app which may not be an acceptable topic in this forum and got nothing to do with ollydbg

and it needs some understanding on your part
basicllay you need to do some trace several times and find when it is showed or created and prevent it from creating showing it

and basically it one byte alteration probably from from a conditional to non conditional
mike
02-25-2004, 03:36 PM
To sgdt:
Well that OK button press looks good but i don't know how to do it?
Can you help me on this?
Thanx
sgdt
02-25-2004, 08:49 PM
Your probably better off at least trying the following (in order of preference because of complexity):

1. nop the CreateWindow
2. Modify the end of the WM_CREATE to jump to "OK" code.

If those don't work, then posting an "OK" button press to the program might be in order. Again, this is only if you've exhausted the simple byte-change type fixes.

To post a message, you will need the ID of the OK button, the address the CreateWindow is called, some blank area at the end of the code section, and a hex editor for adding to the relocation table and adding the function and injecting the code.

While it's not hard to do, it's kind of dependant on what code is happening past the CreateWindow (i.e. jumps and stuff). The first time you do this it may be a little difficult.

What you do is replace the 5+ bytes after CreateWindow with a relative call to a blank area where we write a function to post the message. This function also executes the opcodes that were overwritten, but care must be taken for things like jumps. Additionally, care must be taken if their was a relocation entry that we are overwriting.

Anyway, the actual function we add towards the end of the code section simply calls PostMesage with the ID of the OK button, executes any instructions we overwrote above, and returns.

The pointer to PostMessage is in the IAT, but because it's a pointer and we can't make a relative call to a pointer, a relocation entry must be added. This entry points to the 4 bytes following the "FF15" of our call instruction.

The relocation section will have to be modified in a hex editor (OllyDebug 2.0???). You add the RVA (not the memory address) of where this entry is. Anyway, make the VirtualAddress the RVA of the function, the SizeOfBlock 0xA bytes (8 for IMAGE_BASE_RELOCATION structure and 2 bytes for our offset), and then the two bytes for our offset.

For the offset, treat it as a big endian WORD value, and or it with 0x3000, so the bytes would be vv vv vv vv 0A 00 00 00 oo 3o (where vv vv vv vv is the RVA of the function, and oo o is the offset into that function. This assumes our function is less than 4096 bytes).

Make sure the RAWSIZE of the Reloc section is large enough to hold the new entry, expand it if needed.

I wrote a tutorial (my first tutorial) on a simular subject a while back, with a great deal more detail, and it's up on ExeTools forum. You could probably find it by searching for Adding Relocation Entries or some such.

Hope this helps.

If you've never done a patch that calls IAT fucntions, it may seem like a PITA, but it's actually not that bad.
mike
02-26-2004, 06:06 PM
to sgdt
The damned doesn't use createwindow.At least olly doesn't stop on the createwindowexa API.
There four calls to this API but none work.
Of course ,there is no any other way ,to create windows, correct???
That means the progy MUST use the API createwindow.
Any suggestion's???
Ricardo Narvaja
02-26-2004, 07:54 PM
If you are in XP type in the commandbar

HE CreateWindowsExA

in windows98 olly is easily fooled with

mov eax, xxxxx
call eax

xxxxx will be the position in memory of the api, and olly will be fooled, in the analisis this construction cannot be detected how call to api.

Ricardo Narvaja
sgdt
02-26-2004, 08:26 PM
At the top of this page, click Stuph, and get Window Juggler. I haven't played with it too much, but it looks like you'll be able to get the window handle you'll need to find in Olly's window list. Set a message break point, then you should have the WndProc.

I would, in a adition to create window, also check into createdialog type functions as well.
mike
02-27-2004, 10:44 PM
to Rigardo Nirvana
I know that thing about fooling Olly but even then isn't necessary to use the "GetProgAddress" api in order to find out the address of the "CreateWindowExa"???


Strange string

RCE Messageboard's Regroupment > General > Strange string
WebRIPPER
02-23-2004, 04:15 PM
Bug, or doing something wrong...

The same test program, with Olly and W32Dasm
Following {Olly} :
--------------------------
0042F35B . 50 PUSH EAX
0042F35C . 68 1B270000 PUSH 271B
0042F361 . E8 3AF40100 CALL hb3.0044E7A0
0042F366 . 83C4 04 ADD ESP,4
0042F369 . 50 PUSH EAX ; |Text
0042F36A . 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ; |
0042F36D . 50 PUSH EAX ; |hOwner
0042F36E . FF15 6C044600 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
--------------------------------------------
Following {W32Dasm} :
--------------------------
:0042F35B 50 push eax 0

* Possible Reference to String Resource ID=10011: "Test for UNICODE key as reference"
|
:0042F35C 681B270000 push 0000271B
:0042F361 E83AF40100 call 0044E7A0
:0042F366 83C404 add esp, 00000004
:0042F369 50 push eax 0
:0042F36A 8B4608 mov eax, dword ptr [esi+08] re
:0042F36D 50 push eax d

* Reference To: USER32.MessageBoxA, Ord:01BEh 11
|
-----------------------------------
As you can see W32Dasm detect the string, but Olly does not. How make Olly able to detect unicode referenced strings?
Ricardo Narvaja
02-23-2004, 09:04 PM
Olly detect the string too, go to view-executables, select the exe and right click view string resources for this type of string, and you see the string

Ricardo
Ricardo Narvaja
02-23-2004, 09:05 PM
Olly detect UNICODE, only this is a RESOURCE STRING you go and look in the correct window and you see the string

Ricardo
WebRIPPER
02-24-2004, 04:01 AM
Thank you. I see it now, but...
It is no search option in this window and how can I go to selected address (except manually). I think it make sense to add right-click function like in string search window...
Ricardo Narvaja
02-24-2004, 05:34 AM
Write to Oleh and tell if in the next beta, the resource string can be wieved and managed how the common string references, and in the same window all references together, common string references and resource strings, how wdasm without differences.

Ricardo
helloword1
02-24-2004, 08:21 AM
WebRIPPER It's possible with OLLYDBG to know where the ressource string are linked with assembler code.

- In the "Resources String" window there is a colunm name Index
For example
index: 80(128.)
string: Cannot open file blabla

- Take the index number and go to
CPU window
Right click
Search for
All sequences
and write :
mov R32, 80
You can also try
push 80


[plugin] OllyScript v0.6

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.6
psyCK0
02-24-2004, 11:22 AM
Hello everyone,

OllyScript v0.6 is now available for download at
http://ollyscript.apsvans.com

Here is an except from the readme:

2.1 What's new?
---------------
The internal architecture of the plugin totally redone and object-oriented
(its not perfect OO, but bear with it). Because of this rewrite, bugs are
likely to appear. Please report them to me ASAP!
Bugs with script processing are fixed, parts of code are redone etc.

+ New commands:
BPCND, BC, BPMC, JA, JB, JAE, JBE, AI, AO, TI, TO
+ Conditional breakpoints
+ Breakpoint clearing (even memory)
+ Tracing and animation
+ More jumps
+ Stepping through script supported
# BP behaviour fixed (it now SETS breakpoint, instead of TOGGLEING it).
# Bugs in script processing fixed (thanks s0nkite).
# LOG now logs things like strings that are referenced by the address,
referenced function addresses etc. Try it, its cool!
# "Thanks" section of readme updated. =)
------------------------------

Hope you like it! =)
helloword
02-24-2004, 02:44 PM
How the Stepping through script supported is working ?
How to load the Logs window ?
psyCK0
02-24-2004, 06:54 PM
1. Use the Step command on the plugin menu to execute one script step at a time when script is paused.
2. RTFM =) (or try looking at the top of the View menu)
loveboom
02-27-2004, 06:36 PM
thanks
Good
psyCK0:
new command:
hedit addr,#HEX#?
bp aadr,EAX==111,DO set ZF=0 ??
psyCK0
02-27-2004, 07:58 PM
v0.61 uploaded (bugfix).

loveboom
1. This is already there, just use MOV [addr], #001234#.
2. The DO is not necessary, you can use EOB. Setting flags is
a nice idea, will come in 0.7.
loveboom
03-01-2004, 08:44 AM
idea:
do this hide ring3 debug with ollyscript
var eax
var addr1
mov eax,dword ptr fs:[30] //?here
add eax,2
mov addr1,eax
mov eax,[eax]
cmp al,1
jne end
mov [addr1],0
end:
or mov eax,dword ptr fs:[18] //?here
thanks
loveboom
03-03-2004, 01:27 AM
today i cann't open:http://ollyscript.apsvans.com (yestoday can do it).post a obsidium 1.0061 crack version unpack script:
test:win2kadv、ollyscripts v0.6(only v0.6)
/*
////////////////////////////////////////////////////////////////////// ////
★ Obsidium1.061 OEP Founder v0.1(for VB only) ★
★ Author: loveboom ★
★ Email : bmd2chen@tom.com ★
★ Date : 2004-2-17 ★
★ Note : If you have one or more question ★
★ email to bmd2chen@tom.com(china) thank you! ★
★ this script can help you found oep、Fix Import、patch OEP code. ★
★ Setting: ALT+O open option window,Exceptions->uncheck . ★
★ all Exception OPT! ★
////////////////////////////////////////////////////////////////////// ////
*/

var cbase
var csize
var count
var patchaddr
var patchcode

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

mov count,11
eoe lbl1
eob lbl1
run

lbl1:
cmp count,0
je lbl2
sub count,1
esto
jmp lbl1

lbl2:
eob lbl3
gpa "LoadLibraryExA","kernel32.dll"
bp $RESULT
esto

lbl3:
eob lbl4
bc $RESULT
rtu

lbl4:
eob lbl5
findop eip,#66F7062000#
bphws $RESULT,"x"
run

lbl5:
eoe lbl6
bphwc $RESULT
asm eip,"TEST WORD PTR [ESI],8"
sto
mov count,eip
mov [count],#7546#
findop eip,#7439#
mov count,$RESULT
mov [count],#7424#
findop eip,#7417#
mov count,$RESULT
mov [count],#7402#
mov count,3
run

lbl6:
cmp count,0
je lbl7
sub count,1
esto
jmp lbl6

lbl7:
eob lbl8
findop eip,#EB03#
bp $RESULT
esto

lbl8:
eoe lbl9
log $RESULT
bc $RESULT
bprm cbase,csize
run

lbl9:
bpmc
mov patchaddr,eip
sub patchaddr,4
mov [patchaddr],[esp]
sub patchaddr,1
mov [patchaddr],#68#
cmt patchaddr,"OEP!,patch oep pass.please dump->fixdump."
msg "Thank you for using my script!Note:if imprec found Invalid API then Cut it!"
ret
psyCK0
03-03-2004, 05:57 AM
God damn, thats an impressive script! You truly used every feature OllyScript has to offer! =)
Will put it on my site as soon as it's up (that's what happens
when you choose the cheapest hosting provider =) ).

loveboom: Your idea about debugger hiding... Do you mean you want a script command that would hide/unhide debugger from IsDebuggerPresent calls?
loveboom
03-03-2004, 08:13 AM
yes!
v0.61 have a bug eob/bphwc,you can test my obs script(pass in v0.6),thank you !
psyCK0
03-03-2004, 01:36 PM
loveboom: please tell me more about the bug. When does it occur? What happens? Maybe you could write a small script that illustrates the problem?
loveboom
03-04-2004, 07:28 AM
test:win2kadv+ollydbg 1.1b

lbl5:
eoe lbl6
bphwc $RESULT //bphwc pass
asm eip,"TEST WORD PTR [ESI],8" //v0.61 stop here
sto
psyCK0
03-04-2004, 01:12 PM
OllyScript v0.62 posted.

* Breakpoint bug fixed (again).
* EFLAGS can be changed.
Anonymous
03-05-2004, 12:09 PM
hi psycko

i am new to ollydbg and ollyscript... i did put ollyscript files on ollydbg directory..

my question is how to i use the ollyscript and the text samples u hav on ur great site...

more power and regards
Anonymous
03-05-2004, 07:01 PM
Anonymous: read the readme :-)
Anonymous
03-08-2004, 05:55 AM
hi,

i did read the readme. and still not know how to use ollyscript.. ;-(

anyways thanks

regards
psyCK0
03-08-2004, 06:08 PM
I think Anonymous #2 said it all... We are at over 3000 downloads now, and it seems people have managed to learn to use my plugin quite fine.
My tips to you:
1. Learn to use OllyDbg
2. Find out what (if any) tasks repeat themselves in your work
3. Use my plugin to automate them

I hope you dont think I am rude.
Good luck!
Anonymous
03-08-2004, 10:17 PM
hi, psycko

u r not rude.. ;-)

sadly i am new to ollydbg but learning... in regards to script.. i will keep trying..

just maybe i am overwhelm with ollydbg and ollyscript power..

will ask again by next week if i still cannot understand how-to make it work.

thanks and more power

AL
sgdt
03-09-2004, 01:05 AM
To learn, I would try playing with some of the scripts, and then try creating a few simple scripts to set a break point and run, recover from exception, and change the EIP to bypass a troubling line of code.

You'll be shocked at how much faster things become. You automate all the things you learn, so what's left is all you need to concentrate on. No more monotony.

Yes, coders and crackers need toil no more with three kazillion Shift F9's followed by setting a register at exactly the right exception followed by..., well, you get the idea.

Who knows, maybe with all this free time, we may actually get to USE some of the stuff we modify... :)
Anonymous
03-09-2004, 03:02 AM
HI sgdt

honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(

i did use tr (dos debuger) with script w/o problems.

regards
AL
loveboom
03-09-2004, 07:28 AM
psyCK0
a bug with findop?:
use ollydbg CTRL+B find hex 89bd
xxxxxxab 75 89 jz xxxxxx //stop here
xxxxxxad bdxxxxxx xxxxxx
use findop eip,#89bd# return zero(000000)
right code:
xxxxxxac 89bdxxxxxx xxxxxx
psyCK0
03-09-2004, 08:11 AM
loveboom: this is by design (thats why its called "findop").

For example:
00412FDD 47 INC EDI
00412FDE 01DB ADD EBX,EBX

findop eip, #47# <-- works
findop eip, #01DB# <-- works
findop eip, #4701# <-- doesn't work because those are from different instructions

Maybe I should implement a "findhex" or something...
sgdt
03-09-2004, 12:06 PM
HI sgdt

honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(

i did use tr (dos debuger) with script w/o problems.

regards
AL

Verify you have OllyDbg 1.10, run it. Go to Options->Appearance, click Directories tab, and look at the Plugin Path. Bring up windows explorer, and verify the script DLL is in that directory. Once those are done, re-run OllyDbg, you should have (under Plugins menu) a OllyScript menu item.
Anonymous
03-09-2004, 09:32 PM
Hi sgdt,

i followed ur instruction still i have no ollyscript menu...

thanks.. i will keep trying...

Log data
Address Message
OllyDbg v1.10 (intermediate version - under development!)
CommandBar v3.00.108
Originary Written by Oleh Yuschuk Modified by Gigapede Contributors:TBD Wayne psyCK0 mfn
Labeler v1.32.108 by Gigapede
IsDebugPresent plugin v1.4 (SV 2oo3)
OllyDump v2.21.108 by Gigapede

regards
psyCK0
03-10-2004, 06:37 AM
Anonymous: what OS are you on?
Also, please try redownloading the plugin. =)
Anonymous
03-10-2004, 09:41 PM
Hi, PsyCKO

win98 2nd edition....

ok... d/ling....

Yes, finally i can see the ollyscript menu.. ;-)

Thanks and More power psyCKO...

now, hope i can help others too...

regards


just an idea!!!

RCE Messageboard's Regroupment > Plugins > just an idea!!!
mike
02-24-2004, 07:23 PM
Is there a plug-in that will read a text file with asm code and do what is the "assemble" command do but automatically in a specific place of the file we will point to???
So instead of writing the code line by line just make the code in a txt file and let the plug-in do the job.
Something like a compiler
oh me anon
02-25-2004, 02:39 AM
mike,
try palying with iczelions snippet creator and masm
it out puts a binary file (.bin) which you can use to binary copy and binary paste in olly

btw even in a text file you will be writing commands only line by line and not ten lines at a time ;( may be iam stupid
psyCK0
02-25-2004, 06:04 AM
You can actually use OllyScript to do something like what you want... Check the ASM command.
mike
02-25-2004, 09:44 AM
well ,oh me anom, you are right but let's say that you want to change some instruction in the code you just type line by line in olly.
Maybe some of the new instruction require more bytes.Then you will have to re-enter all the instruction that follows the new instruction.But it is much faster to type the new instruction in the txt file and let olly make the patch
oh me anon
02-25-2004, 01:27 PM
elementary my dear watson as sherlock would say

select all the following bytes and binary copy them to some address below than change the only one instruction and rejoin it back use binary copy binary paste actually binary paste only coz it already in your clipboard during earlier copy
;)
mike
02-25-2004, 02:21 PM
yes it work.Thank my brother!!!You saved my ass !!!


How to debug multifile application

RCE Messageboard's Regroupment > General > How to debug multifile application
svt
02-25-2004, 09:32 AM
For example, main program is A.exe, but it is the loader and command line parser only. The code I want to examine is in the file A.res
I need to set breakpoint to CreateFileA and some other places in A.res, but how to do it when Olly loads A.exe ? Is there solution except to attach Olly to A.res manually ?
oh me anon
02-25-2004, 01:44 PM
is a.res an executable if yes then ithink you can goto debug option(alt+o)-->events --->checkmark the break on new module

when olly breaks use find executable modules --->follow entry --->
analyze if you want your break points for next session too and set bpt or you can set bpt as it is olly will not remember it next time


TYPELIB in ressources

RCE Messageboard's Regroupment > General > TYPELIB in ressources
helloword
02-26-2004, 04:07 PM
I notice that it's possible, with some ressources editor tools, to display an Item called TYPELIB where we can find interesting information like the class, function,property , ... name.

Is it possible in one way or another to got these information with OllyDBG ??


String references

RCE Messageboard's Regroupment > General > String references
Pompeyfan
02-26-2004, 05:06 PM
How come not all the string references show in Olly, that show in W32DSM?
Ricardo Narvaja
02-26-2004, 07:50 PM
Wdasm only show a 10 % of strings you can view in olly, only you have configure olly well.

If is a packed program wdasm not show references of the original program, olly yes.
with olly you can view all strings of all sections and dlls of the program, with wdasm not.

Only in debugging Options-Debug put the mark in

memory block currently selected in dissasembler

and with this olly show the string of the section or dll listed in CPU, if you need the strings of the first section (the most common) go to expression=401000 for display in CPU the first section and SEARCH FOR THE REFERENCES.

And for RESOURCE STRINGS go to VIEW-EXECUTABLE mark the line of the exe and right click SHOW RESOURCE STRINGS and look

Ricardo
Pompeyfan
02-27-2004, 04:33 PM
Even with those changes, with the program Webwhacker version 5, available at hxxp://www.bluesquirrel.com/free_download.html, I cant get it to show the evaluation expired strings, whereas in W32DSM it does, why would this be?
Ricardo Narvaja
02-27-2004, 07:28 PM
you go to 401000 and search strings with olly well configured?

And go to view-executables right click and go to VIEW-RESOURCE WINDOWS and the string is not here.

Verify well the two options

Ricardo
Pompeyfan
02-28-2004, 05:18 PM
The string is actually in the ix.dll file in this case, and yes if you click on view/resource you can see it, but from here why cant you double click on it, and go to it in the cpu window, also it doesn't show you every instance of it in the program, and you can never get it to show in the cpu window of the ix.dll file, it just shows the resource number.
It is a lot clearer in this intance to look at it in W32DSM, which is a dissapointment, because in every other respect Olly is great.
Ricardo Narvaja
02-29-2004, 08:01 AM
Write to olleh and tell if in the next beta add the resource strings in the common string reference list, and with a double click go to the cpu for view.
In the resurce strings you can view the number of this resource, if you search this number or PUSH (this number) you found the same locations in the olly than wdasm, but you can write to olly for improve this method, with one only list of strings with double click for go to the code when the string are used.

Ricardo
Pompeyfan
02-29-2004, 01:44 PM
Yes, I guess I should drop the author a note about it.
helloword
03-01-2004, 06:53 AM
Pompeyfan have a look to my comment in this post in the topic "Strange string"
Pompeyfan
03-03-2004, 08:05 AM
Yes, thanks for that, that makes it a bit easier to find what you are looking for, I still think that Olly needs to do some work, so that these references show as well as they do in W32DSM.


import libraries & object files

RCE Messageboard's Regroupment > Bugs > import libraries & object files
Lord_Looser
02-27-2004, 11:25 AM
please increase the limit of [Object files] and [Import libraries] above 200 in ollydbg.ini


Hardware breakpoints?

RCE Messageboard's Regroupment > Plugins > Hardware breakpoints?
psyCK0
02-27-2004, 03:50 PM
Is there any way to get values of DR0-DR3 from OllyDbg? Or any other way to check what hardware breakpoints are set?
Lord_Looser
02-27-2004, 05:16 PM
OllyDbg menu – Debug – Hardware Breakpoints

or in C++

CONTEXT Context;
Context.ContextFlags = CONTEXT_DEBUG_REGISTERS;
GetThreadContext( hThread, &Context );

see for more details
http://www7.informatik.uni-erlangen.de/~msdoerfe/embedded/386html/s12_ 02.htm (http://www7.informatik.uni-erlangen.de/~msdoerfe/embedded/386html/s12_02.htm)
psyCK0
02-27-2004, 07:56 PM
Lord_Looser: Thanks, I was looking for an API in the plugin SDK and never thought of just doing it the usual way.. =)
oh me anon
02-28-2004, 02:58 AM
psycho
right click in register pane (where eax,etc is seen) and click view debug registers shows all the debug registers are you searching for this or is it some thing else
psyCK0
02-28-2004, 05:19 AM
oh me anon: I was after a method to get them programmatically in a plugin. Its solved now. =)
Ricardo Narvaja
02-28-2004, 04:13 PM
Yes, you produce and exception and go to the exception handler, in the stack, the 3 o 4 value point to the values of the four HARDWARE BPX, try

Ricardo


Detach from debuggee feature

RCE Messageboard's Regroupment > General > Detach from debuggee feature
focht
02-28-2004, 05:21 AM
Greetings,

i'd like to see the ability to detach from debuggee (without exiting it of course).
Windows XP natively implements it and the VS.NET debugger uses it. Its quite handy feature.

Maybe ollydbg can implement it for xp+ based target systems.
I dont care about win9X (well for win2k i might be missing this one).
The menu command should be made only available when running on xp+ based systems.

The relevant API is in kernel32.dll:

"DebugSetProcessKillOnExit"
"DebugActiveProcessStop"

Of course it could be implemented in plugin but it might mess around with ollydbg's main debugger loop itself bring it into unstable state.

Regards,

A. Focht
Ricardo Narvaja
02-28-2004, 04:10 PM
Is easy detach manually with OLLY.

Olly debug a PROGRAM

ATTACH OLLY with other OLLY2

When are atached, pause OLLY2 and write

PUSH HANDLEOFPROGRAM
Call DebugActiveProcessStop
NOP

and NEW ORIGIN HERE in the PUSH

BPX in THE NOP
RUN

when stop in BPX the program continue running and you can close the two OLLYS and the PROGRAM CONTINUE RUNNING WITHOUT EXIT.

Ricardo
focht
02-28-2004, 04:59 PM
Hi,

of course it works that way you suggested. But i'm lazy :)

I'm debugging native NT services thats why i need that kind of stuff (without restarting the process itself when done).

I'll stick with VS.NET 2003 debugger for that purpose it has that functionality nicely integrated *button click*
Oh did i mention that remote pipe/tcp/ip debugging with VS.NET over internet is fun? It is ;)
Maybe one day ollydbg gets that kind of functionality too...

Regards,

A. Focht
psyCK0
03-09-2004, 07:03 PM
Olly says this feature will be available in v2.x


how to intercept debug events in a debugged proces

RCE Messageboard's Regroupment > General > how to intercept debug events in a debugged proces
Lord_Looser
02-28-2004, 06:01 PM
Compile this Dll and inject it in one debugger’s process (e.g. OllyDbg) - not debuggee. You should see in “c:\> inject.txt” an output file for each debug event e.g. "Single Stop" you make in OllyDbg.

No warranty – demonstration program only – beta

I found HookImportedFunction() at http://www.codeproject.com/useritems/DLL_Injection_tutorial.asp and add_log() in one nice OpenGL wrapper tutorial.

#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
#pragma comment(linker,"/MERGE:.data=.text /MERGE:.rdata=.text /SECTION:.text,EWR /IGNORE:4078")

#include <windows.h>
#include <stdio.h>

/*
#pragma data_seg (".InjectDll") // you must define as SHARED in .def
HANDLE g_hModule = NULL; // one instance for all processes
#pragma data_seg ()
*/

#define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr)+(DWORD)(addValue))

#define CASEL( x ) \
case (##x): \
add_log(#x "\n"); \
break; \

PROC HookFn( HMODULE hModule, PSTR FunctionModule, PSTR FunctionName, PROC pfnNewProc )
{
PROC pfnOriginalProc;
IMAGE_DOS_HEADER *pDosHeader;
IMAGE_NT_HEADERS *pNTHeader;
IMAGE_IMPORT_DESCRIPTOR *pImportDesc;
IMAGE_THUNK_DATA *pThunk;
if ( IsBadCodePtr(pfnNewProc) ) return 0;
pfnOriginalProc = GetProcAddress(GetModuleHandle(FunctionModule), FunctionName);
if(!pfnOriginalProc) return 0;
pDosHeader = (PIMAGE_DOS_HEADER)hModule;
if ( IsBadReadPtr(pDosHeader, sizeof(IMAGE_DOS_HEADER)) )
return 0;
if ( pDosHeader->e_magic != IMAGE_DOS_SIGNATURE )
return 0;
pNTHeader = MakePtr(PIMAGE_NT_HEADERS, pDosHeader, pDosHeader->e_lfanew);
if ( IsBadReadPtr(pNTHeader, sizeof(IMAGE_NT_HEADERS)) )
return 0;
if ( pNTHeader->Signature != IMAGE_NT_SIGNATURE )
return 0;
pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, pDosHeader,
pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]. VirtualAddress);
if ( pImportDesc == (PIMAGE_IMPORT_DESCRIPTOR)pNTHeader )
return 0;
while ( pImportDesc->Name )
{
PSTR pszModName = MakePtr(PSTR, pDosHeader, pImportDesc->Name);
if ( stricmp(pszModName, FunctionModule) == 0 )
break;
pImportDesc++;
}
if ( pImportDesc->Name == 0 )
return 0;
pThunk = MakePtr(PIMAGE_THUNK_DATA, pDosHeader, pImportDesc->FirstThunk);
while ( pThunk->u1.Function )
{
if ( (DWORD)pThunk->u1.Function == (DWORD)pfnOriginalProc )
{
DWORD dwOldProt;
if (VirtualProtectEx(GetCurrentProcess(),&pThunk->u1.Function,sizeof(PDWO RD),PAGE_EXECUTE_READWRITE,&dwOldProt))
{
pThunk->u1.Function = (PDWORD)pfnNewProc;
DWORD dwNewProt;
VirtualProtectEx(GetCurrentProcess(),pThunk->u1.Function,sizeof(PDWORD ),dwOldProt,&dwNewProt);
}
return pfnOriginalProc;
}
pThunk++;
}
return 0;
}

void add_log (LPCTSTR psz, ...)
{
char logbuf[256]="";
va_list va;
va_start (va,psz);
_vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), psz, va);
va_end(va);
FILE * fp;
if ( (fp = fopen ("c:\\inject.log", "a")) != NULL )
{
fprintf ( fp, "%s", logbuf );
fclose (fp);
}
}

BOOL
WINAPI // your debugger filter routine - loop possible
_WaitForDebugEvent( LPDEBUG_EVENT lpDebugEvent,
DWORD dwMilliseconds)
{
BOOL bRet = WaitForDebugEvent(lpDebugEvent,dwMilliseconds);
if (bRet == 0)
return bRet;
add_log("%08x ",lpDebugEvent->u.Exception.ExceptionRecord.ExceptionAddress);
switch (lpDebugEvent->dwDebugEventCode &
(APPLICATION_ERROR_MASK | ERROR_SEVERITY_SUCCESS | ERROR_SEVERITY_INFORMATIONAL |
ERROR_SEVERITY_WARNING | ERROR_SEVERITY_ERROR))
{
case APPLICATION_ERROR_MASK:
{
switch (lpDebugEvent->dwDebugEventCode)
{
case 0:
break;
default:
add_log("default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
}
break;
case ERROR_SEVERITY_SUCCESS:
{
switch (lpDebugEvent->dwDebugEventCode)
{
case EXCEPTION_DEBUG_EVENT:
switch (lpDebugEvent->u.Exception.ExceptionRecord.ExceptionCode)
{
CASEL (EXCEPTION_ACCESS_VIOLATION)
CASEL (EXCEPTION_BREAKPOINT)
CASEL (EXCEPTION_DATATYPE_MISALIGNMENT)
CASEL (EXCEPTION_SINGLE_STEP)
CASEL (DBG_CONTROL_C)
default:
add_log("default 0x%08x\n",lpDebugEvent->u.Exception.ExceptionRecord.ExceptionCode);
break;
}
break;
CASEL (CREATE_THREAD_DEBUG_EVENT)
CASEL (CREATE_PROCESS_DEBUG_EVENT)
CASEL (EXIT_THREAD_DEBUG_EVENT)
CASEL (EXIT_PROCESS_DEBUG_EVENT)
CASEL (LOAD_DLL_DEBUG_EVENT)
CASEL (UNLOAD_DLL_DEBUG_EVENT)
CASEL (OUTPUT_DEBUG_STRING_EVENT)
CASEL (RIP_EVENT)
CASEL (STATUS_WAIT_0)
CASEL (STATUS_ABANDONED_WAIT_0)
CASEL (STATUS_USER_APC)
CASEL (STATUS_TIMEOUT)
CASEL (STATUS_PENDING)
default:
add_log("default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
}
break;
case ERROR_SEVERITY_INFORMATIONAL:
{
switch (lpDebugEvent->dwDebugEventCode)
{
CASEL (STATUS_SEGMENT_NOTIFICATION)
default:
add_log("default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
}
break;
case ERROR_SEVERITY_WARNING:
{
switch (lpDebugEvent->dwDebugEventCode)
{
CASEL (STATUS_GUARD_PAGE_VIOLATION)
CASEL (STATUS_DATATYPE_MISALIGNMENT)
CASEL (STATUS_BREAKPOINT)
CASEL (STATUS_SINGLE_STEP)
default:
add_log("default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
}
break;
case ERROR_SEVERITY_ERROR:
{
switch (lpDebugEvent->dwDebugEventCode)
{
CASEL (STATUS_ACCESS_VIOLATION)
CASEL (STATUS_IN_PAGE_ERROR)
CASEL ( STATUS_INVALID_HANDLE)
CASEL ( STATUS_NO_MEMORY)
CASEL ( STATUS_ILLEGAL_INSTRUCTION)
CASEL ( STATUS_NONCONTINUABLE_EXCEPTION)
CASEL ( STATUS_INVALID_DISPOSITION)
CASEL ( STATUS_ARRAY_BOUNDS_EXCEEDED)
CASEL ( STATUS_FLOAT_DENORMAL_OPERAND)
CASEL ( STATUS_FLOAT_DIVIDE_BY_ZERO)
CASEL ( STATUS_FLOAT_INEXACT_RESULT)
CASEL ( STATUS_FLOAT_INVALID_OPERATION)
CASEL ( STATUS_FLOAT_OVERFLOW)
CASEL ( STATUS_FLOAT_STACK_CHECK)
CASEL ( STATUS_FLOAT_UNDERFLOW)
CASEL ( STATUS_INTEGER_DIVIDE_BY_ZERO)
CASEL ( STATUS_INTEGER_OVERFLOW)
CASEL ( STATUS_PRIVILEGED_INSTRUCTION)
CASEL ( STATUS_STACK_OVERFLOW)
CASEL ( STATUS_CONTROL_C_EXIT)
CASEL ( STATUS_FLOAT_MULTIPLE_FAULTS)
CASEL ( STATUS_FLOAT_MULTIPLE_TRAPS)
CASEL ( STATUS_ILLEGAL_VLM_REFERENCE)
default:
add_log("default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
}
break;
default:
add_log("BAD default 0x%08x\n",lpDebugEvent->dwDebugEventCode);
break;
}
return bRet;
}

BOOL APIENTRY DllMain( HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
/* if (g_hModule == NULL)
g_hModule = hModule;
else
*/
HookFn(GetModuleHandle(NULL),"kernel32.dll","WaitForDebugEvent",(PROC) _WaitForDebugEvent);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
focht
02-28-2004, 06:10 PM
Hi,

please forgive my ignorance ... but what advantage does this method have over using ollydbg's plugin API ODBG_Pluginmainloop() callback?

Regards,

A. Focht
Lord_Looser
02-28-2004, 07:42 PM
If you want to debug a program that debugs itself you can yet set breakpoints or something else (without OllyDbg's aid :-( ) and catch these before the program can recognise this.
Unfortunately OllyDbg cannot debug/open already debugged processes and on Win2k systems you cannot detach debugger.


Single Stepping?

RCE Messageboard's Regroupment > Plugins > Single Stepping?
pedram
03-01-2004, 12:07 AM
Is it possible for an OllyDbg plugin to single step through an entire application, instruction by instruction and process each one? I haven't seen any singlestep API call and a simple loop around:

Sendshortcut(PM_MAIN, 0, WM_KEYDOWN, 0, 0, VK_F7);

Does not work. Furthermore can certain modules (ie: kernel32) be overlooked? More specifically as every instruction is being single stepped and processed if the plugin detects that it has entered kernel32 to simply execute until breaking out of that module.

Thanks in advance.
psyCK0
03-01-2004, 05:27 AM
Well, single stepping works as long as you implement it correctly. You can only call Sendshortcut once per execution of ODBG_Pluginmainloop. You cen check the OllyScript source for details.

When it comes to module detection, you can get module information and then check if EIP is in the correct module?
oh me anon
03-01-2004, 01:28 PM
well pedram try playing with run trace (ctrl+f11) is equivalent to
f77inng the whole application including system dlls

ctrl+f12 is equivalent to f8inng the whole app

yes oleh has implemented what you ask too if you dont want to step into dlls

goto options ---> debugging options---->(alt+o) --->trace --->checkmark always step over system dlls

btw oleh is one step ahead too in this regard if you dont like to see repecmpsb repne movsb rep lodsb (all sting manipulation being single stepped) you can check mark always trace over string commands too

and yes you can log this single stepping to a log file
to do that before trace select log to file
and then start tracing you will see all the commands in a .txt file you specify

to view runtrace during execution use view -->runtrace

or the ... (three dots) button if you have enabled the tool bar

and you can profile the whole runtrace
either module by module
or global profile it

hope you find it usefull to use the same functionality in a plugin too
just find how he does it and send shortcut to it


tiny bug in olly

RCE Messageboard's Regroupment > Bugs > tiny bug in olly
QvasiModo
03-01-2004, 09:01 PM
When debugging a program that uses Unicode APIs, the ANSI version is shown instead in the stack pane. Also the string won't be displayed (olly attempts to read an unicode string as ansi).
oh me anon
03-02-2004, 11:53 AM
hey quasimodo ,
which version are you using the latest one or old versions

i dunno i have seen olly behaving correctly in older versions 1.09b
0012F4B8 UNICODE "f8dc9cdca395e85c"
0012F4BC UNICODE "12345678901234"
a sample stack paste

and i have seen many vb apps (those uses unicode only even for message box iirc) and correct unicode strings


Auto apply the patches

RCE Messageboard's Regroupment > General > Auto apply the patches
ldril
03-03-2004, 11:44 AM
Hi!

I'm new to this wonderful debugger and I have a question: if I have some patches made to a DLL is it possible to make OD automatically apply them when the DLL is first loaded?

Now I'm applying them manually with SPACE when I get in the DLL code.

Best regards,
ldril
oh me anon
03-03-2004, 02:21 PM
patches are always temporary unless you save them back

if you want to save your patches use copy to executable file---->all modification or some selected modification only and in the window that pops up --->save file

playing and patching system dlls must be done at your risk only if you dont know what you are doing then you are in for lot of troubles and bugs


when i look ollydbg 2.0 ?

RCE Messageboard's Regroupment > General > when i look ollydbg 2.0 ?
Mybada
03-06-2004, 10:01 AM
I waiting for ollydbg 2.0 and i look forward to ollydbg 2.0 i wonder that when i look ollydbg 2.0
oh me anon
03-06-2004, 12:28 PM
have you exhausted all the possibilities available in ollydbg 1.10b
the latest version released some ten twelve days back including its ability to laod dlls and analyse them

i dont believe you have

so let oleh take his own time and release it when he deems fit
Mybada
03-06-2004, 12:41 PM
1years ago oleh send to TBD ollydbg2.0 pre alpha version
he say that he will open to the ollydbg 2.0 in mars 2004
TBD
03-08-2004, 04:19 AM
Mybada: some clarifications:
* Oleh didn't send me OD2.0, he showed me, in person ;)
* there are no deadlines in freeware world ! when it is ready, you will have it ! till then these requests are ignored.

I dont want to sound harsh, but we cannot force Oleh to spend all his free time working on OD because we want a new version (i think with 1.10 you can spent a lot of time).

... and, as far as I know, no donations where made ! (except a small lunch when we meet 2nd time ;)
psyCK0
03-08-2004, 06:10 PM
/me wonders why Oleh doesn't put a Paypal button on his site...
jayte
03-09-2004, 05:37 AM
That is a really good idea, 'cuz I'd imagine there have been at least a few, surely, who would take advantage of the convenience (I'm sure there's been more than one well intentioned individual who... "just didn't get around to it"... "yet").
peak
03-21-2004, 12:02 PM
expectting.....
vrowang123
12-19-2004, 02:17 AM
http://home.t-online.de/home/Ollydbg/whatsnew.htm
1bitshort
12-19-2004, 03:00 AM
Ollydbg v1 is already the best usermode debugger (in nearly all aspects, although IDA is right up there also but more for its disassembling than debugging), so whats your rush for v2 other than curiosity? :)
FireRaven
03-22-2005, 07:52 AM
version 1.10 cant seem to debug fullscreen apps easily...
i am waiting for version 2 because i heard it has remote debugging yay!


Multi conditional BP ??

RCE Messageboard's Regroupment > General > Multi conditional BP ??
ollylover
03-07-2004, 11:29 AM
Hi..

I very often have used ollydbg.. (as my user name "ollylover"..)
Now, What I wanna do is Multi Conditional BreakPoint on one code line..
How can I do it??

In detail, How can I use these(MSG, Whnd..) value in conditional Breakpoint log..??

If 1.10b has not this feature, wanna have this in next new version..

:)
oh me anon
03-08-2004, 08:44 AM
will you read the fine manual or "rtfm" ;)

Condition: [ESP+4]==00001234 && [ESP+8] IN (0F0..0F7,135)
Explanation: <WinProc>
Pause program: On condition

At entry to window procedure, stack contains:

[ESP+00] Return address
[ESP+04] Window's handle
[ESP+08] Message
[ESP+0C] wParam
[ESP+10] lParam
Now it's clear that first part of condition means: "Window's handle must be 00001234" and second: "Message is one of (BM_GETCHECK...BM_SETIMAGE, WM_CTLCOLORBTN)".

Important note: Window's handle is different each time window is created, so if you set breakpoint on actual window only, this breakpoint is valid only for the life of this window.

Message groups

Group Messages in group
Any message Any message
Creation and destruction WM_CREATE, WM_DESTROY, WM_CLOSE, WM_QUERYENDSESSION, WM_QUIT,WM_ENDSESSION, WM_NCCREATE, WM_NCDESTROY, WM_INITDIALOG
Window activation WM_ACTIVATE, WM_SETFOCUS, WM_KILLFOCUS,WM_ENABLE, WM_SHOWWIND
ollylover
03-08-2004, 06:08 PM
Hi, oh me anon!!

First of all, very thanks for your helpful reply !!
Now it works vey well..

:)

Have a good day !!


0EEDFADE exception

RCE Messageboard's Regroupment > General > 0EEDFADE exception
tonyxxy
03-07-2004, 09:07 PM
I'd like to know why i get a 0EEDFADE exception when running an application in olly. When i run the application without olly i'm not getting any exception. Can anyone tell me why? Tnx in advance.
oh me anon
03-08-2004, 08:59 AM
it is not a regular window exception like 8000003 (int3) 8000004 (single stepping) c000005 (access violation) etc etc

so you need to read about anti debugging tricks, structured wxception handling etc etc to get to know about it

in short the app you are trying to open in olly does not like being opened in olly
Pompeyfan
03-08-2004, 05:34 PM
Where is a good place to read up on anti debugging tricks?
tonyxxy
03-08-2004, 06:34 PM
oh me anon---> Thanks for helping me out.
I've read some anti debugging tricks and i presume the app is using some of em. Though, it's to much information to fully understand protection schemes in a short period of time.

Pompeyfan: I've found some usefull information here
h**p://www.anticracking.sk/
h**p://www.woodmann.com/crackz/Tutorials/Protect.htm
h**p://www.woodmann.com/crackz/Miscpapers.htm#antidbug]
Pompeyfan
03-09-2004, 06:34 AM
Thanks, I'll check those links out :-)
oh me anon
03-09-2004, 01:52 PM
hey tony if you post some links try not to link it directly use hxxp instead of http so that the user would have to copy paste it to a new browser (referrer will be unknown then)

and mostly i dont think these kind of forums cant have links to some tricky subjects like reverse engineering

but tbd has to decide on that if these links are ok to be posted here
tonyxxy
03-09-2004, 02:29 PM
oh me anon: i'll keep that in mind for future posts.
Now i know :-)


Plugins...

RCE Messageboard's Regroupment > General > Plugins...
Sebbyuta
03-09-2004, 04:28 PM
Hy. First of all...I wanna say olly is GREAT .It is doing a great job. The Plugin arhitecture makes him the even better...
My sugestion for OllyScript:
make a command that saves same memory into a file on hard drive...(using address and the length of memory)
There is an alternative...but this means that plugins to work together..If OllyScript would use the OllyDump plugin to dump some memory would be great (complete automation)....of course, this means that OllyDump to have some changes....
psyCK0
03-09-2004, 07:02 PM
Ill make a command to dump a memory range to a file.
Sebbyuta
03-10-2004, 08:16 AM
You're the master !! (after Oleh..ofcourse...) :D

Thanks man.
Ricardo Narvaja
03-10-2004, 09:51 AM
Tha plugin IsDebugPresent has a dumper , in this dumper you put the initial address and size of the memory and dump.

Ricardo


To Gigapede

RCE Messageboard's Regroupment > Plugins > To Gigapede
psyCK0
03-09-2004, 07:07 PM
Hey Gigapede!

I'm getting user requests to somehow make my OllyScript plugin to cooperate with your OllyDump plugin to automatically dump files at some point... I was thinking maybe we could cooperate so that this feature is made available somehow?
Gigapede
03-10-2004, 12:22 PM
Hi.

Yes, of course I want to cooperate. But I don't know how to do it.
Just export some functions? Or register some shortcut?
Please give me some advice.

I have another cooperation idea.
I'd like to call OllyScript from CommandBar.
Command is like this;

oscr SCRIPTNAME

Nice, isn't it?
psyCK0
03-10-2004, 02:04 PM
Gigapede: great idea about putting an OllyScript command into CommandBar!!! =)

I'll try to think of some way to make the plugins listen to eachother. You think a little too, ok? Then we can post our ideas here.
psyCK0
03-12-2004, 10:07 AM
Hey again,

We can use shared memory to communicate between plugins.
Check out: http://ollyscript.apsvans.com/download/TestSharedMem.rar

The SharedMemory class (defined in SharedMemory.h) should be used in both our plugins. Then we define one or two shared memory areas and communicate using those. We can for example check the contents of this memory each time we pass the plugin loop and if there are commands in it execute them...

I was also thinking named pipes, but they are really a hell to implement in an assynchronous way.

What do you think?
sgdt
03-12-2004, 04:55 PM
Named events are easy and very eligent, and would probably do exactly what you want (syncronizing shared memory). Pipes are, well, yuchy...
psyCK0
03-12-2004, 05:00 PM
Great idea sgdt! The class will have to be revised then...
Gigapede
03-14-2004, 12:42 AM
Sorry, I don't understand these ideas very well.
I'm not a real programmer...
psyCK0
03-14-2004, 09:34 AM
I have an even easier idea... The plugins run all in the same process so we can do it like this:

1. Both of us export some function. For example lets say I export:
extc int _export cdecl DoSomeShit(int x)
{
cout << "Hello" << endl;
return 0;
}

2. To call this function you do:
HMODULE hMod = GetModuleHandle("OllyScript.dll");
if(hMod) // Check that the other plugin is present and loaded
{
// Get address of exported function
int (*pFunc)(int) = (int (*)(int)) GetProcAddress(hMod, "DoSomeShit");
if(pFunc) // Check that the other plugin exports the correct function
pFunc(10); // Execute exported function
}

Thats it! Easy, huh? I've tested it and it seems to work!
So, because you wanted to execute a script from CommandBar I will export:
extc bool _export cdecl ExecuteScript(const char* const scriptName).

What parameters do you need to dump a file in OllyDump?
You can export something like:
extc bool _export cdecl Dump(......).
Gigapede
03-15-2004, 10:24 AM
Yeah, it is easy to use and implement.
But I didn't make functions with suitable to export.
I must modify it a little.

Is it required a full dump only or also a partial dump?

I am very busy with work now.
So please wait patiently.
psyCK0
03-15-2004, 11:56 AM
I think we can start with full dump and then implement other stuff later...
psyCK0
04-11-2004, 05:46 PM
Gigapede: the new version of OllyScript exports a function that can be called from other plugins to execute a script... Thought you might want to add it to CommandBar. =)

Check readme for details on how to call the exported func.
Radier
04-25-2004, 10:45 AM
Hi psyCK0,

I have added the functionality to ollyscript to dump the PE.
but need a bit of help with the commands setup tho
currently borrowing your DM cmd

Best Wishes
R@dier
Gigapede
05-05-2004, 06:16 AM
psyCK0:: I implement command calling OllyScript in CommandBar.

http://dd.x-eye.net/file/cmdbar310109c.zip
[OSC script file name(fullpath|relative from OllyDbg installed)]

It is nice to make option to set default path of script file in OllyScript, isn't it ?
It is such a bother to have to specify full path.

anyway thanks.

Please wait the OllyDump export function.


post 3 Unpack Script! thank SHaG!

RCE Messageboard's Regroupment > OllyScript > post 3 Unpack Script! thank SHaG!
loveboom
03-11-2004, 08:41 AM
1、
Unpack Script-->ExE stealth 2.74

/*
////////////////////////////////////////////
ExE Stealth 2.74 OEP Finder v0.1

Author:loveboom
Email :bmd2chen@tom.com
OS :Win2k ADV sp2、OllyDbg1.1B.OllyScript v0.61
Date :2004-3-9
Config:Uncheck"Memory access violation" and
"IsDebuggerPresent->Hide"
Other :If you have one or more question
email me please,Thank you!
/////////////////////////////////////////////
*/
var csize
var cbase

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
run

lbl1:
esto
eob lbl2
bprm cbase,csize
esto

lbl2:
bpmc
cmt eip,"OEP!Please dump it :>"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret

2.

UnPack Script-->FSG v1.33

/*
////////////////////////////////////////////
FSG V1.33 OEP Finder v0.1

Author:loveboom
Email :bmd2chen@tom.com
OS :Win2k ADV sp2、OllyDbg1.1B.OllyScript v0.6
Date :2004-2-27
Config:N/A
Other :If you have one or more question
email me please,Thank you!
/////////////////////////////////////////////
*/
var baddr
var aeip

gpa "GetModuleHandleA","kernel32.dll"
bphws $RESULT,"x"
run

lbl1:
eob lbl2
bphwc $RESULT
rtu

lbl2:
eob lbl3
gpa "GetProcAddress","kernel32.dll" //GetProcAddress
bphws $RESULT,"x"
run

lbl3:
eob lbl4
bphwc $RESULT
rtu

lbl4:
eob lbl5
mov baddr,eip
sub baddr,B
bphws,baddr,"x"
run

lbl5:
sto
mov aeip,eip
sub aeip,6
cmp aeip,baddr
je lbl6
bphwc baddr
cmt eip,"OEP,please dump it :>"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret

lbl6:
run
jmp lbl5

3.
UnPack Script-->Krypton v0.5

/*
////////////////////////////////////////////
Krypton v0.5 OEP Finder v0.1(Default mode)

Author:loveboom
Email :bmd2chen@tom.com
OS :Win2k ADV sp2、OllyDbg1.1B.OllyScript v0.6
Date :2004-2-27
Config:Uncheck"Memory access violation"
Other :If you have one or more question
email me please,Thank you!
/////////////////////////////////////////////
*/
var cbase
var csize
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov bsize,$RESULT
eob lbl1
eoe lbl1
run

lbl1:
eob lbl2
esto

lbl2:
eoe lbl3
bprm cbase,csize
esto

lbl3:
bpmc
cmt eip,"OEP,please dump it"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret
psyCK0
03-11-2004, 10:50 AM
Great work loveboom!
Site updated.


possible bug with Ollyplug-inn "WindowInfos b

RCE Messageboard's Regroupment > Bugs > possible bug with Ollyplug-inn "WindowInfos b
mike
03-12-2004, 04:17 PM
When the plug-in "WindowInfos by DDM/FFF" is open ,Olly doesn't react when i press any button.Is this a bug???
I am using Olly 1.09(step 4) under XP
oh me anon
03-13-2004, 03:08 AM
iirc windows info has no button to press and it operates by hooking mouse pointer position and deciphering its handles

and i dont think olly will react to any button press

it just gives the cursor position and handle to any window which is beneath that position as far as i know

its some thing like winspy++ sort of plugin but with lesser capabilities than winspy++
mike
03-13-2004, 09:06 AM
When i say pressing buttons i mean Olly buttons such as "step over".Then Olly doesn't step over, and only if you close the plug-in Olly will continue tracing.
oh me anon
03-14-2004, 06:34 AM
and i dont think olly will react to any button press

well i really dont think olly will react to any button press coz its
hooking mouse moves or mouse positon and using olly for it to do its job

but why would you want both running at same time ????
its some spy kind of utility and spies are used on critical missions
only they dont run wild in public and dont work publically ;)


BAK and UDD Files Location

RCE Messageboard's Regroupment > General > BAK and UDD Files Location
comrade
03-13-2004, 09:14 PM
Is it possible to configure Ollydbg to save these files in same directory as .exe, not in ollydbg directory?
oh me anon
03-14-2004, 06:28 AM
well it isnt impossible to do it
but you have to change the directory path everytime you open anew exe and thats damn boring

well ask psycko (shag in c4n,win32asm,coders) if his olly script can dothis repetetive task then you can run it which might possibly store the udd and bak in the directory that exe resides and all other implications like restarting the olly that arise due to change in directory


steps for beginner

RCE Messageboard's Regroupment > General > steps for beginner
husler
03-17-2004, 03:02 AM
is there anyone who can help us the begineer, can u please replies anything that can help us the beginners, anything even an idea...thanks[
oh me anon
03-17-2004, 03:19 AM
well to be frank every one must have been a beginner at some point of time no one was born an expert
so begin some where

have you palyed AI videogames you start pushing a button it reacts
and you react by pushing another button this time well most of the time the AI beats you in the start but you start learning faster becoz your intelligence is not artificial like its intelligence so you start beating it more now

think of everything as a game that you are playing and start pushing buttons you will become an expert
ever seen a two year kid playing dr mario or formula1 on a computer well its worth a watch to see how his finger hit the right button at the right time and he was born no expert its practice and
and sheer learning
TBD
03-17-2004, 04:28 AM
oh me anon: I could not say it better. thanks.

another hint: use google, search&get any tutorials that you can find and DO NOT ASK for tutorials. FIND THEM BY YOURSELF. it is more exciting :)
husler
03-18-2004, 05:08 AM
thanks for your replie Tbd, thanx,.....any more advice are ...jwelcome
husler
03-18-2004, 05:12 AM
this may sound bit silly but what does the ollydebugger do? what can u do with this debugger.. really.. thans...any advice welcome!@!!!!!!
TBD
03-18-2004, 08:42 AM
husler: RTFM ! (use google if you dont know what RTFM means)
psyCK0
03-18-2004, 09:47 AM
TBD: lock this stupid thread


Run trace log bugs

RCE Messageboard's Regroupment > Bugs > Run trace log bugs
1bitshort
03-17-2004, 08:59 AM
I have a small "Hello World" exe that's packed with FSG. Here's the start of the code from the entrypoint as disassembled by OllyDbg (the About window shows its version as being v1.10 step 2):
0040791D <> BE A4014000 mov esi,4001A4
00407922 AD lods dword ptr [esi]
00407923 93 xchg eax,ebx
00407924 AD lods dword ptr [esi]
00407925 . 97 xchg eax,edi

And here's the first few coresponding lines from the run trace:
00407922 Main lods dword ptr [esi]
00407925 Main xchg eax,edi
00407926 Main lods dword ptr [esi]
00407927 Main push esi
00407928 Main xchg eax,esi

As you can see, the addresses in the run trace don't correctly correspond to the ones from the disassembly, and consequently the disassembly in the run trace is also incorrect.

Followup - I just tried with OllyDbg v1.09c (step 3) (its good to keep backups of all versions of quality software!), and 1.09c's run trace was correct, so it appears to be a new bug introduced into the latest (or later) versions, as the bug doesn't exist in 1.09c.

No real problem though, I don't mind switching between v1.10 and v1.09c so don't lose sleep over this one Oleh, but please add it to the bug list, as Run Trace is an excellent feature but one that can only be used if it reports the correct results :)


How to disassemble Startup code of Binary

RCE Messageboard's Regroupment > General > How to disassemble Startup code of Binary
joeblack_2k2
03-17-2004, 11:50 AM
When disassembling a binary file, I only see the code portions starting at the main routine. Is it possible to disassemble the compiler startup and exit code as well ?


Adding own function parameters?

RCE Messageboard's Regroupment > General > Adding own function parameters?
psyCK0
03-17-2004, 01:58 PM
Hey,

Anybody knows if there is a way to make olly recognize function parameters? Windows API params are recognized and labeled with their names, can I add this for other functions too?

For example:
100011D0 |. 6A 04 PUSH 4 ; /maxlen = 4
100011D2 |. 8D4C24 60 LEA ECX,DWORD PTR SS:[ESP+60] ; |
100011D6 |. 50 PUSH EAX ; |src
100011D7 |. 51 PUSH ECX ; |dest
100011D8 |. E8 93010000 CALL <xxx._strncpy> ; \_strncpy

Those params are recognized and labeled.
oh me anon
03-17-2004, 02:16 PM
1)
have you tried assume arguments (stdfunction int1,int3......int n) to the call and reanalysing (rightclick and look down in cpu menu it must be in some context of analysis or arguments)

well there is some .arg file thingy but i gotta refresh my usage
as to it (tried playing with it using the olly help file (see it uses some methods to describe how it names all the calls there is an example to iirc with the help of CreateFont search ollyhelp file
probably youll find it if i remember correctly
sgdt
03-17-2004, 04:19 PM
Wow!

The topic heading is "Custom function descriptions", I had absolutely no idea OllyDebug could do this. Way cool feature!!!

Good things come to those who read, I guess.

I could have used this functionality so many times, and if I'd bothered to read the help file, I'd have been that much further ahead.

I wonder if there are any other cool features I've missed out on simply because of 'documentation phobia'???

EDIT: Playing with this is FUN FUN FUN!!!!
psyCK0
03-17-2004, 09:04 PM
OllyDbg's possibilities are limitless. =)))
Thx oh me anon!

Btw sgdt, have you played with this new load dll feature? Used it today and it saved me hours of boring work.
oh me anon
03-18-2004, 12:03 PM
np
yes ollydbgs possibilities are almost limitless only thing you gotta keep right clicking everywhere ;)

have you tried goto--->find all switch cases
search for all intramodularcalls and view call tree (not control+k) but in context on goto


eax not copied to clipboard correctly

RCE Messageboard's Regroupment > General > eax not copied to clipboard correctly
britedream
03-18-2004, 05:37 AM
ST7 empty 96.000000000000000000
ECX 0012FFA8
EDX 0012FFB4
EBX 7FFDF000
ESP 0012FF9C
EBP 0012FFA8
ESI 0000007D
EDI 0000000D
EIP 004190F6 004190F6
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 1 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDE000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_FILE_NOT_FOUND (00000002)
EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty 6.5141362678532930380e-729
ST1 empty 4.4168995399759555060e-4169
ST2 empty 5.9116286138511298010e-4932
ST3 empty 0.0000000137640829490e-4933
ST4 empty 4.9204029533478579320e-4738
ST5 empty 1.7550629249623336870e+4405
ST6 empty 6.2842860683752586980e-4932
ST7 empty 96.000000000000000000
3 2 1 0 E S P U O Z D I
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0

I wonder why eax copyied as st7 by copy all registers to clipboard, if Debug registers are in view it isn't copied at all,any light on this is appreciated.

britedream
psyCK0
03-18-2004, 08:41 AM
Looks like a bug.... Doesn't work for me either.


Setting breakpoint on WM_COMMAND

RCE Messageboard's Regroupment > General > Setting breakpoint on WM_COMMAND
dandy
03-19-2004, 01:42 AM
Is it possible to set a breakpoint on WM_COMMAND (and simliar messages)? thanx and sorry if this is a dumb question but i'm still a newb.
Ricardo Narvaja
03-20-2004, 09:32 AM
yes is possible go to VIEW WINDOWS and right click in the windows you want and MESSAGE BREAKPOINT ... and chose the type of message you want.

In a common conditional BPX you can put in TranslateMessage or pther apis that work with messages, you can put a condition

MSG==WM_COMMAND

or a message you want

MSG==WM_BUTTONDOWN

etc

Ricardo


Numbers associated with segments ?

RCE Messageboard's Regroupment > General > Numbers associated with segments ?
Neitsa
03-19-2004, 11:19 AM
Hello,

Can someone told me what are those number associated with segments (Registrers window, at the right of the flags). I know what are the segments (Extra , code, stack, Data...) and the size that is specified also (just after "32 bits"). But I don't know what is the Word specified with them.

Generally, when I debug a program ES=0023, CS=001B, SS=0023 ...

Can you explain it precisly please ?

Thank you very much.


It seems that only softice can solve this problem,

RCE Messageboard's Regroupment > General > It seems that only softice can solve this problem,
peak
03-20-2004, 12:59 PM
I am debugging a overflow code ,i find when i come to the return address (retaddr)that has been overlaied with the wrong address, ollydbg always says
"Don't know how to step because memory at address 61616161 is not readable.Try to change EIP or pass exception to program"
I know this exception can be catched by the command "faults on" with softice.But how can i catch it with ollydbg?
example :
vc6 /release
files.txt----------aaaaaaaaaaaaaaaaaaaa
when the number of the characters >=20,overflow.....
#include <stdio.h>
int main()
{
char buffer[16]="";
FILE *fd=NULL;
fd = fopen("files.txt","rb");
if(fd == NULL)
return printf("can't open files.txt\n");
fgets(buffer,1000,fd);
return 0;
}
peak
03-20-2004, 11:43 PM
Now I give out the disassembler of the code :

:0040112B 55 push ebp
:0040112C 8BEC mov ebp, esp
:0040112E 6AFF push FFFFFFFF
:00401130 68B0604000 push 004060B0
:00401135 6840284000 push 00402840
:0040113A 64A100000000 mov eax, dword ptr fs:[00000000]
:00401140 50 push eax
:00401141 64892500000000 mov dword ptr fs:[00000000], esp:00401148 83EC10 sub esp, 00000010
:0040114B 53 push ebx
:0040114C 56 push esi
:0040114D 57 push edi
:0040114E 8965E8 mov dword ptr [ebp-18], esp
|
|
|
|
:004011DA E821FEFFFF call 00401000
:004011DF 83C40C add esp, 0000000C
:004011E2 8945E4 mov dword ptr [ebp-1C], eax
:004011E5 50 push eax

F7->00401000

:00401000 83EC10 sub esp, 00000010
:00401003 A0F0784000 mov al, byte ptr [004078F0]
:00401008 33C9 xor ecx, ecx
:0040100A 894C2401 mov dword ptr [esp+01], ecx
:0040100E 6858704000 push 00407058
:00401013 894C2409 mov dword ptr [esp+09], ecx
:00401017 684C704000 push 0040704C
:0040101C 894C2411 mov dword ptr [esp+11], ecx
:00401020 88442408 mov byte ptr [esp+08], al
:00401024 66894C2415 mov word ptr [esp+15], cx
:00401029 884C2417 mov byte ptr [esp+17], cl
:0040102D E8E6000000 call 00401118
:00401032 83C408 add esp, 00000008
:00401035 85C0 test eax, eax
:00401037 7511 jne 0040104A
:00401039 6830704000 push 00407030
:0040103E E884000000 call 004010C7
:00401043 83C404 add esp, 00000004
:00401046 83C410 add esp, 00000010
:00401049 C3 ret
:0040104A 50 push eax
:0040104B 8D542404 lea edx, dword ptr [esp+04]
:0040104F 68E8030000 push 000003E8
:00401054 52 push edx
:00401055 E816000000 call 00401070---------------->fgets
:0040105A 83C40C add esp, 0000000C
:0040105D 33C0 xor eax, eax
:0040105F 83C410 add esp, 00000010
:00401062 C3 ret------------------------------>be careful ,return the address(retaddr)that has been overlaied(wrong)
peak
03-21-2004, 12:00 PM
I have got it.
olly can catch it too.
:-)
oh me anon
03-22-2004, 12:53 PM
wont sharing your thought process be better for someone reading this thread rather than seeing you blinking your eye
when you ask a question and expect it to be answered then i think it is also normal to answer your own question when you have found out on your own how you found it out

my opinion
peak
03-23-2004, 12:00 AM
:) I just wonder why nobody answers my question. Are my expressions too poor to be understand?
Thank you for your advice.

Here is my way:
open the program;
then before run it ,make a breakpoint at KiUserExceptionDispatcher
"bpx KiUserExceptionDispatcher";
run;
stop at 00401062 C3 ret
shift + F9 ----->enter the context of KiUserExceptionDispatcher.....
oh me anon
03-23-2004, 02:22 AM
well then that means you are talking about nt based systems only and not 9x based system coz in 9x based systems you cant step through or break in system dlls

2)why dont you view seh chain (available in latest version to see the exception handler and break on it)

3)before pressing shift +f9 or f8 why dont you go to debugging options--->exceptions--->add last exception

4) u can also search for zwContinue in ntdll.dll and keep a permanent break there so it breaks on any exception or fault

5)try searching for a call near ecx in ntdll.dll there must be two or three of them and one of that calls belongs to KiUserException Blah
you analyze ntdll and put a break there and it remains for ever as long as you dont delete the ntdll.udd file
peak
03-25-2004, 02:58 AM
thanks


subclassed wndproc

RCE Messageboard's Regroupment > Bugs > subclassed wndproc
shane
03-21-2004, 04:19 AM
Im not sure if this is a bug, or im just doing something wrong, or it is actually desired behaviour- anyway:

Setting a BPX on the wndproc of a window using the window list will only break on the original wnd proc.

ie. if a windows wndproc was changed via setwindowlong etc, the new procedure will not be considered the windows wndproc.

Is this a bug? Or does anyone know a good way of setting breakpoints on the new procedure?
oh me anon
03-22-2004, 12:49 PM
i think i you can break on subclassed class proc too
right click and study all options if it is subclassed then there must be an option in the context to break on it
focht
03-22-2004, 05:46 PM
Greets,

the problem with WinProc column in windows list missing after breaking on ::SetWindowLog( .... GWL_WNDPROC ... ) import is in fact some sort of bug.
You can work around it by closing the "windows" window and reopen it.
It should then show all subclassed window procs.
One can then simply follow the subclassed procedure by ENTER or using context menu.

You should mail the author about this "feature" ;)

Regards,

A. Focht
oh me anon
03-23-2004, 02:26 AM
yeah i think you have to press actualize before the subclassed proc is visible or close and open the windows window
most of the time actualize works and it is always good to actualize before seeing anyinfo in any windows in olly coz when you are debugging excel.exe kind of proggie for debugging a macro written in vba which runs 1000s and thousands of other shit along with it is always good to actualize before hand
shane
03-23-2004, 02:36 AM
Yeah I realise you have to actualize or 'refresh' the view somehow. However, even after doing that the WndProc seems to always point to the original.

ie. I am trying to debug a plugin in Winamp. The plugins in Winamp make extensive use of SetWindowLong(GWL_WNDPROC) to modify the wndproc for the windows.

However, no matter how much I try to actualize the window list, the wndproc always points to the original in the winamp.exe module even though its been subclassed multiple times by different plugins.

Its quite easy to find the new wndproc's, but I was just wondering if this is a bug or intended behaviour. It seems ollydbg is obtaining the wndproc address by methods other than spying on the real time wndproc of the windows. I've tried the 'allow code insertion to find wndproc' setting, but it doesn't seem to make a difference.

Or it could be, that winamp is just using some trick to make sure it is always at the top of the list. - or Im just missing something completely.

UPDATE: Just did a quick test. Run winamp in ollydbg and also run spy++. You'll notice that the reported wndproc's are different for windows that are subclassed. (note that this may actually be desired behaviour, but I think it would be good to be able to follow the new wndproc as well)

Eevn better would be for ollydbg to keep a list of all the wndprocs that have entered the chain for a window. This could be done with some clever logging of setwindowlong though I suppose.


ExECryptor 1.53 UnPacking Script!

RCE Messageboard's Regroupment > OllyScript > ExECryptor 1.53 UnPacking Script!
loveboom
03-21-2004, 07:54 AM
Unpacking Script-->ExECryptor1.53

/*
//////////////////////////////////////////////////
EXECryptor1.53 OEP Finder v0.1 for 2k/xp
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-14
Config: Check All Exception!
Note :Especially Tank tDasm.If you have one or more question
email me please,thank you!
//////////////////////////////////////////////////
*/
var addr

run
mov [eip],#CC039090#
bphws 0012FF84,"r"
gpa "VirtualProtect","kernel32.dll"
mov addr,$RESULT
add addr,1
bphws addr,"x"
esto
eob lbl1
rtu

lbl1:
bphwc addr
mov addr,eip
add addr,7A
bphws addr,"x"
eob lbl2
run

lbl2:
bphwc addr
sti
sti
sti
sti
sti
mov addr,edx
log edx
log addr
bphws addr,"x"
eob lbl3
run

lbl3:
bphwc addr
bphwc 0012FF84
cmt eip,"OEP Found!please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my Script!"
ret
Anonymous
03-21-2004, 03:43 PM
Please create script for ExECryptor1.51
Anonymous
03-21-2004, 03:52 PM
I seen error

Error on line 1
Text: ....var addr
No such command : ....var addr
psyCK0
03-21-2004, 04:10 PM
Great script loveboom. Script added to site.
Anonymous
03-21-2004, 09:24 PM
Thank you loveboom Script work very good!
loveboom
03-22-2004, 07:39 AM
Please create script for ExECryptor1.51
Please send me a packed thank you!
my email:loveboomNew@hotmail.com or bmd2chen@tom.com(CN)

I seen error

Error on line 1
Text: ....var addr
No such command : ....var addr

"OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62"


Basic theory behind creating an unpack/OEP finder

RCE Messageboard's Regroupment > OllyScript > Basic theory behind creating an unpack/OEP finder
1bitshort
03-21-2004, 12:15 PM
Recently we've seen a lot of excellent unpack/OEP-finder scripts for the OllyScript plugin, and it looks like several of you already have a good grasp on the assembly-like OllyScript language.

I was hoping somebody could create an OEP-finder script for Lamecrypt (because it's the simplest of cryptors/packers), and make a mini tutorial describing how they went about it all. Such a tutorial would be a great starting point for many of us who are interested in writing our own OEP-finding scripts with OllyScript but not too sure where to start
wut55
05-12-2004, 01:31 PM
i also think so,so if anyone have tut on this,please send me one
to wut55@tom.com
psyCK0
05-13-2004, 09:42 AM
Well, there is really not much to it...
1. Find packed app
2. Unpack manually noting what steps you took in OllyDbg
3. Write down those steps
4. Translate steps to script


Newbie needs help

RCE Messageboard's Regroupment > Plugins > Newbie needs help
MrDebug
03-22-2004, 10:17 AM
All

I have installed CommandBar and set hardware bp but nothing happens!

I cannot use normal bp as the program somehow knows they are their and crashes

How do I use Hardware bp that I have set?

MrDebug
oh me anon
03-22-2004, 12:46 PM
well commandbar is a plugin so that means the original can run without it too and perform its functions plugins are like extensions to already existing functionalities
anyway on the subject
right click on the line you need to set hardware bpt you will see
many option set hardware breakpoint on execution if you are sure the line will be executed

if you want to see what hardware bpts have been set then use menu--->debug--->hardware bpt
you can set upto a max of 4 hard ware bpt at any given time


DBPE v2.x Unpacking Script!

RCE Messageboard's Regroupment > OllyScript > DBPE v2.x Unpacking Script!
loveboom
03-23-2004, 07:26 AM
Bad luck, cann't visite http://ollyscript.apsvans.com/
error message:time out.
so,post here.:(
/*
//////////////////////////////////////////////////
DBPE V2.X Unpack script v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-21
Config: Ignore all exceptions
Note : If imports table like this "JMP DWORD PTR DS:[804EXXXX] or Call DWORD PTR DS:[804EXXXX]" then use winhex edit
target's memory,strat addr:IAT start address,find hex"4E80" Replace "4E00".
f you have one or more question, email me please,thank you!
Warning:If you want unpacking manual,you'd better use Winxp+IDT tool debug target
If your system is Win2k,Be careful in(SYSTEM CRASH,hoho!)
//////////////////////////////////////////////////
*/

var csize
var cbase
var count
mov count,3
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

lbl1:
eob lbl2
gpa "CloseHandle","kernel32.dll"
bphws $RESULT,"x"
run

lbl2:
sub count,1
cmp count,0
je lbl3
run
jmp lbl2

lbl3:
bphwc $RESULT
eob lbl4
bprm cbase,csize
run

lbl4:
bpmc
eob lbl5
findop eip,#FFE0#
bprm $RESULT,A
msg "Now Ctrl+B Find 89BD(like this '75 89 jnz addr <89BDxxxxxxxx>'),at the third time replace'nop(909090909090)' and then find 890F replace 8907,last time,resume script!"
pause
run

lbl5:
bpmc
sto
cmt eip,"OEP Found,please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret
psyCK0
03-23-2004, 08:23 AM
Added to site, thanks loveboom.

Yeah, the site goes down from time to time. Thats coz my hosting provider sucks... =(
Anonymous
05-16-2004, 03:49 AM
I can't use this script to uppack the DBPE V2.X,Because when I find 89BD everytime,it look's like this:
7FF936E7 ^75 E9 JNZ SHORT 7FF936D2
7FF936E9 BD 0100007A MOV EBP,7A000001
"89BD" is in sunder, how can i do ?
loveboom
05-17-2004, 06:52 AM
If you are from china or you can speak chinese,you can download my unpacking demo for dbpe 2.x.
download address:
http://www.chinadfcg.com/viewthread.php?tid=873


File offset from rebased module

RCE Messageboard's Regroupment > General > File offset from rebased module
shane
03-24-2004, 06:41 AM
Is there an easy way to find the file offset of an address when debugging?

This is particularly useful when disassembling with IDA, and you want to find the corresponding locaiton in ollydbg and vice-versa, particularly with DLLs which get relocated.

Is it possible? if not, could it be added? maybe with a plugin?

Thanks.


Exception Handling

RCE Messageboard's Regroupment > Bugs > Exception Handling
Snej
03-24-2004, 07:07 AM
Try this
http://www.jorgon.freeserve.co.uk/ExceptFrame.htm
and load Except1.exe into Ollydbg 1.09d
Ollydgb behaves strange if I set a breakpoint in the SE Handler (Structured Exception Handler) routine and single step the procedure
if I choose Run instead, all is going fine

anything known about it?

CU Snej
oh me anon
03-24-2004, 02:07 PM
what do you mean by different behaviour do you mean the other message box that says ive cleaned blah blah does not appear if you single step it or what is the differnt behaviour

coz if you are complaing about the other msg box not appearing then it doesnt appear coz olly handles that cleaning
so you will see it returns to olly stating cant process eception
before terminating itself

but other wise there must be no different behaviour and the tut accompaniying is one of the best douments available on seh
Snej
03-24-2004, 03:40 PM
Then lets me describe it in more detail
after loading i set a breakpoint at 40307f

1.) press f9 , press shift f7 , press f9 , clicking yes , press f9 , clicking ok -> program terminated
2.) press f9 , press shift f7 , keep pressing f7 , clicking yes , keep pressing f7 , clicking yes , keep pressing f7 , clicking yes , ....
without an end

Thats my different behavior
thx for interest

CU Snej


to Gigapede about cmdbar

RCE Messageboard's Regroupment > Plugins > to Gigapede about cmdbar
loveboom
03-24-2004, 08:27 AM
Cmdbar v3.00.108
Is that a bug??

enter mr 4010cc
return "Integer expression expected"

like this:
mr 4010cc,eax==1 //pass
md //pass
mr 4010cc //pass
mr GetWindowTextA //pass

TEST:win2kadv sp2+ollydbg1.1b


How can i use symbolic debugging information maken

RCE Messageboard's Regroupment > General > How can i use symbolic debugging information maken
peak
03-25-2004, 04:27 AM
i know that ollydbg can use debugging information maken by masm32.
the command is:
\masm32\bin\ml /c /coff /Zi test.asm
\masm32\bin\Link /DEBUG /DEBUGTYPE:CV /SUBSYSTEM:WINDOWS test.obj
but how i can use the debugging information maken by VC,
i open the .exe file in the debug directory ,which was maken by the GUI .But i can't see the source file and Ctrl+F5 doesn't work at all.
i wander whether it must be compiled and linked under the command line ,
such as:
cl test.c /link /DEBUG
can anybody help me?
oh me anon
03-26-2004, 09:52 AM
Understands debugging information in Borland® format
/DEBUG /DEBUGTYPE:CV /SUBSYSTEM:
the cv there stands for codeview
and the files it looks for if there is debug info is a file with extension .pdb

does your vc satisfy these condition then yes ctrl+f5 will work
recap
1)need a *.pdb in the directory of exe
2)find a command line or read the manual and see how to generate debug info in borland format (there must some blahblah switch to it)
oh me anon
03-26-2004, 01:34 PM
well a little google yielded this tell me if this is usefull info

hxxp://www.michaelmoser.org/compopts.htm (notice xx)
peak
03-26-2004, 11:27 PM
by vc7
the command line:
cl test.c
link /DEBUG /DEBUGTYPE:CV SUBSYSTEM:CONSOLE (/INCREMENTAL:NO) test.obj
or
link /DEBUG /DEBUGTYPE:CV SUBSYSTEM:WINDOWS (/INCREMENTAL:NO) test.obj
od open ->test.exe->Ctrl +F5 doesn't work
od debug->select path for symbols ->point to the directory (include the.exe .pdb.obj files)->Ctrl +F5 doesn't work yet


ExEcryptor 1.5x Unpacking script

RCE Messageboard's Regroupment > OllyScript > ExEcryptor 1.5x Unpacking script
loveboom
03-25-2004, 07:19 AM
This script can unpack Execryptor 1.51 and ExeCryptor 1.53(must be win2k/xp)
to psyCK0:
help me delete this page "ExECryptor 1.53 UnPacking Script!"
/*
//////////////////////////////////////////////////
EXECryptor1.5x OEP Finder v0.1 for 2k/xp
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-14
Config: Check All Exception!
Note :Especially Tank tDasm.If you have one or more question
email me please,thank you!
//////////////////////////////////////////////////
*/
var addr
var haddr

run
mov [eip],#CC039090#
mov haddr,esp
add haddr,14
log haddr
bphws haddr,"r"
gpa "VirtualProtect","kernel32.dll"
mov addr,$RESULT
add addr,1
bphws addr,"x"
esto
eob lbl1
rtu

lbl1:
bphwc addr
mov addr,eip
add addr,7A
bphws addr,"x"
eob lbl2
run

lbl2:
bphwc addr
sti
sti
sti
sti
sti
mov addr,edx
bphws addr,"x"
eob lbl3
run

lbl3:
bphwc addr
bphwc haddr
cmt eip,"OEP Found!please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my Script!"
ret
psyCK0
03-25-2004, 12:26 PM
CAnt help youi there... Im not forum admin =) OllyScript page updated with your script.


I am....

RCE Messageboard's Regroupment > The Heap > I am....
psyCK0
03-25-2004, 12:29 PM
... now the most active registered user on this forum.
Congratulate me! ;)

I really should get a life. :D
littlecode
02-18-2005, 04:34 PM
Congratulation buddy ~

But you really should get not just a life, it was a file too ~

Littlecode
kevatt
06-12-2005, 06:36 PM
seeing you are the most active member perhaps you could explain how to start a thread or better still tell me how to remove a peice of sh-t programme called execryptor it is haning my machine all the time and i cannot find one refrence of this carappy software anywhere on my machine

just got my machine running great and now it looks like i am up for another so--ing format why do people have to aurther this hijaking software
help regards kev
arjuns
06-13-2005, 04:35 PM
Congrulation psyCK0
I am also having the same problem about createing new thread, and we all would be very grateful if you could help us ...
....arjuns
1bitshort
06-14-2005, 10:22 AM
Ricardo Narvaja has taken your title ;)
Ricardo Narvaja
06-15-2005, 12:59 AM
No it´s psyCK0 title, not mine.

Congratulations
Ricardo Narvaja
1bitshort
06-16-2005, 04:25 AM
http://ollydbg.win32asmcommunity.net/index.php?action=stats&top=0&days =60&lst=1
(http://ollydbg.win32asmcommunity.net/index.php?action=stats&top=0&days=60&lst=1
)

Ricardo Narvaja - 352
psyCK0 - 319
arjuns
06-26-2005, 05:41 PM
Hello TBD!!!!!!!! please help me to create new Threads,I've got very standard problem to ask for,so that everybody in this fourm could get bit relief in reverse engineering.
I'd be very proud if anybody could help me. write me mail at

reverser41@gmail.com
joe
06-26-2005, 06:48 PM
to: arjuns
This tell Ricardo Narvaja in thread:
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=1337
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=1337
)
He says: enter in a sub forum and press the button NEW TOPIC
(this button is at upper rigt corner)
arjuns
06-27-2005, 04:30 PM
Thanks joe but I've not found "sub forum"
oh me anon
06-27-2005, 04:48 PM
hey arjuns are you joking ??
one post members can pretty well find how to post a new topic :(
any way on the pretty slim doubt that you are really facing a problem

open your browser of choice
type ollydbg.win32asmcommunity.net
hit enter
this forum should open
now on the top you will see two edit boxes
one for your name othere for your password fill them and hit enter forums
this forum should log you in
once you are logged
hit the subforum of your choice viz general plugin blah blah blaha whatever
if you scroll down you should notice
the new topic edit box

. 1 . 2 . 3 . 4 . 5 . 6 . 7 . 8 . 9 . 10 ... 25 . 26 . >>
New topic fill your new topics title
Message
big box here for your new topics message

Bold Style Italic Style Underlined Style Image Link Insert URL Email Link Disable *What`s that?

a button here to submit it
Before posting non-english message, check your browser`s encoding!
Logged as: oh me anon » Logout
arjuns
06-29-2005, 03:35 PM
Thank u very very much oh me anon for your answer ....


Kernel32.DebugActiveProcess For Anti Debugger.

RCE Messageboard's Regroupment > General > Kernel32.DebugActiveProcess For Anti Debugger.
Teerayoot
03-26-2004, 09:42 AM
I create a small loader to patch program in memory.
And my loader protect with protection program use for commercial.

And ploblem is that : If someone use debugger to attact my programe ,he can dump with full patched by my loader.

I want to protect my program with DebugActiveProcess ,yes i have to edit loader.exe(with Ollydbg) it'self .After i use DebugActiveProcess the program go in SUSPEND mode how to make program go in running again.

Or have another protect solotion to protect my prog ,PLESE suggest.
Note: I know i'm very STUPID ;)


tracing API's

RCE Messageboard's Regroupment > General > tracing API's
shadows
03-27-2004, 05:06 AM
Hi all.
I hope I dont rehash here whats allready been discussed 5 billion times.
Im trying to break on certain messagebox but there are like soooooooo
many modules. Any tips on how to locate the right messagebox ?
I use Olly. I've tried a few methods...maybe Im on the right track.
There's an option in the memory pane to view all names in a specific module-- or all modules....can also inspect resource data.
In many case the messagebox info I found in a module name
listing is really a data define...so I would highlight that and check for all
code references to it and break on them. But it's funny cuz they arent
breaking at all and I'm clueless as to why not.
I've hear nice stories of SoftICE and how one can just set BP on any API
and when it hits SICE will dump you right there in the code.....must
be nice, I've never experianced such bliss.
Well
regards and thanks for any advice
_________________
Ricardo Narvaja
03-27-2004, 07:12 PM
If you have nt/2000 or XP you can put bpx on api similar to softice, you can trace the apis, and work more confortable than softice.

Ricardo


Two Scripts(Acprotect 1.22 and morphine 1.2)

RCE Messageboard's Regroupment > OllyScript > Two Scripts(Acprotect 1.22 and morphine 1.2)
loveboom
03-27-2004, 09:39 AM
ACProtect 1.22 oep finder,can help found the target's oep
and fix oep code.
//////////////////////////////////////////////////
UltraProtect 1.x/ACprotect 1.22 OEP Finder(For VB only!)
( for 'oep obfuscation and anti loader' mode)
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-26
Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks".
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var addr
var paddr //push address
var Aaddr // asm Address
var cbase
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
eob lbl1
run

lbl1:
findop eip,#C3#
eob lbl2
bp $RESULT
esto

lbl2:
bc $RESULT
sto
mov addr,esp
eob lbl3
bphws addr,"r"
run

lbl3:
bphwc addr
eob lbl4
bprm cbase,FF
run

lbl4:
bpmc
mov addr,esp
add addr,4
mov paddr,[addr]
mov Aaddr,eip
add Aaddr,7
mov [Aaddr],paddr
sub Aaddr,1
mov [Aaddr],#68#
mov addr,Aaddr
cmt addr,"OEP is Found"
add addr,5
cmt addr,"Here patch code 'call EIP',and then you can dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret

////////////////////////////Morphine 1.2////////////////////////

/*
//////////////////////////////////////////////////
morphine 1.2 OEP Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-26
Config: N/A
Note :If you have one or more question
email me please,thank you!
//////////////////////////////////////////////////
*/
gpa "LoadLibraryA","kernel32.dll"
bp $RESULT
run

lbl1:
bc $RESULT
rtu
eob lbl2
findop eip,#FFD7#
bphws $RESULT,"x"
run

lbl2:
bphwc $RESULT
sti
cmt eip,"OEP foun!Please dumped it!"
msg "Scrtipt by loveboom[DFCG],Thank you for using my script!"
ret

to psyCK0:
idea.
var addr
var value
xxx
xxx
cmt eip,string &&addr // here
msg string&&value //here
ShubNigurrath
03-29-2004, 10:49 AM
I know that's newbie question,
but once executed the script what I exactly have to do?

If the question is long could you point to some tut for these things??


ASPROTEC - OEP?

RCE Messageboard's Regroupment > General > ASPROTEC - OEP?
cps530
03-27-2004, 12:17 PM
I'm working on a program packed with ASPROTECT 1.23 RC4. Using the exceptions method by Ricardo Narvaja, I have found the following instructions, as OEP:

00509FE8 PUSH 0
PUSH 0
DEC ECX
JNZ 00509FE8

I can't find stollen bytes, and stepping over some instructions below, the program starts. Those instructions seem very strange! Or not? Do I need continue searching for OEP? Thanks
Teerayoot
03-27-2004, 01:23 PM
Where to download that progie?
Or send me via email.
Ricardo Narvaja
03-27-2004, 07:25 PM
the method put you ina first sentence executed of the original program not is the real OEP, look in the stack if you have a

RETURN TO ...... XXXXXX

if XXXXX is in the first section too you are in a CALL, mark this line in the stack and right click FOLLOW IN DISSASSEMBLER and go out of the call, posibly to the oep zone

Ricardo
cps530
03-27-2004, 07:53 PM
Yes, I have, but a RETURN TO kernell.77E814C7. And nothing more. Any idea?
Ricardo Narvaja
03-28-2004, 12:27 AM
Well if you not have RETURNS to an code section in a stack, before

00509FE8 PUSH 0
PUSH 0
DEC ECX
JNZ 00509FE8

there are a space with zeros? (zone for stolen bytes)
And other thing the method of exceptions, you count the exceptions in the asprotect zone (not in others dll, or exe exceptions)
Ricardo
cps530
03-28-2004, 11:53 AM
Yes, there is a space with zeros. So I think I have stolen bytes. The problem is the stolen bytes are trashed (I believ so). Is there any tutorial describing or commenting how to handle that? thanks
Ricardo Narvaja
03-28-2004, 05:53 PM
well there are many tutorials in my FTP but are all in spanish i think is better you go to rce forum and look for a tute in english, there are some tuts of asprotect with stolen bytes.
there are many methods for you obtain the stolen bytes, tracing the code before the oep, or comparing the stack of a program when start, against the stack of the program when stop in the oep.
If you wrote the values of the registers when the program start before unpacking and compare with the registers in the real OEP (not fake oep) are equals, for this reaso the diference in the fake oep, are made for rthe lines executed.

An example

if you in the star of the program have EBP=12ff00

and the stacks of the program when start is

0012FFC4 77E614C7 RETURN to kernel32.77E614C7
0012FFC8 77F417E6 RETURN to ntdll.77F417E6 from ntdll.77F68C4E
0012FFCC 77F41778 RETURN to ntdll.77F41778 from ntdll.77F417B5
0012FFD0 7FFDF000
0012FFD4 F9FB0CF0
0012FFD8 0012FFC8
0012FFDC 8053C88F
0012FFE0 FFFFFFFF End of SEH chain
0012FFE4 77E74809 SE handler
0012FFE8 77E71210 kernel32.77E71210

and the stack of the program in the fake oep is

0012ffc0 12ff00
0012FFC4 77E614C7 RETURN to kernel32.77E614C7
0012FFC8 77F417E6 RETURN to ntdll.77F417E6 from ntdll.77F68C4E
0012FFCC 77F41778 RETURN to ntdll.77F41778 from ntdll.77F417B5
0012FFD0 7FFDF000
0012FFD4 F9FB0CF0
0012FFD8 0012FFC8
0012FFDC 8053C88F
0012FFE0 FFFFFFFF End of SEH chain
0012FFE4 77E74809 SE handler
0012FFE8 77E71210 kernel32.77E71210

is obvious the first line executes was PUSH EBP the diference of the stacks is this value.

Generally you found 5 or 6 values, and if you analize the stack compare, you can found the lines executed easily

Ricardo

Ricardo
cps530
03-28-2004, 08:49 PM
Thanks for your tipos. I speak spanish so, if you can, tell me your ftp address. Thanks again.
Ricardo Narvaja
03-29-2004, 05:45 AM
Bueno mi FTP es

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

y como yo no se hablar ingles no se si se entendio algo de lo que explique antes pero la base es que en el OEP correcto y en el inicio del programa antes de arrancarlo los registros y el stack deben ser iguales, asi que cuando paras en el punto donde te deja el metodos de las excepciones, analizando las diferencias sacas las lineas que fueron ejecutadas.

Ricardo
cps530
03-29-2004, 01:35 PM
Gracias, una vez más. Yo compreendo totalmente lo que dices. Voy a chequear tu ftp. (ftp://ftp.)
j_petrucci
04-05-2004, 09:47 PM
Hi Ricardo!

Do you also have some lesson or tutorial in english? it would be nice to translate some of your work... :)
Ricardo Narvaja
04-06-2004, 06:25 AM
i have today 205 tutorials , but only 5 or 6 in english, (POINTH, ARMADILLO WITH COPYMEM2, WITHOUT COPYMEM2), nothing more.

Write tutorial is a hard work, investigate protections take a big time, and i don't speak english well for translate and have not time.

If you have time for translate do it, i put the english versions in my FTP.
(ftp://FTP.
)

Ricardo
j_petrucci
04-08-2004, 09:49 PM
Ricardo, I would be VERY happy to translate them for you, because I believe you are a pretty talented one, but unfortunately I can't speak Spanish! :(

sorry about that

take care
Ricardo Narvaja
04-08-2004, 10:38 PM
SNIF SNIF the where are bilingual crackers ? jeje

Ricardo


BPX on labels from dynamicly loaded DLLs

RCE Messageboard's Regroupment > General > BPX on labels from dynamicly loaded DLLs
merbzt
03-27-2004, 05:22 PM
How do I set a BPX on an external label? With SoftIce one can add a DLL whose exported functions/labels with EXT=path/to/dll in the softice.ini (or something). How do I do that with OllyDbg ? I tried with Alt+F1 but I guess that the label is still unknown to Olly before the program has loaded the DLL. Any hints would be welcome.
Aaerox
04-04-2004, 09:01 PM
You could try setting a breakpoint on GetProcAddress, so you can catch the program as it tries to locate the API. Or, you could set a breakpoint LoadLibrary, so immediatly after the dll is loaded, you can set a breakpoint.


tracing resource data access/locations

RCE Messageboard's Regroupment > General > tracing resource data access/locations
shadows
03-27-2004, 07:14 PM
trying to debug an exception
What I did was modify string data in a resource and then create an exception that would cause a text entry box to display my modified string -- that much worked ,but now I need to find excactly where and how the resource was loaded -- any clues?
I did a run trace and looked back....nothing noticeable,
usuallu Olly is pretty good about showing ascii data in
the debugging pane...Im sure I would have seen it.
I also did a search for references to the resource address...none found
Thanks for any tips :)
ShadowDark
05-07-2004, 07:47 PM
i should u some of programming teaches... why did u modify a string on the resources [RCDATA :S?]¿?, why don't modify it on strings references :|¿?
Bytes...

P.D: when u are in a exception u can seek that problem on the aplication pushing call stack button & looking for .exe MODULE reference...

P.D: if somebody couldn't understand me... it's normal... i'm not english xD.


BUG IN OLLYSCRIPT 0.62?

RCE Messageboard's Regroupment > OllyScript > BUG IN OLLYSCRIPT 0.62?
Ricardo Narvaja
03-28-2004, 12:34 AM
I write this script

eoe LABEL
eob BABEL
run

LABEL:
esto

BABEL:
cmp eax, 00DCE1FC
log eax
je STEP
run

STEP:
ret

and put manually a HARDWARE BPX ON WRITE on a location.
This script skip the exceptions and automatically SHIFT + F9 well, and continue, but when the program write in the poistion of the HARDWARE BPX, the first time (in the log)

Log data, item 21
Message=eax = FEEEFEEE | FEEEFEEE

EAX is not 00DCE1FC, JUMP and continue RUNNING, the second time equeal but the 3er time, stop and finish the script, EAX=FEEEFEEE in this time too and a CMP is not true.

But the ollyscript jumps and end the plugin, the plugin is write to finish when eax= 00DCE1FC not eax=FEEEFEEE

SNIF

Ricardo
Ricardo Narvaja
03-28-2004, 12:36 AM
Sorry i wrote bad this part

EAX is not 00DCE1FC,NOT JUMP and continue RUNNING, the second time equal, but the 3er time, stop and finish the script, jumping bad if EAX=FEEEFEEE and a CMP is not true.

Ricardo
Ricardo Narvaja
03-30-2004, 05:32 AM
I need this script for the solution of the new armadillo with IAT destruction, where is the autor buaaaaaaaaaa, without the script take hours go to the desired point

Ricardo
psyCK0
04-01-2004, 09:47 PM
Sorry, really missed your post =(
Check what I replied to the other guy...
Maybe you have the same error (: after jump)?
Anonymous
04-01-2004, 11:11 PM
Ricardo, Te falta un JMP.

Salu2.

SACCOPHARYNX
Anonymous
04-01-2004, 11:17 PM
PSYCKO:

The script works now. It is not a great idea to use EBP because the difference between the value of EBP and the value of SubKey in the stack is not 3B in all cases, but using ESP or EAX, it works.

Thanx a lot for your help.

SACCOPHARYNX
psyCK0
04-02-2004, 09:17 AM
My fault... I meant ESP =)


UltraProtect 1.x/ACprotect 1.22 OEP Finder(Default

RCE Messageboard's Regroupment > OllyScript > UltraProtect 1.x/ACprotect 1.22 OEP Finder(Default
loveboom
03-28-2004, 01:41 AM
Default mode
/*
//////////////////////////////////////////////////
UltraProtect 1.x/ACprotect 1.22 OEP Finder(Default mode,not for Delphi)
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-28
Config: Hide ollydbg(IsDebuggerPresent),Exceptions:uncheck "INT3 breaks".
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var bpaddr //Break Point Address

start:
run

lbl1:
findop eip,#C3#
eob lbl2
bp $RESULT
esto

lbl2:
bc $RESULT
sto
mov bpaddr,esp
eob lbl3
bphws bpaddr,"r"
run

lbl3:
bphwc bpaddr
sto
sto

end:
cmt eip,"OEP found!please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret


PESpin v0.3 Stolen Code Finder

RCE Messageboard's Regroupment > OllyScript > PESpin v0.3 Stolen Code Finder
loveboom
03-28-2004, 01:42 AM
/*
//////////////////////////////////////////////////
PESpin v0.3 Stolen Code Finder v0.1
( for 'Remove OEP' mode)
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-28
Config: Ignore other exceptions except 'Invalid or privileged instruction'
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var bpaddr //Break point address

start: //script start
run

lbl1:
esto
esto
gpa "LoadLibraryA","kernel32.dll" //GetProcAddress
mov bpaddr,$RESULT
bp bpaddr
eob lbl2
esto

lbl2:
bc bpaddr
eob lbl3
rtu

lbl3:
mov bpaddr,esp
add bpaddr,4
bphws bpaddr,"r"
eob lbl4
run

lbl4:
bphwc bpaddr

end:
cmt eip,"Stolen Code found,here start Stolen program's OEP Code.please patch OEP code and then dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my Script!"
ret
cyberbob
03-29-2004, 08:21 PM
but how to fix import table? :)
loveboom
03-30-2004, 07:19 AM
that too easy!pespin Stolen a few code before call a API
like this:
push ebp
mov ebp,esp
xxx
jmp xxxx
jmp addr(kernel32,system dll)
cyberbob
03-30-2004, 07:53 PM
new version coming soon
loveboom
03-31-2004, 07:26 AM
where can i download it ?
cyberbob
03-31-2004, 08:18 PM
I will put it on a friend websit:
www.crackmes.prv.pl (http://www.crackmes.prv.pl) in tools section
soon, just must test it.
loveboom
04-01-2004, 08:23 AM
hoho,error message:"This page cann't display",because i am from china
can you email me? thank you!
FEUERRADER
04-01-2004, 11:45 PM
loveboom
I wrote u on e-mail about script for PESpin.
Your script for PESpin 0.3 doesn't work!
Target terminates with error code 80.
I ignore other exceptions except 'Invalid or privileged instruction' but it has no effect.
What are you say?
loveboom
04-03-2004, 01:47 AM
FEUERRADER
unpack your program no problem
on my computer

test1 :win2kadv sp2+OD1.1b/OD1.1B(DIY)+OS0.62
test2:VmWare+winxp+od1.1b/od1.1b(Diy)+os0.62


tiny feature request -> beep on bpx

RCE Messageboard's Regroupment > General > tiny feature request -> beep on bpx
saffron
03-28-2004, 06:05 AM
i sometimes need to let an app run for a few hours before a bpx is hit; id like to request a simple option to enable the playing a .wav or make a beep when a bpx is hit.


RE OllyDbg Forum

RCE Messageboard's Regroupment > General > RE OllyDbg Forum
Nilrem
03-28-2004, 08:36 PM
The AR Cracking team has recently setup a RE (Reverse Engineering) forum, this is not to take members away from the forum here, but merely to prevent more 'cracking' tutorial requests.

http://forum.accessroot.com/


Dual Monitor Support?

RCE Messageboard's Regroupment > General > Dual Monitor Support?
sgdt
03-29-2004, 04:03 PM
Hello. On dual monitors, the CPU window perpetually chooses 90% of the screen for registers and 95% for call stack (leaving very little room for ASM and Dump panels). It doesn't appear to remember the preportions after exit.

It appears that when it starts up, it wants both screens (choosing the preportions based on a 2560 wide screen) and then goes to 1280x1024.

It only takes a couple seconds per session to fix, but I was hoping for something a bit more automatic...

Is there a way to fix the perportions of the screens on the CPU window, or am I doing something very wrong?

Thank you in advance.


re DDRAW methods labelling

RCE Messageboard's Regroupment > General > re DDRAW methods labelling
oh me anon
03-30-2004, 09:15 AM
i was going through some ddraw debugging
the dissembly was like this

0040145D PUSH DWORD PTR DS:[403019]
00401463 MOV EAX,DWORD PTR DS:[4030E9]
00401468 PUSH EAX
00401469 MOV EAX,DWORD PTR DS:[EAX]
0040146B CALL DWORD PTR DS:[EAX+50]

i did analyse the .objfile

the dissembly turned into this

0040145D PUSH DWORD PTR DS:[hWnd]
00401463 MOV EAX,DWORD PTR DS:[lpDD]
00401468 PUSH EAX
00401469 MOV EAX,DWORD PTR DS:[EAX]
0040146B CALL DWORD PTR DS:[EAX+50]

whereas my source is like this

push [hWnd]
mov eax,[lpDD]
push eax
mov eax,[eax]
call DWORD PTR [eax+DDSETCOOPERATIVELEVEL]

so since i was using ntsytem i did some lookup and reached here and labelled this in the ddraw.dll
BAABE157 <DDSETCOOPERATIVELEVEL> 55 PUSH EBP

thinking some how the 50 in eax+50 will get converted to eax+ddset
but nope it doesnt become so

only one time i can is if i single step through the code and it isnt feasible for full screen application ;)

0040145D . FF35 19304000 PUSH DWORD PTR DS:[hWnd]
00401463 . A1 E9304000 MOV EAX,DWORD PTR DS:[lpDD]
00401468 . 50 PUSH EAX
00401469 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0040146B . FF50 50 CALL DWORD PTR DS:[EAX+50] ; <DDRAW.DDSETCOOPERATIVELEVEL>

so any one has any ideas as to how to label the vTableEntry

so that the dissembly looks like
call [eax+DDSETCOOPERATIVELEVEL] rather than call [eax+50]

this i can put here since i had source what will i do if i do not have source with me (yeah i can find lpdd and follow it in dump but;))


tElock 0.9 - 1.0 (private) -> tE! OEP Finder v0

RCE Messageboard's Regroupment > OllyScript > tElock 0.9 - 1.0 (private) -> tE! OEP Finder v0
loveboom
03-31-2004, 07:27 AM
/*
//////////////////////////////////////////////////
tElock 0.9 - 1.0 (private) -> tE! OEP Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-3-29
Config: uncheck all the boxes on the Exceptions tab
in Debugging Options except the topmost one.Rename 'OLLYDBG.EXE'
Modify Classname 'OLLYDBG',I can email you a file patch(Only 1.1b) if you want.
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var count //Declare variant
var cbase
var csize

start:
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
mov count,f
run

lbl1:
cmp count,0
je lbl2
sub count,1
esto
jmp lbl1

lbl2:
bprm cbase,csize
esto

lblend:
bpmc
cmt eip,"OEP found!please dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret
Anonymous
07-11-2004, 04:01 PM
What do you mean by "modify classname"?

Thanks.
Anonymous
07-11-2004, 04:05 PM
And why would want to rename OLLYDCG.exe?
Anonymous
07-13-2004, 04:13 AM
"And why would want to rename OLLYDCG.exe?"
Because Program detect debug with name "OllyDBG.exe"
Anonymous
07-13-2004, 07:41 AM
for hide debugging n in particular olly


to gigapede regarding labeller plugin

RCE Messageboard's Regroupment > General > to gigapede regarding labeller plugin
oh me anon
03-31-2004, 02:43 PM
hey gigapede ,
i was trying out your labeller plugin with referance to my post with topic re Ddraw methods labelling
i edited the struct deffinition and reloaded struct definition then
i told it to make a label
and specified an address of 0x728a**** (this is the method this struct has 24 members)

but it says debuggee blah blah is out of range and crashes ollydbg itself

so i tried various address and i always see that address is out of debugge range

see your source

if(adrs < dwImageBase || adrs > dwImageBase+dwSizeOfImage) {
wsprintf(buf,"The address 0x0%X is out of Debugee range.\nReally do you want to set label at this address?",adrs);
ret = MessageBox(hwmain,buf,PNAME,MB_OKCANCEL);
if(ret == IDCANCEL) {
return FALSE;
}
}

why is this happening do you have any ideas
you can tell it faster than me coz i have to peer through your whole source and understand it completly to find the problem
so if you happen to read this please reply
thanks and regards
focht
03-31-2004, 07:17 PM
Greets,

i guess you trying to mimic vtable interface (OLE/COM style) with your struct definition.
Tthe check fails because your "virtual" functions/methods reside in system dll area (0x72......).
Gigapede simply took the PE header image base+size to validate the range.
Maybe its dangerous setting/keeping labels outside of debuggee image in sync (target dll in not loaded yet/delay load, relocated, vm block/page not accessible... whatever)

For the ollydbg crash it would be nice to get a callstack to track down the cause (probably accessing invalid memory).

Regards
oh me anon
04-01-2004, 12:23 PM
greets focht,
yep i assumed so that it may not be accepting range outside my debuggee

so i tried various address and i always see that address is out of debugge range

so i tried 401000 ,402000 and all these address pops up this debuggee out of range message that is why i wrote this post

and another problem is i tried loading this in TBD_DEBUGPLUGIN TO SEE BUT TBD DEBUG PLUGIN SAYS it is updated for 1.08 only
;) and i am using 1.10b

so its problem over problems only then i wrote this post
asking gigapede for help resolving

and thanks for reply yes i am trying to label
728a6153,***,*** as DDQUERYINTERFACE,DDRELEASE,DDSETCOOPERATIVELEVEL ETC,ETC

yes its com
oh me anon
04-02-2004, 02:42 PM
well so iloaded that tbd debug plugin in version 1.08 and tried debugging you plugin

extc void _export cdecl ODBG_Pluginaction(int origin,int action,void *item) {

here when i click labeller-->make label
i see
0048CF28 |. FFD0 CALL NEAR EAX ; Labeler._ODBG_Pluginaction

EBP-14 0> 00000000
EBP-10 0> 00000000
EBP-C 0> 00000000
EBP-8 0> 0042E7D8 Entry address
EBP-4 0> 0000E240
EBP ==> 0>/0012F6F0
EBP+4 0>|00430540 RETURN to ollydbg.00430540 from ollydbg.0048CEC4

your source
switch(origin) {
case PM_MAIN:
switch (action) {
case LBL_MAKELABEL:
if(Getstatus() == STAT_NONE) {
return;
}
MakeLabel(origin, NULL);
return;
case LBL_DELETELABEL:
if(Getstatus() == STAT_NONE) {
return;
}

in disembly
041F1410 Labeler.>PUSH EBP
041F1411 MOV EBP, ESP
041F1413 ADD ESP, -884
041F1419 PUSH EBX
041F141A PUSH ESI
041F141B PUSH EDI
041F141C MOV EDI, DWORD PTR SS:[EBP+8]
041F141F MOV EAX, EDI
041F1421 SUB EAX, 1 ; Switch (cases 0..22)
041F1424 JB SHORT Labeler.041F1444
041F1426 SUB EAX, 1E
041F1429 JE Labeler.041F14F6
041F142F DEC EAX ; Labeler._ODBG_Pluginaction
041F1430 JE Labeler.041F16E7
041F1436 SUB EAX, 2
041F1439 JE Labeler.041F1631
041F143F JMP Labeler.041F1729
041F1444 MOV EDX, DWORD PTR SS:[EBP+C] ; Case 0 of switch 041F1421
041F1447 CMP EDX, 2 ; Switch (cases 0..3F)
041F144A JG SHORT Labeler.041F145A
041F144C JE SHORT Labeler.041F14B3

and this directly goes to DialogBoxParamA
041F1F10 CALL <JMP.&USER32.DialogBoxParam>; \DialogBoxParamA

stack here
EBP-150 0>|hInst = 041F0000
EBP-14C 0>|pTemplate = 65
EBP-148 0>|hOwner = 004C00B6 ('OllyDbg - trespass.exe - [CPU...',class='OLLYDBG')
EBP-144 0>|DlgProc = Labeler.041F2274
EBP-140 0>\lParam = NULL

and in your dlg proc you confirm this
041F27F6 CMP EAX, DWORD PTR SS:[EBP-20]
041F27F9 JA SHORT Labeler.041F2806
041F27FB ADD EAX, DWORD PTR DS:[4202274]
041F2801 CMP EAX, DWORD PTR SS:[EBP-20]
041F2804 JNB SHORT Labeler.041F2844
041F2806 MOV EDX, DWORD PTR SS:[EBP-20]
041F2809 LEA ECX, DWORD PTR SS:[EBP-134]
041F280F PUSH EDX ; /<%X> = 4C00B6
041F2810 PUSH Labeler.041FF551 ; |Format = "The address 0x0%X is out of Debugee range.
Really do you want to set label at this address?"
041F2815 PUSH ECX ; |s = Labeler.041F0000
041F2816 CALL <JMP.&USER32.wsprintfA> ; \wsprintfA
041F281B ADD ESP, 0C

but the GetpeInfo isnt called before so the dwords pointed by
imagebase and imagesize always remain zero
so it says so

can you please go through your source and tell me if you are filling the imagebase and imagebase_imagesize before hand

else if iam right can you correct this plugin and upload a new version

btw (i think you should implement imagebase of any dlls too if its possible)

thanks and regards
focht
04-03-2004, 01:19 PM
Greets,

well i managed to compile the plugin using VC++ 7.1 ...
It shows lots of warnings and some errors (which went away after i used the uglyness of c-style casts).

Anyway you're right - it depends how the plugin is used.
If used with context menu (right click cpu window) it correctly initializes the stuff, even GetPEInfo() is called.
When using with main menu, GetPEInfo() isnt called and other stuff goes way wrong so it crashes ollydbg
(mainly due to unitialized memory/null pointer derefencing)

int MakeLabel(int origin, char *addr)
{
int id,i,j,k;
UINT adrs;
char lbl[255],fmt[10];
int align[] = {1,2,4,8,16};

id = DialogBoxParam(hinst,MAKEINTRESOURCE(IDD_LABELMAKE R),hwmain,(DLGPROC)M akLblDlgProc,(LPARAM)origin);
if(id != IDOK) {
return -1;
}
WriteLabelHistToIni();
//adrs = strtoul(addr,&stop,16);
sscanf(addr,"%X",&adrs); <--- crashes here because "addr" is not setup (null ptr)
....

A code cleanup would improve quality and slay some bugs (i suspect more bugs while glancing over the code).
(e.g. factoring out the "local scope" address calc in ODBG_Pluginaction() into helper functions).
Consistent use of error handling/pointer checking/asserts would pinpoint bugs more quickly.

There exist good _free_ PE.c modules which wrap alot of PE reading/data gathering stuff. No need to reinvent the wheel.

For the range itself, yes its very strict only allowing the debuggee module base + size itself not any other (system module/dll).

BOOL GetPEInfo(void)

...
DbgePath = (char*)Plugingetvalue(VAL_EXEFILENAME);

..

Regards
oh me anon
04-03-2004, 03:04 PM
hi focht,
greetings ,

thanks a lot focht for clearing up the doubts
i lack programming knowledge so i couldnt confirm anything
i glanced over the source many times but couldnt come to a conclusion as to where his pm_main,pm_cpuregs_pm_disasm (all switches) are initialized or what ever it is called
but debugging it through tbd debug plugin i saw the the GetPeInfo didnt break at all so single stepped through ODBg_PLUGINACTION
and wrote the above post

yep i saw that dbgepath thats why i asked him if he could implememt system dlls if its possible

thanks a lot once again

regards


Help file & how to setp up plug ins

RCE Messageboard's Regroupment > General > Help file & how to setp up plug ins
nsumer
04-01-2004, 06:18 AM
I need ollydbg.hlp file and knowladge about how to set up plugins.

Thanks in advance
oh me anon
04-01-2004, 12:30 PM
ollydbg hlp file accompanies the package that olly comes with
if you dowloaded the latest 1.10 beta as your first download then may be olly hasnt included it in the package coz olly help file was updated only on version 1.08
so you can try downloading 1.08 package and getting the help file shifted

to set up plugins ?? what do you mean just put the dlls in the same directory in which olly resides and its done
no setup or nothing required

if you like to put your plugins in one folder which is not default ollydbg directory then
go debug -->options -->appearance--->dialogs and directory -->browse your path to plugin and udd directory and set the path and restart ollydbg
they get into effect
;)
Renz
04-01-2004, 12:50 PM
wat he meants was how to compile the source file into dll cuz dll files for d cmdline is not included in the latest 1.10 beta version.
im lookin forward for da answer too...i'm unable to compile it too!! :) though u can get d dll files from da previous version ;|
oh me anon
04-01-2004, 01:12 PM
its a regular cpp file so it must compile with a regular c++ compiler
i dunno i never compiled those sources
any way a bcc5.5 tut may be of help to you
hxxp://www.ifrance.com/compilbcc/bcc55eng.htm notice the xx
;)


OllyScript have a big bug

RCE Messageboard's Regroupment > OllyScript > OllyScript have a big bug
Anonymous
04-01-2004, 09:57 AM
What have we here?

Many scripts where conditional jumps don't work appropiately.

I have a lot of scripts but, How many do they work correctly?
Mmmmmmmmm, few scripts.

Why? I think that OllyScript is for the time being, an experimental
language of scripts and many bugs should be repaired.

The scripts only works where the code is separated by blocks, which transfer the control to the next block when an exception or a BP happens:

start:
run

bloqck1:
gpa "LoadLibraryA","kernel32.dll" //GetProcAddress
bphws $RESULT, "x"
eob block2
run

block2:
eob block3
run

block3:
eob block4:
run

block4:
bphwc $RESULT

end:
msg "This is a shit, This is a shit, This is a shit"
ret

THIS IS A SHIT, because previously it is necessary to count the quantity of times that the program stops in that BP and then to make a block for every time.

The best thing is to make a single main block which repeats until a
condition is completed:

start:
run

bloqck1:
gpa "LoadLibraryA","kernel32.dll" //GetProcAddress
bphws $RESULT, "x"
eob block2
run

single_main_block:
mov a,eax
cmp a,44332211 (for example)

je PATCH:

continue:
log a
eob single_main_block
run
jmp single_main_block

PATCH:
mov [a], #11223344#
bphwc $RESULT
msg "This is correct but it doesn't work yet"
ret

The problem is that "je PATCH" is never executed when "cmp a,WWXXYYZZ" is true: PATCH label will be never executed.

I have loged variables to Log Window to see their values, but when "a" takes the value 44332211, the jump is not executed.

Could somebody tell me how to make so that this work appropiately, please?

From the depths of the abyss...
SACCOPHARYNX
psyCK0
04-01-2004, 01:46 PM
I will look into it ASAP.
Can you please mail me the app you tested this on? Or write something so I can test it?
psyCK0
04-01-2004, 02:00 PM
Update: I wrote a small test app and tested script jumps and they seem to work? Look at
http://ollyscript.apsvans.com/tmp/jump_test.rar
Anonymous
04-01-2004, 03:19 PM
Hi psyCKO:

The script that I wrote is this:

// ANTI-Detect NTICE for Armadillo
// by SACCOPHARYNX
// http://www.iespana.es/saccopharynx
// Tested on HyperSnap DX 5 (Download from http://www.hyperionics.com)

var a
var b

gpa "RegOpenKeyExA", "advapi32.dll"
bphws $RESULT,"x"
eob main
run

main:

mov a,eax
add a,22
mov b,[a]
cmp b,49636545 //it compares if b is equal to "IceE"
//cmp b,45656349 //it compares if b is equal to "IceE"
jne continue:

patch:
mov [a], #43434153#
bphwc $RESULT
msg "Nice! Softice has not been detected."
ret

continue:
log "This is a: "
log a
log "This is b: "
log b
//eob main
//run
jmp main

but you need SoftICE installed and NOT STARTED to test that. I'm working on Olly 1.10 and Ollyscript 0.62. I hope you can help me.

Good luck.

From the depths of the abyss...
SACCOPHARYNX
Ricardo Narvaja
04-01-2004, 06:08 PM
well is the same bug i post and have no response
The conditional jump, jump and the condition is not reached for jumping.

Ricrado
psyCK0
04-01-2004, 08:11 PM
Ok... there are some errors in this script... Here is the explanation.
Code + exe can be downloaded at:
http://ollyscript.apsvans.com/tmp/jump_test2.rar

The source for the test proggie is below. As you can see it opens
three keys and then closes them.

.386
.model flat, stdcall

include kernel32.inc
includelib kernel32.lib

include advapi32.inc
includelib advapi32.lib

.const
HKEY_LOCAL_MACHINE equ 80000002h
KEY_QUERY_VALUE equ 0001h

.data
szSW BYTE "SOFTWARE", 0
szHW BYTE "HARDWARE", 0
szSYS BYTE "SYSTEM", 0

.data?
hKey DWORD ?

.code

main proc
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, addr szSW, 0, KEY_QUERY_VALUE, addr hKey
invoke RegCloseKey, hKey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, addr szHW, 0, KEY_QUERY_VALUE, addr hKey
invoke RegCloseKey, hKey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, addr szSYS, 0, KEY_QUERY_VALUE, addr hKey
invoke RegCloseKey, hKey
invoke ExitProcess, 0
main endp

end main

The script below breaks when the program tries to open the HARDWARE key. I didn't really get what the EAX business was all about, the lpSubKey param is at EBP-3C. Also NO : (COLON) AFTER LABEL FOR JUMP COMMANDS (JUST LIKE IN REAL ASM)!

var a
var b

gpa "RegOpenKeyExA", "advapi32.dll"
bphws $RESULT,"x"
eob main
run

main:
mov a, ebp // Here we get the value of lpSubKey from the stack (4 rows)...
sub a, 3c
mov b, [a]
mov b, [b]
cmp b, 44524148 // Compare the value on stack to "HARD"
jne continue // Notice the missing colon (:)

patch:
// mov [a], #43434153#
// bphwc $RESULT
msg "RegOpenKeyExA for key starting with HARD has been detected!"
ret

continue:
//eob main
run
jmp main

Hope this helps! =)


OllyScript site updated

RCE Messageboard's Regroupment > OllyScript > OllyScript site updated
psyCK0
04-01-2004, 02:16 PM
Some new scripts added (many from this board).


Help needed on debugger detection

RCE Messageboard's Regroupment > General > Help needed on debugger detection
crknoob
04-03-2004, 05:12 AM
Greets,

I'm working on a proggie (written in BCB, packed with ASPack, I have manually unpacked it) and have been stuck on a problem for days, when I run the proggie standalone, it pops up a message box first, then goes on, but when I load the proggie into Olly, the message no longer pops up. Obviously it detected the debugger (or loader), I also tried to locate the normal anti-debug things like MeltICE, IsDebugPresent, etc but no luck. Can anyone point me a way to solve this problem? This popup is important, cuz the IDA shows the procedues after this popup are critical to proggie running.

Thanks in advance.
Snej
04-04-2004, 02:19 PM
there are several things ollydebug cant deal with
two examples

1. fs related things
fs has to do with thread information block / thread environment block / process environment block
fs:[00] holds for instance the error handler

2. the program may load kernel32.dll and jumping to the (undocumented) routines directly
if you choose trace into ollydebug may hold on in the dll code
if you choose trace over, the program could make a "pop" and so never return

a solution could be to place a "jmp toitself" what means "EB FE" in the file, execute the file, attach ollydebug to it and replace the EB FE with the former values
so you can trace the way of the code the program follows

CU Snej
crknoob
04-04-2004, 04:37 PM
Hi Snej,

First thanks for yr reply. I think yr first guess is most likely the cause of the problems, cuz I've found tons of fs:[0] codes in the program. I have to say that Im not familiar with SEH things (Im learning it though), after some tests, Iv found that BCB generates such codes to handle exceptions, and one thing confused me is: if I keep hitting F8, the program can pass thru the codes (which contain the "mov fs:[0], something") withouth problem, however, if I set a breakpoint after the same code and press F9, Olly stops with an exception, is this normal ? Is there any general rules on dealing with programs that have such fs:[0] things?

Thank you.
Snej
04-04-2004, 05:05 PM
Hi crknoob

this with fs:[0] behavior of ollydebug I described in the bug section over a week ago - but there is no answer yet :(
I hope this will be fixed in 1.10 or later

in my post in the bug section there is also a link about exception handling which may be useful to you

I´m not into these things so I can´t tell you more

CU Snej
crknoob
04-05-2004, 01:46 AM
I also noticed the program uses Process32First and Process32Next to check something, I heard this is a way to detect if the process is loaded by loader or running standalone, but I don't know how this is implemented, can anyone describe this in a bit? A link will also be very helpful.

Thank you.
Ricardo Narvaja
04-05-2004, 08:56 AM
I have the tuts in my ftp of acprotect 1.09 and 1.10 this packer use this detection and is explained but is in spanish.

If you need fool this detection is easy, make a infinite loop in the entry point of the packer bytes EB FE, and save the changes.

RUN the program out of ollydbg, and will be looping in the EP , now attach with ollydbg, change manually EB FE for original bytes
and RUN, and voila, the detection is fooled.
Only ollydbg is detected if you run the program in the debugger with open-run, not if you atach the program.
If you have detailed information how work this apis read the tutes mi ftp
ricnar456.no-ip.org
user:curso
pass:curso

NUEVA TEORIAS

Ricardo
crknoob
04-05-2004, 01:04 PM
Well, one question, the detection is not in the packer (cuz iv removed the packer) but coded into the program itself, does this method (dead loop & attach) still work ?

Thank you.

PS. Too bad I can't read Spanish :(
Ricardo Narvaja
04-05-2004, 02:25 PM
well is in the functionality of the apis, try this method and rename the exe of the olly to other name for better protection, put two exes in the ollys folder OLLYDBG.exe and a renamed.exe and use renamed.exe for debugging and use the method of atach too for two protections.

The other possible detection is for the name of the window OLLYDBG, this can be fooled using WINDOWSHACKER.

Ricardo
crknoob
04-08-2004, 12:23 PM
yeah thanks for all yr helps, after i attached to the running (in a dead loop at EOP) process, i could trace as needed.


Had I been to a wrong "ollydbg homepage"

RCE Messageboard's Regroupment > The Heap > Had I been to a wrong "ollydbg homepage"
seekbaby
04-03-2004, 03:05 PM
I am a new user of ollydbg, one month ago , I had download
an ollydbg v1.09 from http://www.ollydbg.com/, but When I check for
update this morning, I found I can not visit ollydbg.com,
so I visit the address at the readme file. And I finally find this
forum via search at net :)

Does is there a www.ollydbg.com (http://www.ollydbg.com) exist or does it is a fake or
I had been to a wrong place ??
focht
04-03-2004, 05:11 PM
Greets,

seems someone registered this domain but is not author of ollydbg.
I get 403's when trying to access the page:

---------------
HTTP/1.0 403 Forbidden
Date: Sat, 03 Apr 2004 20:05:48 GMT
Server: A-NETEK RobustWeb/1.0.4 (Unix) PHP/4.3.1 mod_throttle/3.1.2
X-Powered-By: PHP/4.3.1
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

-------------

The real ollydbg homepage is http://home.t-online.de/home/ollydbg/
The forum is http://ollydbg.win32asmcommunity.net

Dont know but this looks suspicious to me ... if you downloaded something from ollydbg.com i would not use it ;)

---------------------------------
whois record:

Domain name: ollydbg.com

Registrant Contact:
liupeng
peng liu 158w@dhit.cn
12345678 fax: 12345678
xianyang
xianyang shanxi 000001
cn

Administrative Contact:
peng liu 158w@dhit.cn
12345678 fax: 12345678
xianyang
xianyang shanxi 000001
cn

Technical Contact:
peng liu 158w@dhit.cn
12345678 fax: 12345678
xianyang
xianyang shanxi 000001
cn

Billing Contact:
peng liu 158w@dhit.cn
12345678 fax: 12345678
xianyang
xianyang shanxi 000001
cn

DNS:
ns.edong.com
ns1.edong.com

Created: 2003-12-22
Expires: 2004-12-22

----------------
NS records:

Domain Type Class TTL Answer
ollydbg.com. A IN 43200 61.152.251.213
ollydbg.com. NS IN 43200 ns.edong.com.
ollydbg.com. NS IN 43200 ns1.edong.com.
ns.edong.com. A IN 43200 61.152.99.200
ns1.edong.com. A IN 43200 61.152.99.197

61.152.251.213 CN CHINA - - CHINANET SHANGHAI PROVINCE NETWORK

--------
seekbaby
04-05-2004, 09:40 AM
Dear focht:
Thanks a lot!
Yestoday I had check the checksum of the binary which I had download from the .com with the real one from the ollydbg, it is ok and the same one.

I hate IE to auto complete the keyword I enter into the "address" bar. So I install a "google bar" on my IE, it is cool!!
http://www.google.com/
I will never be send to some unknown site again!!!

btw:
I wonder how you dig out the dns information of the web site,
Is there a tool in the windows platform can do the job ?? :)
TBD
04-05-2004, 12:12 PM
seekbaby: for DNS stuph I use: http://www.samspade.org/

... and for browser http://www.myie2.com

my 2c :)
seekbaby
04-05-2004, 01:12 PM
Thanks for the information!!!
I will test the site and software!!
crknoob
04-06-2004, 05:44 AM
to get domain dns info, under windows command prompt, type:

C:\>nslookup
Default Server: resolver1.level3.net
Address: 209.244.0.3

> set type=any
> ollydbg.com
Server: resolver1.level3.net
Address: 209.244.0.3

Non-authoritative answer:
ollydbg.com internet address = 61.152.251.213
ollydbg.com nameserver = ns.edong.com
ollydbg.com nameserver = ns1.edong.com
> ns.edong.com
Server: resolver1.level3.net
Address: 209.244.0.3

Non-authoritative answer:
ns.edong.com internet address = 61.152.99.200


Forcing code sections

RCE Messageboard's Regroupment > General > Forcing code sections
Aaerox
04-04-2004, 08:58 PM
In a certain application I have been debugging, due to the aftermath of a packer, I'm rendered unable to have ollydbg analyse the code as the section it's in isn't labeled as code.
Is there anyway to force ollydbg to recognize this area as a code section, or possibly even force olly to analyse the code?
sgdt
04-04-2004, 10:27 PM
You could load the EXE into PE Tools or the like and set the PE header to point at the correct code section and size. Then tools like Olly, IDA, and PE Explorer will be able to correctly identify it as code.
Aaerox
04-04-2004, 10:36 PM
Can PE Tools edit it as it's running?

I remember trying something like this before, I think ollydbg just ignored it. Perhaps it only updates when a significant event takes place.
sgdt
04-05-2004, 07:44 PM
Apparently, Olly won't look at what is BaseOfCode or SizeOfCode anytime after restart, so you can't just modify it in OllyDbg and click Analyze. Maybe version 2?

Anyway, it's only 2 DWORDs (BaseOfCode and SizeOfCode) in the PE Header. Modify the EXE to have these values point to the propper section, and load into OllyDbg.

Is there a reason (checksums or what not) that is a problem?


about OllyScript

RCE Messageboard's Regroupment > OllyScript > about OllyScript
TBD
04-05-2004, 12:17 PM
"OllyScript is a plugin meant to let you automate OllyDbg by writing scripts in an assembly-like language."

homepage: http://ollyscript.apsvans.com/

ps. to have something "sticky" :)


ASProtect 1.3B Stolen code Finder

RCE Messageboard's Regroupment > OllyScript > ASProtect 1.3B Stolen code Finder
loveboom
04-06-2004, 09:46 AM
/*
//////////////////////////////////////////////////
ASProtect 1.3B Stolen code Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-4-6
Config: Ignore all Exceptions except "Memory access violation",Hide Ollydbg.
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var eval //esp value
var eaddr //eip address
var faddr //Findop return address
var evalue //eip value
var pvalue //ebp value
var ismodt //mode 2

start:
findop eip,#EB01#
mov eaddr,$RESULT
sub eaddr,eip
sub eaddr,2
cmp eaddr,0
jne mod1
mov ismodt,1

mod2:
jmp lbl1

mod1:
mov ismodt,0
mov eval,esp
sub eval,4
run

lbl1:
eoe lbl2
esto

lbl2:
mov eaddr,eip
mov evalue,[eaddr]
sub evalue,8F640031
cmp evalue,0F640032
je lbl3
jmp lbl1

lbl3:
findop eip,#C3#
cmp $RESULT,0
je lbl1
mov faddr,$RESULT
sub faddr,eip
sub faddr,3D
cmp faddr,0
je lbl4
jmp lbl1

lbl4:
cmp ismodt,0
jne jmod2
mov faddr,$RESULT
eob lbl5
bp faddr
esto

lbl5:
bc faddr
mov pvalue,ebp
bphws pvalue,"r"
run

lbl6:
bphwc pvalue
findop eip,#C20800#
bp $RESULT
eob lbl7
run

lbl7:
bc $RESULT

lbl8:
eob lbl9
sti

lbl9:
mov pvalue,ebp
sub pvalue,eval
cmp pvalue,0
je lblend
jmp lbl8

lblend:
cmt eip,"Now please fix stolen code,and then dumped it!"
msg "Script by loveboom[DFCG],Thank you for using my script!"
ret

jmod2:
eob mod1
esto
Anonymous
04-06-2004, 01:51 PM
not working on Reg1aid,protected by asprotect 1.23
loveboom
04-07-2004, 02:54 AM
Anonymous
not working on Reg1aid,protected by asprotect 1.23
for asprotect 1.3b,not 1.23
Anonymous
04-07-2004, 09:46 AM
will you please tell which program is protected with 1.3b, in the protector homepage only 1.23 is mentioned.
loveboom
04-08-2004, 03:07 AM
Anonymous
in the protector homepage only 1.23 is mentioned.
yes,www.aspack.com,only v1.23rc4,but if you are register use,you can get the aspr 1.3b.AlfaClock V1.61 Beta or c32asm is protect by aspr 1.3b.i think my script for aspr1.3b can help you!
Anonymous
04-08-2004, 04:51 AM
Grateful to you , Thanks a lot.
Anonymous
04-09-2004, 05:05 PM
it only works with win2k ?
Anonymous
08-21-2004, 11:26 AM
I have a Question.
Is the Asprotect 1.3b in the RPG Maker Xp?
shERis
08-26-2004, 02:35 AM
Hi loveboom!
I tried your script and found the following:
1. eob lbl6 is missing. I assume it must be in lbl5 part. The script cannot be finished successfully.
2. sub evalue,8F640031
cmp evalue,0F640032
seems very strange. I assume you search for a special sequence of commands. Perhaps it must be cmp evalue,0 ?

Please correct the script.
Thanx
~hERi~
Anonymous
09-15-2004, 06:29 AM
hey can anyone help me unpack a program packed with aspr 1.3?please add me at naomikx@hotmail.com or send me a mail to h3r4in@gmail.com


Strange

RCE Messageboard's Regroupment > Bugs > Strange
pmpch
04-06-2004, 11:01 AM
6FD26B5C 8B0485 C86AD26F MOV EAX,DWORD PTR DS:[EAX*4+6FD26AC8]

Olly always extended this to:

6FD26B5C E3:8B0485 C86AD26F MOV EAX,DWORD PTR DS:[EAX*4+6FD26AC8]

I had to trick it to stop it from doing that. What is the difference of these 2 instructions?
oh me anon
04-06-2004, 05:47 PM
e3 as an opcode isnt a prefix it represents jecxz if irecallcorrectly

well 66 67 can become prefix but i ve neverseen e3 becoming a prefix

well i just tried using ctrl+ edit and pasted the opcodes here olly seems to do it right

00401474 ^\E3 8B JECXZ SHORT GPFCODE.00401401
00401476 04 85 ADD AL,85
00401478 C8 6AD26F ENTER 0D26A,6F

????


OTHER BUG IN OLLYSCRIPT or its me jeje

RCE Messageboard's Regroupment > OllyScript > OTHER BUG IN OLLYSCRIPT or its me jeje
Ricardo Narvaja
04-06-2004, 06:54 PM
eoe LABEL
eob BABEL
run

LABEL:
esto

BABEL:
mov !ZF, 0
run
JMP BABEL

this is a simple, script when found a hardware BPX put by me by hand go to BABEL and change the flag Z to 0 but not function change the flag P not the Z buaaaaaaaa, help mee

Ricardo
loveboom
04-07-2004, 02:57 AM
yes.
a good idea.
bp addr,eax=112233,do change zf==0
psyCK0
04-07-2004, 04:26 PM
Will look at it ASAP... Too much to do at work at the moment though.
psyCK0
04-10-2004, 05:29 PM
Bug fixed and v0.621 uploaded (a REALLY MINOR update =) )
Ricardo Narvaja
04-11-2004, 04:50 AM
Thanks work well

Good Job
Ricardo


How to break on a int 3?

RCE Messageboard's Regroupment > General > How to break on a int 3?
j_petrucci
04-08-2004, 09:47 PM
Hi to all!

I don't know if this has been already said, but I don't know how to make OllyDbg break on a INT 3. I confusely remember in Softice is bpx int 3, but in OllyDbg? Do I have to use CommandBar plugin?

thanks!
Ricardo Narvaja
04-08-2004, 10:36 PM
Ollydbg always stop in a INT3, the method for olly don't stop in INT3 is DEBUGGING OPTIONS-EXEPTIONS put the mark in INT3 and don't stop more, if you dont have INT3 marked olly always stop in INT3.

Ricardo


PE sections and the "Contains" column in

RCE Messageboard's Regroupment > General > PE sections and the "Contains" column in
yaa
04-09-2004, 08:41 PM
Hello,

how is ollydbg able to identify the contents of a pe section???
I mean how is ollydbg determining what it then displays in the "Contains" column in the Memory Map dialog box????
Also, I sometimes see custom names displayed in this column but I can't see them in the pe header. Where are they provided inside a binary???

yaa


reaad

RCE Messageboard's Regroupment > OllyScript > reaad
Anonymous
04-10-2004, 05:02 AM
reaad
Anonymous
04-10-2004, 05:05 AM
Sorry about that, I actually wanted to know if there was a collection of custom function signatures for fuctions like fread. I know we can make them ourselves but I just wanted to know if there was an easy download somewhere


OllyScript on Win9x?

RCE Messageboard's Regroupment > OllyScript > OllyScript on Win9x?
psyCK0
04-10-2004, 05:43 PM
Hey all,
Can anyone using Win9x please tell me if OllyScript works on that platform? Please run latest OllyDbg. =)


[plugin] OllyScript v0.7

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.7
psyCK0
04-11-2004, 05:34 PM
New version of OllyScript is available for download.
Grab it at
http://ollyscript.apsvans.com

Changes in v0.7:
+ New commands: #INC, #LOG, DM, FIND, GO, MSGYN
+ Possibility to call OllyScript from other plugins
# Wildcard search for the FINDOP command
- Source code not included in distribution archive (available on request)
britedream
04-12-2004, 12:01 AM
thanks for the script plugin, I have posted in an other forum where is your info post ,that the script isn't working.
psyCK0
04-12-2004, 07:11 AM
When does olly crash? When you execute some script?? What script? What OS are you on?

EDIT: i think I found the bug and fixed it. Please redownload.
loveboom
04-12-2004, 08:39 AM
Thank you very much!:)
Anonymous
04-18-2004, 08:41 AM
Äh, i copied the plugin dll in the OllyDir, but in the Plugin it isn't shown in the Plugin Menue, (Olly 1.10b)
Can someone help?
Ricardo Narvaja
04-18-2004, 04:32 PM
go to appearence-directories-plugin and change the path to the correct path of olly folder

Ricardo


Before posting bugs in OllyScript...

RCE Messageboard's Regroupment > OllyScript > Before posting bugs in OllyScript...
psyCK0
04-12-2004, 09:15 AM
Hey! =)

Please try to redownload the plugin before you post a new bug. From now on I'll fix small bugs on the fly (without announcing bugfixes) and upload new updates to the site... I'm just too lazy to change build number... I will however put a compilation date/time in the about box...
Ricardo Narvaja
04-13-2004, 06:27 AM
For psycko a question:

What API of windows make the same work of the commang GMI, addr, CODEBASE and MODULEBASE

GMI addr, info
--------------
Gets information about a module to which the specified address belongs.
"info" can be MODULEBASE, MODULESIZE, CODEBASE or CODESIZE (if you want other info in the future versions plz tell me).
Sets the reserved $RESULT variable (0 if data not found).
Example:
GMI eip, CODEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs

I need maje a inject in a program and i need a api, this api give me this info, i give to the api the adress and return me the base of the module of this adress.

How you implement this in ollyscript i think you know a api who make this work similar to the command GMI of your plugin.

Thanks


Post two script for new version ollyscript(oscv0.7

RCE Messageboard's Regroupment > OllyScript > Post two script for new version ollyscript(oscv0.7
loveboom
04-13-2004, 10:05 AM
Thank psycko,now post two script.Enjoy it!

My script for svkp 1.3x can fix stolen code,If target is delphi's program.
/*
//////////////////////////////////////////////////
SVKP 1.3x -> Pavol Cerven stolen code Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.7
Date : 2004-4-13
Config: Ignore all exceptions.hide your debug.
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var addr
var espval //esp
var espval1
var esptmp
var cbase
var csize

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
mov espval,esp

start:
run

lbl1:
bprm cbase,csize
eob lbl2
esto

lbl2:
bpmc
mov espval1,esp
add espval1,58
cmp [espval1],espval
jne lblabort
eob lbl3
bphws espval1,"r"
run

lbl3:
run
bphwc espval1

lbl4:
mov esptmp,espval
sub esptmp,4
cmp esptmp,ebp
je lbl5
sti
jmp lbl4

lbl5:
cmt eip,"Now run trace,please waite!"
find eip,#FF6424FC# //find command JMP DWORD PTR SS:[ESP-4]
cmp $RESULT,0
je lblabort
eob lbl6
bp $RESULT
ti

lbl6:
bc $RESULT
sto
msgyn "Do you want fix stolen code(for Delphi only)?"
log $RESULT
cmp $RESULT,1
jne lblend
mov addr,eip
sub addr,b
asm addr,"push ebp"
add addr,1
asm addr,"mov ebp,esp"
add addr,2
mov [addr],#83EC#
mov esptmp,ebp
sub esptmp,esp
add addr,2
mov [addr],esptmp
add addr,1
mov [addr],#B8#
add addr,1
mov [addr],eax

lblend:
cmt eip,"Script finished!"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblabort:
msg "Error,script abort.Maybe target is not protect by SVKP1.3x or your forgot Ignore all exceptions."
ret

/*
//////////////////////////////////////////////////
MoleBox 2.x.x Fix IAT+OEP Finder v0.1
Author:loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.7
Date : 2004-4-13
Config: N/A
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

start:
gpa "LoadLibraryA","kernel32.dll"
bp $RESULT
cmp $RESULT,0
je lblabort
run

lbl1:
bc $RESULT
rtu

lbl2:
find eip,#E8DB050000#
cmp $RESULT,0
je lblabort
go $RESULT
eob lbl3
sti

lbl3:
asm eip,"ret"
find eip,#FFE0#
cmp $RESULT,0
je lblabort
eob lbl4
bp $RESULT
run

lbl4:
sto

lblend:
cmt eip,"OEP found!please dumped it!"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblabort:
msg "Error,maybe target is not packed by MoleBox 2.x.x.Script abort!"
ret
psyCK0
04-13-2004, 01:26 PM
loveboom: as usually, your scripts are amazing! =)
loveboom
04-15-2004, 08:13 AM
I think i am a unpack fans(Not cracker).^_^
my script for molebox 2.0 fix a bug,and post a new script for pc-guard v5.0
/*
//////////////////////////////////////////////////
MoleBox 2.x.x fix IAT+OEP Finder v0.11
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.7
Date : 2004-3-29
Config: N/A
Note : Thank David!If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var addr

start:
gpa "LoadLibraryA","kernel32.dll"
bp $RESULT
cmp $RESULT,0
je lblabort
run

lbl1:
bc $RESULT
rtu

lbl2:
find eip,#05000083C408E9#
cmp $RESULT,0
je lblabort
mov addr,$RESULT
sub addr,2
go addr
eob lbl3
sti

lbl3:
asm eip,"ret"
find eip,#FFE0#
cmp $RESULT,0
je lblabort
eob lbl4
bp $RESULT
run

lbl4:
sto

lblend:
cmt eip,"OEP found!please dumped it!"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblabort:
msg "Error,maybe target is not packed by MoleBox 2.x.x.Script abort!"
ret
---------------------------------------
PC-GUARD V5.0

/*
//////////////////////////////////////////////////
PC-Guard v5.0 OEP Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.7
Date : 2004-4-15
Config: Ignore all Exceptions,hide your OllyDbg.
Action: Fix import function,found target's OEP
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var espval //esp value
var cbase
var csize
var addr

mov espval,esp
sub espval,4
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
start:
gpa "LoadLibraryA","Kernel32.dll"
bp $RESULT
run

lbl1:
bc $RESULT
rtu
find eip,#8918#
cmp $RESULT,0
je lblabort
mov addr,$RESULT
mov [addr],#9090#
eob lbl2
go addr

lbl2:
bphws espval,"r"
eob lbl3
run

lbl3:
bphwc espval
eob lbl4
eoe lbl4
bprm cbase,csize
run

lbl4:
bpmc

lblend:
cmt eip,"OEP found,please dumped it and then use importrec Get import functions,cut a invliad function."
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblabort:
msg "Error,Script abort!Maybe target is not protect by PC-Guard v5.0.:("
ret
loveboom
04-17-2004, 10:23 AM
script for PC-Guard v0.5 has a bug
lbl1:
bc $RESULT
rtu //here
rtu //if system is winxp,add it.
find eip,#8918#
Anonymous
06-08-2004, 07:44 AM
dear loveboom :

can you help me to UNPACK this :

http://download.howudodat.com/chatterbox/download/chatsetup.1.2.10.0.e xe
(http://download.howudodat.com/chatterbox/download/chatsetup.1.2.10.0.exe
)

If you can answer me @ : hazemsp@hotmail.com

thanx .
psyCK0
06-08-2004, 10:39 AM
My god, Anonymous, you should really consider joining some kind of anti-Mensa - your IQ can't be higher than that of a mentally chalenged maggot. Have you ever heard about "board rules"? Then READ THEM BEFORE POSTING.
Let me rephraze a scene from Pulp Fiction:
psyCK0: Did you see a sign on this board saying "We crack on request"?
Anonymous: Duh...
psYCK0: I said, did you see a sign on this board saying "We crack on request"?
Anonymous: No...
psyCK0: Do you know why?
Anonymous: *looks stupid*
psyCK0: BECAUSE CRACKING ON REQUEST AIN'T OUR FUCKING BUSINESS!!!
Anonymous
07-02-2004, 02:43 PM
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"


How to make multi conditional BP with negations?

RCE Messageboard's Regroupment > General > How to make multi conditional BP with negations?
kao
04-13-2004, 10:29 AM
Hi everybody!

I am just stuck with a seems-to-be-trivial problem. I need a conditional breakpoint that breaks if ESI is not equal to 0x11010504 and ESI is not equal to 0x1101E434.

If I try to write "(esi != 11010504)&&(esi != 1101E434)", Olly still stops when ESI=1101E434

Breakpoint "!(esi IN (11010504,1101E434))" also is not giving the expected result. How can I get the result that I need?

Thanks,
kao.

p.s. Olly version is 1.09d.
p.p.s. Yes, I read the manual. And yes, I've used Google before asking... :(
nucleon
04-13-2004, 11:10 PM
i also have a problem with conditional breakpoints, similar to yours..

the condition "BYTE [EDX]==36" doesn't work properly.
for example, it also breakes if EDX=0..
i'm not sure what is wrong. maybe the problem is, that the memory value at [EDX]=[0] is undefined/can't be accessed, so it breaks by default.

but then if i try "(BYTE [EDX]==36)&&(EDX!=0)" it still doesn't work.. it isn't even accepted as a valid expression, as it seems.

and that's just one example. there were more occasions like that.
leads to the conclusion that the expression handling is buggy.
or can anyone explain that behaviour?
crknoob
04-15-2004, 07:01 AM
maybe it requires 0x36 ? dunno, just random guess.
oh me anon
04-15-2004, 04:46 PM
well there seems to be some problem with the syntaxes posted

first q
at any given time esi cant be equal to x and y
it can be either equal to x or not equal to x
so may be you should try using or
{
.if esi != ***** will break every where except *****
if esi == ***** will break only at ******
if esi == ***** or ++++++ may break at two points
}
needs some checking and i dont have access to olly atm so may post edits later but i never faced some problems with cond break
and i use it all times (gotta use it when debugging ddraw fullscreen apps and it will freeze with hard bpt)
else how to find what call is called with [edx+5ch]

second q
why not try writing like byte ptr ds:[ebx] == 0x36 and once it breaks then try abbreviations

instead of just conditional try using conditional log and choose to log always so that the log window shows you what really your condition means to olly and what was your assumption of the condition

many times olly will tell you unknown thats a big hint to write proper condition rather than breaking head
kao
04-16-2004, 06:55 AM
Sorry, my english obviously is not good enough.

I wish that olly continues if ESI=0x11010504. I wish that Olly continues if ESI=0x1101E434. Otherwise Olly should stop. Hopefully it is now clear.

The problem is very strange. The following breakpoint is working (unpacked exe, addresses in EXE code segment):
esi!=400100&&esi!=400400

This breakpoint is not working (packed exe, these addresses are in loaded OCX code segment):
esi!=11010504&&esi!=1101E434

Any ideas?


TO PSYCKO

RCE Messageboard's Regroupment > Plugins > TO PSYCKO
Ricardo Narvaja
04-13-2004, 05:25 PM
For psycko a question:

What API of windows make the same work of the commang GMI, addr, CODEBASE and MODULEBASE

GMI addr, info
--------------
Gets information about a module to which the specified address belongs.
"info" can be MODULEBASE, MODULESIZE, CODEBASE or CODESIZE (if you want other info in the future versions plz tell me).
Sets the reserved $RESULT variable (0 if data not found).
Example:
GMI eip, CODEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs

I need maje a inject in a program and i need a api, this api give me this info, i give to the api the adress and return me the base of the module of this adress.

How you implement this in ollyscript i think you know a api who make this work similar to the command GMI of your plugin.

Thanks
psyCK0
04-14-2004, 06:39 AM
Hey Ricardo!

The GMI command uses the function Findmodule, which exists in the OllyDbg API. I don't really know how you can do that using Windows API right away, but I think I did something like that once... So it is possible. =) Ill try to find more info for you.
Ricardo Narvaja
04-14-2004, 09:01 AM
Thanks i use this api in my code.

Thanks again
Ricardo
Ricardo Narvaja
04-17-2004, 06:09 PM
hmm this FindWindow is not a WINDOW api, snif i need an api what make the same work of GMI, but i don't found.

Ricardo
Will
05-25-2004, 08:48 PM
Maybe the debugactiveprocess api will be of use. If memory serves, there is a struct that windows sends you with this info in it.

hope that helps,
will
focht
05-26-2004, 04:11 AM
Greetings,

a short circuit version which comes to my mind (not tested though):

MEMORY_BASIC_INFORMATION mi;
int result = ::VirtualQuery( address, &mi, sizeof(mi));

// mi contains allocation base of block
// additionally you might check for:
//
// mi.BaseAddress == mi.AllocationBase
// mi.type == MEM_IMAGE
// to be sure its module area

// module instance handle is the allocation base
TCHAR filename[ MAX_PATH];
int len = ::GetModuleFileName( (HINSTANCE) mi.AllocationBase, filename, MAX_PATH);

Oh well ... another one:

Use EnumerateLoadedModules() from image helper/debug helper API and loop through.
Check each module info entry if the address belongs to this module.
e.g. something like:

if( module_entry.BaseAddress <= my_address &&
((SIZE_T) module_entry.BaseAddress + module_entry.Length > (SIZE_T) my_address))
{
// within space, save module entry
}

Hope this helps...

Regards,

A. Focht
psyCK0
05-27-2004, 09:43 AM
Maybe something that should be implemented in OSC? Anyone want that?


What happened with the oldschool style ?

RCE Messageboard's Regroupment > OllyScript > What happened with the oldschool style ?
Anonymous
04-15-2004, 04:14 AM
Yes... What happened with the oldschool style of unpacking? What happened with the unpacker writers? Is a kiddie script a real solution?

P.S: I am not saying anything against OllyScript.Greetz to SHaG.
Ricardo Narvaja
04-15-2004, 07:37 AM
The scripts don't unpack a program, only help with mechanical cuestion and repetitive, the methods are the same of unpacking today and in teh past, i'm unpacking by years and i do no look changes in the method for help in the repetitive tasks with and script.
There are new packers day by bay if you don't acelerate your work, when you unpack asprotect 1.23 for example there are 5 new versions of asprotect and your work is wasted time.In old times a new version of a packer was published one by year.

Ricardo
psyCK0
04-15-2004, 10:18 AM
When I wrote OllyScript I didn't know it would become a scriptable unpacking engine. =) There are many other tasks that can be automated!
Pumqara
04-15-2004, 01:59 PM
I posted the first msg :).
Well sure it is a nice tool SHaG, but i prefer to write a 900 lines of asm code with full decryptor,decompressor,stolen bytes restorer and import rebuilder (my last unpacker - not released) than 5 lines in a kiddie script.For me the script is worse than a dumper.I am just giving my own opinion and how I feel all this.
Ricardo Narvaja
04-15-2004, 03:23 PM
Well is a good job the yours, but i unpack manually all packed programs, your 900 lines with a little change of version is fooled, and if you wish,you can adapt the unpacker to the new version of the packer.
Manually is more dificult be fooled by little changes, and i not depend if are released the new version of the unpacker or not.
Very good unpackers are discontinued and the users are not capable of unpack manually nothing, if you unpack manually good, you not depend of others.

Ricardo Narvaja
Pumqara
04-15-2004, 04:03 PM
Right.I code unpackers because I like to break the whole protection scheme.This is interesting and it brings real knowledge.Manually unpacking is ok too, but not a script unpacking :).I just hate the word "script" ;P
Ricardo Narvaja
04-15-2004, 06:21 PM
well only the script automat the hard work, not unpack, if you use the script to found and oep, you can dump repair the iat, and repair the code (antidump etc) all the manual work is realized by hand, the script only save time in any aspect (found OEP) for example.

Ricardo
Pumqara
04-16-2004, 03:56 AM
BTW many of the scripts don't work for me.Like Asprotect and PeSpin.They do not bypass the anti-debug tricks.
psyCK0
04-16-2004, 05:51 AM
There is a hide debugger plugin :P
1bitshort
04-16-2004, 02:03 PM
but i prefer to write a 900 lines of asm code with full decryptor,decompressor,stolen bytes restorer and import rebuilder (my last unpacker - not released) than 5 lines in a kiddie script

Each to their own. Personally, if a 5-line script is available to unpack a program then I find it pointless writing 900 lines of asm code to unpack it. I mean, what do you really want to do - unpack it, or try and impress somebody with your l33t assembly program? Time is money. If you want to waste time writing and debugging 900 lines of assembly code to unpack a program that a 5 line script can already do for you then that's your loss, and anyone from the 'oldschool' (as you put it) would be resourceful enough to do the same, and spend their time on more constructive issues that can't be automatically solved by existing programs/scripts.

Peace.
Anonymous
05-03-2004, 10:41 PM
900 lines is a waste of time.

Cracking isn't a hobby for most people, it's a means to get software.

So yes, Time is Money
Anonymous
05-14-2004, 10:09 AM
Hey Guys,

Just my 2 cents on this topic :P

Both parties have valid points.

A 900 line ASM app which is well written, stable and effective app is a work of art and a joy to use.

A script gets the job done and give you the flexability to change things slighty for the next version is useful.

So which is better ....

1. A script allows you to learn from the process.
2. An app is standalone and allows even the most in-experienced person to unpack complex commercial protection schemes.
3. An app does this at the click of a button.
4. A script can become redundant or wont work when a big enough change is made to the script engine.
5. an app can bypass msot generic or specific debug traps.

So the jury is still out

Scripts can still be classed as "old-school".. Remember TR.EXE (Liu Tau) ..

Well I wrote a number of scripts to unpack various files...
When scripts would not cut it, i wrote apps...

I think this is a mute topic cause you should use the best tool for you (personally) to get the job done.

L8z :)

*rant rant*

RedBull
Pumqara
05-16-2004, 10:05 AM
Ah the old tr.exe :).Good compare.Well I think having the source of the unpacker in front of you is better than having a script.You will learn more.


kernel32 description?

RCE Messageboard's Regroupment > General > kernel32 description?
Snej
04-15-2004, 06:28 PM
I found
http://mitglied.lycos.de/pepage/k32.htm
and I´m looking for descriptions - the ins and outs of these functions
has someone a useful link for me plz?

thx Snej
Pumqara
04-16-2004, 03:57 AM
wow.This is the Export Functions list of kernel32.dll.
The link you need is: http://msdn.microsoft.com
Snej
04-16-2004, 08:13 AM
I visited already. But I only found usage in C++.
In C++ there are not described all these functions but I think the compiler might translate them into asm code.

What I´m looking for is the usage for asm programming.
I think that this isnt supported by MS (especially the undocumented ordinal functions), so I´m asking you whether someone had something worked out.

What I want is writing some asm code which allocates memory or loads dlls or something similar.

Thx Snej
TBD
04-16-2004, 09:12 AM
Snej:

Win32Api.hlp (http://spiff.tripnet.se/~iczelion/files/win32api.zip) = Win32API help file [8mb zip] - A MUST
Microsoft Win32 Knowledge Base (http://spiff.tripnet.se/~iczelion/files/WIN32KB.EXE) = collection of Q&A related to win32 programming [854k zip]

thanks to Iczelion (http://win32asm.cjb.net) for hosting the files

remember
this is a bit old info (win95 era) but you can use it. also check msdn for updated info.


SVKP 1.3x Stolen code finder v.02 beta

RCE Messageboard's Regroupment > OllyScript > SVKP 1.3x Stolen code finder v.02 beta
loveboom
04-17-2004, 10:19 AM
v0.2 fix all Import function,found oep/fix stolen code.
/*
//////////////////////////////////////////////////
SVKP 1.3x -> Pavol Cerven stolen code Finder v0.2 Beta
Author: loveboom
Email : bmd2chen@tom.com
OS : Win2kADV sp2,OllyDbg 1.1b,OllyScript v0.62
Date : 2004-4-17
Action: Fix target's iat,found stolen code/fix stolen code.
Config: Ignore all exceptions.hide your debug.
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var addr
var espval //esp
var espval1
var esptmp
var cbase
var csize

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
mov espval,esp

start:
run

lbl1:
bprm cbase,csize
eob lbl2
esto

lbl2:
bpmc
cmt eip,"Running,please wait!"
find eip,#EB02CD2058EB020FE88907# //find iat magic jmp
mov addr,$RESULT
asm addr,"pop eax"
add addr,1
mov [addr],#8b44241C# //replace to "mov eax,DS:[ESP+1C]" action:fix import functions

lblcheck:
find eip,#813B706586B1EB03C7848B0F84# //fix API function "GetModuleHandleA"
mov addr,$RESULT
cmp addr,0
jne lblfix0
find eip,#813BC5B1662DEB03C784E80F84# //Fix API function "GetCommandLineA"
mov addr,$RESULT
cmp addr,0
jne lblfix0
find eip,#813BCC971025EB03C784E90F84# //Fix API function "ExitProcess"
mov addr,$RESULT
cmp addr,0
jne lblfix0
find eip,#813BA41A86D0EB03C7849A0F84# //Fix API function "GetCurrentProcess
mov addr,$RESULT
cmp addr,0
jne lblfix0
find eip,#813B4A7687DFEB02CD200F84# //Fix API function "GetVersionExA"
mov addr,$RESULT
cmp addr,0
jne lblfix1
find eip,#813B0F1ACF4CEB02CD200F84# //Fix API function "GetVersion"
mov addr,$RESULT
cmp addr,0
jne lblfix1
mov espval1,esp
add espval1,58
cmp [espval1],espval
jne lblabort
bphws espval1,"r"
run
run

lbl3:
bphwc espval1

lbl4:
find eip,#FF6424FC# //find command JMP DWORD PTR SS:[ESP-4]
log $RESULT
cmp $RESULT,0
je lblabort
eob lbl5
bp $RESULT
run

lbl5:
bc $RESULT
sto
msgyn "Do you want fix stolen code(for Delphi only)?"
cmp $RESULT,1
jne lblend
mov addr,eip //if select yes then script help you fix stolen code
sub addr,b
asm addr,"push ebp"
add addr,1
asm addr,"mov ebp,esp"
add addr,2
mov [addr],#83EC#
mov esptmp,ebp
sub esptmp,esp
add addr,2
mov [addr],esptmp
add addr,1
mov [addr],#B8#
add addr,1
mov [addr],eax

lblend:
cmt eip,"Script finished!"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblfix0:
add addr,B
mov [addr],#EB04#
jmp lblcheck

lblfix1:
mov addr,$RESULT
add addr,A
mov [addr],#EB04#
jmp lblcheck

lblabort:
msg "Error,script abort.Maybe target is not protect by SVKP1.3x or your forgot Ignore all exceptions."
ret
MC707
04-19-2004, 09:13 AM
Respect!
psyCK0
04-19-2004, 10:12 AM
loveboom rocks on! =)
Site updated.
BruceLee
05-31-2004, 05:39 AM
Script don't work with BlindWrite 5.0.0.110! :(
loveboom
06-01-2004, 10:24 AM
yup,you are right. beta only.


need this special script

RCE Messageboard's Regroupment > OllyScript > need this special script
caty
04-19-2004, 04:59 PM
hi

i need this special script to do this

when it breaks at a code /offset do this
go to eax address ,copy(hex) 24 bytes from eax address and paste to separate file or a separate log
psyCK0
04-20-2004, 03:30 AM
Please order your script at Pay2Crack - only $9.95 a script....
britedream
04-20-2004, 06:43 AM
var cnt
eob logAdd
run

logAdd:
go eax
MSG " go to log and right click and choose log file"

loop:
log [eip]
add eip,4
add cnt,4
cmp cnt ,18
jne loop
MSG "close log to file"
ret
loveboom
04-20-2004, 09:13 AM
test:

var addr
var count
var contents

start:
go eax

lbl1:
mov addr,eip
mov count,0

loop:
mov contents,[addr]
log contents
cmp count,4
je lblend
add count,1
add addr,4
jmp loop

lblend:
msg "Script finished,press alt+l open log window"
ret
loveboom
04-20-2004, 09:50 AM
log contents
cmp count,4
je lblend
add count,1
add addr,4
jmp loop

right:
cmp count,6

Another:

start:
go eax

lbl1:
dm eip,24,"c:\dump.dmp"

lblend:
msg "script finished"
ret
caty
04-21-2004, 07:49 PM
thanks guys ,these scripts works gr8,now any function to add/append the dump to the same file each time it breaks
psyCK0
04-22-2004, 03:27 AM
cant be done atm. maybe i will implement this in the next ver


Deutsche Hilfe oder Anleitung?

RCE Messageboard's Regroupment > General > Deutsche Hilfe oder Anleitung?
Andiamo
04-22-2004, 11:44 AM
hallo @lle,

gibt es für das tool eine deutsche anleitung.. bzw. jemand der mir ein paar fragen beantworten kann?
bin auf dem gebiet ein neuling...

danke
Andiamo
yano
04-23-2004, 05:51 PM
ich glaube ,der gute website ist :http://ollydbg.win32asmcommunity.net/ aber im inglish sparache .benuzen sie GOOGLE.COM damit konnen sie alles ubersetzung .
focht
04-27-2004, 04:25 AM
Tach,

wenn Dein Englisch etwas holprig ist, tut das der Sache keinen Abbruch.
Das ist die Gelegenheit, die Englischkenntnisse aufzufrischen ;)
Übung macht den Meister.

Gruss,

A. Focht

PS: Ich werde keine weiteren Anfragen auf deutsch beantworten.
Entweder Englisch oder gar nicht.


Single step exception and OllyScript

RCE Messageboard's Regroupment > OllyScript > Single step exception and OllyScript
psyCK0
04-23-2004, 09:29 PM
Hey,

Some people have mailed me about the EOE command not working with single step exceptions. I mailed Olly asking if there is a way to distinguish between single step events generated by the debugger and other ones. The answer was that it's not possible in the current version and will not be possible in any v1.X ... As far as I could understand he might implement this in v2, we will see... So as I see it, I cant do anything... Ideas are of course welcome. =)


Can't resume attached process

RCE Messageboard's Regroupment > General > Can't resume attached process
TheBlasphemer
04-25-2004, 10:53 AM
I am trying to debug a game.
Unfortunately it is launched trough a launcher (TTDPatch),
so i can't just run it straight from ollydbg.
When i try to attach it to the running game, everything seems to go well, I end up in a debugbreak.
but when i press F9, the game just freezes, and all threads are suspended.

Right-clicking and resuming the threads does not seem to help.

How can i attach to the game and leave it running?
Ricardo Narvaja
04-25-2004, 06:09 PM
i attach and when stop in debugbreak go to view-memory and mark the code section usually 401000 and right clic- set breakpoint memory on acess and RUN,when stop in the exe, in the correct section,quit the BPM and put the isdebuggerpresent plugin and RUN its all.

Ricardo


about ollydump

RCE Messageboard's Regroupment > Plugins > about ollydump
mike
04-25-2004, 04:41 PM
Where can i find a tutorial with info on how to use ollydump?
Something like a help file maybe
Rockman99
09-12-2004, 03:24 PM
There is a tutorial at BiW reversing in the tuts section\tools named
ollydump. Can you tell me where I can get that plugin Stuph is getting me nowhere.


new OllyDbg version 1.10c

RCE Messageboard's Regroupment > Announcements > new OllyDbg version 1.10c
Lord_Looser
04-26-2004, 07:51 AM
Third beta: v1.10c (http://home.t-online.de/home/Ollydbg/whatsnew.htm)


Access violation in ollydbg when reading [0000000C

RCE Messageboard's Regroupment > Bugs > Access violation in ollydbg when reading [0000000C
Lord_Looser
04-26-2004, 10:27 AM
Access*violation*when*reading*[0000000C]*at*address*00421342

error*description:
CPU*-*main*thread*[no*module]*-*right*mouse*click*on*disassambly*line* =>*error!

ollydbg.exe*(version*1.10c)
0042131A***.*/74*26*****************je*short*OLLYDBG.00421342
0042131C***.*|8B8D*D4E9FFFF*mov*ecx,dword*ptr*ss:[ebp-162C]
00421322***.*|51**********************push*ecx************************ *****************;*/Arg1
00421323***.*|E8*30070400*****call*OLLYDBG._Findmemory**************;* \_Find memory
00421328***.*|59pop*ecx
00421329***.*|85C0******************test*eax,eax
0042132B***.*|74*15*****************je*short*OLLYDBG.00421342
0042132D***.*|68*7E404B00*****push*OLLYDBG.004B407E****************;*/ pItem *=*"&Follow\tEnter"
00421332***.*|6A*47*****************push*47*************************** ***************;* |ItemID*=*47*(71.)
00421334***.*|6A*00*****************push*0**************************** ****************;* |Flags*=*MF_BYCOMMAND|MF_ENABLED|MF_STRING
00421336***.*|8B85*70FFFFFF**mov*eax,dword*ptr*ss:[ebp-90]*******;*|
0042133C***.*|50*********************push*eax************************* ****************; *|hMenu
0042133D***.*|E8*04E00800****call*<jmp.&USER32.AppendMenuA>**;*\Append MenuA
00421342***>*\8B56*0C***********mov*edx,dword*ptr*ds:[esi+C]


OllyDbg can only see one NtXxx function exported f

RCE Messageboard's Regroupment > General > OllyDbg can only see one NtXxx function exported f
1bitshort
04-27-2004, 03:20 AM
1) Load any process (i used notepad.exe)
2) Go to View | Executable Modules
3) Right-click on ntdll.dll, and select View Names
... why is NtOpenProcess not in the list? Actually I can only see ONE exported NtXxx function

Win32dasm had no problems seeing all NtXxx exported functions, so it seems to be a bug with OllyDbg?
focht
04-27-2004, 04:10 AM
Greetings!

Win32dasm had no problems seeing all NtXxx exported functions, so it seems to be a bug with OllyDbg?

Not necessarily.
For user mode processes, the two native API forms "NtXxx" and "ZwXxx" are equivalent and are just different symbols for the same entry point in ntdll.dll (it exports one routine with two names).

How does it work?
Well, the code executes the system service dispatcher instruction (int 2E) to enter kernel mode.
The kernel mode code that executes in response to this instruction records the previous mode of the process in ETHREAD structure of current thread before calling the function that implements the native system service.

Kernel mode code links against ntoskrnl.exe rather than ntdll.dll.
The two different forms of the system service name point to different entry points: the ZwXxx format entry point contains a copy of the code from ntdll.dll, which re-enters the kernel and uses the system service dispatcher and the NtXxx format entry point contains the actual implementation of the system service.

So it might be a "feature" of ollydbg regarding "NtXxx/ZwXxx" exports in user mode.
Though one might argue that "view names" list does not exactly resemble the exports table.

Regards,

A. Focht


Suggestions

RCE Messageboard's Regroupment > General > Suggestions
ssb
04-27-2004, 04:45 AM
It would be nice if "Names" and "Intermodular Calls" windows had a find command. Sometimes it's time consuming pointing a specific call by name.
Also a keyboard shortcut (Ctrl-F) in "Text Strings - Search for text"

Thanks
TBD
04-27-2004, 11:12 AM
ssb: Find feature is already there in "Names" and "Intermodular Calls" - just press the letters that make the word
ssb
04-28-2004, 05:05 AM
OMG you're right !!!
I'm using OllyDebug since its early days and never find it.

Thanks a lot
TBD
04-28-2004, 08:28 AM
ssb: hehe. I am since day one (1.0) and I still find something new :)


Help on script

RCE Messageboard's Regroupment > OllyScript > Help on script
Anonymous
04-28-2004, 03:18 PM
Ive this question;

i almost finished my script for PECompact 2.01 but on the end the ammount of pressing SHIFT-F9 (esto in script) differs per target.

How can i generally make it stop at the final breakpoint?

thanx in advance.
Anonymous
04-29-2004, 09:02 AM
Well, this should be working just fine for the time beeing:

/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee.

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize

sto
sto
sto
sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
bp $RESULT

MSG "From here, press SHIFT-F9 till break at 'JMP EAX'. Then F8 and you're on OEP!"

Hope it's usefull.


Total Useless Newbie trying to figure out OllyDbg.

RCE Messageboard's Regroupment > General > Total Useless Newbie trying to figure out OllyDbg.
HexScribe
04-28-2004, 08:50 PM
Hi... I would like to know how to search for a command... let's say I want to put a breakpoint on some message box (MessageBoxA), how can I find it in the code window? I tried to search for the code Hex string I picked up from a disassembler, but it don't works... Also, why does the code begins at 75F51C96 in OllyDbg and at 00401000 in my disassembler...

Thanks! I know these are stupid questions but I just want to find out how to use this excellent tool everyone's talkin about! :) Btw, I won't use it for cracking purposes! :P
Ricardo Narvaja
04-28-2004, 09:29 PM
If you put a BPX in messageboxa go to B window (DEBUG-BREAKPOINTS) and doble click in the BPX and you will go to the location in the CPU PANEL.

The other question is confuse, try clear the question

Ricardo
HexScribe
04-28-2004, 10:19 PM
- How to put a BPX to messageboxa!! This is what i want to know!! How can I find where's the "MessageBoxA" in the code!!

- I think it's clear enough... The application start point isn't the same in OllyDbg and in PE Explorer disassembly... why?
HexScribe
04-29-2004, 01:40 AM
Ah! I found that Ollyscript has nice ways to do it :)
Ricardo Narvaja
04-29-2004, 09:02 AM
A application start in the EP and this point is in the exe, if olly stop before reach the EP are for.

1) a exception (skip with shift + f9 or put in debug breakpoint the mark in the type of exception,if you want olly don´t stop more there).
2) if you dont know the type of exception go to debuggin options-exceptions and when you are sttoped in ths exception, press ADD LAST EXCEPTION and check IGNORE CUSTOM... and with this olly do´t stop more in this exception.
And for type BP MessageBoxA or BPX MessageBoxA go to Stuph page of this forum and download the comanndbar plugin and with this you can type bp or bpxs directly.

Ricardo
Ricardo
Lord_Looser
04-30-2004, 06:06 AM
how to find MessageBoxA code:
- go to the code window
- press right mouse button into the disassembly (popup menu will open)
- select 'Search for' - 'Name in all modules' ('All names' window will open)
- for searching your function write it down directly to the window (press M e s s a g e B o x A on your keyboard :-)
you can see what you are writing in the tiltle bar from olydbg (right at the top)
- select export line for code

result in Win2k:
77E23259 > 55 db 55 ; MessageBoxA
JDog45
04-30-2004, 07:44 AM
Or Press Ctrl + N as a shortcut..
HexScribe
04-30-2004, 02:42 PM
Ok thanks guys!

:)


[tool] tiny hexer - good freeware hex editor

RCE Messageboard's Regroupment > The Heap > [tool] tiny hexer - good freeware hex editor
TBD
04-29-2004, 05:27 AM
Tiny Hexer (homepage (http://www.mirkes.de/en/freeware/tinyhex.php))

features:
* edit multiple files (mdi),
* read sectors of disks and other data media
* modifiy virtual memory of other processes.
* scriptable
* view data structures in a special browser in human readable format.
* Value Editor - edit hex data in different formats (like Byte, Char, DWORD, IEEE Float...).

---

nice freeware hex editor, good help file, structure viewer, 1.45mb download.


how 2 mov ollydump to center of screen?

RCE Messageboard's Regroupment > Plugins > how 2 mov ollydump to center of screen?
idoit
04-29-2004, 09:18 AM
after ollydump loaded it just pop up over my screen i can c half on the top of my screen. i cannot edit the raw size. can some 1 tell me how 2 move a bit lower with keyboard or to center of the screen. thnaks
Lord_Looser
04-30-2004, 05:51 AM
work with all Windows' windows:
- press ALT-space key combo
- a menu window will open left above
- press your language hot key letter for <u>m</u>ove (m?)
- move the window with the arrow keys


PECompact 2.01a script

RCE Messageboard's Regroupment > OllyScript > PECompact 2.01a script
Anonymous
04-29-2004, 10:27 AM
My final scrip for this packer..

/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize
var lbl1
var oki

sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto

cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret

lbl1:
MSG "Press SHIFT-F9 till break at 'JMP EAX'. Then F8 and you're on OEP!"

/Scarabee
Anonymous
04-29-2004, 11:19 AM
I managed to solve my problem, so this should be final :

/*

PECompact 2.01a (27-04-04 release) OEP Finder by Scarabee

Make sure you Select NO on 'Compressed code message' when loading application in Olly.
When at OEP, just dump and fix with IMPREC.

*/

var cbase
var csize
var lbl2
var lbl1
var oki

sto
findop eax, #c3#
bp $RESULT
esto
esto
GMI eip, CODEBASE
mov cbase, $RESULT
GMI eip, CODESIZE
mov csize, $RESULT
bpwm cbase, csize
esto
sto
bpmc
findop eip, #FFE0#
mov oki, $RESULT
bp $RESULT
esto

lbl2:
cmp eip, oki
jne lbl1
sto
MSG "This is OEP, now dump and fix!"
ret

lbl1:
esto
jmp lbl2
Anonymous
04-29-2004, 01:11 PM
Works for v2.02 also! (release 29-04-04)
eos
04-29-2004, 01:58 PM
http://www.pgware.com/downloads/pcmedik.exe <= pecompact 2.0
ollyscript OEP not find.
Anonymous
04-29-2004, 03:09 PM
Works fine for me.
i tried your application and script gives me OEP:

0048566C 55 PUSH EBP
0048566D 8BEC MOV EBP,ESP
0048566F B9 37000000 MOV ECX,37
00485674 6A 00 PUSH 0
00485676 6A 00 PUSH 0
00485678 49 DEC ECX
00485679 ^75 F9 JNZ SHORT PcMedik.00485674
vivaman
04-30-2004, 01:57 PM
Thanks.. "Anonymous"..
Scarabee
04-30-2004, 02:44 PM
You're welcome..

i didnt register here just yet. as you can see, i did by now :))


BUG OR NEW FEATURE OF OLLYSCRIPT

RCE Messageboard's Regroupment > OllyScript > BUG OR NEW FEATURE OF OLLYSCRIPT
Ricardo Narvaja
05-01-2004, 11:40 AM
When you use

log eax

and eax point to one string, in the log you can view this string perfect, but when you or log [esp] if olly show a string in the stack, in the log only appear the hex value but not the string, this is very important, the possibility of show in the log the strings of the stacks (or the strings of certain memory address)

Ricardo
psyCK0
05-03-2004, 07:53 AM
Will fix asap.
britedream
05-03-2004, 11:11 AM
comparison to -1 ;"FFFFFFFF", doesn't yield correct result.

Regards.
psyCK0
05-04-2004, 01:40 PM
Will check that also.
psyCK0
05-06-2004, 11:22 AM
Ricardo:
Seems to work? check this:

// When you break on a breakpoint on a call to MessageBoxA
// this script logs the value of messagebox message
var x
mov x, esp
add x, 4
log [x]
ret

britedream:
Can you please paste me the scriptline you execute when you get bad results?
Ricardo Narvaja
05-06-2004, 04:00 PM
i try but this script show in the log the string of messageboxa?
Not the value the string

Ricardo
Ricardo Narvaja
05-06-2004, 04:03 PM
if eax=432000 and in 432000 there are a string this appear in olly and in the log, but in the stack if [esp] or any value of the stack point to a string, in olly in the stack you can view the string but in the log ollyscript only show the hex value not the string.

Ricardo
psyCK0
05-07-2004, 03:49 AM
well, thats what i tried to illustrate with the script....
when you break on the call to messageboxa then [esp+4]
= the string that appear in the msgbox. ollydbg also shows this string in the stack window and ollyscript logs it to the log window.
or doesnt it work that way for you?
psyCK0
05-07-2004, 12:40 PM
Ricardo: I just read a tut of yours that said:

Se me ocurren algunas ideas pero la almohada puede que me ayude a ordenarlas y quizás el susodicho OLLYSCRIPT ayude un poco también, aunque mis primeros intentos de hacer un script que me ayude dieron con un bug del mismo OLLYSCRIPT que acabo de reportar al autor veamos si para la parte 2 de este tute ya lo arreglo y nos puede ayudar.

What is this bug you mention? Is it the stack string logging problem?
Ricardo Narvaja
05-07-2004, 06:53 PM
my scipt is this and is not the original, but with the trouble of no logging the scripts of the stack, i was changing and trying but i can not log the strings of the stacks in the log
---------------------------------------------------------------------- ----------------
var a
var b
var c
var d
var e
var f
var g

eob FILE
run

FILE:
log "PARO EN TU API"
log "VALORES ANTES DE LA API"
log eax
log ebx
log ecx
log edx
log esi
log edi
mov a,[esp]
log a
mov b, [a]
log b
add a, 4
log a
mov b, [a]
log b
log a
mov b, [a]
log b
add a, 4
log a
mov b, [a]
log b
add a, 4
log a
mov b, [a]
log b
add a, 4
log a
mov b, [a]
log b
add a, 4
log a
mov b, [a]
log b
add a, 4
rtu
log "VALORES DESPUES DE LA API"
log eax
log ebx
log ecx
log edx
log esi
log edi
run
jmp FILE

---------------------------------------------------------------------- ------------
is for any api you put a BP or HE and you look in the log strings compared, strings of messages, values before and after the api, and strings of the stack, but only in olly when stop in the stack i see the strings in the log only view hexa values.

Ricardo
psyCK0
05-08-2004, 06:43 AM
hey Ricardo!

Here you go, a working script to log API parameters at calls:

/*
* API logger v1.0
* This script logs API call parameters and registers to LOG window
* By SHaG
*/

var stackpointer
var pointed_to
var counter

eob FILE
run

FILE:
log "Register values before call:"
log eax
log ebx
log ecx
log edx
log esi
log edi
log esp

log "Stack parameters"
mov stackpointer, esp
mov pointed_to, [stackpointer]

mov counter, 4 // number of API parameters to log

apiloop:
log stackpointer
log pointed_to
add stackpointer, 4
mov pointed_to, [stackpointer]
sub counter, 1
cmp counter, 0
jne apiloop

rtu
log "Register values after call:"
log eax
log ebx
log ecx
log edx
log esi
log edi
log esp
Ricardo Narvaja
05-08-2004, 07:52 AM
is the same better organized and show you the string of the stack?
I try in the new olly , i'm using 1.10b for the bugs of 1.10c.

Ricardo
psyCK0
05-08-2004, 09:32 AM
Yeah, it shows me the strings in the stack... OD v1.10C, OSC v0.8 ...
Should also work with OD v1.10B and OSC v0.7

Your script was a bit wrong, you incremented the value pointed to by ESP by 4. The right thing is to increment the value OF ESP by 4 =)

have you tried my script?
Ricardo Narvaja
05-08-2004, 09:51 AM
the string of mine was right a 3 days ago but i was changing and toching for look the strings and i corrupt jeje, in the first moment work right but i don't store, for not look the strings.
I try your script
psyCK0
05-08-2004, 10:08 AM
yeah, try it and tell me if it works please!
Ricardo Narvaja
05-08-2004, 10:08 AM
yes the strings are in the log but the script stop after one api, the goal is the program log all the calls to an api and continue running, logging the values and the strings, this only log and pause one only call to an api.

Ricardo
psyCK0
05-08-2004, 12:46 PM
OllyScript v0.81 now available!

Main change in v0.81:
OLLYSCRIPT v0.81 NOW WORKS WITH OLLYDBG v1.10b.
I reverted to the old code because of the bugs in OllyDbg v1.10c.
Some minor bugfixes were also made
psyCK0
05-08-2004, 12:47 PM
Ricardo:

This script should do what you want:
/*
* API logger v1.1
* This script logs API call parameters and registers to LOG window
* By SHaG
*/

var stackpointer
var pointed_to
var counter
var apiaddr

eob API

// Get API addr and set BP
gpa "CreateFileA", "kernel32"
mov apiaddr, $RESULT
bp apiaddr
run

API:
log "Register values before call:"
log eax
log ebx
log ecx
log edx
log esi
log edi
log esp

log "Stack parameters"
mov stackpointer, esp
add stackpointer, 4
mov pointed_to, [stackpointer]

mov counter, 4 // number of API parameters to log

apiloop:
log stackpointer
log pointed_to
add stackpointer, 4
mov pointed_to, [stackpointer]
sub counter, 1
cmp counter, 0
jne apiloop
rtu

log "Register values after call:"
log eax
log ebx
log ecx
log edx
log esi
log edi
log esp
run

By the way there is a nice tool called Auto Debug for Windows v2.3.1.60 Professional
for this.
Ricardo Narvaja
05-08-2004, 05:22 PM
yes there are tools but this plugin maybe useful not only for apis when you can view access to certain address logged, well has the problem of RETURN TO USER CODE but is very easy of repair.

For example you can view acess to 401500, put a BPM ON ACCESS in this adress on HBPM ON ACESS and the program will be logging the values, strings etc when a program try to acess certain location.

Is very useful and there are no tools for this.

Ricardo
leesj85
05-29-2004, 02:29 PM
britedream

hi britedream,

could you send me your stolen bytes tuts?

e-mail: leesj85@empal.com


Debug symbols, information, symbol server setup

RCE Messageboard's Regroupment > General > Debug symbols, information, symbol server setup
focht
05-02-2004, 02:30 PM
Greetings,

i have some annotations/requests regarding ollydbg's use of symbol files (.pdb, .dbg) with operating system binaries.

Ollydbg seems to load both, the (older) imagehlp.dll and newer versions of dbghelp.dll (in start directory) to fetch symbolic information.
I assume "set symbols path" option in ollydbg corresponds with appropriate "SymSetSearchPath" or "SymInitialize" stuff.

This doesnt work at all if i feed my symbol store to ollydbg.
Even with latest dbghelp.dll in ollydbg directory (from "debugging tools for windows") it is not clear to me how and when symbolic information is used.
In fact i can't see much use (no dbghelp API getting initialized) in ollydbg.

I wrote a simple console program (proof of concept) which loads "dbghelp.dll" and initializes the debug symbol API using "SymInitialize".
I can see the symbol server dll loaded and the dynamic symbol file fetch mechanism works.

I would like to gain more information from ollydbg when specific symbols for a module are correctly loaded and when not.
Like the VS.NET 200X "modules" list where is a column "symbols" which displays the state.
Or like windbg's commandline output.
There is even an "reload symbols" option which i would like to see too.
Additionally i would like to customize symbol options before the symbol load process with "SymSetOptions"-like dialog:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug /base/symsetoptions.asp
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/symsetoptions.asp
)

The showstopper is the use of the new "symbol server" technology.
I mainly use VS.NET 2003 for source level debugging which is able to fetch symbols for every binary on demand (if available).
No more need to download symbol files separately/for each service pack.
I can even remotely debug another system which is different to my host system and symbol server will fetch debug symbols for the remote system, allowing me to see "informational" callstacks.

Symbol server tech:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug /base/symbol_servers_and_symbol_stores.asp
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/symbol_servers_and_symbol_stores.asp
)

The debugging symbols interface of ollydbg could be polished up a bit (more user friendly, more information).
Support of symbol server would improve usability much.

Regards,

A. Focht
oh me anon
01-24-2005, 12:20 PM
Dear Focht ,
Greets
i wanted to look at some symbols from ntdll.dll
so i was poking around and i saw ollydbg wasnt loading symbols like you say in this thread
so i digged in little deep to look at .symopt params
and i saw olly was using 0x1212 as the default param
whereeas the windbg help file (version 6.02.007) was stating that
that the default value for windbg is 0x30337 and for kd.exe it is 0xb0227

so i kinda patched ollydbg to take these params
replaced the old dbghelp.dll with the one from windbg

and i notice ollydbg is now able to load the symbols from
c:\symbols ( this was originally set by livekd environment variable _nt_symbol_path)

if time permits could you please look at this and reply back
the patch is as follows

fc ollydbg.exe ollydbgmodsymold1.exe
Comparing files OLLYDBG.EXE and OLLYDBGMODSYMOLD1.EXE
00090709: 10 27
0009070A: 12 02
0009070B: 00 0B

rva here
00491107 |> \81CA 27020B00 OR EDX, 0B0227 (i use kd.exe default as it suppresses dialogs and sets enum source off by default ie it differs from windbg default by +0x80000 -0x10

i am not using the view-->debug-->select path for symbols it is blank in ollydbg.ini

Thanks and Regards
Lord_Looser
01-24-2005, 02:12 PM
default folders for symbols
c:> tree C:\WINNT\system32\Symbols

C:\WINNT\system32\Symbols
├───16bit
├───8bf
├───8bi
├───acm
├───ax
├───cfm
├───cnv
├───com
├───cpl
├───dll
├───drv
├───ds
├───exe
├───flg
├───ime
├───io
├───mll
├───noexport
│ ├───dll
│ ├───exe
│ └───sys
├───ocx
├───scr
├───sys
├───tsp
├───uniproc
│ ├───dll
│ └───sys
├───usa
├───winnt32
│ ├───dll
│ └───exe
└───wpc

example:
copy winmine.dbg & winmine.pdb in favor of winmine.exe into directory C:\WINNT\system32\Symbols\exe
oh me anon
01-24-2005, 02:50 PM
Lord_looser i can copy all those .pdb and .dbg files one by one into ollydbg folder itself and they work fine without any patch etc
that way it doesnt need the symsrv.dll and doesnt need to download
anything it would use the files that was fetched by windbg without problems
i was loking for a some way which uses the functionality automatically

but it seems i have dig a litle more
with the above patch olly just seems to find the same symbols that are already available in view names and just embeds them in the .udd file
and updates the log window with a message saying
debugging info available in microsoft format
if i use view names i just see a duplicate list of same names
but the title says Library instead of Export

and the disassembly details are certainly different than with windbg
after posting the first post
i made a concurrent session with windbg and ollydbg at the same time
and olly didnt load the symbols so it is back to square one
for now :(
focht
01-25-2005, 04:22 AM
Hi,

and olly didnt load the symbols so it is back to square one
for now :(

thats what i tried to tell in initial post ... i debugged ollydbg itself in that case, verifying its use of dbghlp api - it doesnt work the way one would expect (sym init sequences, sym api queries) ;(

I guess we have to wait til V2 to see if situation improved.

Regards
oh me anon
01-28-2005, 11:36 AM
Dear Focht,
Greets ,
a little more pestering form me :)
hope you get some time to check it up :)

it seems after DBGHELP.dll sets the symsearchpath to default
_nt_symbol_path + _nt_alt_symbolpath+ systemroot coz olly pushes
0 to syminitialize
olly sets the symsearchpath again to just the exe directory
which just overrides the default searchpath :)

so i kinda patched olly again not to set the default search path
this patch below skips the msvcrt_fnmerge() and SymSetSearchPath()
004911EC . /EB 2E JMP SHORT OLLmodsy.0049121C

this now successfully fetches the symbols :) but works kinda too slow to my liking (syn_sent for all plugins and failing to fetch the dbg and pdb files for all the plugins that are loaded makes it too slow at the starting :)
like ida analysis you run the exe and go have a coffee,get your lungs polluted a little and then gossip with the receptionist piss off and come back and you will still find it thinking :)
but that may be because i compare ollydbg on ollydbg on debugges time
i suppose it wouldnt be the same case in ollydbg on debuggee
anyway i dint check :)

anyway focht would you please check it out and tell if this works :) or it creates some other problems ???

my latest patches

C:\TC\odbg110>fc ollydbg.exe ollmodsym.exe

Comparing files OLLYDBG.EXE and OLLMODSYM.EXE
00090709: 10 37
0009070A: 12 02
0009070B: 00 03
0009070C: 00 80
000907EC: 74 EB

C:\TC\odbg110>

1)for .symopt i use 80030237 (windbgs default+ !sym noisy + !sym on)
and the patch at 907ec is to jump directly without setting the symsearchpath()

2) symsrv.dll dbghelp.dll and srcsrv.dll in ollydbg directory

without srcsrv.dll initialized files with source dont work i think
didnt check it (but if there is srcsrv in ollydbg directory
i see it getting initialised so it is a better option in my opininion to put it there :)

3)_nt_symbol_path == symsrv blah blah (default of livekd) which points to c:\symbols in my case

call stack shows this for icztutes\03 == win.exe

Procedure / arguments
? USER32.NtUserFindExistingCursorIcon (doesnt exist in plain )
Arg1 = 0012FCBC
Arg2 = 0012FCCC
Arg3 = 0012FF04
? USER32.FindExistingCursorIcon (doesnt exist in plain)
Arg1 = 77E69318
Arg2 = 00007F00
Arg3 = 0012FF04
USER32.LoadIcoCur
Arg1 = 77E10000
Arg2 = 00007F00
Arg3 = 00000003
Arg4 = 00000000
Arg5 = 00000000
Arg6 = 00008040
USER32.LoadIconW
hInst = NULL
RsrcName = IDI_APPLICATION
<JMP.&USER32.LoadIconA>
hInst = NULL
RsrcName = IDI_APPLICATION
WIN.00401031
Arg1 = 00400000
Arg2 = 00000000
Arg3 = 00132330 ASCII ""C:\masm32\ICZTUTES\TUTE03\WIN.EXE""
Arg4 = 0000000A
0012FFC4 77E87903 Maybe WIN.<ModuleEntryPoint>

in names window i see

lot of xxx names :)
Names in USER32, item 3297
Address=77E357AD
Section=.text
Type=Library
Name=xxxCBSizeHandler

Names in ntdll, item 1581
Address=77FB0BB8
Section=.text
Type=Library
Name=RtlpDebugPageHeapSearchAvailableMemListForBes tFit

Names in GDI32, item 2277
Address=77F49758
Section=.text
Type=Library
Name=vOutlineTextMetricWToOutlineTextMetricA

Names in RPCRT4, item 3623
Address=77D41E7B
Section=.text
Type=Library
Name=TransportProtocol::SetStateToLoadedAndMonitor ProtocolIfNecessary

Names in ADVAPI32, item 1005
Address=77DB1200
Section=.text
Type=Library
Name=_imp__NtAccessCheckByTypeResultListAndAuditAl armByHandle

hope you could point out some problems with using the above patch
and confirm if it really works the way it should work
i normally dont work with symbols so i cant say if there are problems

i saw some access violation in dbghelp.dll during
SymLoadModule() but after trying to ascertain causes i couldnt find some thing credible so uses add last exception and it seems to wrok well
any comments corrections problems are welcome :)

thanks and regards
focht
01-28-2005, 05:55 PM
Hello,

actually i'm very pleased ;)
I applied your patch and voila symbol server setup works as expected.

2) symsrv.dll dbghelp.dll and srcsrv.dll in ollydbg directory

Yes i already had them there, copied from latest windbg package ("debugging tools for windows") which is quite nice itself.
Windbg is steady getting better over time...

nt_symbol_path == symsrv blah blah (default of livekd) which points to c:\symbols in my case

Yes, mine is similar:

_NT_SYMBOL_PATH=symsrv*symsrv.dll*e:\symbols*http: //msdl.microsoft.com /download/symbols

hope you could point out some problems with using the above patch
and confirm if it really works the way it should work
i normally dont work with symbols so i cant say if there are problems

As i said above .. it seems to work.
I have a local web proxy and can watch symbol server queries going out for missing/mismatched pdb's.

i saw some access violation in dbghelp.dll during
SymLoadModule() but after trying to ascertain causes i couldnt find some thing credible so uses add last exception and it seems to wrok well
any comments corrections problems are welcome :)

Didnt see any here (all exceptions unchecked, loaded ollydbg in ollydbg and simple debuggee).

Its a very useful patch because variable names/data structures in usermode system dlls are now displayed correctly (though not as good as IDA does but well ... )

Nice work. ;)

Regards
oh me anon
01-29-2005, 07:25 AM
Dear Focht,

thanks for confirming that it work as expected did you load any debuggee
that has source files and tried to look if sources load too properly
i mean .pdb files of compiled exes in a complex project that has its
.pdb .dbg .map files in some of thier default directories
does the srcsrv.dll find them properly

ida also identifies flirt signatures as far as i know so it may be showing some more details but i think godup plugin can also load the
flirt signatures from ida signatures

anyway i put ollydbg on ida and created a map file and converted that map file by mapconv plugin that is how i found out that the call above is
fnmerge() :)

004911CF CALL <OLLYDBG.j___fnsplit>
004911D4 ADD ESP, 14
004911D7 PUSH OLLYDBG.004C8CC1 ; /ProcNameOrOrdinal = "SymSetSearchPath"
004911DC MOV ECX, DWORD PTR DS:[4D5A00] ; |DBGHELP.02800000
004911E2 PUSH ECX ; |hModule = 0012BB50
004911E3 CALL <OLLYDBG.GetProcAddress> ; \GetProcAddress
004911E8 MOV ESI, EAX
004911EA TEST ESI, ESI ; DBGHELP.SymSetSearchPath
004911EC JE SHORT <OLLYDBG.loc_49121C>
004911EE PUSH 0 ; /Arg5 = 00000000
004911F0 PUSH 0 ; |Arg4 = 00000000
004911F2 LEA EAX, DWORD PTR SS:[EBP-638] ; |
004911F8 PUSH EAX ; |Arg3 = 0012B640 ASCII "\masm32\ICZTUTES\TUTE03\"
004911F9 LEA EDX, DWORD PTR SS:[EBP-7] ; |
004911FC PUSH EDX ; |Arg2 = 0012BC71 ASCII "C:"
004911FD LEA ECX, DWORD PTR SS:[EBP-128] ; |
00491203 PUSH ECX ; |Arg1 = 0012BB50
00491204 CALL <OLLYDBG._fnmerge> ; \OLLYDBG.004A5198
00491209 ADD ESP, 14
0049120C LEA EAX, DWORD PTR SS:[EBP-128]
00491212 PUSH EAX
00491213 MOV EDX, DWORD PTR DS:[4D5A78]
00491219 PUSH EDX
0049121A CALL NEAR ESI ; DBGHELP.SymSetSearchPath

the access violation i am talking about happens here in dbghelp.dll

Log data, item 0
Address=0283BCEE
Message=Access violation when reading [00000011]

disassembly window
0283BCEE MOVZX EAX, WORD PTR DS:[EDX+12]

edx+12 ==

DS:[00000011]=???
EAX=0620A2AC

callstack
Call stack of main thread, item 0
Address=0012ABDC
Stack=0283A74D
Procedure / arguments=DBGHELP.0283AEC0
Called from=DBGHELP.0283A748
Frame=0012ABD8

this violation may be because i was using the unpatched ollydbg on patched ollydbg but it would be better if some one independantly
corraborates the result :)

also did you try changing the symbolpath to come new directory
and see if ollyfetches it on its own ?? and also extracts the .pd_files
to.pdb files etc

ill check these points but it would be better if i get a corraborated
results so that i can concentrate on patching it more :)

Thanks and Regards


Can't "Step" after "Pause

RCE Messageboard's Regroupment > General > Can't "Step" after "Pause
Lena
05-04-2004, 04:27 AM
Try to do the following:

1. Open "calc.exe" (for examle)
2. Start it - "F9"
3. Then "Pause" it - "F12"
4. Press "Step" - "F8"

Instead of one step "calc.exe" will running.
What's the problem?
focht
05-04-2004, 05:20 PM
Hello Lena ;)

Your operating system is Windows XP based, right?

Well the magic lies in the instruction displayed before return in ollydbg's cpu window.
Sysenter (intel, PII or later) or Syscall (amd) are used for usermode/kernelmode transitions (not only on windows, newer linux kernels use it too).

In NT-based systems (Windows 2000 and the former), the kernel was entered using int 2E system trap, called the Native Call Interface (NCI).

With newer processor generations a few special instructions were added to make user/kernel mode transition less costly (faster).
Normally one could spend about 1500-2000 cycles for "traditional style" call gates/interrupts.
Sysenter/Sysexit are actually very fast - compared to call gates - they "only" use like 150 cycles (consult intel documents for details).

Whats the point... well
Sysenter doesn't save the return address.
It wipes out the user stack pointer too, thats why it gets saved away before sysenter.

Before executing Sysexit itself (from kernel mode), EDX contains user mode return address and ECX the user mode stack pointer.
(there is another important register while transitioning - the MSR - but thats another story...)

So lets break it down for your case:

If you pause calc.exe you see its pumping messages using traditional message loop:

> user32.dll!_NtUserGetMessage@16() + 0xc
calc.exe!_WinMain@16() + 0x25f
calc.exe!_WinMainCRTStartup() + 0x174
kernel32.dll!_BaseProcessStart@4() + 0x23

Lets follow it (i commented each line before)

----------------------

_NtUserGetMessage@16:

; eax contains the syscall number
77D439FD B8 A5 11 00 00 mov eax,11A5h

; the shared system call address
77D43A02 BA 00 03 FE 7F mov edx,7FFE0300h

; get to shared system call area
77D43A07 FF D2 call edx

; pop 4 parameters (important: we land here after Sysexit)
77D43A09 C2 10 00 ret 10h

----------------------

Ok ... whats at shared system call address:

; save away the sysexit trampoline (user mode return address)
7FFE0300 8B D4 mov edx,esp

; lets do it .. make transition to kernel mode
7FFE0302 0F 34 sysenter

; never reached
7FFE0304 C3 ret

----

Saw my last comment?
Thats the important one why ollydbg behaves like you reported.

When returning from Sysenter using Sysexit (kernel -> usermode), the execution is not resumed at "7FFE0304 C3 ret".
Instead the "ret 10h" at 0x77D43A09 is used, because it was saved as return addr in EDX.
Put a breakpoint at 0x77D43A09, single step and you will see ;).

I just guess the author of ollydbg just overlooked this ... you might call it a bug .. well ;)

Hope i could help...

Regards,

A. Focht
Lena
05-06-2004, 02:14 AM
A.Focht,

Thanx a lot for your answer!


Address of FS?

RCE Messageboard's Regroupment > Plugins > Address of FS?
psyCK0
05-04-2004, 05:26 PM
Hey...

Maybe someone can help me here...
In the main Olly window, just below the registers, you can see segment register values. For example in my case it says:
FS 0038 32bit 7FFDE000(FFF)
What I was wondering is how to get this value (7FFDE000) from a plugin?`Also whats the (FFF) used for?

Cheers!
focht
05-04-2004, 05:44 PM
Greetings,

What I was wondering is how to get this value (7FFDE000) from a plugin?

May like this (not tested):

t_thread* thread = ::Findthread( ::Getcputhreadid());
if( thread != 0)
{
ulong fs_value = thread->reg.s[ SEG_FS];
// do something ...

}

Also whats the (FFF) used for?

See my answer here: http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=524
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=524
)

Regards,

A. Focht
psyCK0
05-05-2004, 07:25 AM
I actually wrote exactly the same code and it gives me 0038 in fs_value ... But how do I find 7FFDE000 from there?

Thanks for replying!
focht
05-05-2004, 08:20 AM
Greetings,

ah well ... i overlooked this (thought you only wanted the selector value).

The base addresses and limits are stored in same structure and accessed in same way.

// get FS base
ulong fs_baseaddr = thread->reg.segbase[ SEG_FS];

// get FS limit
ulong fs_limit = thread->reg.seglimit[ SEG_FS];

Regards,

A. Focht
psyCK0
05-06-2004, 11:45 AM
this is buggy in the latest odbg... gonna report to olly...


Finding OEP op early Armadillo

RCE Messageboard's Regroupment > General > Finding OEP op early Armadillo
Pompeyfan
05-04-2004, 06:39 PM
Trying to unpack Netnanny 5, I scanned some of the .exe files with PEid, and interestingly the only file protected was nntray.exe, which is protected by Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks

Armkiller is the only one that dumps it, but on checking the eip.bin file, all that is in there is ° , and when I try and fix the import table with Imprec, when I get to the fix dump button, I get the message "Invalid dump file!Cant match RVA to offset in the dump file"

How do I find the correct OEP for this version of Armadillo?
psyCK0
05-05-2004, 07:26 AM
Dont think this is the place to ask... Try W**dmann's board


1.10c bug, crash OllyDBG

RCE Messageboard's Regroupment > Bugs > 1.10c bug, crash OllyDBG
ssb
05-05-2004, 04:35 AM
The following bug exists in latest build (1.10c) and is reproducible.

Start debugging an exe
Analyze it
Run it (F9)
Terminate it normally (from the program exit not from Olly)
Right click on disassemply window immediately after program exit.
OllyDBG crash

It happens on all OllyDBG installations here in my company's LAN, any setup (including clean OS systems) and any debugged exe application.
(WinXP / SP1 + all hotfixes, P4 > 3G, 1-4 GB Ram)
Ricardo Narvaja
05-05-2004, 07:37 AM
yes is true, the right click button crash olly 1.10c in many situations, i was cracking an armadillo and when right click in a call, olly crash, with 1.10 b work perfect in the same program, in the same call, in the same moment.

Ricardo
Lord_Looser
05-05-2004, 07:22 PM
same problem?
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=3& topic=670 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=3&topic=670)
cps530
05-05-2004, 09:13 PM
Just for your information, I'm trying to reproduce the problem described but nothing happens. It's all working fine. (windows xp professional)
psyCK0
05-06-2004, 03:52 AM
crashes for me too... OS: XP PRO SP1
Lord_Looser
05-06-2004, 04:42 AM
to reconstruct a crash at OllyDbg 1.10c:

debug calc.exe – open cpu window - goto any address without a module into disassembler with strg-g (e.g. 10000) – right click on disassemby --> crash

It always seems to crash if there is no module to disassemble at the CPU window.
Goudaman
05-16-2004, 08:01 PM
Anyone know of any solutions to this? I get it too. XP Pro Sp1 For now i'm going back to 1.09d..since its never crashed on me once
ssb
05-17-2004, 04:51 AM
Anyone know of any solutions to this?

I think you should wait for next build, really hope it will be out soon.


MFC API

RCE Messageboard's Regroupment > General > MFC API
MC707
05-05-2004, 05:54 AM
Can OllyDbg recognize MFC "API"?
For example:
00417D5C ¦. E8 C5520300 ¦CALL ‹JMP.&MFC42.#5857›
focht
05-05-2004, 08:15 AM
Hi,

see my reply here:

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=3& topic=518
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=3&topic=518
)

Regards,

A. Focht
MC707
05-05-2004, 11:06 AM
oh, i've not saw this post. Thx.

Yeah, thats a pity that it cant be so.
psyCK0
05-05-2004, 12:13 PM
You can use IDA to explore your target, then create a .map file and use a plugin to import the .map into Olly. Easy, huh? =)
MC707
05-06-2004, 03:14 AM
Yeah! That works. :) I dont knew it. Big thanks!


ASProtect 1.23 RC4 (again) - Stolen bytes

RCE Messageboard's Regroupment > General > ASProtect 1.23 RC4 (again) - Stolen bytes
Strangerke
05-05-2004, 02:41 PM
Hi,

I'm busy on a tool packed with ASProtect 1.23 RC4 for DAYS and I read a lot of tutorials just to be sure I wasn't doing stupid things.

Well, I thing that what still missing are the stolen bytes and obviously the final OEP modification (I've already set it to a temporary value I got by using tc eip<900000)

I'm sure there are stolen bytes because in the trace run I can see
REPSTOSB
POPFD
POPAD
RETN

I then tried to use LaBBa trick (searching for a "push ebx push esi push edi" block) but found nothing useful.
And when I take a look at the bytes before the OEP, I just can find 46 (!!!) stolen bytes.

My question is the following :
Does someone already saw this king of enormous amount of stolen bytes ?

By the way, I identified the version ASProtect by using PEid. Is there anothere way to do so ? (Manually if possible)

Thanks in advance for your precious help...
Scarabee
05-06-2004, 07:39 AM
Well, as we dont know what target you are working this is rather hard to determine your stolen bytes.
However, i ran into some application once which contained a great deal of stolen bytes also. The pattern looked like this:

PUSH EBP
MOV EBP,ESP
PUSH -1
PUSH DVDIdleP.00****** <-- Needs updating
PUSH DVDIdleP.00****** <-- Needs updating
MOV EAX,DWORD PTR FS:[0]
PUSH EAX
MOV DWORD PTR FS:[0],ESP
SUB ESP,68
PUSH EBX
PUSH ESI
PUSH EDI
MOV DWORD PTR SS:[EBP-18],ESP
XOR EBX,EBX
MOV DWORD PTR SS:[EBP-4],EBX
PUSH 2

This might be of use to you !?

/Scarabee
Scarabee
05-06-2004, 07:54 AM
btw, read all about this subject here:

h**p://www.exetools.com/forum/showthread.php?t=3720&highlight=stolen+b ytes

Thats where i discovered about that ammount of stolen bytes also then. very usefull!
Radier
05-06-2004, 10:26 AM
try this tute
h**p://www.exetools.com/forum/attachment.php?attachmentid=1199

it may help

Best Wishes

R@dier
Strangerke
05-06-2004, 11:25 AM
Well in fact the problem is I cannot find any reference to
PUSH EBX
PUSH ESI
PUSH EDI

Therefore, I have problems finding the stolen bytes.

I just added the initialization of EAX and a standard header, and I can continue the job, but it's far from being perfect (I don't like to do approximations, even if in this case it works).

In order to find the stolen bytes, I thaught I could also set a trace condition on
REP STOS BYTE PTR ES:[EDI]
as it's the operation that erases the stolen bytes.

It doesn't seem to work... (nor to trace with an address condition by the way : e.g. 'TC EIP = A57946' has no usefull effect) Is it related to the version of OllyDbg I'm using ? (1.10c)

By the way, exetools doesn't accept new members nowadays, and I'm not registered...I therefore do not have access to the forums... :(

Strangerke
Radier
05-06-2004, 12:13 PM
Strangerke
give me an email addy or
pm me at the W**dmann's board
and I will send it to you

R@dier


[plugin] OllyScript v0.8

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.8
psyCK0
05-06-2004, 04:08 PM
2. Status (6 May 2004)
----------------------------
All right, v0.8 of OllyScript is ready. Thanks to R@dier it now
has a PE dumper engine. I really don't have much time for the plugin
at the moment, so updates will be kinda slow. Please have patience!

!!!IMPORTANT!!!
The plugin is rewritten to work with OllyDbg v1.10c ONLY!!!
If you don't want to upgrade please use v0.7 or earlier!
Also due to a bug in OllyDbg v1.10c this plugin's debugger hiding
functionality is likely to not work with next OllyDbg version.
Of course I will update the plugin immediately when it comes out.

Also I've got some comments about writing values to memory (like NOPs).
It's already there! Please check the MOV command carefully! I've also
added a FILL command to simplify NOPing code and zeroing memory.

TO ALL THE FRIENDS FALLEN VICTIM TO GREEDY SOFTWARE COMPANIES - I GRIEVE WITH YOU.

2.1 What's new?
---------------
+ New commands: DBH, DBS, DPE, FILL
+ PE dumper
+ Debugger hiding
# FIND now accepts wildcards

------------------------------
TBD
05-07-2004, 04:09 AM
psyCK0: nice stuff. thanks !
freeshown
05-07-2004, 04:34 AM
very nice stuff.
thank u~!
Gigapede
05-07-2004, 05:07 AM
Great work!
Because the dump engine was implemented, export function from OllyDump isn't needed anymore.

Thanks.
psyCK0
05-07-2004, 05:42 AM
Gigapede: yeah, but maybe you can implement integration with CommandBar ? I have sample code in the readme =)
Gigapede
05-07-2004, 07:38 AM
Sorry, I posted update info of new CommandBar to old thread in plugins.

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=601
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=601
)

>psyCK0:: I implement command calling OllyScript in CommandBar.
>
>http://dd.x-eye.net/file/cmdbar310109c.zip
>[OSC script file name(fullpath|relative from OllyDbg installed)]
>
>It is nice to make option to set default path of script file in >OllyScript, isn't it ?
>It is such a bother to have to specify full path.
>
>anyway thanks.
>
>Please wait the OllyDump export function.
Anonymous
05-07-2004, 08:28 AM
sorry to hijack thread but gigapede did you read this post

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=638
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=638
)

any comments
psyCK0
05-07-2004, 12:37 PM
Gigapede: cool =)
caty
05-08-2004, 04:04 PM
hey psyCK0
i want to do dump file which appends the same file when it breaks,you said this version could to it,but how?
psyCK0
05-08-2004, 04:33 PM
i dont really understand your question...
Gigapede
05-08-2004, 11:07 PM
Anonymous:: It must be a bug.
At first the label was put on a debuggee image.
I don't know it is possible to put label on outside of debuggee memory, but I try to make it.
caty
05-09-2004, 01:53 PM
i dont really understand your question...

I am using this script to dump edi to file,but when it breaks again it overwrites the dump,So instead of overwriting it needs to add the dump(append) to the same file :)
start:
bp 1AD6358
cmp eip,55407D
jne start
go edi
dm edi, 40, "c:\dump.bin"
msg "script finished"
jmp start
ret
psyCK0
05-09-2004, 06:26 PM
aaaah, ok =)
will be available in v0.82!
Anonymous
10-27-2004, 03:16 PM
also tell, where from we can get full scripts in single zip file!


Scribble pad?

RCE Messageboard's Regroupment > General > Scribble pad?
TheBlasphemer
05-08-2004, 10:07 AM
Hi,

I recently had to use windbg because i needed it to download some PDB's for me.
I am totally in love with ollydbg, but while using windbg for this very short period, i did find a very usefull feature:
the scribble pad.
It's actually just a little box on the side of your screen where you can write little notes to yourself.
I was wondering, is this also in ollydbg or any plugin? and if so, where?

GRTZ TB
psyCK0
05-08-2004, 02:26 PM
not a bad idea =) write a plugin!
TheBlasphemer
05-09-2004, 03:20 PM
hehe, how :P?
psyCK0
05-09-2004, 06:23 PM
Well...

1. Learn C/C++ if you dont know it already
2. Study the examples available on the OllyDbg official site
3. Write plugin =)

Idea - maybe the notes can be stored in text files in the same place as the UDDs and auto-loaded with teh target?


Hehe,My first plugin Launcer.dll

RCE Messageboard's Regroupment > Plugins > Hehe,My first plugin Launcer.dll
Teerayoot
05-08-2004, 10:12 PM
Sorry for too fast release my plugin,it still alpha testing;)

Some bug may have,and something may not implement yet,but it may helpfull sometime.
I coding for learning c++ programming .
www.prdhosting.com/teerayoot/Download/Launcer.zip
(http://www.prdhosting.com/teerayoot/Download/Launcer.zip
)

Version 0.2 will be avial tonight
*with Make alway launced program work alway all top.
*more options.

Any bugs please report here ,thank you.
Teerayoot.
Teerayoot
05-08-2004, 10:53 PM
In Options DlgBox ,Right click to remove selected item.
Teerayoot
05-08-2004, 11:02 PM
*0.11,minor bug fixed
*Browse/Add
http://www.prdhosting.com/teerayoot/Download/Launcer.zip
Teerayoot
05-09-2004, 04:06 PM
Help me!

I want to put new program name into Launced menu when Browse/Add was clicked.

You see ,when u click Browse/Add , it need to close OllyDbg and Open it again to call

ODBG_Pluginmenu(int origin,char data[4096],void *item) {code here} for update new submenu.

How to put new program name into Launced menu when Browse/Add was clicked no want to reOpen Ollydbg.
focht
05-09-2004, 04:27 PM
Hello,

there is no intro (readme.txt) nor source associated with the .zip archive. Dll only ... well.

Could you please describe what purpose your plugin serve?
Thanks.

For the "menu item" thing ... well ollydbg doesnt support dynamic rebuild of menu items (it would have to call each plugins menu export in a row to calc layout, resulting in performance loss each time a submenu is displayed).
Ollydbg reads the menu destriptors only once at start (ODBG_Pluginmenu) and builds the menu resource according.

There are some ways (hooking ollydbg window proc, search menu item resources and replace it) but that are dirty hacks and wont work reliably (without ollydbg's interaction)...

Regards,

A. Focht
Teerayoot
05-09-2004, 04:50 PM
Thank you for your reply,Focht.

My purpose of this plugin is to Help me to launce program no need to browse in explorer nor click on start menu,Just click in Plugin submenu(it more closer to reach).

Here my plugin BCB 6.0 source .
http://www.prdhosting.com/teerayoot/Download/Launcer0.11src.zip
Teerayoot
05-15-2004, 01:16 PM
//Readme.txt

Launcher 0.12 Ollydbg plugin (Written by Teerayoot).

Installagion...
Extract Launcher.dll to Ollydbg plugin folder.

Usage...
Launcher is a plugin help you to launch any tool with ease just click at plugin menu.
For first time need to Config and add tools you want to appear in plugin menu after that
restart ollydbg to take effect update plugin menu.

Know issue...
Config dialog not use ollydbg as parent window so that when you switch to another app you can't switch to

Config dialog again ,if someone can help me solve this ,please mail me to Teerayoot@bugsgroup.com.

Any comment ,bugs mail to Teerayoot@bugsgroup.com || Admin@Hacker2k2.com

//EOF
Download 0.12
www.prdhosting.com/teerayoot/Download/Launcher0.12.rar (http://www.prdhosting.com/teerayoot/Download/Launcher0.12.rar)


A script for pecompact new version(v2.08)

RCE Messageboard's Regroupment > OllyScript > A script for pecompact new version(v2.08)
loveboom
05-09-2004, 07:27 AM
pecompact v2.08's signature for peid v0.92

copy signature text->open"userdb.txt"->paste

signature text:

[PeCompact v2.08->Bitsum Technologies(signature by loveboom)]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D
ep_only=true

script:

/*
//////////////////////////////////////////////////
Pecompact v2.08 OEP Finder v0.1 beta
Author: loveboom
Email : bmd2chen@tom.com
OS : winxp,OllyDbg 1.1C,OllyScript v0.7
Date : 2004-5-8
Config: Ignore all exceptions.
Note : Donn't use this script unpack "pe2gui.exe"
If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var addr

start:
gpa "VirtualFree","kernel32.dll"
cmp $RESULT,0
JE lblabort
mov addr,$RESULT
bp addr
run

lbl1:
run
bc addr //Clear break point
rtu

lbl2:
findop eip,#FFE0#
cmp $RESULT,0
je lblabort
mov addr,$RESULT
bp addr
eob lbl3
run

lbl3:
bc addr
sto

lblend:
cmt eip,"OEP Found,Please dumped it!"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret

lblabort:
msg "Error! script abort, Maybe target is not packed by pecompact v2.08,more information,mailto bmd2chen@tom.com."
ret


f*cked up MFC

RCE Messageboard's Regroupment > General > f*cked up MFC
TheBlasphemer
05-09-2004, 03:21 PM
Hey,

I'm writing an add-on to msn messenger,
and because i wanna do some asm patches, I'm using Ollydbg for those.
However, Ollydbg always hangs on MFC42.dll.
Is there any way to let ollydbg ignore mfc42.dll and just move on without hanging on me?
Teerayoot
05-09-2004, 03:54 PM
yeah, if application refer to MFC42.dll module it's take too long for loading module,but not hang for me .Just wait for loading maybe 5 minute or more .

hmm,if not wait too long for this will be good.
focht
05-09-2004, 04:39 PM
Greetings,

Ollydbg always hangs on MFC42.dll.

could you please be more specific?

I guess you are debugging messenger app which loads some plugin dlls?
Though i've never worked with that msn stuff and dont know about its plugin architecture... lemme give following hints.

Remove each plugin.
Run the app in ollydbg.
Does it load completely?
Add each plugin again, one by one and do a test-run with ollydbg.

Try to isolate the plugin which causes mfc42.dll to be loaded.
(of course you could use some tool like dependency viewer or others too to get the plugins with mfc dependency).

When it hangs - does it hang the debugger completely or can you "break" the loading process.
If its breakable, post the call stack of main thread here.
(it might be a dreaded loader lock issue...)

Regards,

A. Focht


Altering ASCII text string

RCE Messageboard's Regroupment > General > Altering ASCII text string
briankai
05-09-2004, 11:05 PM
Hi guys, new to the board and the program, and I'm having a bit of a problem.

I need to change one of the text strings I found, but I have no idea how to do so. I attempted to convert the hex value, but it doesn't seem to be working.

This is what I've got:

00402438 BF FC9B4000 MOV EDI,eyes.00409BFC ; ASCII "VOICE\"

Binary value: BF FC 9B 40 00

I need to change this so that the ASCII will be "\VOICE\"

Is this possible, and what do I need to do it?

Kai
ShadowDark
05-10-2004, 03:38 AM
to change the string u can follow in dump the string and change in it... to save the changes if the dump adress is...

00403220 47 6F 6F 64 20 57 6F 72 Good Wor
00403228 6B k

and if u want for example change it to other string like this other...

00403220 42 61 64 20 57 6F 72 6B Bad Work
00403228 20

to save it u need to go at 403220 adreess pushing CTRL + G (search adress ¬¬...) and enter 403220...

0040321F 0042 61 ADD BYTE PTR DS:[EDX+61],AL
00403222 64:2057 6F AND BYTE PTR FS:[EDI+6F],DL
00403226 72 6B JB SHORT ByteKeyg.00403293
00403228 2000 AND BYTE PTR DS:[EAX],AL

look the bytes... 42 61 64 20 57 6F [...] It's THE STRING!!, and select the red lines and right button - copy to executable - selection (or all modifications if ollydbg permit this).
Bytes...

P.D: i don't know if u will be able to understand me... because my english is bad xD... :D...
psyCK0
05-10-2004, 04:15 AM
Umm... CTRL-G in disassembler? You surely dont need the string disassembled as commands?

I can see you've found your string. Now click in the dump window to activate it and then press ctrl-g . then enter the address and you will be there. Now select the bytes of the string and press ctrl-e to edit it. Enter whatever you like. thats it!
ShadowDark
05-10-2004, 11:22 AM
ohhh xD, sorry... i was found it on OllyDBG 1.10c... the subject from this forum is OllyDBG (i think...), on a dissasembler u need to catch the adress from the string and substract the imagebase... when u have this result go on a HexEditor and search this adress to change the bytes... to know the ASCII code only take the ALT + [...] code & pass it to decimal...

for example, A = 61 (ALT + 61), and u need to convert it to hexadecimal for get the byte than u need to change the string... 61 = 0x41...
Bytes...

P.D: but in OllyDBG it's more easy...
briankai
05-11-2004, 08:36 PM
Thanks for the help guys, I did manage to change the string... although it didn't have the desired effect that I wanted. =(

Not sure about how this falls in the rules of the forum, but I am trying to alter a game exe to run it's voice files from CD. This isn't a crack, as the game allows itself to be run from the harddrive without the voice files, but I just thought it would be nice to not have to dig out the CD just to use all the games features. If an alteration like this would be ok to discuss here, I could sure use some help with it. Of course, if I'm out of line let me know.

Kai


How to locate child process entry point ?

RCE Messageboard's Regroupment > General > How to locate child process entry point ?
GIJoe
05-10-2004, 05:14 PM
Hello,

I'm new to this forum and OllyDbg (great stuff btw.),

I've got a program that calls CreateProcessA function to spawn it's child process, now, how do I find this spawned child process' entry point with OllyDbg, so that I can set breakpoints there ?

I've just come across this thread:

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=570&page=0#2
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=570&page=0#2
)

Which seems to fairly explain what I'm intending to do, but... it may actually sound very stupid to you, OllyDbg gurus, but I don't know what did Ricardo mean by saying "open PUPE", what is "PUPE" ?

Any help will be greatly appreciated.Thanks in advance.
GIJoe
05-10-2004, 05:52 PM
Please, help me, if you know what is "PUPE", tell, this is very important for me :(
focht
05-10-2004, 06:32 PM
Hello,

its a process patcher tool (spain originated?)...
Last version is PUPE2002 i think.
You can find it here: http://www.terra.es/personal/guillet/pupe.htm

Anyway you can find entry point of "child process" by loading the child itself into ollydbg.
Olly will probably break on entry itself.

If you really need to break at child entry, create endless loop at entry (opcode: EB FE), do "attach to process" and restore previous bytes.

Regards,

A. Focht
GIJoe
05-10-2004, 06:43 PM
Thanks for reply focht, is there an english version of this tool as well ?

You told me I can find out entry point of child process by loading the child itself into ollydbg, well, It's not clear for me what you mean... maybe you mean about attaching OllyDbg to a child process spawned by the master process before ? Well, if so, then unfortunately I've tried it already, and been not successful to attach OllyDbg to a child process, OllyDbg says:

Unable to attach to process "ChildTest"

Maybe it's because there is no endless loop ?

I don't understand Spanish, only Polish and English and learning German...
focht
05-10-2004, 07:13 PM
Hi again,

Thanks for reply focht, is there an english version of this tool as well ?

Not that i know ... this tool and tutorials come in their native language. No localization ;(

I had same problems and used some online translators (google it)...
Its a pity that ppl write tutorials and tools - which might be in public interest - using their (non-english) mother tongue .
My native language is german but i would never write tuts nor tools exclusively for it.
Sharing all the knowledge/stuff using the "universal" english language (even its bad spelling hehe) is much more fruitful ... just my opinion... but well.

Unable to attach to process "ChildTest"

Might be due to some protection mechanism like armadillo, which basically sets up a debug server/client pair.
In fact you can't attach to an already debugged process at all.
There are some methods (forcing debugger to detach from child...) which are described in some tutorials.

Just try to identify the protector method (if any) using PeID: http://peid.has.it/ and then google for tutorials

Regards,

A. Focht
GIJoe
05-10-2004, 07:22 PM
Hi again focht :)

I've put it through PeID and it detected no compression algorithm being used in this file, it is plain msvc++ 6.0 linker output...

I think I misunderstood you before, now it's clear for me what I'm supposed to do :) Thanks a lot.
Teerayoot
05-10-2004, 09:45 PM
Set BP on CreateProcessA then Use Hexeditor replace child process 's oep with 0xEBFE (maybe store in temp dir) and F9 run again .
And in Tark Manager right click select -> Debug on target child,yeah and replace with original byte one.

Regards,
Teerayoot
Ricardo Narvaja
05-11-2004, 06:53 AM
the child is the same file of the father (there are equals) for this reason the EP of the child is the same of the EP of the father, reopen the father in olly and when stop in Entry Point, copy the value of the EP, and is the same of the child.

Ricardo
Ricardo Narvaja
05-11-2004, 06:54 AM
And when stop in WriteProcessMemory for copy the two bytes in the parameters of this api in the stack you can view the value of the ep (the father is copying the EB FE infinite loop in the ep of the child)

Ricardo
Ricardo Narvaja
05-11-2004, 06:59 AM
And is not possible put a bp in the child with olly, till the father is debugging, there are saome process in the tuts depending the version of armadillo to make and next kill the father and let the child looping.
And in my ftp are versions translated to english and not by a machine, look

69-ARMADILLO FOR DUMMIES GETRIGHT 5 vol I ENGLISH.rar
70-ARMADILLO FOR DUMMIES GETRIGHT 5 vol 2 ENGLISH.rar
74-ARMADILLO & NANOMITES part 1ENGLISH.rar
77-armadillo & nanomites 2 part english.rar
78-ARMADILLO MAS NANOMITES ANEXO .rar

this are all translated to english by a human not a machine, if you are making a tut in spanish, download the english version.

Ricardo


Arm 3.7Std_release(OllyScript)

RCE Messageboard's Regroupment > OllyScript > Arm 3.7Std_release(OllyScript)
loveboom
05-12-2004, 01:56 PM
Author:Volx

/*
Script written by VolX
Debugging options: Tick all items in Debugging Options-Exceptions
and add C000001D..C000001E in custom exceptions
Test Environment : 1.OllyDbg 1.1b & 1.1C
2.OllyScript 0.71, 0.81 .
3.OS -- WINXP & WIN2K SP3
Thanks : Oleh Yuschuk - author of OllyDbg
SHaG - author of OllyScript
*/

var j
var k
var l
var m
var y
var z
var ori1
var ori2
var ori3
var paddr1
var paddr2
var paddr3
var imgbase
var decryptcall
var dllimgbase
var dll1stend
var backstep
var relocva
var relocstk
var min
var splitva
var codesplit
var Elimination
var autofill

mov [ebx],#00000000#
gmi eip,MODULEBASE //get imagebase
mov imgbase,$RESULT
mov k,imgbase
add k,3C //40003C
mov k,[k]
add k,imgbase //j=signature VA
add k,f8 //1st section
add k,28 //2nd section
add k,28 //3rd section
add k,28 //4th section
add k,28 //5th section
add k,28 //6th section
mov m,2

loc11:
mov l,[k]
cmp l,7461642E //".dat" ? check if it is .data1 section
jne loc12
add k,4
mov l,[k]
cmp l,00003161 //"a1 " ?
je loc13

loc12:
cmp m,0
je loc15 //can't find the .data1 section
add k,28
sub m,1
jmp loc11

loc13:
sub k,4
add k,8
mov j,[k]
cmp j,20000 //check if VSize=20000
je loc14
jmp loc15

loc14:
mov autofill,1
add k,4
mov m,[k] //get the VOffset
add m,imgbase //get the VA
add m,10000
mov splitva,m

loc15:
gpa "CreateFileMappingA", "kernel32.dll"
bphws $RESULT, "x"
eoe lab2
eob lab2
run

lab2:
bphwc $RESULT
gpa "time", "msvcrt.dll"
mov j, $RESULT
bp j
gpa "VirtualProtect", "kernel32.dll"
bp $RESULT
eob lab3
eoe lab3
esto

lab3:
bc $RESULT
bc j
cmp eip,j //check if it break on time API
jne lab31 //jump if not equal which means no code splicing
eob lab32
rtu

lab31:
eob lab4
rtu

lab32:
findop eip,#250000FF#
cmp $RESULT,0
je lab4 //jump if equal which means no code splicing
mov codesplit,1

lab4:
mov j,eip
and j,0fff0000
mov l,2
lab41:
cmp l,0
je error
sub j,10000
mov k,[j]
cmp k,00905A4D //e_magic ?
je lab42
sub l,1
jmp lab41

lab42:
mov dllimgbase,j
log dllimgbase
add j,014AC
mov decryptcall,j
log decryptcall
cmp codesplit,1 //check if code splicing is used
jne lab52 //jump if no code splicing
findop eip,#250000FF#
mov j,$RESULT
add j,b
mov paddr1,j
mov ori1,[j]
mov [j],51
add j,52
bp j
eob lab5
run

lab5:
bc j
mov [paddr1],ori1 //restore original code
cmp autofill,1 //check if auto filling code splicing VA
je lab51
msg "Edit the EAX to an address for the splicing code and then press resume"
pause
mov splitva,eax
jmp lab52

lab51:
mov eax,splitva

lab52:
gpa "strchr", "msvcrt.dll"
bp $RESULT
eoe lab6
eob lab6
esto

lab6:
bc $RESULT
eoe lab7
eob lab7
rtr

lab7:
sti
//pause
findop eip,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov z,$RESULT
findop eip,#80A5# //search "AND BYTE PTR SS:[EBP-1750],0"
log $RESULT
mov j,$RESULT
add j,9
mov j,[j]
and j,0ffff
add j,ebp
sub j,10000
mov relocstk,j
log relocstk
mov j,[j]
mov relocva ,j
log relocva
cmp relocva,0 //check if import table elimination is used
je lab101 //jump if not used
mov Elimination,1
mov j,eip
sub j,90
findop j,#EBCA#
mov backstep,$RESULT
add backstep,2
log backstep
findop eip,#C1E802# //search "SHR EAX,2"
mov j,$RESULT
add j,5
mov ori1,[j]
findop z,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
mov j,y
sub j,4
mov ori2,[j]
mov paddr1,j
mov [j],ori1
sub j,6
mov ori3,[j]
mov j,y
add j,b
mov paddr2,j
mov k,dllimgbase
add k,3C
mov k,[k]
add k,dllimgbase //j=signature VA
add k,f8 //1st section
add k,0C
mov l,[k]
add k,4
mov j,[k]
add j,dllimgbase
add j,l
mov dll1stend,j
sub j,100
mov paddr3,j //store addr for putting patch code
mov [j],#8985#
add j,2
mov [j],ori3
add j,4
mov [j],#FF85#
add j,2
mov [j],ori1
add j,4
mov k,j
mov l,paddr2
add l,6
sub k,l
mov m,10000
sub m,k
sub m,5
mov [j],#E9#
add j,1
mov [j],m
add j,2
mov [j],#FFFF#
mov j,paddr2
mov k,paddr3
sub k,j
sub k,5
mov j,paddr2
mov [j],#E90000000090#
add j,1
mov [j],k
findop paddr2,#FF15#
mov y,$RESULT
add y,b
bp y
eob lab8
run

lab8:
bc y
mov j,eip
add j,18
mov eip,j
mov [paddr1],ori2
mov j,paddr2
mov [j],#8985#
add j,2
mov [j],ori3
mov j,paddr3
mov [j],#0000000000000000000000000000000000000000#
findop eip,#E9#
mov j,$RESULT
add j,5
bp j
eob lab9
run

lab9:
bc j
mov eip,backstep
mov [relocstk],00000000 //emulate no import table elimination

lab91:
findop eip,#0FBE00# //look for addr to chk FirstThunk for comparison
mov j,$RESULT
add j,14
mov y,j
bp y
eob lab10
run

lab10:
mov min,eax //store FirstThunk

lab101:
mov ori1,[z]
mov [z],#9090# //nop the gabage btw dll filling code
findop z,#595940#
mov j,$RESULT
add j,10
mov paddr1,j
mov ori2,[j]
mov [j],#EB# //patch magic jump
findop paddr1,#0F84#
bp $RESULT
cmp Elimination,0 //check if import table elimination is not used
je lab102 //jump if it is not used
eob lab12
run

lab102:
eob lab131
run

lab12:
cmp eip,y
je lab121
jmp lab13

lab121:
mov j,eax
cmp min,j
jb less
mov min,j
less:
eob lab12
run

lab13:
bc y

lab131:
bc $RESULT
//log min
mov [z],ori1 //restore original code
mov [paddr1],ori2 //restore original code
bp decryptcall
mov k,3
eob lab14
run

lab132:
sub k,1
eob lab14
eoe lab14
esto

lab14:
cmp k,0
jne lab132
eob lab15
rtr

lab15:
bc decryptcall
sti
cmp Elimination,0 //check if import table elimination is used
je lab181 //jump if not
findop eip,#EBCA#
mov j,$RESULT
add j,2
bp j
eob lab16
run

lab16:
bc j
mov j,relocstk
mov [j],relocva
findop eip,#0FB685#
mov j,$RESULT
add j,9
bp j
eob lab17
run

lab17:
bc j
cmp !ZF,1 //some Arm program will encrypt the import table section so better check it
je lab171
msg "Copy the section contains import table then press resume"
pause
sti
msg "Paste the data back to the section contains import table then press resume"
pause

lab171:
findop eip,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
add y,7
bp y
mov j,$RESULT
sub j,6
mov paddr2,j
mov ori2,[paddr2]
mov [j],#E90000000090#
mov k,paddr3
sub k,j
sub k,5
add j,1
mov [j],k
mov j,paddr3
mov [j],ori2
add j,4
mov [j],#FFFF5350BB000000008B098D048B8BC8585BE9#
add j,5
mov k,min
add k,imgbase
mov [j],k
mov l,paddr2
add l,6
mov k,paddr3
add k,16
sub k,l
mov m,10000
sub m,k
sub m,5
add j,0e
mov [j],m
add j,2
mov [j],#FFFF#
eob lab18
run

lab18:
bc y

lab181:
findop eip,#2BF9FFD7#
mov j, $RESULT
add j,2
bp j
eob lab19
run

lab19:
bc j
sti
msg "OEP arrived! You can dump the file and fix the IAT"
log codesplit
log splitva
log Elimination
pause
jmp end

error:
msg "error"

end:
ret
psyCK0
05-12-2004, 05:46 PM
hehe, and I thought my dillo scripts were special =)
added to site.

To Chad: a big F**K YOU
TBD
05-13-2004, 03:46 AM
psyCK0: watch the language ;)
psyCK0
05-13-2004, 08:06 AM
Sry.. Just don't like that guy. He is too full of himself (unlike other copy protection authors like for example Ryan)
Anonymous
05-13-2004, 10:03 AM
hey psycho do you have any other arma scripts cuz I dont like CHAD either.
Teerayoot
05-13-2004, 10:36 AM
Really Cool!
schar
05-13-2004, 11:23 AM
Tested on an app packed in this type of arma with data1 section, but script not works. :(
Ricardo Narvaja
05-14-2004, 07:28 AM
Good work, terrific job in hypresnap of my tut the script let you in the oep with IAT repared, ordered, and full valid, and the antidumps are redirected too, big big job.

100% GOOD JOB
Ricardo Narvaja
schar
05-14-2004, 09:39 AM
maybe some thing i did is wrong :(
any tips for me?
Ricardo Narvaja
05-14-2004, 10:39 AM
I try the script in the program you are working this afternoon and tell you whats the tip jeje.

Ricardo
Ricardo Narvaja
05-14-2004, 08:27 PM
for schar

your program is not the same version of hypersnap of my tut or for the script, is a copymem2 armadillo, the script and my tut are for armadillo without copymem2 with destruction of table.
For this program there are the tut of GetRight or Lydia in my FTP but are versions 3.20 of armadillo and this program can be a newer version.
How i read silicon realms do not continue with copymem2 in futures realeases of armadillos, for this reason i do not make a tut of copymem2 in new versions, but if copymem2 continue i study and make a new tut.

Ricardo Narvaja
schar
05-15-2004, 01:15 AM
thx, Ricardo.
i will see what happens there in my app..
RedH@wK
05-29-2004, 07:00 PM
Hello.loveboom:

your script don't work in this arma with it destruction
stop in a messagebox with error.

donwload from here
http://tinyurl.com/28j7f
RedH@wK
05-29-2004, 07:12 PM
Sorry,it's a tiny crackme 265k only

greetings

---=<<RedH@wK>>=---
1bitshort
05-30-2004, 03:01 PM
loveboom,
It's obvious that a _lot_ of work has gone into creating that script, that deserves a few beers right there, well done mate :)

psycko, who is Chad? A main author of Armadillo?
psyCK0
05-30-2004, 03:50 PM
Chad Nelson - main developer of Armadillo and an arrogant bastard =)
loveboom
05-31-2004, 01:25 AM
donwload from here
http://tinyurl.com/28j7f
sorry,This page i cann't connection
please email target to me.thank you
VolX
05-31-2004, 03:00 AM
Hi RedH@wK,

I wrote that script so I think it will be appropriate for me to answer your question.

Load the crackme in olly and run this script, when a messagebox popup showing
"Edit the EAX to a address you like and then press resume" .

Press OK button and follow the belowing steps:

1.Go to register window select EAX register then press ENTER button, key in 0043f000 in the Hexadecimal editbox and press OK button.

2.Select Plugins--Ollyscript--Resume.

When Olly stop at OEP dump the file and fix IAT.

Hope it helps!
Ricardo Narvaja
05-31-2004, 06:26 AM
i try this crackme and the script and the messagebox show ERROR and close, not other message.

Ricardo
VolX
05-31-2004, 06:58 AM
Did you tick all the item in Debugging Options-Exceptions and add C000001D..C000001E in custom exceptions ?
Or may be you must rename your Olly to something else, I tried this crackme with a renamed Olly three times and there were all success.
Ricardo Narvaja
05-31-2004, 08:42 AM
I tried with renamed ollydbg, tick all exceptions and have this two exceptions added, and stop in error nessagebox.

i use ollydbg 1.09b

and ollyscript is not the last, but in my other program work well the script, in this crackme not work for me.

Ricardo
VolX
05-31-2004, 09:59 AM
Here is some updates.
This script works fine if you are using Ollyscript 0.71 or 0.81 , but it fails if you are using Ollyscript 0.85 , the error occurs at here

lab101:
mov ori1,[z]
mov [z],#9090# <-- the address z is correct for both three versions
findop z, #595940#
mov j,$RESULT <-- $RESULT = 00000000 if using Ollyscript 0.85 hence error occurs
add j,10
mov paddr1,j
mov ori2,[j]
mov [j],#EB#
findop paddr1,#0F84#
bp $RESULT
cmp Elimination,0
je lab102
eob lab12
run

Maybe I made mistake at somewhere. Are you using Ollyscript 0.85 ? If so, please use Ollyscript 0.71 or 0.81 if you try to use my script.
psyCK0
05-31-2004, 11:43 AM
That was a bug in OSC v0.85. Please redownload the plugin and all will be fine!
Ricardo Narvaja
05-31-2004, 08:22 PM
i redowload the plugin 0.85 and is the same finish in an error message (for psyck0)

Ricardo
Ricardo Narvaja
05-31-2004, 08:44 PM
i try with olly 1.10 and ollyscript 0.7 and is the same ERROR MESSAGEBOXA and SCRIPT FINISHED.

Ricardo
psyCK0
05-31-2004, 10:11 PM
Ok, checked it out and the script gives me errors (on both OSC 0.71 and 0.85) here:

lab41:
cmp l,0 <-- l gets to 0 after 2 and 1
je error

I am using the http://tinyurl.com/28j7f crackme as target...
VolX
06-01-2004, 01:21 AM
Ah , then it miss the imagebase of security.dll, what is the result of OSC 0.81 ?
For me it is OK on OSC 0.71 (release date 12.apr.04) & 0.81.
At the mean time I'll download the lastest OSC 0.85 and see what's the outcome.
psyCK0
06-01-2004, 07:23 AM
VolX: please let me know how it goes
VolX
06-01-2004, 10:28 AM
Testing, testing and more testing.....

This time I use another PC to run the tests.

Operating system : Win2000 SP3.
OSC : 0.71 (file date 12-apr-04)
0.81 (file date 8-may-04)
0.85 (file date 25-may-04)
Ollydbg 1.1b

First testing combinations and the results are as follows

Test no. : 1 2 3 4 5 6
OSC ver. : 0.71 0.81 0.85 0.71 0.81 0.85
Results : Fail Pass Fail Pass Pass Fail

After the above testings, I use Powerquest Drive Image to restore a fresh image of my hard drive and perform more testings, the testing combinations and results are as follows :

Test no. : 1 2 3 4 5 6
OSC ver. : 0.81 0.85 0.71 0.81 0.85 0.71
Results : Fail Fail Pass Pass Fail Pass

Repeat the refreshing step on the image of my hard drive , this time the testing combinations and results are as follows :

Test no. : 1 2 3 4 5 6
OSC ver. : 0.85 0.71 0.81 0.85 0.71 0.81
Results : Fail Pass Pass Fail Pass Pass

Conclusion : 1. My script will fail on the first execution disregarding the version of OSC used.
2. On the subsequent tests my script work fine if you are using OSC 0.71 and 0.81 but failed if using OSC 0.85.
psyCK0
06-01-2004, 11:39 AM
VolX: Thats some testing! =) if you use the #LOG command to see what commands get executed, in which step dóes the script execution on 0.85 differ from 0.71?If it's the findop command, what are you searching for? I'm sure you are aware of the difference between FIND and FINDOP for searching code?
psyCK0
06-01-2004, 12:17 PM
By the way, check the Exetools forums for some nice new Arma builds.

From the SR homepage:
Added a "memory-patching protection" option. This replaces the Improved CopyMem-II, and should provide better protection from this form of attack, as well as giving far better performance. The "three-page option" has also been removed, as it is no longer needed.
VolX
06-02-2004, 10:16 AM
Bug fixed, but still not working when using OSC 0.85 , I am lazy to rewrite it ,cos cuurrently busy with ASPR.

/*
Script written by VolX
Debugging options: Tick all items in Debugging Options-Exceptions
and add C000001D..C000001E in custom exceptions
Test Environment : 1.OllyDbg 1.1b & 1.1C
2.OllyScript 0.71, 0.81 .
3.OS -- WINXP & WIN2K SP3
Thanks : Oleh Yuschuk - author of OllyDbg
SHaG - author of OllyScript
Release Note : Fix the bug when trying to unpack a target on its first execution
Please be noted on some occasions you might need to use a renamed Ollydbg.
*/

var j
var k
var l
var m
var y
var z
var ori1
var ori2
var ori3
var paddr1
var paddr2
var paddr3
var imgbase
var decryptcall
var dllimgbase
var dll1stend
var backstep
var relocva
var relocstk
var min
var splitva
var codesplit
var Elimination
var autofill
var 1stexec

mov [ebx],#00000000#
gmi eip,MODULEBASE //get imagebase
mov imgbase,$RESULT
mov k,imgbase
add k,3C //40003C
mov k,[k]
add k,imgbase //j=signature VA
add k,f8 //1st section
add k,28 //2nd section
add k,28 //3rd section
add k,28 //4th section
add k,28 //5th section
add k,28 //6th section
mov m,2

loc11:
mov l,[k]
cmp l,7461642E //".dat" ? check if it is .data1 section
jne loc12
add k,4
mov l,[k]
cmp l,00003161 //"a1 " ?
je loc13

loc12:
cmp m,0
je loc15 //can't find the .data1 section
add k,28
sub m,1
jmp loc11

loc13:
sub k,4
add k,8
mov j,[k]
cmp j,20000 //check if VSize=20000
je loc14
jmp loc15

loc14:
mov autofill,1
add k,4
mov m,[k] //get the VOffset
add m,imgbase //get the VA
add m,10000
mov splitva,m

loc15:
gpa "CreateFileMappingA", "kernel32.dll"
bphws $RESULT, "x"
eoe lab2
eob lab2
run

lab2:
bphwc $RESULT
eob lab21
rtr

lab21:
sti
mov j,eip
and j,0fff0000
mov l,2

lab22:
cmp l,0
je error
mov k,[j]
cmp k,00905A4D //e_magic ?
je lab23
sub j,10000
sub l,1
jmp lab22

lab23:
mov dllimgbase,j
log dllimgbase
add j,014AC
mov decryptcall,j
log decryptcall
gpa "time", "msvcrt.dll"
mov j, $RESULT
bp j
gpa "VirtualProtect", "kernel32.dll"
bp $RESULT
eob lab3
eoe lab3
esto

lab3:
cmp eip,j //check if it break on time API
jne lab31 //jump if not equal which means no code splicing
eob lab32
rtu

lab31:
bc $RESULT
bc j
eob lab4
rtu

lab32:
mov k, eip
sub k, 10
mov k, [k]
and k, 0ffff
cmp k, 000075ff //check if "PUSH DWORD PTR SS:[EBP-??]
jne lab33
mov 1stexec, 1
log 1stexec
eob lab3
eoe lab3
esto

lab33:
bc $RESULT
bc j
findop eip,#250000FF#
cmp $RESULT,0
je lab4 //jump if equal which means no code splicing
mov codesplit,1

lab4:
log codesplit
cmp codesplit,1 //check if code splicing is used
jne lab52 //jump if no code splicing
findop eip,#250000FF#
mov j,$RESULT
add j,b
mov paddr1,j
mov ori1,[j]
mov [j],51
add j,52
bp j
eob lab5
run

lab5:
log autofill
bc j
mov [paddr1],ori1 //restore original code
cmp autofill,1 //check if auto filling code splicing VA
je lab51
msg "Edit the EAX to an address for the splicing code and then press resume"
pause
mov splitva,eax
jmp lab52

lab51:
mov eax,splitva

lab52:
gpa "strchr", "msvcrt.dll"
bp $RESULT
eoe lab6
eob lab6
esto

lab6:
eob lab7
rtr

lab7:
sti
bc $RESULT
cmp codesplit,1
je lab72
mov splitva,0

lab72:
findop eip,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov z,$RESULT
findop eip,#80A5# //search "AND BYTE PTR SS:[EBP-1750],0"
mov j,$RESULT
add j,9
mov j,[j]
and j,0ffff
add j,ebp
sub j,10000
mov relocstk,j
log relocstk
mov j,[j]
mov relocva ,j
log relocva
cmp relocva,0 //check if import table elimination is used
je lab101 //jump if not used
mov Elimination,1
mov j,eip
sub j,90
findop j,#EBCA#
mov backstep,$RESULT
add backstep,2
log backstep
findop eip,#C1E802# //search "SHR EAX,2"
mov j,$RESULT
add j,5
mov ori1,[j]
findop z,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
mov j,y
sub j,4
mov ori2,[j]
mov paddr1,j
mov [j],ori1
sub j,6
mov ori3,[j]
mov j,y
add j,b
mov paddr2,j
mov k,dllimgbase
add k,3C
mov k,[k]
add k,dllimgbase //j=signature VA
add k,f8 //1st section
add k,0C
mov l,[k]
add k,4
mov j,[k]
add j,dllimgbase
add j,l
mov dll1stend,j
sub j,100
mov paddr3,j //store addr for putting patch code
mov [j],#8985#
add j,2
mov [j],ori3
add j,4
mov [j],#FF85#
add j,2
mov [j],ori1
add j,4
mov k,j
mov l,paddr2
add l,6
sub k,l
mov m,10000
sub m,k
sub m,5
mov [j],#E9#
add j,1
mov [j],m
add j,2
mov [j],#FFFF#
mov j,paddr2
mov k,paddr3
sub k,j
sub k,5
mov j,paddr2
mov [j],#E90000000090#
add j,1
mov [j],k
findop paddr2,#FF15#
mov y,$RESULT
add y,b
bp y
eob lab8
run

lab8:
bc y
mov j,eip
add j,18
mov eip,j
mov [paddr1],ori2
mov j,paddr2
mov [j],#8985#
add j,2
mov [j],ori3
mov j,paddr3
mov [j],#0000000000000000000000000000000000000000#
findop eip,#E9#
mov j,$RESULT
add j,5
bp j
eob lab9
run

lab9:
bc j
mov eip,backstep
mov [relocstk],00000000 //emulate no import table elimination

lab91:
findop eip,#0FBE00# //look for addr to chk FirstThunk for comparison
mov j,$RESULT
add j,14
mov y,j
bp y
eob lab10
run

lab10:
mov min,eax //store FirstThunk

lab101:
mov ori1,[z]
mov [z],#9090# //nop the gabage btw dll filling code
findop z, #595940#
mov j,$RESULT
add j,10
mov paddr1,j
mov ori2,[j]
mov [j],#EB# //patch magic jump
findop paddr1,#0F84#
bp $RESULT
cmp Elimination,0 //check if import table elimination is not used
je lab102 //jump if it is not used
eob lab12
run

lab102:
eob lab131
run

lab12:
cmp eip,y
je lab121
jmp lab13

lab121:
mov j,eax
cmp min,j
jb less
mov min,j
less:
eob lab12
run

lab13:
bc y

lab131:
bc $RESULT
//log min
mov [z],ori1 //restore original code
mov [paddr1],ori2 //restore original code
bp decryptcall
mov k,3
eob lab14
run

lab132:
sub k,1
eob lab14
eoe lab14
esto

lab14:
cmp k,0
jne lab132
eob lab15
rtr

lab15:
bc decryptcall
sti
cmp Elimination,0 //check if import table elimination is used
je lab181 //jump if not
findop eip,#EBCA#
mov j,$RESULT
add j,2
bp j
eob lab16
run

lab16:
bc j
mov j,relocstk
mov [j],relocva
findop eip,#0FB685#
mov j,$RESULT
add j,9
bp j
eob lab17
run

lab17:
bc j
cmp !ZF,1 //some Arm program will encrypt the import table section so better check it
je lab171
msg "Copy the section contains import table then press resume"
pause
sti
msg "Paste the data back to the section contains import table then press resume"
pause

lab171:
findop eip,#8908# //search "MOV DWORD PTR DS:[EAX],ECX"
mov y,$RESULT
add y,7
bp y
mov j,$RESULT
sub j,6
mov paddr2,j
mov ori2,[paddr2]
mov [j],#E90000000090#
mov k,paddr3
sub k,j
sub k,5
add j,1
mov [j],k
mov j,paddr3
mov [j],ori2
add j,4
mov [j],#FFFF5350BB000000008B098D048B8BC8585BE9#
add j,5
mov k,min
add k,imgbase
mov [j],k
mov l,paddr2
add l,6
mov k,paddr3
add k,16
sub k,l
mov m,10000
sub m,k
sub m,5
add j,0e
mov [j],m
add j,2
mov [j],#FFFF#
eob lab18
run

lab18:
bc y

lab181:
findop eip,#2BF9FFD7#
mov j, $RESULT
add j,2
bp j
eob lab19
run

lab19:
bc j
sti
msg "OEP arrived! You can dump the file and fix the IAT"
log codesplit
log splitva
log Elimination
pause
jmp end

error:
msg "error"

end:
ret
psyCK0
06-02-2004, 01:14 PM
Ill check it to see what the problem with 0.85 is =/
RedH@wK
06-02-2004, 05:13 PM
thanks for your request..y by your great work....lo I watch and I say to you thank you very much... in any case and but recognized respect towards you
a hug friend
greetings
---=<<RedH@wK>>=---
VolX
06-03-2004, 04:01 AM
To psyCK0 :
Just FYI, my ASPR script run well on OSC 0.71 , 0.81 and 0.85 , so I think may be it is related to this paticular script only, and since ARM 3.75 is different now, there is no point to waste time on supporting old version (I mean ARM), well, my 2cents.
Of course , will report to you if encounter any bug from OSC.
Ricardo Narvaja
06-03-2004, 08:37 AM
well this crackme was packed with armadillo 3.75.

Ricardo
VolX
06-03-2004, 09:14 AM
To Ricardo:
Where can I get this special Armadillo, in your FTP?
Ricardo Narvaja
06-03-2004, 05:09 PM
The version of armadillo 3.75 alpha 1 is in my FTP in herramientas.

or you can enter by http

http://www.ricnar456.no-ip.org/

Ricardo
Ricardo Narvaja
06-06-2004, 08:39 AM
with the new or old script in this crackme don't work for me, with ollyscrip 0.7, stop in error, is the same if i try 1 2 or 3 times dont work.

Ricardo
Anonymous
06-09-2004, 01:55 AM
Hello Ricardo,

Do you have an example on how to use Nanomites?
I have mark the code with NANO_BEGIN and NANO_END Pair and it still doesn't accept. Do you know why?
Ricardo Narvaja
06-09-2004, 06:58 AM
i don't know how mark the program for nanomites sorry, i only crack programs with nanomites jeje.

Ricardo
VolX
06-10-2004, 07:45 AM
Ricardo:

Sorry to know that the script doesn't work for you .
I redownloaded the crackme and tried it on my 2 PC (one WINXP the other WIN2K SP3) , the script ran without error.
So if I can't reproduce the same error here I can't fix it.
Ricardo Narvaja
06-10-2004, 08:13 AM
Well if 2 computers are a enough for you in crackslatinos 40 crackers report error in the script, any in the messagebox with only the word ERROR and finish the script others in the messagebox for change the value of eax, this crackres change the value of eax and resume script and nothing happens all have win XP PRO sp1 spanish.
This crackme is a weekly contest and have no solution and there are 500 crackers suscribed trying, i unpack the crackme but without the script, i report the bug only for help. Maybe you have a different script posted here the last version?
Ricardo
shadiguy1
07-09-2004, 07:34 PM
I am a real f*cking idiot trying to offer cash for cracks
Anonymous
07-10-2004, 12:05 AM
nanomites only works with custom build armadillo.exe. ;-)
DudE
07-15-2004, 09:33 PM
to Anonymous

shouldnt be anything more than to include the definitions of NANOBEGIN and NANOEND and then put them around a code snippet and compile

If it says it injected 0 real, then it might just not have found a good spot to place any , or you made a mistake placing it...
djneo
08-17-2004, 10:45 AM
I have a program which is protected by armadillo 3.75b and the security is a WriteProcessMemory of 2 bytes, so it's easy to pass. After I found the magic jump, but there is nanomites and some jumps to sections who is not in dump.

I would like to know if I can use this Script on child when it was detach. Because I should be the same protection after.

Is it possible?
djneo
08-18-2004, 03:12 PM
I've tried to apply script on my program after detach son of his father, and when there is message to edit eax I put an address where there is space but after the process terminates.

I don't know the address to put to eax and why the process crash after?

Is it possible that script crash because the free space I give in eax is not big enough?

Otherwise, sections of program are differents than previous armadillo and there is no .data1 section but there is its equivalent.

CODE
DATA
BBS
.idata
.tls
.rdata
.reloc
.text --> .text1
.adata
.data --> .data1
.reloc1
.pdata
.rsrc

I think it's the same sections but I'm not sure.
Please help me


No veo las

RCE Messageboard's Regroupment > General > No veo las
tktmo
05-13-2004, 10:32 AM
tutorial del jefe ricardo narvaja 83-armadillo 3 superexplicado lydia desempacado parte1

estoy atorado en el paso ke dice:

"4TO PASO: NOPEO EL CALL ENCRIPTADOR

Ya vimos en los tutes anteriores que cuando paramos aquí estamos en el call desencriptador de hecho el padre esta desencriptando un bloque en el hijo, ahora también hay un call encriptador o destructor mejor llamado, o sea que luego de copiarle varios bloques el padre comienza a destruir los bloques ya usados para no permitir el dumpeo ya que nunca se encontrarían todos los bloques en memoria a la vez, este call malo hay que nopearlo, pero ... como lo hallo?
Como aun estoy en la api WriteProcessMemory voy al CALL STACK (letra K) y allí veo.

En el call stack lo superior es donde estamos actualmente , o sea la api alli en CALLED FROM muestra el call 4684A4 que es el call a la api desde el ejecutable como ese call esta dentro del call desencriptador dicho call desencriptador es el siguiente o sea"

mi problema es ke al abrir el call stack no veo ninguna llamada y en el tuto es la base del paso 4

tengo una pentium 4, winxp pro y lo intenté con el ollydbg 1.08 1.09d y 1.1c teniendo siempre el mismo resultado

tal vez me puedan ayudar
mil gracias

nota: el post esta en español por ke va principalmente dirigido al mismisimo jefe ricardo
Ricardo Narvaja
05-13-2004, 12:50 PM
si el call stack no te muestra la informcion, el mismo stack siempre la muestra, baja desde donde ests en el stack mirando los RETURN TO .....

Fijate de donde son llamados dichos RETURN TO... es la mism informacion del call stack, si vas bajando y mirando los RETURN y vuendo cuales vienen de esa zona, lo encontraras igual que en el call stack.

Ricardo
ShadowDark
05-13-2004, 03:28 PM
Nas,

solo decir que el Stack es la ventana de abajo a la derecha y que muestra los valores introducidos en la pila... así como valores de retorno etc... quizás lo k no ve es el Stack de la tecla "K" ... así que guíate por la vetana de abajo - derecha ;)...
Salu2...
tktmo
05-14-2004, 01:55 AM
de nuevo yo, ya use otra computadora para ver si mi makina no me dejaba ver el call stack y lo mismo, segui sus consejos, muchas gracias por ellos pero al seguir los returns, ninguno me llevó a la funcion de encripta/decripta, nada parecido a lo del tutorial :-(, no se ke pasé, lo he intentado mas de 30 veces y nada, intentando cambiar pekeñas cosas y nada,

me gustaria poner una imagen para ke vieran la diferencia entre lo ke se ve en el tuto y lo ke yo veo, para empezar, en el tuto paso 4 yo no veo de donde se hace la llamada

y al ir directamente a la direccion del tuto y kerer ver las funciones de encripta y decripta no salen

vale la pena resaltar ke uso el mismo proograma del tuto bajado del ftp de ricardo, las dirrecciones tambien coinciden en los primeros 3 pasos,

me gustaria saber si hay otra forma ya ke seguir los RETURN TO de la STACK (abajo a la derecha) no me funcionaron :-(

Saludos
Ricardo Narvaja
05-14-2004, 06:43 AM
mira lo que esta en el call stack, tambien esta en el stack solo debes ir bajando desde donde estas y anotando los lugares de los returns que vienen de la zona donde esta el call (no de apis o otras zonas) y llegas perfecto a la misma parte, lo hemos hecho cientos de veces en ese programa y en otros.
Mandame las imagenes del stack a ver a mi mail
ricnar22@millic.com.ar
Quizas a vos te confunda el ofuscado hay que no marearse con eso.
Ricardo
tktmo
05-15-2004, 02:50 AM
Hola otra vez, ya encontré el problema ke yo tenia, no estaban bien mis settings, se compuso el problema al bajar el OLLYDBG.INI de la pagina de crackslatinos.hispanodominio.net, es una maravilla.

espero ke este problema le ayude a otras personas a arreglar esas peqkeñas pero significativas molestias y problemitas.

mil gracias a Ricardo Narvaja y ShadowDark por sus coemntarios de ayuda.

saludos y con esto doy por cerrado el caso


PLs Help Me In finding point h of my Computer

RCE Messageboard's Regroupment > General > PLs Help Me In finding point h of my Computer
jitin
05-13-2004, 06:12 PM
HI guys
I have tried the gr8 tut on point h by Ricardo Narvaja
but I m having problem
Could anyone pls explain me 9 and 10. step
9) Olly will stop when it finds the sought serial (FIGURA 6). Then we marked the serial and we put BP MEMORY ON ACCESS.

10) RUN (F9).... Olly will stop exactly in the point-h (FIGURA 7).

I do as given but does not happens anything pls help me.
Ricardo Narvaja
05-14-2004, 06:55 AM
Go to mi FTP and search for two other tuts of point H, are in spanish but are more easy for people with any trouble, search for number of tut 178 and 180

In my tut if you found the fake serial in the crackme of cruehead, and put a BPM in the dump when the fake serial is, and RUN, the program RUN and when stop, is in the point H, if is not point H, you stop in a exception look at the left lower corner, and read the cause of the stop, if are a exception pass with SHIFT + f9 till you read MEMORY BREAKPOINT in the lower corner and you are in point H.

Ricardo
jitin
05-14-2004, 06:04 PM
pls anyone help me I donno spanish
only english
btw thanx ricardo narvaja
RagnaBaby
05-23-2004, 11:23 PM
Please email me your point.h tutorial.

kerruben@yahoo.com

tnx


Found OEP. and then?

RCE Messageboard's Regroupment > General > Found OEP. and then?
j_petrucci
05-14-2004, 09:17 AM
Hi to all!
I'm pretty a newbie in the manual unpacking field, and I would like to know what (generally) to do after finding the program OEP. Just how to manage the basic steps (how to identify the packer rountine, skipping the CRC checks, etc...)

thanks
Ricardo Narvaja
05-14-2004, 10:41 AM
well if you found the oep, i think you need know what packer is, generally you dump, rebuid the iat with IMP REC, and fix the dump, but this can be different in each packer.

Ricardo


what does it stand for ?

RCE Messageboard's Regroupment > Plugins > what does it stand for ?
comlysouthchina
05-15-2004, 11:58 AM
Hi All

I use OllyDBG to load a executable file ,during loading the OllyDBG will show a MessageBox Dialog. It has the hint '
The prodedure entry point _setmbc could not be located in the dynamic link librray MSVCRTD.DLL' . What does it stand for ?
focht
05-15-2004, 03:43 PM
Greetings,

the program (debuggee) has a binding to microsoft C-runtime library (debug version).
Seems your system's msvrtd.dll is a different one than the program was linked to (import library).
Just make sure the program gets the right C-runtime dlls or try to rebuild the source with correct import library version.

Regards


Modifying SetTimer

RCE Messageboard's Regroupment > General > Modifying SetTimer
tonyxxy
05-15-2004, 02:36 PM
Hi all,

I'm trying to modify a program that i often use at work...the program makes a backup every
60 secs which is very annoying because it takes a lot of time.
I've already found where it pushes the value

0042FB9C /$ 55 PUSH EBP
0042FB9D |. 8BEC MOV EBP,ESP
0042FB9F |. 53 PUSH EBX
0042FBA0 |. 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]
0042FBA3 |. FF75 14 PUSH DWORD PTR SS:[EBP+14]
0042FBA6 |. FF75 10 PUSH DWORD PTR SS:[EBP+10] ---> points to mem address 12f760
0042FBA9 |. FF75 0C PUSH DWORD PTR SS:[EBP+C]
0042FBAC |. 53 PUSH EBX ; /Arg1
0042FBAD |. E8 8274FDFF CALL WINNER.00407034 ; \WINNER.00407034
0042FBB2 |. 59 POP ECX ; |
0042FBB3 |. 50 PUSH EAX ; |hWnd
0042FBB4 |. E8 034F0B00 CALL <JMP.&USER32.SetTimer> ; \SetTimer
0042FBB9 |. 5B POP EBX
0042FBBA |. 5D POP EBP
0042FBBB \. C3 RETN

When i look at memory address 0012f760 it contains the value EA60h = 60000 millisecs.
How can i modify this (timer)value and save the changes once done?

Thanks in advance.
focht
05-15-2004, 03:48 PM
Hi,

[EBP+10] is the parameter that got pushed by caller.
Just get the caller (the one, that called 0042FB9C) and look where the variable is used.

You might then patch the initialization of parameter/variable by replacing the binary constant (and save changes to disk).

Regards
cobra1111
05-15-2004, 08:50 PM
the easiest way i think is to modify 0042FBA6 like this:

PUSH DWORD PTR ***** ;replace SS:[EBP+10] by any time you want.............

regards
focht
05-16-2004, 04:31 AM
PUSH DWORD PTR ***** ;replace SS:[EBP+10] by any time you want.............

push <immediate constant> opcode is 5 bytes ... (32 bit) so how do you fit this in 3 byte opcode?

He already said 60 sec is too short that means the number _must_ be 32 bits wide (> 0xFFFF).

Just walk the caller chain up until the point where the constant is used/variable initialized and patch there

Regards
tonyxxy
05-16-2004, 02:13 PM
Thanks you guys :-)

I've found how the value was set.

At line 004146F1 EAX (3C) is multiplied with 3E8 = EA60 = 60000 (milliseconds),
and stored in EDX.

004146EB |. 6A 00 PUSH 0 ; /Arg4 = 00000000
004146ED |. 0FBF45 FE MOVSX EAX,WORD PTR SS:[EBP-2] ; |
004146F1 |. 69D0 B80B0000 IMUL EDX,EAX, 3E8 ; |
004146F7 |. 52 PUSH EDX ; |Arg3
004146F8 |. 6A 64 PUSH 64 ; |Arg2 = 00000064
004146FA |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1
004146FD |. E8 9AB40100 CALL WINNER.0042FB9C ; \WINNER.0042FB9C

So I replaced 3E8 with 1388. 3c * 1388 = 300000 (milliseconds)

There's only one thing I couldnt figure out...where 3C gets into EAX?

Thanks again everyone.

tonyxxy
KSA
05-16-2004, 02:45 PM
Hi,

EAX gets 0x3C at line 004146ED where:

MOVSX EAX, WORD PTR SS:[EBP-2]
^^^
So, Check ss:[ebp-2] from where it gets the value 0x3C

KSA


PEBundle

RCE Messageboard's Regroupment > OllyScript > PEBundle
Anonymous
05-16-2004, 12:48 AM
PEBundle
hacnho
06-27-2004, 11:41 PM
see my script posted.


help in finding neolite 2.0 oep in win98

RCE Messageboard's Regroupment > General > help in finding neolite 2.0 oep in win98
i_doit
05-16-2004, 02:25 AM
i think i hav found the oep in polyphonix studio with neolite 2.0 oep is around 40203D <= i hope i still remember. With imprec 1.6 you will get pretty import table. But i have problem to go to that address to dump in win98x system coz the breakpoint on hardware access is disable in win98.
the pop up message show 'the debugger don't know how to step try 2 change eip' can anyone solve this problem. Or if u have good way to go to the oep address try 2 help me. Thanks.


In ollydbg how 2 operate the F12 function like sof

RCE Messageboard's Regroupment > General > In ollydbg how 2 operate the F12 function like sof
i_doit
05-16-2004, 02:29 AM
u can break at the api like getdlgitem but i donnt know how to operate 'return to the caller function'. Thanks for reply
Teerayoot
05-18-2004, 11:27 AM
Alt+F9!
idoit
05-21-2004, 08:43 AM
thanks for ur help.


pushfd makes F4 failed?

RCE Messageboard's Regroupment > Bugs > pushfd makes F4 failed?
kongfoo
05-16-2004, 05:39 AM
Hi,
My friend found that F4 will not work if a program begin with pushfd, is this an OD problem?

Thx


Is there a way to dereference STRING resource?

RCE Messageboard's Regroupment > General > Is there a way to dereference STRING resource?
muminoi
05-17-2004, 10:18 AM
Hi,
Is there a way to dereference STRING resource? It seem to me that Search_For->All_Referenced_Text_String return only string in source code only not including the one in resource. Reight now, I need to use w32dsm (which I hate it :) to do this job and use ollydbg to debug it. Do I miss some feature in ollydbg?

Thank,

Great Win32 DBG program ever (for me) anyway :)
babar0ga
05-17-2004, 09:23 PM
not sure what are you trying to do...

in case you want to see strings from resources then go to
View>Executables modules(alt+e) and click on one with right mouse button...

i'm sure you'll know what to do then
muminoi
05-18-2004, 12:50 AM
Thank, But I like to see it side by side with disasm code like the way that ollydbg did for normal text string. Is there anyway to do?
Teerayoot
05-18-2004, 11:16 AM
Set condition log on LoadStringA or LoadStringW will handle your ploblem.

Ex...
77D46DBA CALL to LoadStringW from notepad.01003D15
hInst = 01000000
RsrcID = STRING "Insufficient memory to create the bitmap. Close one or more applications to

:)
oh me anon
05-19-2004, 12:49 PM
if i remember correctly
view-->exemodules--->select module-->rightclick-->view resources /view resource strings --->must show all resource strings in the exe
then you have find ref to that string follow in dissembler
and viewing the dump options


Why does Win9x support Terminate/SuspendThread but

RCE Messageboard's Regroupment > The Heap > Why does Win9x support Terminate/SuspendThread but
1bitshort
05-17-2004, 12:32 PM
Win9x supports a variety of thread functions (including SetThreadContext, ResumeThread, SuspendThread, TerminateThread, etc) ... BUT, all of those functions require a thread handle, yet Win95/98 doesnt support OpenThread!!! (strange, because WindowsME does)

So how on earth are you supposed to use those functions without a handle !? Any ideas???

In other words ... how can I get a handle to a thread in another process under Win95/98?
focht
05-17-2004, 01:51 PM
Greetings,

well accessing other processes thread handle stuff was likely left off due to security reasons (if you follow MSDN).

There are some hacks to get around with ... but not very comfortable.

1) running the target as debuggee, that should give you access to all threads that are created

2) toolhelp API?

3) Using windows hooking (pseudo code)

myHook := ::SetWindowHookEx( WH_GETMESSAGE, .., ThreadID);
::PostThreadMessage( ThreadID, .., ::GetCurrentProcessID(), Handle);

hook dll containing basically following code to communicate the stuff back (or use shared mem whaetver)

hProcess := ::OpenProcess( .., pid);
::DuplicateHandle( ::GetCurrentProcess(), ::GetCurrentThread(), hProcess, &myThreadHandle, ..);
..
// transfer it back to our process
::PostMessage( .. , WM_USER+1, 0, myThreadHandle);

4) found following code from russian site (did not test it):

w9x_OpenThread proc flags,inheritance,tid:dword
local w9xopenthread:dword

pushad
call GetCurrentProcessId
xor eax,fs:30h
mov ebx,eax
lea esi,OpenProcess+2 ; jmp far [xxxx]
lodsd ; xxxx
xchg eax,esi
lodsd ; [xxxx]=KERNEL32!OpenProcess
lea esi,[eax+24h]
lodsd ; [OpenProcess+24h]
mov edi,esi
cmp eax,0b9h ; mov ecx,dword ptr 0
jnz bad_exit
sub edi,4
mov w9xopenthread,edi
xor ebx,tid
lea esi,[ebx+2]
call IsBadWritePtr,esi,2
or eax,eax
jnz bad_exit
xchg eax,ebx
mov eax,w9xopenthread
call eax,flags,inheritance,tid
mov [esp.Pushad_eax],eax
popad
ret

bad_exit: popad
call SetLastError,ERROR_ACCESS_DENIED
xor eax,eax
ret
w9x_OpenThread endp

Why do you try to support a dead OS ... even microsoft announced end-of-life support some time ago.
Though i must admit i never used win9Xt, started with NT 3.51 ;)

Regards
1bitshort
05-24-2004, 12:22 PM
focht,
You're a champion of this forum, thanks very much for taking the time to put together that response, I know it would've taken a lot of time, research and effort, and I appreciate that a lot. (Sorry for the delay in responding!)

I've given up on Win9x threads -- the w9x_OpenThread function is very interesting but not reliable enough for production code.

I just find it very strange that Win9x supports so many thread-related functions (such as TerminateThread) when it doesn't support the pre-requisite function, OpenThread ... very weird :)

Cheers


Armadillo new anti-olly?

RCE Messageboard's Regroupment > General > Armadillo new anti-olly?
sonkite
05-18-2004, 04:19 PM
I've debugged many armadillo apps but this one is strange.
I have all exceptions on ignore.

Olly first stops on:

- 004D98F4 LOCK MOV DL,0FD ; LOCK prefix is not allowed

then i press shift+f9

it breaks on:

- 004E11B1 IN AL,DX ; I/O command

Then it terminates. Anyone seen this before?
psyCK0
05-18-2004, 07:31 PM
Try:
1. Rename ollydbg.exe to something else
if that doesn't help
2. Change OllyDbg window class and window caption

Please post your results here
Ricardo Narvaja
05-18-2004, 08:41 PM
Us better put a second OLLYDBG.exe in OLLY FOLDER with other name. You can use OLLYDBG.exe in same ocassion and PIRULO.exe (ollydbg renamed) for this new armadillo.

With this and use plugin IsDebug is enough and run perfect in olly.

Ricardo
sonkite
05-19-2004, 02:15 PM
Thanks that worked, nice to see he updated his protection a little ;)


CommandBar help

RCE Messageboard's Regroupment > Plugins > CommandBar help
Slap
05-18-2004, 07:24 PM
Hello,To all

Need someone to please help me with this problem.
i download the commandbar-plugin, but when i startup
Olly, i don't see the cmdbar, at all so any help on this please

Thank you
Slap
05-18-2004, 07:58 PM
Hey,To all

Well i found a way to fix this for my self.
what i did was name a folder, plugins
put all of the dll's in it & all is great i

now have cmdbar, working

Thank you
wut55
05-29-2004, 03:51 AM
That's the way it should be.


ASPRs 1.30 & 1.31 scripts

RCE Messageboard's Regroupment > OllyScript > ASPRs 1.30 & 1.31 scripts
Mario555
05-18-2004, 08:01 PM
/*
////////////////////////////////////////////////////
// ASProtect 1.30b import recovery & OEP / tempOEP finder (only Delphi & Imagebase = 400000)
// Author: Mario555
// Email : Mario555@pisem.net
// OS : WinXP SP1, OllyDbg 1.10b,OllyScript v0.7
// Note : Olly must be hide (IsDebuggerPresent)
////////////////////////////////////////////////////
*/

var cbase
gmi eip, CODEBASE
mov cbase, $RESULT
log cbase
var csize
gmi eip, CODESIZE
mov csize, $RESULT
log csize

var k
var l
var c
var function
var first
var a1
var a2
var a3
var iat_addr
var wr_addr
var mhandle
var mhandle_old
var iat_addr_old

mov c,0
mov mhandle_old,0
mov first,0
mov iat_addr, 400000
cmp [4002d0],0
jne loc_section_change
add iat_addr, [4002cc]
loc:
log iat_addr
eoe lab1
eob lab1
run

lab1:
cmp c,7
je lab_Breaks
add c,1
mov k,esp
add k,40
mov l,[k]
cmp l,400000
je lab_last
esto

lab_Breaks:
add c,1
var addr
var temp
mov addr,eip
shr addr, 10
shl addr, 10
mov temp, addr
add temp, 776d
mov a1,temp
bp temp
add temp, 159
mov a2,temp
bp temp
add temp, 6d
mov a3,temp
bp temp
eob lab2
eoe lab2
esto

lab2:
cmp eip, a1
je loc_imp
cmp eip, a2
je loc_imp
cmp eip, a3
je loc_imp
jmp lab1

loc_imp:
mov k, esp
add k, 30
mov mhandle, [k]
cmp mhandle, mhandle_old
je loc1
mov mhandle_old, mhandle
add iat_addr, 4

loc1:
cmp first,0
mov first,1
je loc3

loc2:
sub wr_addr,1
mov [wr_addr], #25#
add wr_addr,1
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function

loc3:
mov wr_addr, ebx
mov function, eax
mov iat_addr_old, iat_addr
add iat_addr, 4
esto

lab_last:
bprm cbase, csize
eob end
eoe end
esto

end:
sub wr_addr,1
mov [wr_addr], #25#
add wr_addr,1
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
cmt eip,"!!!!!!!!!!!!!!!!!!"
bpmc
bc a1
bc a2
bc a3
bc a4
ret

loc_section_change:
add iat_addr, [4002a4]
jmp loc
Mario555
05-18-2004, 08:02 PM
/*
////////////////////////////////////////////////////
// ASProtect 1.31b import recovery & OEP / tempOEP finder (only Delphi & Imagebase = 400000)
// Author: Mario555
// Email : Mario555@pisem.net
// OS : WinXP SP1, OllyDbg 1.10b, OllyScript v0.7
// Note : Olly must be hide (IsDebuggerPresent)
////////////////////////////////////////////////////
*/

var cbase
gmi eip, CODEBASE
mov cbase, $RESULT
log cbase
var csize
gmi eip, CODESIZE
mov csize, $RESULT
log csize

var k
var l
var c
var function
var first
var a1
var a2
var a3
var a4
var a5
var iat_addr
var wr_addr
var mhandle
var mhandle_old
var iat_addr_old

mov c,0
mov mhandle_old,0
mov first,0
mov iat_addr, 400000
cmp [4002d0],0
jne loc_section_change
add iat_addr, [4002cc]
loc:
log iat_addr
eoe lab1
eob lab1
run

lab1:
cmp c,0a
je lab_Breaks
add c,1
mov k,esp
add k,14
mov l,[k]
cmp l,400000
je lab_last
esto

lab_Breaks:
add c,1
var addr
var temp
mov addr,eip
shr addr, 10
shl addr, 10
mov temp, addr
add temp, 4728
mov [temp], #3bc090#
add temp, 0ee1
mov a1,temp
bp temp
add temp, 11f
mov a2,temp
bp temp
add temp, 0a6
mov a3,temp
bp temp
add temp, 52
mov a4,temp
bp temp
sub temp, 4f
mov a5, temp
bp a5
eob lab2
eoe lab2
esto

lab2:
cmp eip, a1
je loc_imp
cmp eip, a2
je loc_imp
cmp eip, a4
je loc_imp
cmp eip, a3
je loc_imp2
cmp eip, a5
je loc_imp21
jmp lab1

loc_imp:
mov k, esp
add k, 14
mov mhandle, [k]
cmp mhandle, mhandle_old
je loc1
mov mhandle_old, mhandle
add iat_addr, 4

loc1:
cmp first,0
mov first,1
je loc3

loc2:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function

loc3:
mov wr_addr, esi
mov function, eax
mov iat_addr_old, iat_addr
add iat_addr, 4
run

loc_imp2:
mov mhandle, eax
cmp mhandle, mhandle_old
je loc22
mov mhandle_old, mhandle
add iat_addr, 4

loc22:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
mov k, esp
add k, 0c
mov k, [k]
run

loc_imp21:
mov l, esp
sub l, 14
mov l, [l]
add k, l
add k, 400000
mov wr_addr, k
mov k, esp
sub k, 24
mov k, [k]
mov function, k
mov iat_addr_old, iat_addr
add iat_addr, 4
run

lab_last:
bprm cbase, csize
eob end
eoe end
esto

end:
sub wr_addr,2
mov [wr_addr], #ff25#
add wr_addr,2
mov [wr_addr], iat_addr_old
mov [iat_addr_old], function
cmt eip,"!!!!!!!!!!!!!!!!!!"
bpmc
bc a1
bc a2
bc a3
bc a4
bc a5
ret

loc_section_change:
add iat_addr, [4002a4]
jmp loc
psyCK0
05-19-2004, 12:02 PM
Great scripts.
Added to site.


MEW 10 - OEP finder (my first script)

RCE Messageboard's Regroupment > OllyScript > MEW 10 - OEP finder (my first script)
Anonymous
05-20-2004, 05:30 AM
/*
// OEP FINDER FOR: Mew 10 exe-coder 1.0 by Northfox
// AUTHOR : SMoKE (smoke@freenet.am)
// OS : WinXP SP1, OllyDbg v1.10c, OllyScript v0.8
// INFOZ :\'@
psyCK0
05-20-2004, 06:38 AM
Here it is... Will be added to site shortly.

/*
// OEP FINDER FOR: Mew 10 exe-coder 1.0 by Northfox
// AUTHOR : SMoKE (smoke@freenet.am)
// OS : WinXP SP1, OllyDbg v1.10c, OllyScript v0.8
// INFOZ : dump at OEP and simply fix import table by ImpRec
*/
var X
gpa "LoadLibraryA", "kernel32.dll"
bphws $RESULT, "x"
eob label1
run
label1:
bphwc $RESULT
mov X, [esp]
bp X
eob label2
run
label2:
bc X
findop eip, #C3#
bp $RESULT
eob label3
run
label3:
bc $RESULT
sto
cmt eip, "OEP Reached !"
ret
loveboom
06-01-2004, 10:29 AM
another:
bp LoadLibraryA
run

bprm codebase,codesize
run

bpmc
findop c3
bp $result
run

sto
ok ,finished
Northfox
06-07-2004, 01:24 AM
Or only use the new version of PEID->General Debugger and it will make the source nearly as the original.


For Teerayoot

RCE Messageboard's Regroupment > General > For Teerayoot
JDog45
05-20-2004, 07:47 AM
There really isn't a general area here, so I hope this is ok.

Teerayoot, are you ever going to open your site back up? I'd love to get a hold of those tuts you had.
Teerayoot
05-22-2004, 12:01 PM
Hi
My website www.bugsgroup.com (http://www.bugsgroup.com) is down due to banwidth limit exceed.
And all tuts have been deleted by accident.
And i think "www.bugsgroup.com" ,i no longer plan to open again because have little banwidth,if open again it will be down again.

Somehow,i plan to open another site come with exploiting ,programming and Reserving .
It's may take a long time to open that site so that please be patient.
JDog45
05-22-2004, 05:39 PM
Hi
My website www.bugsgroup.com (http://www.bugsgroup.com) is down due to banwidth limit exceed.
And all tuts have been deleted by accident.
And i think "www.bugsgroup.com" ,i no longer plan to open again because have little banwidth,if open again it will be down again.

Somehow,i plan to open another site come with exploiting ,programming and Reserving .
It's may take a long time to open that site so that please be patient.

I have a board that I'm an admin at. There is plenty of space/bandwith if you need. It's a paid host too.

MSN: JDog45_@hotmail.com
file
05-26-2004, 07:10 AM
To Teerayoot
How I can contact u for Demo Something? Please contact me file_0007@hotmail.com
JDog45
05-30-2004, 03:33 AM
Teerayoot

I got the new host, do you have a regular email addy that you check?


OllyDbg v1.10b - where to download?

RCE Messageboard's Regroupment > General > OllyDbg v1.10b - where to download?
psyCK0
05-20-2004, 11:32 AM
Hey all...
Can't find the old OllyDbg version 1.10b anywhere... Can someone post a link or something? =)
Epsylon3
05-20-2004, 04:09 PM
yep... here you have it :
www.rouzepsy.us/odbg110b.zip (http://www.rouzepsy.us/odbg110b.zip)
psyCK0
05-20-2004, 07:55 PM
thx


Script for upxshit 0.6 (snaker)

RCE Messageboard's Regroupment > OllyScript > Script for upxshit 0.6 (snaker)
mimas
05-20-2004, 12:45 PM
Upxshit is an upx scrambler used in PEiD.

It's my first script :)

--8<----
/*
EOP finder for upxshit 0.6 (snaker) & UPX
It also works for a "standalone" UPX packed program

Author : mimas
*/

var x

loop:
findop eip, #E9??# // find jump to next loop
mov x, $RESULT
sub x, eip
cmp x, 10 // (@jmp - eip) use to be 10,
// we can handle different loop size this way
ja stub
go $RESULT
sto
jmp loop

stub:
// the terrific UPX OEP finder
eob end
sto
mov x, esp
bphws x, "r"
run

end:
bphwc x
sto
ret
mimas
05-20-2004, 12:59 PM
Oups, version is 0.06
psyCK0
06-24-2004, 09:09 AM
Added to site


[Plugin Dev Question] Extract highlighed lines in

RCE Messageboard's Regroupment > Plugins > [Plugin Dev Question] Extract highlighed lines in
Epsylon3
05-20-2004, 04:08 PM
How can i get the DRAW_XXX values from module list...

i get all t_module fields in t_sorted data of the t_table... but i dunno where to find this info...


[NEW Plugin] DLLBreakEx

RCE Messageboard's Regroupment > Plugins > [NEW Plugin] DLLBreakEx
Epsylon3
05-20-2004, 04:42 PM
Description :
For debugged proggies which loads a lot of dll, with this plugin you can select a dll from harddrive.
When this dll will be loaded, you will get an Alert MessageBox.

Needs the debugging option event : Break on new module (DLL)

Tested on odbg 1.10c

Sources Compiled with :

BCB6.0 / Plugin SDK 1.10c
Epsylon3
05-20-2004, 06:55 PM
v1.2
+ Static version (no runtime)
* Added compatibility with 1.10b (ODBG_Paused)

v1.1
+ Added DLL Breakpoints List in Menu
+ Ignore other modules when bp is set
* Bug with module cache on restart

http://www.rouzepsy.us/DLLBreakEx.12.zip

To enhance the plugin, i need help to :

Resume run if not the good dll in proc ODBG_PausedEx()

i used a PostMessage WM_KEYDOWN F9 but i would like to use last mode like the Go() func..

tx
psyCK0
05-21-2004, 06:14 AM
I think it might be better if you used ODBG 1.10b as a platform for development... 1.10c is buggy...
focht
05-21-2004, 01:24 PM
Seems you forgot to redist BCB runtime?

Ollydbg doesnt load your plugin due to "Rtl60.bpl is missing".
Either link statically or add the missing library with your plugin release.

Regards,

A. Focht
Epsylon3
05-21-2004, 01:33 PM
updated my post with static version...

psycho : yep 1.10c is not compatible with ollyscript 0.81 ive seen...
after a 30mn search for debug vc71d dlls

but i use the new ODBG_PausedEx...
i will try with the 1.10b ODBG_Paused func...
psyCK0
05-23-2004, 06:26 PM
Epsylon3: you can use the plugins main loop. I tried using ODBG_PausedEx and it works great, but the the plugin is not compatible with 1.10b, and 1.10c is way too buggy.
OSC 0.81 was accidently shipped as a Debug build. Sotty about that =) 0.85 should work ok.
Epsylon3
05-25-2004, 04:44 PM
Version 1.10 - first beta

Callback function ODBG_Paused(int reason,t_reg *registers). Called each time when debugged application is paused;

it's in since the 1.10a

i use now ODBG_Paused and not ODBG_PausedEx
orchid88
08-06-2004, 04:33 AM
Epsylon3
I am very interested in your plugin.Since I can not explore your web site which mentioned above, would you please email you as an attachment! My email address is:orchid88@21cn.com . I will be appreciate for your help.

Regard
ywind
08-19-2004, 05:01 AM
this plugin can't download
emb
09-17-2004, 01:25 AM
I can not login the Web,please send me one . zhangyun_dx@hotmail.com
Thanks a lot!
Epsylon3
09-28-2004, 08:07 PM
new link :
http://epsylon3.free.fr/files/DLLBreakEx.12.zip
Epsylon3
10-02-2004, 10:20 PM
Version 2.2 (Made with Delphi) :

http://epsylon3.free.fr/files/DLLBreakEx.22.zip

* Fix runtime libs...
+ Load/Save filter for process name command
+ Reload last used filter


[plugin] OllyScript v0.85

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.85
psyCK0
05-20-2004, 05:19 PM
Changes in v0.85:
+ New commands: AN, DEC, DMA, INC, REPL
+ $VERSION reserved variable
# Better handling of wildcards
# Fixed bug with handling of large numbers
# Works with OllyDbg v1.10b

Get it from http://ollyscript.apsvans.com
psyCK0
05-21-2004, 05:50 AM
Umm, I accidently compiled the plugin in debug mode instead of release mode. Please redownload.
Anonymous
05-21-2004, 07:24 AM
need source!
psyCK0
05-21-2004, 08:13 AM
then mail me plz


Not really a bug

RCE Messageboard's Regroupment > Bugs > Not really a bug
RE_LOAD
05-20-2004, 06:24 PM
in the CPU tab of the window "Debugging options", in the list of the visible lines after stepped command, the item "7 lines" appears twice.


New OllyScript error!

RCE Messageboard's Regroupment > OllyScript > New OllyScript error!
Anonymous
05-20-2004, 08:36 PM
Hi to all,
after installing new version of OllyScript 0.85, i have the following error in Olly 1.10c

Missing MSVCP71D.dll

Olly starts too .. but OllyScript cannot be found in Plugins.
What can i do?
With 0.80 is all ok!
Anonymous
05-20-2004, 09:38 PM
It need file "MSVCP71D.dll", It can write in .NET, "MSVCP71D.dll" is file library of Microsoft Studio.Net. You can search and copy to folder system(windows\system or windowns\system32)
focht
05-21-2004, 05:06 AM
Greetings,

its the C runtime (debug version) of VC++ 7.1 Compiler...

release: MSVCP71.dll, MSVCR71.dll
debug: MSVCP71D.dll, MSVCR71D.dll

MSDN tells the story ... they are no longer distributed by OS/service packs.
App vendors must distribute the files.
They have to be kept locally so that they don't overwrite the system versions (which i regularly do, i put them into same app directory)

http://support.microsoft.com/default.aspx?scid=kb;en-us;326922

Overview:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vclib /html/_crt_c_run.2d.time_libraries.asp
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vclib/html/_crt_c_run.2d.time_libraries.asp
)

Though i wonder why the plugin is shipped as debug version (unusual) ...
I read somewhere you must redist msvcp71.dll and msvcrt71.dll but you are NOT allowed to redist msvcp71d.dll and msvcrt71d.dll. ;)

Just ask the author of plugin to recompile it using release version and redist both release runtime dlls - OR - statically link to CRT.

Regards
psyCK0
05-21-2004, 05:45 AM
The reason for it being compiled in debug mode is the author being tired and therefor clicking on the wrong folder in Explorer. =)
Please redownload to get the telease version. :)
britedream
05-26-2004, 02:15 AM
ollyscipt doesn't assemble correclty : asm xxxxxxx, "mov edx,dword ptr ss:[esp+0C]"


TOOL FOR AUTOMATIC FOUND OF POINT H

RCE Messageboard's Regroupment > General > TOOL FOR AUTOMATIC FOUND OF POINT H
Ricardo Narvaja
05-21-2004, 12:49 PM
If you actualice your SO and don't have time for fpund the new point H run this little tool made by AKIRA and you have your point H in a second, without you need make nothing of work.

http://tinyurl.com/2byg5

This is the link to DOWNLOAD

Ricardo Narvaja
tonyxxy
05-21-2004, 02:25 PM
Thanks Ricardo and Akira!

works great :-)
JDog45
05-21-2004, 04:33 PM
Nice!! Worked perfect! :D
jitin
05-21-2004, 06:32 PM
was looking for this only
thanx one again
josephhkim
02-06-2005, 02:44 PM
The link isn't working. Can someone repost it? Thanks.
hosiminh
02-07-2005, 06:34 AM
Press Alt+E , select module: USER32.dll and double click on it.

Press Ctrl+S and copy&paste into input box :

MOV ESI,EAX
MOV EAX,ECX
SHR ECX,2
REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
MOV ECX,EAX
AND ECX,3
REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]

Press F2 on this line :

77D5CA9E F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]

(This address (77D5CA9E) will be **different** in your comp.)

or enter in commandline plugin: bp 77D5CA9E
josephhkim
02-07-2005, 09:32 PM
Ricardo Narvaja
Wow, thanks ALOT. :-D


1.23

RCE Messageboard's Regroupment > OllyScript > 1.23
noinzang
05-21-2004, 04:24 PM
1.23
psyCK0
05-21-2004, 06:57 PM
are you the one who also started the amazingly insightful thread with topic set to "PEbundle", first post of which also consisted of that sole word? I think I can detect a pattern here...


Hi !Can Olly set break point like Si?

RCE Messageboard's Regroupment > General > Hi !Can Olly set break point like Si?
deux
05-22-2004, 02:50 AM
I've just use Olly for 2 month, and i have a question:
Can Olly set breakpoint at API fuction like Softice?
If it can do that i think it can replace SI perfect.
EJ12N
05-22-2004, 03:35 AM
Yes it can
psyCK0
05-22-2004, 05:29 AM
Yes it can. To do it flip the switch at the back of your computer from 1 to 0. Now fly away and be a happy cabbage!

WTF is happening? Feels like we are invaded by an army of mutated idiots or idiotic mutants or something.
JDog45
05-22-2004, 08:20 AM
Yes it can. To do it flip the switch at the back of your computer from 1 to 0. Now fly away and be a happy cabbage!

WTF is happening? Feels like we are invaded by an army of mutated idiots or idiotic mutants or something.

Tell me about it. Another board I belong to (BiW), the same thing is happening.

Deux, look for the command bar plugin.
psyCK0
05-22-2004, 08:47 AM
Last week a guy msgd me on IRC asking advice on unpacking Armadillo. He did not know ANY asm, had never heard of IDA or any of the other usual tools (except for PEiD apparently), and really wanted me to crack on request. Whats the world coming to?
deux
05-25-2004, 06:26 AM
thank for helping, ichange to use Olly replace for SI because i've just install windows XP , althought SI now is support XP but not good as for w98 so i use Olly., i hope will have more help from you
idoit
05-25-2004, 12:00 PM
wanna set breakpoint like SI in olly is easy
load ur target. click [E] icon means executables. then find ur target
@ c:\program files\alcohol.exe ; in the Executable windows
then right click then click view names
u will see bunch of api calls
just search the api u wanna break;
@user32.getdlgitema <=right click to toggle or set breakpoint on every refrences if toggle does not break
u will let olly act like SoftIce.
Bingo!!!
j2innet
10-23-2004, 07:21 PM
cmdline.dll comes with ollydbg1.1


Debugging Microsoft Visual C# / Basic .NET Code...

RCE Messageboard's Regroupment > Bugs > Debugging Microsoft Visual C# / Basic .NET Code...
I Have Forgotten
05-23-2004, 06:48 AM
I am using OllyDbg 1.10c to debug some Basic .NET code but everytime it analyzes the code it actually executes and runs the code in question.

I can pause the program and check the stacks, etc. but this is not good if I need to debug early on in the code.

Any ideas how this can be worked around until Olly is updated to recognize .NET code better?
mimas
05-23-2004, 10:08 AM
You should use Windbg with the SOS (Son of strike) extension, in the SDK .net. Ollydbg can only show 'jitterised' instructions in a native format and the 'real cpu' stack.

As the .Net code is compiled on the fly, the SOS extension can help you to watch the .net stack and other CLI stuff.

Take a look at the SDK .net tools (ildasm, DbgClr,....), there are more adapted tools than ollydbg for this kind of thing.
I Have Forgotten
05-23-2004, 01:41 PM
I have never really been a WinDBG fan but sometimes it is necessary so thanks for this info.

For those among us who may be interested I found this interesting page concerning WinDBG and SOS:

_http://msdn.microsoft.com/msdnmag/issues/03/06/Bugslayer/default.aspx

Does anyone know if Olly will support .NET code in the future?
1bitshort
05-24-2004, 12:20 PM
I found it interesting that programs compiled in 'weird' languages such as Visual Basic's PCode format and .NET are hard to attack, obviously because disassemblers/debuggers etc can only go to work on 'normal' x86 code.

Armed with this in mind, I created an 'interpreted assembly language' ... basically you just create an assembly language 'script', which can be as simple as something like this:
mov eax, 1
ret
But it doesnt compile to normal x86 opcodes. Instead, it compiles to my own custom format, which can only be read by my own interpreter. So while crackers could use their debuggers to disassemble the part of the program that interprets and executes the assembly script (which is obviously normal x86 code), it'd be quite difficult for them to analyse the actual interpreted assembly script which is the part they'd need to patch - not the interpreter.

I'd appreciate both positive and negative constructive feedback on this idea, cheers. :)
Necr0Potenc3
05-28-2004, 06:12 PM
Well, .net code is now using obsfucators, they kinda "emulate" the code at runtime

you can just decompile the code (like salamander decompiler) and you'll see what you need

the only visible part of the code when you disasm it, are the variables (other than strings)


Difference

RCE Messageboard's Regroupment > OllyScript > Difference
Scarabee
05-23-2004, 03:25 PM
Hi all,

i wrote this small script for unpacking MEW10. Just for fun, but i encountered something weird:
when testing the script with Ollyscript 0.7 and with 0.85 it gives me different results.

this is the script:

var oki
var oki2

sto
sto

findop eip, #FFE0#
mov oki, $RESULT
bp oki
esto
sto
bc oki

findop eip, #C3#
mov oki2, $RESULT
bp oki2
esto
sto
bc oki2

MSG "OEP Reached!"

version 0.7 puts me at the RETN that leads to the OEP, but 0.85 leads me to a different (earlier)

location after searching for C3 byte:

0048C0FF ^EB C3 JMP SHORT Unpacked.0048C0C4 <-- 0.85 lands here
0048C101 52 PUSH EDX
0048C102 51 PUSH ECX
0048C103 57 PUSH EDI
0048C104 56 PUSH ESI
0048C105 AD LODS DWORD PTR DS:[ESI]
0048C106 50 PUSH EAX
0048C107 52 PUSH EDX
0048C108 FF11 CALL DWORD PTR DS:[ECX]
0048C10A 5E POP ESI
0048C10B 5F POP EDI
0048C10C 59 POP ECX
0048C10D 5A POP EDX
0048C10E AB STOS DWORD PTR ES:[EDI]
0048C10F ^EB B3 JMP SHORT Unpacked.0048C0C4
0048C111 C3 RETN <-- 0.7 lands here

so my question, is this a small bug or does 0.7 search for the first byte of the ASM command?

/scarabee
psyCK0
05-23-2004, 06:12 PM
I've now fixed that unwanted "feature" and reuploaded the plugin. =)
Scarabee
05-24-2004, 04:23 AM
Much appreciated!
Thanx


NEW - OllyDbg v1.10

RCE Messageboard's Regroupment > Announcements > NEW - OllyDbg v1.10
sonkite
05-24-2004, 02:30 PM
New version is out, lets all try it out.

http://home.t-online.de/home/Ollydbg/odbg110.zip
JDog45
05-24-2004, 03:43 PM
Excellent. Will give it a try...:D
1bitshort
05-25-2004, 12:44 AM
The Ollydbg website seems to be down at the moment?
babar0ga
05-25-2004, 04:09 AM
nice.

using it...


crash ollydbg 1.10, OD has a big bug

RCE Messageboard's Regroupment > Bugs > crash ollydbg 1.10, OD has a big bug
loveboom
05-25-2004, 07:43 AM
now ollydbg has a big bug,
1,load target.
2,press f9
3.and now press f12
crash ollydbg, hoo!

OS:winxp pro sp1, ollydbg 1.10(May.23.2004)
tonyxxy
05-25-2004, 09:18 AM
Same problem for me :-(

OS: also winxp pro sp1 ollydbg 1.10 final beta
loveboom
05-25-2004, 09:40 AM
And now i found another bug,
open ollydbg 1.1
select file-->attach,
attach a process,at this time,press f9,
crash ollydbg too!
Lord_Looser
05-25-2004, 09:52 AM
OllyDbg crashes only with OllyScript (v0.85 - Compiled May 23 2004 22:18:32) OS: Win2k SP4 OllyDbg v1.10

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012E000 00496BB4 Maybe OllyScri._ODBG_Pausedex OLLYDBG.00496BAE 0012E020
0012E024 00434466 OLLYDBG.00496B84 OLLYDBG._Suspendprocess+1D1 0012E020
0012E028 00000001 Arg1 = 00000001
0012E02C 00000000 Arg2 = 00000000
0012E030 00000000 Arg3 = 00000000
0012E034 00000000 Arg4 = 00000000
0012E050 0043212C OLLYDBG._Suspendprocess OLLYDBG.00432127 0012E04C
0012E054 00000001 Arg1 = 00000001

040145C0 /$ 83EC 54 sub esp,54
040145C3 |. 56 push esi
040145C4 |. 8B7424 68 mov esi,dword ptr ss:[esp+68]
040145C8 |. 57 push edi
040145C9 |. 83C6 0C add esi,0C
040145CC |. B9 15000000 mov ecx,15
040145D1 |. 8D7C24 08 lea edi,dword ptr ss:[esp+8]
040145D5 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi]
040145D7 |. 8B0D 14D90204 mov ecx,dword ptr ds:[402D914]
040145DD |. E8 BE07FFFF call OllyScri.04004DA0
040145E2 |. 83F8 03 cmp eax,3
040145E5 |. 5F pop edi
040145E6 |. A3 40E90204 mov dword ptr ds:[402E940],eax
040145EB |. 5E pop esi
040145EC |. 75 19 jnz short OllyScri.04014607
040145EE |. 817C24 58 84000000 cmp dword ptr ss:[esp+58],84
040145F6 |. 75 0F jnz short OllyScri.04014607
040145F8 |. 8B0424 mov eax,dword ptr ss:[esp]
040145FB |. 8B0D 14D90204 mov ecx,dword ptr ds:[402D914]
04014601 |. 50 push eax
04014602 |. E8 0908FFFF call OllyScri.04004E10
04014607 |> 33C0 xor eax,eax
04014609 |. 83C4 54 add esp,54
0401460C \. C3 retn

eip=040145D5
ecx=00000015 (decimal 21.)
ds:[esi]=[0000000C]=???
es:[edi]=stack [0012DFAC]=00000000
OllyScri._ODBG_Pausedex+15
psyCK0
05-25-2004, 02:23 PM
You mean ALL the above crashes are because of OSC? If you remove it all is ok?
tonyxxy
05-25-2004, 02:47 PM
There's another starting thread about this subject

h--p://www.exetools.com/forum/showthread.php?t=4339
psyCK0
05-25-2004, 06:27 PM
A temporary bugfixed version is uploaded to the OllyScript site. Please test it, I didn't have time (should work though).
ILCH
05-26-2004, 08:41 AM
I´ve got the same prob with Olly.
1.Load Executable
2. F9 to Run
3. F12 to Pause
4. Olly Crash

Prob is since 1.10c

1.10b work fine

[OS]
Win2kSP3
Teerayoot
05-26-2004, 11:05 AM
0llyScript 0.85
http://ollyscript.apsvans.com/getPlugin.php?ver=08

and OllDbg 1.10 - preliminary release
http://home.t-online.de/home/Ollydbg/odbg110.zip

Work fine.
Lord_Looser
05-26-2004, 12:50 PM
0llyScript 0.85 (Compiled May 25 2004) works fine...

anther bug in OllyDbg 1.10 - preliminary release...
Enabled OllyDbg security option “Allow code injection to get address of WinProc” randomly produces an error message “Unexpected event 00000006 in injected code. Debugged program may get unstable, please reload it as son as possible.”
focht
05-26-2004, 04:08 PM
Greetings,

Enabled OllyDbg security option “Allow code injection to get address of WinProc” randomly produces an error message “Unexpected event 00000006 in injected code. Debugged program may get unstable, please reload it as son as possible.”

Well it may be due to the nature, the injector code is implemented.
I've written lengthy explanations on the side effects in other thread some time ago (mainly conversation with "oh me anon" to explain why code injection sometimes fail).

In short: the injector code synchronizes its execution with the debugger with INT3's (produce EXCEPTION_DEBUG_EVENT + EXCEPTION_STATUS_BREAKPOINT).
If the debugger encounters any other event code while waiting for injector sync points, like LOAD_DLL_DEBUG_EVENT (0x6) in this case, it assumes something went wrong (it expected EXCEPTION_DEBUG_EVENT).

You might look into debugger log which module gets loaded on demand or enable "break on dll load" to catch this case.

The exercise is left to the author, which API call demands the load of additional dll in injector code.

Regards,

A. Focht
Lord_Looser
05-27-2004, 06:29 AM
to focht: Thanks to your detailed info.


how 2 defeat upxpr in olly

RCE Messageboard's Regroupment > General > how 2 defeat upxpr in olly
idoit
05-25-2004, 11:55 AM
upx is easy 2 unpack but upxpr will prevent from unpacking
i hav unpack with ollydump but unable 2 fix IAT with imprec v1.6
can anyone help me to defeat this new upxpr packer.
Thanks
Teerayoot
05-27-2004, 12:04 PM
You may found wrong OEP!
BruceLee
05-31-2004, 05:37 AM
Which proggie do you unpack?
idoit
06-01-2004, 06:29 AM
alcohol
if u hav idea pls hav a help thanks


skype /no crack request

RCE Messageboard's Regroupment > General > skype /no crack request
deli
05-26-2004, 05:17 AM
hi
skype is a p2p phone.
i want to make a security analysis of the binary.
but i cannot unpack the file.
i have less knowlege in unpacking, but i tried it.
i was wonderning that the protections pushs 20 times a null on the stack, is this a debuging detection trick ???

sorry for my lame english, and less knowlege

best regards , deli
tonyxxy
05-26-2004, 09:21 AM
Skype is packed with PeX 0.99. The authors also scrambled it somehow to prevent unpacking with DeX (PeX unpacker). You'll have to do it manually. There's a tutorial about this subject. Did'nt try it myself though.

h--p://mup.anticrack.de/MUP_PeX_v0.99.zip

Regards,

tonyxxy
deli
05-26-2004, 01:58 PM
are you sure ?
i downloaded pex and test it with a exe and the decryption algorithm looks total different...

but thanks a lot
tonyxxy
05-26-2004, 02:49 PM
Don't know for the current version of Skype but a while ago on version 0.95 it was PeX. To be sure you can always check with PEiD.

Regards,

tonyxxy
tonyxxy
06-14-2004, 11:38 AM
deli,

Do you still want to unpack Skype?
deli
06-16-2004, 04:02 AM
yes that would be great, but i need the newest version unpacked.

peid doesn't detect anything

best regards
delikon
TBD
06-16-2004, 04:20 AM
unpack thread. closed.


To Teerayoot

RCE Messageboard's Regroupment > General > To Teerayoot
file
05-26-2004, 07:14 AM
How can I contact u for demo something? Please contact me at file_0007@hotmail.com


DLL packed by Armadillo

RCE Messageboard's Regroupment > General > DLL packed by Armadillo
tresor
05-26-2004, 10:03 AM
Hi,

I have a dll protected with armadillo. No one debugger/disassebmler could help me with this. Maybe someone unpack any armadillo protected DLL, please help me !!! :)

regards
Ricardo Narvaja
05-26-2004, 01:30 PM
All debugger help you, sofice, ollydbg are capable of work with this, is similar then unpack an exe. (in XP is equeal to unpack an exe, in 98 there is more difficult but is possible too with hard work).

Ricardo


To psycko

RCE Messageboard's Regroupment > OllyScript > To psycko
Scarabee
05-26-2004, 03:08 PM
Hi psyCKO,

i'm facing an error using the different ollyscript plugin versions again.

This is script, for unpacking ASPack 2.000:

var oki

findop eip, #6175#
mov oki, $RESULT
bp oki
run
sto
sto
sto
sto

msg "OEP Reached!"

Ollyscript v0.7 leads me to OEP, as it should. Latest v0.85 gives error message: "Unable to read memory of debugged process. Breakpoint at 00000000 is deleted."

This is caused due to the fact that the findop command cannot search for more than 1 byte! if i'd replace 'findop eip, #6175#' with 'findop eip, #61#' the script works fine!

/Scarabee
psyCK0
05-26-2004, 03:49 PM
If the 6175 you are looking for is something like

00401034 61 POPAD
00401035 75 6A JNZ SHORT xxx.004010A1

then 61 and 75 are in different opcodes.
Therefore OSC correctly returns 0 in $RESULT.

To find bytes in different opcodes you should use FIND:
FIND eip, #6175#
which will give you the correct result, in this case 00401034.

You should also check for this kind of errors in the script, ie:
FIND eip, #6175#
CMP $RESULT, 0
JE nothing_found
bp $RESULT
....

nothing_found:
msg "Nothing found!"
ret
Scarabee
05-26-2004, 05:40 PM
thanx a lot.

i was confused as it worked in v0.7 that way.
Learned something again today :)
Anonymous
05-26-2004, 07:03 PM
Hi psyCKO,

I also have a question concerning this. In Ollyscript 0.81 i used
findop eip, #C3# and it worked fine.
However when i'm trying to use the same script in 0.85 I break on #EBC3#. Is there a possibility to search only for #C3#? It seems there's a difference between 0.85 and 0.81.

Thanks in advance.

Regards,

tonyxxy
psyCK0
05-27-2004, 04:23 AM
Hey... That's a bug (or maybe an unwanted feature) that was fixed a couple of days ago. Please redownload the plugin. =)
tonyxxy
05-27-2004, 06:43 AM
Ok thats solved my problem :-)

Thanks psyCKO

tonyxxy


GGS0 GGS1 Section headers

RCE Messageboard's Regroupment > OllyScript > GGS0 GGS1 Section headers
Epsylon3
05-26-2004, 09:30 PM
hi, does somebody know which compression/protection is used to encode PE with those PE section markers :

GGS0
GGS1
.rsrc
bigglass
05-27-2004, 06:56 AM
scrambled UPX
Epsylon3
05-29-2004, 11:22 PM
yes, thanx... that works with the script upx.txt


DLL Export not working

RCE Messageboard's Regroupment > General > DLL Export not working
sam
05-28-2004, 01:26 AM
Following the loaddll tutorial on the website I get an error when I try to execute CALL DLL export from the view menu. The program sais that it is not able to locate the dll.

Whats wrong with my setup , am i missing files ??
sam
05-28-2004, 04:12 AM
nevermind, i just realised what i was doing wrong....
i was trying to debug user32.dll from another folder.


How to find references to menu property

RCE Messageboard's Regroupment > General > How to find references to menu property
tresor
05-28-2004, 08:00 AM
Hi,

is anyone knows how to change property of menu item or any other control in app written in VC++ ? I have grayed menu items (eg. Help,About) and I'd like to change their property to enabled. Maybe there's something like, for example closing the window in hex FF FF FF 82 to FF FF FF 77........

Thanks
sonkite
05-28-2004, 12:59 PM
Check on these apis, or use a resource editor.

EnableMenuItem / EnableWindow


How to put a breakpoint on Menu Click Event?

RCE Messageboard's Regroupment > General > How to put a breakpoint on Menu Click Event?
wut55
05-29-2004, 03:45 AM
I used a Software and soon I found a bug in it.
The bug is that when I do some modifications in my archive and
Click Edit->Undo,there is no response the first time, when i click
it the second time,it does response.
So i want to DIY it ,but how can i put a breakpoint on Menu Click Evnet?
Thank you in advance!
Sorry for my poor English!


Help PLZ

RCE Messageboard's Regroupment > General > Help PLZ
bazuka
05-29-2004, 08:08 AM
I know that this is not cracking forum, but i need u'r help, i've download ollyscript and i have script for execryptor. I have found OEP and what now???

10x
psyCK0
05-29-2004, 09:39 AM
Dump and fix IAT. If you dont understand what I mean, read tuts.
bazuka
05-29-2004, 10:50 AM
Where can i find some good tut for IAT!!!???

10x for reply!
psyCK0
05-29-2004, 11:43 AM
www.google.com (http://www.google.com)
bazuka
05-29-2004, 12:41 PM
Plz help me i'm gonna crush my fucking comp, i'm trying to dump some shit 5h!!!

Plz
bazuka
05-29-2004, 12:59 PM
I did dump it, but can't make it run dumped file!!!
BruceLee
05-31-2004, 05:35 AM
IAT???? Easy way!
Download ImpREC!
:)
And fix the IAT with IMpREC!
bazuka
05-31-2004, 04:48 PM
Man i have everything for unpacking and cracking, i need u tell me whole procedure for unpacking. I think i have OEP and what should i do with this. In ImpREC u have OEP, RVA and SIZE, and i dont know what should i do then!!!???

10x for any help
mimas
05-31-2004, 07:08 PM
Did you read some IAT rebuilding tuts ? I Think you didn't. So google for it and use "da brain power(tm)".
JDog45
06-02-2004, 04:18 AM
This guy just wants a custom answer to his problem... He doesn't want to spend anytime researching himself.
TBD
06-02-2004, 04:38 AM
how many times I must say:
"THIS IS NOT AN UNPACKING FORUM"

from now on, any posts related to unpacking will be deleted with no warning. I will leave only OllyScript scripts.


Looking to reformat help...

RCE Messageboard's Regroupment > OllyScript > Looking to reformat help...
Jeremy Loper
05-29-2004, 12:55 PM
SHaG/psyCK0,

I am wanting to reformat the help file.
Would it be possible to get a list of error numbers/messages so that I may include a section for that, and possibly get some ideas of what you would want included in a FAQ section.

Basically what I wanting to do is limit the amount of junk posts and email you may be recieving in reguards to common errors and answer some repetitive questions.

Thanks
psyCK0
05-30-2004, 01:48 PM
Hmm, good idea. =)
I will make a list and mail it to you asap.
Jeremy Loper
06-05-2004, 11:56 AM
I'll watch for you email


olly scrip use

RCE Messageboard's Regroupment > OllyScript > olly scrip use
Anonymous
05-29-2004, 07:11 PM
hi

can any one plz tell me how to use the olly scrip
JDog45
05-30-2004, 03:31 AM
Jesus another newbie. Try "looking" at the forums first and READING....
psyCK0
05-30-2004, 08:28 AM
TBD: why dont you delete this kind of threads?
Anonymous
05-30-2004, 09:30 AM
u should't let any one come and write any thing
i suggest that u allow one the members
cps530
05-30-2004, 11:54 AM
To those who never was a newbie, you just have to be quite. Simply don't answer questions you consider stupid ones. You're wasting your precious time.
psyCK0
05-30-2004, 01:46 PM
I'm just sorry to see a great board being polluted by idiotic questions from people to lazy to read the f*cking manual.

I think reading the documentation of OllyDbg and OllyScript is enough to start using those tools. If you, despite reading the manuals, still have some issues - then you are free to ask questions.

Everyone has been a noob once, but I cant remember myself starting threads on reversing boards asking how to use this tool or another. I used the search feature of the board and/or google.


Installation instructions for OllyScript

RCE Messageboard's Regroupment > OllyScript > Installation instructions for OllyScript
psyCK0
05-30-2004, 02:06 PM
Installation instructions can now be downloaded from OllyScript site. You can find them in Documentation section.


To Ricardo, re: packers

RCE Messageboard's Regroupment > General > To Ricardo, re: packers
1bitshort
05-30-2004, 03:07 PM
Ricardo,

You dont seem to have any problems unpacking even the most advanced packers (Armadillo etc) ... I'm just wondering if youve created, or have considered creating your own packer? If not, why not? :)
Ricardo Narvaja
05-30-2004, 03:36 PM
why i'm not a programmer i'm a selfmade cracker and i have my limitations, and hate programming, only make tiny keygens or injects for crack, but don't like programming at all.

There are good programmers for make packers my hobbie is unpack and crack only, and make tuts, jeje.
But in crackslatinos there are members programming a packer, if will be good or not i see when release.
Ricardo
1bitshort
05-30-2004, 03:58 PM
I find it interesting that you're so proficient with disassembling/cracking, yet don't like programming - the two usually go hand-in-hand! But they're definately two seperate and unique skills so I can understand your position. :)

Anyway I was just curious, thanks for taking the time to respond

Enjoy the rest of the weekend!


SVKP 1.3x -> Pavol Cerven HOW to ?

RCE Messageboard's Regroupment > General > SVKP 1.3x -> Pavol Cerven HOW to ?
yano
05-30-2004, 06:15 PM
Hello !

I tried to dump a proggy packed with SVKP 1.3x -> Pavol Cerven using a memory dumper like procdump,memory Dumper,LordPE...etc
after finding the OEP :) hehe (using Ricardo methodes..)
but the probleme is that the proggy Process doesn't appear in the process list .So i used the ollydump 2.0108 ;but once done a message appeared : " The application or dll C:\Windows\system32\SetVer.exe isn't a valid windows image.Check through your installtion floppy disk . (in fact the message was in french :)

Please what to do ?
BruceLee
05-31-2004, 05:31 AM
Where can I download tutor about unpacking SVKP 1.3x?
tonyxxy
05-31-2004, 09:21 AM
Try Ricardo's tutorials. They are in Spanish though, but you can translate them with some online translation utility such as Bablefish, should be enough to understand what's going on. The tuts are always very detailed. Ricardo: keep the good work going man :-)

Regards,

tonyxxy
Paule
05-31-2004, 09:26 AM
Hi there,

as you can see, I´m pretty new to this forum and I apologize for my first post being a question, but after reading this:
after finding the OEP :) hehe (using Ricardo methodes..)
I became curious about what "Ricardos methodes" are. I read a lot about and from Ricardo Narvaja (It´s the guy you tlking about, isn´t he?) and I also searched his FTP for some stuff concerning SVKP but so far I was not able to find something. Do you mind explaining me, how this method works, or where i can find something about it?
Thanks a lot in advance

Regards Paule

btw. Really nice board
yano
05-31-2004, 06:05 PM
HE paule !

enter Ricardo 's ftp and dowload his lessons (tutorialz) about finding OEP of all known packers such as ASPACK, Neolite,Asprotect,Armadillo,..etc and then you will be able to find SVKP's OEP easilly.In fact, i used the methode concerning asprotect OEP finding and worked good :(Exception methode) :)
KNOW that the content of FTP IS IN spanish language.

read his cursos and read them all and.....

sorry i can't tell more
thanks for your question
Paule
06-01-2004, 10:35 AM
Hi yano,

first of all I would like to thank you for your quick answer. I will do as you´ve suggested. There is so much stuff on this FTP, I think I would have searched forever. Unfortunally I´m not able to understand Spanish, but i´ll give it a try with Babelfish or another translation-tool. Even if not every word is translated correctly I think it will comfort my needs.

Thank you

Regards Paule
yano
06-01-2004, 03:25 PM
hello !

Simply here is the site you would look for :

http://www.iespana.es/OllyDBG/Ricardo.html

You can find here all you want concerning the Unpacking...hehe :)
of course included SVKP packer

But this site is in english as well
bye !
yano
06-01-2004, 03:26 PM
hello !

Simply here is the site you would look for :

http://www.iespana.es/OllyDBG/Ricardo.html

You can find here all you want concerning the Unpacking...hehe :)
of course included SVKP unpacking

NB: But this site is in spanish as well
bye !
psyCK0
06-01-2004, 03:59 PM
There is a tool called SysTran which actually produces quite understandable English from those tuts.
Paule
06-02-2004, 10:38 AM
Thanks a lot for all the information. I managed to get the tuts (there has been two of them) concerning SVKP-unpacking. Unfortunally none of the techniques provided within these tuts worked for me. I tried it also the "ASProtect way" and still the same -> I stuck in the middle of nowhere. I always end up at "Int 1" (the last exception) and can´t get Olly to break afterwards. When I follow the code after this "Int 1" I arrive at "SYSENTER" within ntdll. Executing this SYSENTER the prog starts. My target is protected with with SVKP 1.32 (as far as I know). Any ideas what to do? I´ll keep trying.

Regards Paule
Pansemuckl
07-03-2004, 11:42 AM
As far as I know, Ricardo's tutorial is all the help you get on this
issue. I've tried to unpack SVKP myself without success.

I tried to follow Ricardos tutorial (with the same target he was
using) step by step without getting through it - bad translation.
So I was looking for some help at efnet #unpacking, but all they
told me was like "Ricardos tutorial didn't work for me... wish u
luck... if you manage to unpack, tell us how..."

There was one last chance to get some help: Asking one of the
elite cr@ckers personaly. I did, but never received an answer.
It's kinda frustrating...

BTW the target I want to look inside is supposed to be a trojan!
I wanna do some research and for that purpose I need to unpack
it.
Pansemuckl
07-03-2004, 11:46 AM
@all : Ricardos side is down by now, you will find tutorials at
http://crackslatinos.hispadominio.net/

@ Ricardo: Did you check your PM at http://www.woodmann.net/forum ?
I need YOUR help.
Ricardo Narvaja
07-03-2004, 12:41 PM
i have no messages at woodman , plis send again o mail me to

ricnar22@millic.com.ar

and mail me the link of this program packed with svkp and i try unpack or put in a crackslatinos weekly contest for members try unpack and make a tut.

Ricardo
Pansemuckl
07-03-2004, 02:50 PM
Dear Ricardo,

Check your mail.
Ricardo Narvaja
07-03-2004, 05:51 PM
i reply your mail jeje
Pansemuckl
07-03-2004, 06:20 PM
@ALL

The well-known ^DEAMON^ apparently coded an unpacker
called SVKP Explorer, but he's never going to release it.

He wrote:

"Svkp explorer is not to be released to the public... i promised pavol a few years ago to never ever hurt his protector :)"

Source: [h**p://disc.server.com/discussion.cgi?disc=203830;article=211;title=D aemon%27s%20Cave]

See a picture of SVKP Explorer on his website
h**p://daemon.anticrack.de/beta.htm

Don't even think about asking ^DEAMON^ for help or the unpacker
itself. He and Pavol (the lamer that created SVKP) are best friends!!

Obviously they're up to make some cash instead of doing
something for the community. Too bad, that their little baby
didn't work out for 'em...

(hehe... )

@Ricardo:

I've read your mail and I've send all the infos to ya. Let me
know if you succeeded. Talk to you soon.
ivan
09-18-2004, 08:45 AM
Pavol used to be a reverser like rest of us, when you grow up you will realise that you can make some cash with knowledge you have and will eventually switch sides too :)
Bob
12-13-2004, 11:33 PM
Well, the tool is now released on Unpacking Gods site, if anyone's not seen it, and I'm now trying to find docs to use the tool, as they don't explain how to set options for it.. :)

~BoB~


Another UPX script

RCE Messageboard's Regroupment > OllyScript > Another UPX script
BruceLee
06-02-2004, 11:14 AM
/*
**
** UPX script by Bruce Lee with dump
**
*/

log " "
log " "
eob bp1
log "Search for address of GetProcAddress..."
gpa "GetProcAddress", "kernel32.dll"
cmp $RESULT, 0
jne nadjen
jmp error

nadjen:
log "OK!"
log $RESULT
bp $RESULT
log "bp on GetProcAddress."
log "Run!"
run

bp1:
bc eip
rtu
log "Clear breakpoint! Return to user code!"
log eip
log "Search for address of POPAD..."
findop eip, #61#
cmp $RESULT, 0
jne ok
jmp error

ok:
log "Run till POPAD."
go $RESULT
log eip
sto
log eip
sto
log eip
MSGYN "OEP! Dump?"
cmp $RESULT, 1
je dump
jmp kraj

error:
Msg "Error!"
jmp kraj

dump:
dpe "c:\bl_dumped.exe", eip
MSG "Your dump is in root of c: ! Start ImpREC and fix the IAT! Bye!"

kraj:
ret
loveboom
06-15-2004, 10:57 AM
this is my script for upx /UPX-Scrambler
Enjoy!
/*
//////////////////////////////////////////////////
Upx/UPX-Scrambler OEP finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : Winxp sp1,OllyDbg 1.1,OllyScript v0.85(latest)
Date : 2004-6-4
Config: N/A
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/
var goaddr

start:
find eip,#61E9??????FF# //find 'popad jmp addr'
cmp $RESULT,0
jne lblupx
find eip,#60E9??????FF# //find 'pushad jmp addr'
cmp $RESULT,0
jne lblupx

lblerr:
msg "Error,Script abort!Maybe target is not pracked by upx or UPX-Scrambler.more information contact me."
ret

lblupx:
mov goaddr,$RESULT
add goaddr,1
go goaddr
sto

end:
cmt eip,":),OEP"
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"
ret


Antidebug

RCE Messageboard's Regroupment > General > Antidebug
BruceLee
06-02-2004, 11:19 AM
How to avoid int3 or 0CCh antidebug trick?
Help Please!
I try with IsDebuggerPresent but stupid MessageBox "Debugger is detected" appear again! :(
I renama Olly... nothing!

Please help me!
Pansemuckl
07-03-2004, 11:52 AM
Olly, [ALT-F1], "BP MessageBoxA" (or try MessageBoxIndirectA, ...)
Run [F9] till message appears, step back and look at stack to find
the corresponding call to it. Somewhere around there should be
a debugger check.

Read something on "anti debug tricks" at http://crackslatinos.hispadominio.net/
and try to identify them in your application. NOP em out (0x90) and there you go.

If you like, send me you app and I will have a look at it.


Bug fix of OSC v0.85

RCE Messageboard's Regroupment > OllyScript > Bug fix of OSC v0.85
psyCK0
06-03-2004, 08:39 AM
A major bug in the FIND command was found (by loveboom) and exterminated (by me). That might be the reason VolX's dillo script didn't work with 0.85.
Please redownload the plugin!
VolX
06-03-2004, 09:07 AM
Oh ! you are fast, after my post I try to find it but failed .
Thanks !
loveboom
06-04-2004, 02:41 AM
Ollyscript has another bug.i will email to you, iam busy.now
psyCK0
06-04-2004, 04:28 PM
yeah, please mail me
psyCK0
06-12-2004, 07:46 AM
A bug that affected operation of FIND and REPL commands fized. Redownload the plugin!


Call stack of main thread help - newbie

RCE Messageboard's Regroupment > General > Call stack of main thread help - newbie
Raza
06-04-2004, 12:59 PM
Hi,

I am a newbie i am try to generate call stack of main thread but i am getting only these lines where as as per tutorial it should generate a long list. can anybody help.

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012DFFC 77D43FBE Includes 7FFE0304 USER32.77D43FBC 0012E030
0012E000 77D487A7 USER32.WaitMessage USER32.77D487A2 0012E030
0012E034 77D4F58C USER32.77D48607 USER32.77D4F587 0012E030
0012E05C 77D6AAAE USER32.77D4F4D8 USER32.77D6AAA9 0012E058
0012E314 77D6AC40 ? USER32.SoftModalMessageBox USER32.77D6AC3B 0012E29C
0012E3E8 77F54169 ntdll.77F81C55 ntdll.77F54164 0012E3E4


Need help on finding a register location...

RCE Messageboard's Regroupment > General > Need help on finding a register location...
RecklessYouth
06-04-2004, 11:36 PM
Im tryin to make a few cheats for a game some friends and i play and am havign a huge problem resolving a DMA. The normal methiod is not pulling through and im going insane trying time and time again with no luck. I read once that olly can locate registers with the quickness so i decided to give it a shot but im having a hell of a time figuring it out and could really use some help!

Say I have this line:
0064FB41 MOV EDX,DWORD PTR SS:[EBP+3D8]
Is there a way to make Olly find EBP?? thanx!
focht
06-05-2004, 04:40 AM
Greetings!

well if you paused at instruction, ollydbg calculates the resulting addresses and values automagically for you.
They get displayed in little pane at bottom of CPU window.
e.g.:

SS:[zzzzzzzz]=xxxxxxxx
EDX=yyyyyyy

You can of course highlight the instrution and use context menu "follow in dump" -> "memory address" to get some more data around that location displayed or to "cast" the values to desired types (like toggling to "float" display to view game float vector variables)

Anyway this value [ebp+3D8] will usually gain you nothing, because its a dynamically created game structure/variable set.
You have to patch the instruction reading/processing these values to overcome the dynamic memory address problem.
Either patch it directly at the location or use code caves.

Code caves give you the advantage of placing/injecting larger code sequences into target.
Additionally anti cheat programs which look for well known offsets (like punkbuster) get defeated by avoiding well known patch locations (placing the code some instructions before checkpoint).
The code cave has to replicate the skipped instructions too.

Use a "jump trampoline" to jump to your injected code, execute your desired code there and/or execute some replicated code.
Then jump back to next original instruction not overwritten by trampoline to resume execution.

Regards,

A. Focht
Lord_Looser
06-05-2004, 06:13 AM
some helpful URLs

fly.to/mtc (http://fly.to/mtc)
xcheater.com/tutorials.aspx (http://xcheater.com/tutorials.aspx)

but if your asm line does always the same thing – e.g. decrement only your life – you can easy nop this line
focht
06-05-2004, 08:18 AM
Some useful message boards where you can get help if you happen to own one of these multiplayer games ;)

MPC: http://mpc.mpcheatz.de/forum/
UC: http://ucforum.net/

Almost everything is covered there.
Lots of stuff to study and/or play with.

My advice: build you own hack - it will increase chances to defeat pathetic crap like punkbuster

Regards
RecklessYouth
06-05-2004, 04:30 PM
Hay, thanx a ton for the replies! I guess im goin to have to use a code cave. The address i posted is a breakpoint of the DMA im tryin to hack. The value of [ebp+3D8] is my DMA. I've been reading a lot about code caving and what not but im still a noob when it comes to codeing with asm. I was wondering how i would make the value of a address i jump to have the value of [ebp+3D8]? Then in vb i could just read that address and I got my DMA to write to. thanx again!
Necr0Potenc3
06-05-2004, 07:13 PM
mov eax, [ebp+3d8]
jump eax

that should do it
focht
06-06-2004, 07:08 AM
Hi again,

not sure what you trying to accomplish... please post a larger code snippet (including the part with [ebp+3D8]) and what you are trying to do with that value (modifiy it, skip it ...).

Regards
RecklessYouth
06-06-2004, 04:56 PM
Wow, I sure like this forum a lot...people here are actually willing to help and share their knowledge, its cool. Anyways, this is for a zoom hack for BFV,I know [EBP+3D8] points to my DMA, so im tryin to put it somewhere i can read to get my DMA. Once i have a way find to the DMA, for now im just going to modify it to 0.2 and once PB is updated i'll be able make a code cave for it too.
Here is a little more of that code:
0064FB41 |> 8B95 D8030000 MOV EDX,DWORD PTR SS:[EBP+3D8]
0064FB47 |. 8B06 MOV EAX,DWORD PTR DS:[ESI]
0064FB49 |. 6A 00 PUSH 0
0064FB4B |. 68 00280000 PUSH 2800
0064FB50 |. 8BCE MOV ECX,ESI
0064FB52 |. 8996 4C020000 MOV DWORD PTR DS:[ESI+24C],EDX
0064FB58 |. FF50 28 CALL DWORD PTR DS:[EAX+28]
0064FB5B |. 85DB TEST EBX,EBX
Thanx for the code necr0 but for the life of me i coulden't get it to work...here is what i tried:(i did it in TS' easywite cuz i didnt know how to write asm in olly)
offset 10001
mov eax,[ebp+3d8]
jmp eax
mov edx,[ebp+3D8]
jmp 0x64FB47
offset 64FB41
jmp 0x10001
nop
If i try it w/o the code necr0 gave me, the jmps work great, so I dont think my cave is the prob.
thanx
focht
06-06-2004, 06:34 PM
Hi again,

well the only lines that seem to be usefull are

0064FB41 |> 8B95 D8030000 MOV EDX,DWORD PTR SS:[EBP+3D8]

and

0064FB52 |. 8996 4C020000 MOV DWORD PTR DS:[ESI+24C],EDX

... are you sure that you got the right DMA for zoom?

Usually the FOV = "field of view" is a float value which gets read before rendering stuff. Example:

// load the value into fpu stack
fld dword ptr [esi+0x24C]
// so something with it....

Finding zoom DMA shouldnt be that hard.
When i made some hacks for myself i used TSearch (*g*).
Just search for float 1.0 when unzoomed (after map load) and then zoom in and do search for float 0.5.
It should go down to a few addresses. Try to change em (write some float to it) and watch if it really works (some locations only update their values occording to a single location).

Many ppl use the code cave to move the DMA value to some location (unused page), known to their trainer, to write it from the trainer process.
I find this way to cumbersome ... why not using the code cave to contain the "update" itself.
When the FOV should be changed, the cave code is "updated".

Example (assumes [ebp+3D8] contains FOV dma):

jmp code_cave_location
nop
reentry:

code cave:

mov eax,[ebp+3d8]
// write float 0.5 = 3F000000h (1.0 = 3F800000h)
mov dword [eax], 3F000000h
jmp reentry

So the opcodes of code cave read as follows:

0041C280 > 8B85 D8030000 MOV EAX, DWORD PTR SS:[EBP+3D8]
0041C286 C700 0000003F MOV DWORD PTR DS:[EAX], 3F000000
0041C28C - E9 xxxxxx JMP xxxxxxx

So if you were to change the FOV value you just replace the immediate of second opcode in your trainer and write the whole code cave again.
E.g. C700 0000003F -> C700 00803F (1.0)

Dont forget to place the code cave a few opcodes before the relating line (replicate the other instructions in code cave) to avoid getting caught by pb offsets.

Regards,

A. Focht
RecklessYouth
06-07-2004, 04:52 AM
Hay man,

HELL YA!! You've solved the problem I cant tell u how long ive been working on. Worked great, thanx a lot!! At first when id right-click to zoom my screen would get all tweaked out getting all inverted, looking in different directions and what not. Finally after about an hour of wanting to dowse my computer in gasoline i realized from ur example that u have to write the the float value backwards from what it shows up in hex. After that it took me prob 30 mintz to make 3 other hacks that have been giving me hell. Thanx again!
psyCK0
06-07-2004, 11:37 AM
Putting ethics of cheating in online games aside...
Doesn't PB take random screenshots of client screens to prevent this kind of exploits?
RecklessYouth
06-07-2004, 03:49 PM
psyCKO...the way i look at it is the other players get their edge by playin 24-7 and fortunately i have a life, so i get my edge by cheating...un’ethical’ mayb…but im having my fun, and everyone else is having theirs. Im not one of those ‘l33t hax0rz’ going around bustin a 100-1 ratio ruining the game for everyone else.

As for the screen shots, the admin can take those on request, if ur like me and make ur self just as good as the next guy u don’t gotta worry about that.
focht
06-07-2004, 06:39 PM
Greetings,

ethics ... well i got interested in hacks just for the sole purpose "what is possible" in multiplayer game that comes with a certain kind of protection and additional punkbuster.

I rather seldom play online ... if a new pb version is released my first thing to do is to dump/fix/decrypt client dlls to get a hand on how the anti-cheat side has evolved.
I usually give hints to both sides in forums how things can be hacked and how the stuff can be detected to help ppl understand what is behind.
There were lots ppl who didnt know anything about game hacking and are now able to code their own (private) hacks which is a good thing (tm) IMHO rather than begging for cheats (no-brainer).

Anyway ... for the screenshot case, yes it can be hacked.
I explained some methods to defeat/avoid it in some mpc threads a while ago. .. some ppl actually implemented it in their hacks (the ultimate one - hooking DDraw's COM interface is still missing hehe).

Regards


Breakpoint at callback function inside DLL

RCE Messageboard's Regroupment > General > Breakpoint at callback function inside DLL
Gustavo
06-07-2004, 05:13 PM
Hello,

How can a set a breakpoint inside a DLL.
The executable loads this DLL with LoadLibrary and then it sets a global CBT hook, pointer to the hook procedure is inside the DLL, so I want to set a breakpoint at this callback procedure.

I have already tried to set it using F2 but the execution never stops.
Is it possible to set a breakpoint at a callback function that is inside this DLL?
if yes, what am I doing wrong?

Thank You
Lord_Looser
06-08-2004, 06:00 AM
You can find module’s entry point inside the “Executable module” window. Set a hardware breakpoint on it.
Gustavo
06-20-2004, 09:32 PM
the breakpoints work well when the dll is loaded but after the executable calls SetWindowsHookEx API function they dont work.
could the problem be that it doesnot stop because the system calls this hook procedure.

thanks


Ollydbg in black and white.

RCE Messageboard's Regroupment > General > Ollydbg in black and white.
Pavel
06-07-2004, 08:20 PM
Hey guys,
Somehow the olly is always black and white, the code highlighting is not working.
Ive set it to crystmast tree.
Infact it never worked, even on older version of olly on this computer.
Any thoughts?

-10x, Pavel.
JDog45
06-08-2004, 04:22 AM
It's your PC...
Lord_Looser
06-08-2004, 05:19 AM
right click on window area – Appearance – Highlighting – Christmas tree

open OllyDbg’s menu – Options – Appearance – Defaults -
Default syntax highlighting - Christmas tree

open OllyDbg’s menu – Options – Appearance – Code highlighting -
Highlighting “Christmas tree” – “Restore defaults”
Pavel
06-08-2004, 07:04 PM
10'x dude, it helped :)


What happenned with ExeTools Forum

RCE Messageboard's Regroupment > General > What happenned with ExeTools Forum
TQN
06-09-2004, 01:05 AM
Hi all!
For over a week, I could not access to ExeTools forum (www.exetools.com/forum or forum.exetools.com). Did ExeTools forum change address or it downed.
Thanks
Teerayoot
06-10-2004, 07:50 AM
http://www.exetools.com/forum/
I can get there.
TQN
06-14-2004, 10:51 AM
Thank Teerayoot !
Still know, I could not connect to ExeTools Forum. I dont know the reason. Do you know the IP address of ExeTools Forum. I think I should use Tracert to find the dead.
Regards


NEW PLUGIN FOR OLLYDBG

RCE Messageboard's Regroupment > Plugins > NEW PLUGIN FOR OLLYDBG
Ricardo Narvaja
06-10-2004, 06:20 AM
This plugin by THE KLUGER is a bettet option for work with POINT H and the NEW POINT A for VISUAL BASIC 5 and 6, this plugin discover the value of the points and let put directly a bpx and any of this poits or quit if you desire is perfect for work with points.

download

http://tinyurl.com/395zo

Ricardo Narvaja
PD:The new point a for visual basic has a tut and help for cracking in visual basic a lot read if you don't understand the use of this incredible point.
TQN
06-11-2004, 03:49 AM
Crash in my Win2000 Server when load OllyDbg.
Ricardo Narvaja
06-11-2004, 07:28 AM
the file README o LEER is for read jeje,this tool is only for XP and olly 1.10, not for 2000.

Ricardo
Lazkao
06-17-2004, 02:50 PM
Hi, I am new on this forum. I am trying to contact Ricardo Narvaja.

Hola, soy nuevo en el foro. Estoy tratando de contactar a Ricardo Narvaja. Si ves este mensaje, por favor escribime a yetanothercracker@yahoo.com Me gustaria leer tus cursos, pero no puedo acceder a tu sitio ftp. (ftp://ftp.) No se si es un problema de mi conexion pesima (que me da la universidad), pero me pide un password.
Lazkao
06-17-2004, 02:56 PM
I keep on writing in English so as to respect other users.

I would like to contact you. I am a fellow Argentinian (I am living in Germany). I was looking for good tutorials in RE, and I thought yours are the best (because they are for REAL BEGINNERS). Unfortunately, the webpage from which I downloaded them only has the first ten lessons.

Other than that, I have found many interesting pages in other languages. For instance, there is plenty of information in French (production francophone) and Italian (universita italiana cr), which for Spanish-speaking people are not that hard to read. But again, there is nothing like leer en castellano!!! (reading in Spanish).
Ricardo Narvaja
06-17-2004, 07:15 PM
Podes entrar por HTTP tambien si no esta lleno jeje

http://www.ricnar456.no-ip.org/

tambien .com y .info tenes las tres opciones en la carpeta NUEVO CURSO-TEORIAS y estan los programas ahi dentro si no podes entrar es que esta lleno entra mas tarde.

Ricardo Narvaja
Lazkao
06-18-2004, 08:52 AM
Gracias Ricardo. Voy a intentarlo.

Supongo que si estas hace tiempo en esto debes conocerlos ya, pero checkeaste los sitios production francophone y universita italiana cracking?
Si queres te mando un link, hay bastante material parece. Por lo menos para un novato para interesante.

Saludos desde Alemania,

Pablo.
Lazkao
06-18-2004, 01:30 PM
Hola otra vez Ric, te conteste en el otro foro, pero por las dudas te lo repito aca, si no molesta, entre en la pagina http que me dijiste, pero es increiblemente lenta, no hay forma de que grabe esos archivos de 50 mega. Alguna sugerencia?

Saludos,

P. L.
Ricardo Narvaja
06-18-2004, 08:14 PM
usa acelerador y baja de noche que hay menos usuarios, por ahi en los ftps de los otros miembros del grupo que son menos concurridos y esta la misma info, tenes mas suerte pero esos no los puedo publicar aca porque son privados para crackslatinos si me escribis al privado mio vemos que hacemos.

ricnar22@millic.com.ar
HaRdLoCk
06-23-2004, 02:53 PM
hehe. very nice plugin.. but please translate to english (or german hrhr) ;-P
Ricardo Narvaja
06-25-2004, 07:05 AM
Well i see this plugin was not uploadesd to plugins page, is a very strange desicion i think is a very bad desicion.

Ricardo
TBD
06-25-2004, 07:49 AM
Ricardo Narvaja: I didn't upload it because it is not in English. if you translate it I will put it on the page. also the sources will be nice to have it included.

please keep the discussions in english as this is an english language forum.

thanks
Ricardo Narvaja
06-25-2004, 08:37 AM
I m not the author but the plugin is very useful and translation for what, for press a button for put and quit a bpx?Is a very easy plugin for make a translation.
i think is a bad desicion but you are the owner.
Ricardo
TBD
06-25-2004, 08:50 AM
sorry, but I cannot please everyone. only english plugins. end.
JDog45
08-31-2004, 07:06 PM
TBD, I have a patch that will convert it to english created by a team that I'm with (ARTeam) (http://www.intechhosting.com/~access/forums/index.php). It sill leaves all credit to the author of the plug-in. Just changes it to English.
kittmaster
08-31-2004, 10:49 PM
where is it located on your site??
jrs13579
09-02-2004, 11:24 AM
I can not download it ,please send me one . jinrs@163.com.
Thanks a lot!
henggu
09-10-2004, 03:25 AM
I can not login the Web,please send me one . henggu9yuan@yahoo.com.cn
Thanks a lot!


[plugin] OllyPad v1.0

RCE Messageboard's Regroupment > Plugins > [plugin] OllyPad v1.0
psyCK0
06-10-2004, 12:22 PM
OllyPad lets you create notes for the currently debugged application
and stores them for later use. Next time you open the
application in OllyDbg your notes along with OllyPad window
size and placement will be restored.

Get it at http://ollyscript.apsvans.com

I will not update this plugin very much... Bug reports are welcome though.
mango
06-11-2004, 05:28 AM
Very useful.. thanks
j_petrucci
06-11-2004, 09:10 AM
The link doesn't work... :-(
mango
06-11-2004, 11:40 AM
works for me. Try this

http://ollyscript.apsvans.com/getPlugin.php?ver=OP
psyCK0
06-12-2004, 08:17 AM
Plugin updated by The Kluger:
- Hide on ALT-press added
- Menu shortcut: ALT-F11
- Background color of textbox is now PostIT yellow.


I can't understand this problem,who can help

RCE Messageboard's Regroupment > Plugins > I can't understand this problem,who can help
prince
06-11-2004, 12:19 PM
Hello everyone! I'm a stranger here,Well,I have a problem about OllyDBG's plugin,I have no idea! I set the path of plugin by option->appearance,but it didn't work when I restart my OllyDBG.Popup many "warnning dialog" which title like this :can't find dll.What should I do?Please tell me! Thank you very much!
Lord_Looser
06-11-2004, 05:30 PM
www.sysinternals.com
(http://www.sysinternals.com
)
"FileMon monitors and displays file system activity on a system in real-time. [...], seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations."

Filemon will show you files OllyDbg is searching for.
sgdt
06-13-2004, 03:04 AM
Have you renamed Olly? If you rename Olly, you will also need to rename any references to it in all installed plug-ins. Axe, HexWorkshop, and WinHex are all more than capable of doing this.

The only time I've ever seen Olly act up is when renaming things to avoid detection.
prince
06-15-2004, 08:27 AM
Maybe using FileMon is a good method,I'll try it at leisure time.In fact,I have almost all the versions of OllyDbg,Chinese version and English version(yes,I come from China,it's farness,isn't it?HeHe),and more,I have some mended versions that use to avoid detection too.I don't know that whether this is the problems on.I'll try to solve it with your advice,thanks to Lord_Looser and sgdt for all.


want To join

RCE Messageboard's Regroupment > General > want To join
surushm
06-11-2004, 04:16 PM
Hi All
I`m new here ,so intrested to join exetools/forum.
but seems it don`t accept new members?!(is it right??)
who can help me to join.

advanced thanks
surush
garryw
06-11-2004, 05:25 PM
yes it is right, noone can help you join, you will have to wait until admin allows new registration.
spongebob
06-15-2004, 03:48 AM
They have stricter rules.

But they are good.
garryw
06-15-2004, 06:47 AM
I'm a member, if you discount access to the ftp (I have no use for it) I wouldn't rate the forum any higher than other rce related forums.


PKlite32

RCE Messageboard's Regroupment > General > PKlite32
MrDebug
06-11-2004, 08:23 PM
All

I have a program that OllyDbg is showing some ascii suggesting PKlite32 has been used...

008D3000 > $ 68 80308D00 PUSH WinMX.008D3080 ; /Arg3 = 008D3080
008D3005 . 68 2A479500 PUSH WinMX.0095472A ; |Arg2 = 0095472A
008D300A . 68 00000000 PUSH 0 ; |Arg1 = 00000000
008D300F . E8 16170800 CALL WinMX.0095472A ; \WinMX.0095472A
008D3014 .^E9 186CC1FF JMP WinMX.004E9C31
008D3019 . 40 28 23 29 50>ASCII "@(#)PKLITE32 Cop"
008D3029 . 79 72 69 67 68>ASCII "yright 1998 PKWA"
008D3039 . 52 45 20 49 6E>ASCII "RE Inc., All Rig"
008D3049 . 68 74 73 20 52>ASCII "hts Reserved ($R"
008D3059 . 65 76 69 73 69>ASCII "evision: $)",0
008D3065 . 50 4B 4C 54 33>ASCII "PKLT32",0

How do I debug this type of program?
JDog45
06-12-2004, 07:54 AM
Unpack it..
MrDebug
06-13-2004, 05:50 PM
I know this isn't an un-packing forum...but this is a ollydump question.

I assume the program must be un-packed on execution and the un-packed version stored in memory?

How do I use ollydbg/ollydump to get at the un-packed program?
psyCK0
06-14-2004, 10:31 AM
ProcDump

When it comes to unpcking forum or not, it depends...
This is definitely not a CRACKING forum...
But IMHO unpacking != cracking. What does TBD have to say?
MrDebug
06-14-2004, 07:09 PM
psyCKO

procdump fails with "Process is not 32 bits or can't be loaded or is already finished"

I want to do this using olly{dbg|dump}

How do I unpack to memory then dump?


XP problem???

RCE Messageboard's Regroupment > General > XP problem???
Wij
06-11-2004, 11:02 PM
I'm an absolute newbie, so maybe i've missed something real obvious, but i get the impression that when you run an app in ollydbg, the app should actually run, as in pop up windows and such.

the only thing that happens for me is that the CPU window changes. Is it a WinXp issue or have i missed something?

thanks for the help.
JDog45
06-12-2004, 07:55 AM
Did you press F9 or hit the 'run' button? Where there any excpetions listed at the bottom?
Wij
06-12-2004, 03:13 PM
Simply put, Yes, Yes and no. I've been trying this with different tutorials with the same results or actually, lack of results.
warezhog
06-14-2004, 10:54 PM
Well, have you followed a tutorial for this program? I know that there a re a few good ones out there for Crackme's. I'm not sure if that is why you are using Ollydbg, but it will give you the experience getting around the program. http://www.google.com/search?ie=UTF-8&oe=UTF-8&q=ollydbg+tutoria l

Just a thought

hog


TCB - Thread control block

RCE Messageboard's Regroupment > General > TCB - Thread control block
Necr0Potenc3
06-13-2004, 10:22 PM
Anyone has the TCB structure for winnt? I have the one for win9x but I need the one for winnt

thanks in advance
focht
06-14-2004, 04:03 AM
Hi,

the TCB is documented in DDK i think.
Here is what i found using google:

typedef struct _KTHREAD {
/*000*/ DISPATCHER_HEADER Header; // DO_TYPE_THREAD (0x6C)
/*010*/ LIST_ENTRY MutantListHead;
/*018*/ PVOID InitialStack;
/*01C*/ PVOID StackLimit;
/*020*/ struct _TEB *Teb;
/*024*/ PVOID TlsArray;
/*028*/ PVOID KernelStack;
/*02C*/ BOOLEAN DebugActive;
/*02D*/ BYTE State; // THREAD_STATE_*
/*02E*/ BYTE Alerted[2];
/*030*/ BYTE Iopl;
/*031*/ BYTE NpxState;
/*032*/ BYTE Saturation;
/*033*/ BYTE Priority;
/*034*/ KAPC_STATE ApcState;
/*04C*/ DWORD ContextSwitches;
/*050*/ DWORD WaitStatus;
/*054*/ BYTE WaitIrql;
/*055*/ BYTE WaitMode;
/*056*/ BYTE WaitNext;
/*057*/ BYTE WaitReason;
/*058*/ PLIST_ENTRY WaitBlockList;
/*05C*/ LIST_ENTRY WaitListEntry; // see KiDispatcherReadyListHead
/*064*/ DWORD WaitTime;
/*068*/ BYTE BasePriority;
/*069*/ BYTE DecrementCount;
/*06A*/ BYTE PriorityDecrement;
/*06B*/ BYTE Quantum;
/*06C*/ KWAIT_BLOCK WaitBlock[4];
/*0CC*/ DWORD LegoData;
/*0D0*/ DWORD KernelApcDisable;
/*0D4*/ KAFFINITY UserAffinity;
/*0D8*/ BOOLEAN SystemAffinityActive;
/*0D9*/ BYTE PowerState;
/*0DA*/ BYTE NpxIrql;
/*0DB*/ BYTE Pad;
/*0DC*/ PSERVICE_DESCRIPTOR_TABLE ServiceDescriptorTable;
/*0E0*/ PVOID Queue;
/*0E4*/ PVOID ApcQueueLock;
/*0E8*/ KTIMER Timer;
/*110*/ LIST_ENTRY QueueListEntry;
/*118*/ KAFFINITY Affinity;
/*11C*/ BOOLEAN Preempted;
/*11D*/ BOOLEAN ProcessReadyQueue;
/*11E*/ BOOLEAN KernelStackResident;
/*11F*/ BYTE NextProcessor;
/*120*/ PVOID CallbackStack;
/*124*/ PWIN32_THREAD Win32Thread;
/*128*/ PKTRAP_FRAME TrapFrame;
/*12C*/ PKAPC_STATE ApcStatePointer[2];
/*134*/ KPROCESSOR_MODE PreviousMode;
/*135*/ BOOLEAN EnableStackSwap;
/*136*/ BOOLEAN LargeStack;
/*137*/ BYTE ResourceIndex;
/*138*/ DWORD KernelTime; // ticks
/*13C*/ DWORD UserTime; // ticks
/*140*/ KAPC_STATE SavedApcState;
/*158*/ BOOLEAN Alertable;
/*159*/ BYTE ApcStateIndex;
/*15A*/ BOOLEAN ApcQueueable;
/*15B*/ BOOLEAN AutoAlignment;
/*15C*/ PVOID StackBase;
/*160*/ KAPC SuspendApc;
/*190*/ KSEMAPHORE SuspendSemaphore;
/*1A4*/ LIST_ENTRY ThreadListEntry; // see KPROCESS
/*1AC*/ BYTE FreezeCount;
/*1AD*/ BYTE SuspendCount;
/*1AE*/ BYTE IdealProcessor;
/*1AF*/ BOOLEAN DisableBoost;
/*1B0*/ } KTHREAD, *PKTHREAD;

Some fields are 2K+ only (mostly power state stuff).

Here is a good resource on (kernel) thread internals - although its a sample chapter - it might be of interest:

http://www.microsoft.com/mspress/books/sampchap/4354b.asp

Using windbg you could dump the ethread (kthread/tcb) structures right out of it (windbg loads extension dlls for the host system):

>!ethread

Regards,

A. Focht


Script for dbpe (all version) v0.2

RCE Messageboard's Regroupment > OllyScript > Script for dbpe (all version) v0.2
loveboom
06-14-2004, 03:40 PM
What new in 0.2:
1.Now Script can unpacking dbpe2.2 dbpe2.32.dbpe2.33(include Cracked version)
2. Fix all API Function.if you Want

Require:OllyScript v0.85 latest version(2004.6.12)
Enjoy!
download:
http://www.exetools.com/forum/showthread.php?t=4450
Magnifier
06-14-2004, 04:09 PM
Hello loveboom,

as some users might be unable to download your file on exetools.com, please post your script here

Thanx,
Magnifier
psyCK0
06-14-2004, 07:23 PM
nice one loveboom. posted on the ollyscript site.
loveboom
06-15-2004, 11:00 AM
http://ollyscript.apsvans.com/scripts/dbpe2x.txt :)
To pscko:i will Email a cool tool to you!


Scripts wanted

RCE Messageboard's Regroupment > OllyScript > Scripts wanted
Magnifier
06-15-2004, 09:06 PM
Hello everyone,

I wonder if scripts could be written for:

*DAEMON Protect 0.6.7
*PE Crypt 1.00/1.01 Console
*PE Crypt 1.02
*CEXE (for cexe.exe the generic UG unpacker doesn't work)
*Lockless Intro Packer [Krypton Mod.]
*BitArts Crunch/PE 4.0.0.x
*PELock 1.0x
*FSG 1.10
*FSG 1.2
*UPX$hit 0.01
*UPX$hit 0.05

I am not as experienced in writing scripts and those unpackers
around do not unpack my executables (p.ex. unpackers listed at
protools or exetools...

Greetings,
Magnifier
TBD
06-16-2004, 04:19 AM
Magnifier: sorry, but this is not an unpacker forum, even if OllyScript can be used for unpacking.


complete newbie

RCE Messageboard's Regroupment > General > complete newbie
Debe
06-17-2004, 03:51 AM
Help i tried 3 tuts crackme 1 & 2 , Acoustica mp3 to wav and can't complete to get thro to the end. this whole crack me game is new to me; but i really really want to get it.... Can anyone get me going with some good tuts or anything PLEASE?????

Lost in translation....

dfire79684all
TBD
06-17-2004, 06:03 AM
but i really really want to get it

1. this is not a crack forum
2. crackme are allowed only to show OD features/bugs/... and not for learnig how to crack
3. search the net - there are a lot of tutorials
4. this is not a crack forum ;)


A bug of Ollydbg?

RCE Messageboard's Regroupment > General > A bug of Ollydbg?
wut55
06-17-2004, 09:41 AM
Hi all
When I use Ollydbg1.10c to analyse a program coded in VC++6.0,
I load MFC42.lib to help me to clear out the MFC function names
but Olly can not resolve them ( functions like <JMP.&MFC42.#1168_?AfxGetModuleState@@YGPAVAFX_MO>)
I am sure this prog is coded in VC6 and use MFC,because I use
Ida to analyse it and a lot of functions show that it use MFC

And I load another prog also coded in vc6 and use MFC,strange
enough, Olly does resolve all the MFC function names

why?then?

If you know the solution,plz dont hesitate to tell me.

Sorry for my poor English, I am trying my best to improve it
for better communication.
Necr0Potenc3
06-17-2004, 02:01 PM
thats called of demangled name and IDA auto-fixes that output but olly doesnt, not sure if olly has an option for that
Lord_Looser
06-17-2004, 07:10 PM
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=116&page=4#19 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=116&page=4#19)
wut55
06-19-2004, 03:00 AM
OllyDbg do have an option to show MFC function names(or other library's function names)
To show it ,choose Debug->Select import libraries,browse to mfc42.lib ,It should be in VC++ derectory if you have VC installed
in your system,if not, you can find it using google.
It work in a way just like IDA Pro using a sig(signature) file to identify some functions and structures

thank you all for answer me.


Finding a window callback procedure

RCE Messageboard's Regroupment > General > Finding a window callback procedure
legionx
06-18-2004, 05:33 AM
If you "Toggle a Breakpoint on ClassProc" in the Window screen in OllyDebug, is there a quick method to find the user defined window / dialog callback procedure from there?

Thanks


[Idea] Diff at disassembly level

RCE Messageboard's Regroupment > General > [Idea] Diff at disassembly level
kbsec
06-18-2004, 09:48 AM
Hello,

I think that it would be nice to have a feature to compare two executable files looking for changes in assembly instructions (for example in order to find if a program has been infected by a virus). I do not know if there already exists a dedicated software; personally I have to save the disassemblies of the executables to a text file and to compare them using "diff" or similar applications. I would like to find a command in Ollydbg that automates this task and that fills the patch window with the found differences (and let, for instance, to distinguish between changes in operands, in addresses, or both).
Alternatively could this feature be done using scripts or existing plugins?
Thanks.
kbsec
06-22-2004, 09:08 AM
The answer can be found through the documentation; the only new feature is the requested filter, but it is easily implemented exporting the patch list and filtering it by means of regular expressions.


breakpoint file

RCE Messageboard's Regroupment > General > breakpoint file
deli
06-21-2004, 02:41 PM
hi
i want write a small plugin for ida which generates a breakpointfile for olly.

to be more execactly:
i want search with ida / and a nice plugin ;) for custom copy loops in programms, and then generate a file for olly with breakpoints so a can easly check if i reach the copy loop.
(please don't tell me ida can also debug yes i know but i like olly more)

can anybody tell me a specification for the udd files for olly ?

thanks
psyCK0
06-22-2004, 10:26 AM
you could easily write an ida plugin / script that would generate an OllyScript file filled with BP commands. Then you just run it in OllyScript.


.NET Applications

RCE Messageboard's Regroupment > General > .NET Applications
ILCH
06-21-2004, 09:05 PM
Olly need support for .NET applications....
someone knows how to reverse .net apps ???
Necr0Potenc3
06-21-2004, 11:56 PM
just use a .net decompiler, there are several free ones in the net

(such as Anakrino)
psyCK0
06-22-2004, 10:24 AM
Or you can even use ILDASM, decompile the file, change the source and then use ILASM to recompile it. =) Piece of cake, huh?


Window ClassProc breaking

RCE Messageboard's Regroupment > General > Window ClassProc breaking
legionx
06-22-2004, 11:54 AM
Forgive my ignorance and odd question but what is the use of "Toggle a Breakpoint on ClassProc" on a Window in OllyDbg? This always breaks in user32.dll. Is it only for debugging user32.dll?


new moderator: psyCK0

RCE Messageboard's Regroupment > The Heap > new moderator: psyCK0
TBD
06-23-2004, 03:53 AM
... please welcome ODF moderator: psyCK0 !
psyCK0
06-23-2004, 11:35 AM
Thank you TBD.
I will be firm but fair. =)
JDog45
06-23-2004, 05:34 PM
Good luck psyCKO, now you can keep all those useless posts out of here..:)


ntdll problem

RCE Messageboard's Regroupment > Bugs > ntdll problem
bcavlin
06-23-2004, 07:51 PM
Hi,

did anyone had a problem when runing trace into with some program (any), and had exception : access violation when reading FFFFFFFF

at point in ntdll

77FA5559 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]

FS is 0000?

I am using Win XP Home SP1 on laptop.
bbotiano
10-01-2004, 10:55 AM
I also cannot Trace Into any application without generating errors - even the run trace example on the OllyDbg HomePage

First error is always access violation in Kernel32.DLL

However if in trace options I set it to Trace Over System DLLs it seems to work :(

XP Pro SP1 on desktop.

Any clues?
oh me anon
10-05-2004, 08:49 AM
First error is always access violation in Kernel32.DLL

options--->debugging options (alt+o) --->exceptions --->
check mark ignore access violation in kernel32.dll
it should be checked by default did you uncheck ???

fs:0 to fs: blah are called as PROCESS_ENVIRONMENT_BLOCK aka PEB
to get an overview find MATT PIETREKS article on MSJ (i think way back in may 1998 issue )


Multiple stepping instructions in a script

RCE Messageboard's Regroupment > Plugins > Multiple stepping instructions in a script
mimas
06-24-2004, 07:15 AM
I'm trying to add a LUA support (an embeded language, www.lua.org) (http://www.lua.org)) to Ollydbg within a plugin, and I've got an error in multiple stepping instructions (in my script StepIn, StepOver). It seems that Ollydbg cannot handle them all. I have to wait until Getstatus() reports STAT_STOPPED to throw another stepping instructions, but I have no control on the script when its launched. I tried a loop while(Getstatus()!=STAT_STOPPED) {}, and a WaitForSingleObject() calls but it doesn't work: the first one makes Ollydbg busy for a while, the second (just a test) does nothing.
I also tried Sendshortcut to send F7 or F8 => just a single step.

Any ideas to make stepping instructions waiting until the end of Ollydbg work ?
psyCK0
06-24-2004, 08:57 AM
That's exactly why I didn't use Active Scripting (or LUA for that matter) when writing OllyScript. The synchronization issues are harder to handle then just writing a custom scripting implementation...

BTW, what exactly do you miss in OllyScript that makes you want to write a new plugin? Or are you just doing it for the fun of it? =)
mimas
06-24-2004, 11:04 AM
Ollyscript is perfect. :)

I have downloaded LUA a few days ago, and I wanna some LUA practices, so I told to myself: "Well, an Ollydbg plugin seems to be an interessant stuff too, mix 'em!". It could be another tool, it was Ollydbg (I don't know why :)).
psyCK0
06-24-2004, 11:10 AM
Good luck then! =) The issue here is the debug loop... I think focht had a nice explanation for this, maybe you can find that thread.
mimas
06-24-2004, 01:08 PM
Thanks. I saw some interesting threads on the forum about this. But I haven't still no idea how to run the script synchronously 8|. I just can see the debugevents now, that's a good start :)


Privileged Instruction

RCE Messageboard's Regroupment > General > Privileged Instruction
OnoSendai
06-24-2004, 10:28 AM
hi all,

an application, that i'm trying to debug, loads a dll with opcodes OUTS and IN. When ollydbg reaches this opcodes a privileged instruction exception is fired.

is there a workaround for this problem?

many thanks in advance!
psyCK0
06-24-2004, 11:13 AM
That exception means that the processor decoded a privileged instruction but was not executing in the privileged mode. Usually this kind of exceptions are fired due to some kind of executable file protection.
mimas
06-24-2004, 11:15 AM
These instructions cannot be executed in ring3 (level application), the programme should run in ring0 (kernel mode) to access I/O port.

What's the DLL ? It could be an anti-debugging trick. Try ty pass the exception with Shift+(F7,F8 or F9).
OnoSendai
06-24-2004, 02:11 PM
thank you for your additional infos!

It is probably an anti debugging trick.

upon mapping of this dll ollydbg shows the message:"...entry point outside code ..."

if i try shift + f7/f8/f9 the log window says:
"Debbugged program was unable to process exception"
afterwards the threads are terminated

(i just trying the porttalk freeware but without success)
Ricardo Narvaja
06-24-2004, 06:36 PM
armadillo probably, rename ollydbg to other name and try again using the plugin Isdebug too and look if pass the exceptions.

Ricardo
OnoSendai
06-24-2004, 09:12 PM
so far I tried this:

-shift f7,f8,f9
-renaming ollydbg
-IsDebug displayed <error>
-start via allowio from porttalk
-noping the io opcodes -> same exception on later calls

programming can be very frustrating

by the way here is the snippet that causes the probs

005ED447 FF15 B8BDA300 CALL DWORD PTR DS:[…] ;
617441F0 > 6F OUTS DX,DWORD PTR ES:[EDI] ; I/O command
617441F1 E5 6D IN EAX,6D ; I/O command
617441F3 AB STOS DWORD PTR ES:[EDI]
617441F4 227F 61 AND BH,BYTE PTR DS:[EDI+61]
617441F7 BB 53CCE5DA MOV EBX,DAE5CC53
617441FC 56 PUSH ESI
617441FD C9 LEAVE

and thank you for any further ideas
Ricardo Narvaja
06-25-2004, 06:56 AM
tell what packer is (use PEID) and will be more easy help.

If you rename olly and have errors, keep a copy of the original ollydbg.exe in the same folder for aviod the errors, and use a renamed exe you put in the same folder.

And if you use IsDEbug and make and error i think you are in win98, in XP work perfect.

Ricardo
OnoSendai
06-25-2004, 10:04 PM
hi ricardo,

peid shows the following message on the dll (while all other modules look normal):
safedisc 2.51.000 -> macrovision

unfortunately i'm not a hacker so i don't know what to do with this message. but i guess there is another tool that can remove this protection?!

looking forward hearing from you

ps: my os is xp and i also tested it on a virtual w2000 (virtual pc)
Ricardo Narvaja
06-26-2004, 12:20 AM
Aja safedisc i hear safedisc have a different kind of detection of ollydbg but i cannot check , safedisc programs are very large (games CDs and is difficult to download.

Ricardo


Problem Olly with Panda

RCE Messageboard's Regroupment > General > Problem Olly with Panda
g30rg3_x
06-24-2004, 04:17 PM
sorry for my bad writing but i not true english writer.

i have problem when i running a program (any)
with panda antivirus platinium 7.0 is currently runnning if i
close olly dont show this error.

this error doesn't do anithing only ever i have run a prog. i recive to put "shift-f9" two times

i see this problem is originated for an a dll "engache.dll" i think is anticracking

welll i just wanna know who to exclude to attach this process to olly for no more "shift f9" bugs

thanks and grettings
Ricardo Narvaja
06-24-2004, 06:28 PM
Panda is not compatible with OLLYDBG you have multiple problems using and unpacking with raebuilding IATs and using OLLY in gral, i tell you change to other better antivirus in my FTP-HTTP is the NOD32 or KASPERSKY full with actualizations for use and are better than panda is a piece of crap.

Ricardo Narvaja
g30rg3_x
06-24-2004, 10:06 PM
thank you ricardo,
i will think about it
and download it!!

:D

Grettings
g30rg3_x
06-24-2004, 10:14 PM
offtopic:
ricardo i will talk in spanish for explain better:
____________
que tal ricardo gracias por contestar mi pregunta ya estoy bajando el NOD32 en este momento, una pregunta que siempre te he querido hacer, es que si tus tuturiales sobre desempaquetamiento de armadillo tambien se extienden o son psibles hasta la version 3.61a,

te pregunto esot por que quisiera yo crackear y desempacar por mis propias manos el ultraedit 10.20a el cual esta empaquetado con la proteccion antes mencionada, el empezar vi que hay algunas cosas que creo pusieton en esta nueva version

gracias de ante mano Ricardo.
Atte g30rg3_x y claro 1 saludo
psyCK0
06-25-2004, 06:11 AM
g30rg3_x: just warning you, unpacking discussions will not be permitted here, no matter what language they are conducted in.
Ricardo Narvaja
06-25-2004, 06:48 AM
UGh TBD clon jeje, jajaja, its okay PSYCKO, i send my mail for private conversation.

G30rg3_x mail me to ricnar22@millic.com.ar and i tell you.

Ricardo
g30rg3_x
06-25-2004, 04:09 PM
thanks ricardo,

and sorry i dont know de rules in this section of the forum psyCKO.
thanks for remenber it!

gretting from mexico


Help Whit H point

RCE Messageboard's Regroupment > General > Help Whit H point
Fauzt0
06-24-2004, 05:35 PM
Well I know That There are some plugins for olly to find the H point but I want To learn The Long way

Can Someone Help Me Whit a Tuto.

I trie The Crack Of Cruehead But no results, I fund a Bug just trace with F7 and whn it compares 18 with ??? the program stops. so it is

Please help, thanks anyway.
Ricardo Narvaja
06-24-2004, 06:34 PM
are you sure you have the correct crackme of cruehead there are many crackmes of cruehead and i think you are in other world jeje.

go to mi FTP - HTTP and download

http://www.ricnar456.no-ip.org/

FOLDER VIEJO CURSO-PROGRAMAS CURSO VIEJO- program number 1 (the programs are numbered)

Ricardo
Fauzt0
06-25-2004, 02:12 AM
well I`m just saying that,
donwload cruehead`s crack (so it's says in the page I download it) and get to the serial just tracing with F7,
aNiway Thats not important the problem is
I Try to learn How to get the H ponit in My PC so I follow the tuto and get to that point, at least i think thats it, its the point after it apears the error window??
because it dosn't lok like...
Ricardo Narvaja
06-25-2004, 06:52 AM
Any points

1)Point H is for NT/2000 or XP
2)Point H don't found tracing at all, only putting a breakpoint on mesage and when stop, putting a bpm in the fake serial in the dump and run, when stop for this BPM you are in the point H.
3)Where in the tut i trace?

Ricardo
Fauzt0
06-25-2004, 05:04 PM
-Yeah I know That H point is for xp (I have XP).
-And I don't refer to H point when I said tracing, I was talking about the serial of that crackme. anyway
- i don't understand the last one...

talking about it the page is not found http://www.ricnar456.no-ip.org/ I can't open it... i like to learn how to found Hpoint in the large way.
By The way I was trying to found it, I need to ask if this is it.
is the point before the message of error apears, Beacuse the program stops there (for me outside the program) wen I run the program one more time just apear the error window, is that it?? My point H??
and can u give me a web with tutos, 'cause I don't Find web about tuto the page of joecracker is down too.

thanks
Ricardo Narvaja
06-26-2004, 12:19 AM
The point H is before the the error message appear , the program stop in point h when enter the fake serial, for this reason this is the start of the work, begin in point H end in the error message.
The crackme take each byte and make XOR one by one and add this result if i remember well.

Sorry the FTP and HTTP is closed
try crackslatinos page
http://crackslatinos.hispadominio.net/
in members there are the tuts of NUEVO CURSO and there are a tut how found the correct serial in crackme cruehead tuts 94 and 110 by SHADOWDARK.
Ricardo
The V Man
06-29-2004, 12:25 PM
Can we get a direct link to the point H plugin? I've looked around everywhere and can't find it now that Ricardo's FTP is gone. I tried the crackslatino page but couldn't find it there (had to translate it and couldn't even find it then). Does anyone have a copy they can put up for download?
Ricardo Narvaja
06-29-2004, 07:45 PM
Well my FTP don't work more, and this page is only for english plugins, there are not solution, only one member who download the plugin pass to your mail, sorry.

Ricardo
The V Man
06-30-2004, 11:15 AM
If you could e-mail it to me it would be much appreciated.
the_v_man96@hotmail.com
Fauzt0
07-06-2004, 01:37 AM
I hope the Hplugin that I send u

and I need som ehelp with some serial I found the H point so i know what does the program do with it but I can't find the were it compares both... the program wa mede in visual basic

thanks anyway
Ricardo Narvaja
07-06-2004, 03:43 PM
The point H stop in olly when enter the fake serial to the program, next you may practice follow the operation program make with your fake serial, this is other point.
Try too the point for visual basic, the tool of krueger find and point bpx in this magic point of VB but if the program make operation with the numbers you may follow this operations.

Ricardo


ESTI / ESTO / DEBUGGING OPTIONS

RCE Messageboard's Regroupment > OllyScript > ESTI / ESTO / DEBUGGING OPTIONS
friedo
06-25-2004, 06:54 AM
Hello.

1.
Can somebody explain me the difference between ESTI and ESTO?

2.
Is it possible to change DEBUGGING OPTIONS (regarding to check/uncheck exceptions) using ollyscript? Any possibilities?

Regards,
friedo
psyCK0
06-26-2004, 05:55 PM
1.
ESTI - Step into SEH handler (Shift-F7)
ESTO - Step over SEH handler (Shift-F9)

2.
Not at the moment, maybe in the next version


Cpu Usage

RCE Messageboard's Regroupment > General > Cpu Usage
sonkite
06-25-2004, 04:40 PM
When i open and have a program running should the cpu usage be 100%? In my case 50% coz of htt.
Eggi
06-26-2004, 08:26 AM
Im not sure if i undestand your question correct but if you mean that when ollydbg is open and you open a other program that then the cpu usage goes to 50% (100%) then its maybe an ollydbg protection.
sonkite
06-27-2004, 08:36 AM
When the debugged program is running under olly im just wondering if the cpu usage should be 100%?


Ricardo's site has gone, need backup

RCE Messageboard's Regroupment > General > Ricardo's site has gone, need backup
Pansemuckl
06-27-2004, 10:54 AM
Hi @all!

I'd like to unpack some SVKP protected exe, but unfortunately
Ricardo's site/tutorial has gone

h***p://www.iespana.es/OllyDBG/Ricardo.html <-- 404, DEAD

Any backup?

I managed to remove the anti-debug of SVKP, but now I need
some help on finding the OEP, removing SVKP shit like stolen bytes.
Ricardo Narvaja
06-27-2004, 02:39 PM
http://crackslatinos.hispadominio.net/

try here in members

Ricardo
psyCK0
06-27-2004, 06:38 PM
Ricardo Narvaja: so the ftp is also permanently down? As far as I can remember your tuts usually came to the ftp some time before they appeared on the site?
Ricardo Narvaja
06-27-2004, 08:14 PM
Yes is down permanently in crackslatinos page the tuts will be more quickly i suppose.

Sorry

Ricardo
Pansemuckl
07-03-2004, 11:47 AM
Ricardo check you PM at h**tp://www.woodmann.net/forum/
Ricardo Narvaja
07-03-2004, 12:38 PM
Yes i check 0 messages, if you send a message try again is empty
If not mail to ricnar22@millic.com.ar
Ricardo


PEBundle 2.0x - 2.4x script

RCE Messageboard's Regroupment > OllyScript > PEBundle 2.0x - 2.4x script
hacnho
06-27-2004, 11:45 PM
/*
//////////////////////////////////////////////////////////////
// PEBundle 2.0x - 2.4x OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
/////////////////////////////////////////////////////////
*/

sti
sti
eob Break
findop eip, #9D68#
bphws esp,"r"
run

Break:
sto
sto
sto
an eip
log eip
cmt eip, "This is the OEP! Found by hacnho/VCT2k4"
MSG "Dumped and fix IAT now! Thanx for using my Script...!"
ret
nanban
07-06-2004, 06:24 PM
hai i used this script but i can't fine OEP, i can't rebuilt import can anybudy have turotial about pebundle. pls any one help me.. thanks

nanbna-n@yahoo.com
nanban
07-06-2004, 06:29 PM
hai friends i am new to this form.. i am just like baby in program . i have 1 Q. i want know how to unpack pe bundle. i was used script also but it's not working ( or i don't know how to to it) pls. any one help me.. how to un pack pe bundle.. thanks.. nanban
hacnho
07-07-2004, 01:19 AM
http://unpacking.free.fr/tuts/unpack/PEBundle/Tutorial-Manual-Unpackin g-PEBundle2.0x-2.4x.zip
(http://unpacking.free.fr/tuts/unpack/PEBundle/Tutorial-Manual-Unpacking-PEBundle2.0x-2.4x.zip
)

French tut!

PS: if you want a tut in english, i will write it!
nanban
07-07-2004, 08:44 AM
i don't know french. if u have in english pls. let me know where i can found that.

thanks


EZip 1.0 Script

RCE Messageboard's Regroupment > OllyScript > EZip 1.0 Script
hacnho
06-27-2004, 11:47 PM
/*
//////////////////////////////////////////////////////////////
// EZip 1.0 OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
/////////////////////////////////////////////////////////
*/
to
sti
eob Break
findop eip, #60BE#
run

Break:
bphws esp,"r"
sto
log eip
cmt eip, "This is the OEP! Found by hacnho/VCT2k4"
MSG "Dumped and fix IAT now! Thanx for using my Script...!"

ret


EXE Shield v0.5-->0.8 (ARM Protector v0.1) scri

RCE Messageboard's Regroupment > OllyScript > EXE Shield v0.5-->0.8 (ARM Protector v0.1) scri
hacnho
06-27-2004, 11:48 PM
/*
///////////////////////////////////////////////////////////
// EXE Shield v0.5-->0.8 (ARM Protector v0.1) OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
/////////////////////////////////////////////////////////
*/

sti
sti
eob Break
esto

Break:
run
esto
an eip
log eip
cmt eip, "This is the OEP!!!"
MSG "Dumped and fix IAT now! Thanx for using my Script...!"

ret
Pumqara
07-05-2004, 06:07 PM
Check http://pumqara.cjb.net for a standalone decryptor.
loveboom
07-06-2004, 02:00 AM
.cjb.net block all china ip,:(
hacnho
07-07-2004, 12:03 AM
Hi Pumqara! i am trying your unpacker for ExeShield 0.8 (Arm 0.1), but cannot unpack. This unpacker will be crash when loading file! I use WinXP Pro.
Anonymous
10-04-2004, 05:50 PM
To loveboom: Use proxy!


How to put a breakpoint on RegistryRead

RCE Messageboard's Regroupment > General > How to put a breakpoint on RegistryRead
IlyaZ
06-28-2004, 08:00 AM
I've searched everywhere but I need guidance on how I can put a breakpoint on registryreads. What are the command and do I need to include/mount additional DLL files like in Softice? If that's the case how do I do it with Ollydbg?

Thanks in advance,
IlyaZ
Lord_Looser
06-28-2004, 12:02 PM
in OllyDbg (with debugged application, advapi32.dll already loaded) – press Alt-E (Executable modules) – select advapi32.dll line – press Ctrl-N (View names) – directly typewrite “reg” letters inside the window – F2 is setting breakpoint

reg read/write function Names in advapi32.dll
Address Name
793518BF RegCloseKey
79389C86 RegConnectRegistryA
79368521 RegConnectRegistryW
79352A9D RegCreateKeyA
79352ED6 RegCreateKeyExA
7935297C RegCreateKeyExW
79352A7D RegCreateKeyW
79353EA2 RegDeleteKeyA
79360D26 RegDeleteKeyW
79360CA1 RegDeleteValueA
79360BA3 RegDeleteValueW
793663E9 RegDisablePredefinedCache
79353CDE RegEnumKeyA
79353BF1 RegEnumKeyExA
79353F27 RegEnumKeyExW
7935400B RegEnumKeyW
79354B10 RegEnumValueA
79360F89 RegEnumValueW
79360C0B RegFlushKey
793625AC RegGetKeySecurity
7938A39B RegLoadKeyA
793694A7 RegLoadKeyW
79353A15 RegNotifyChangeKeyValue
79354067 RegOpenCurrentUser
79352608 RegOpenKeyA
793524B9 RegOpenKeyExA
79351CAB RegOpenKeyExW
79351DA3 RegOpenKeyW
79358896 RegOpenUserClassesRoot
793897AD RegOverridePredefKey
79360D8E RegQueryInfoKeyA
793542D2 RegQueryInfoKeyW
7938A987 RegQueryMultipleValuesA
7938AD2C RegQueryMultipleValuesW
79358712 RegQueryValueA
79352C9C RegQueryValueExA
79351DDB RegQueryValueExW
7935388E RegQueryValueW
7938A5CE RegReplaceKeyA
7938A6ED RegReplaceKeyW
7938B11C RegRestoreKeyA
7938B1C1 RegRestoreKeyW
79362F7D RegSaveKeyA
7938B29C RegSaveKeyW
79362DFB RegSetKeySecurity
7935901A RegSetValueA
79353024 RegSetValueExA
79352B8D RegSetValueExW
79360542 RegSetValueW
7938A4AF RegUnLoadKeyA
7938A551 RegUnLoadKeyW
IlyaZ
06-28-2004, 01:27 PM
thank you


feature request

RCE Messageboard's Regroupment > OllyScript > feature request
orion
06-28-2004, 05:31 PM
I would like to have a block move command:

move dest, src, size

or even better, to move c-string:
movenz dest, src

Also, if a script set a breakpoint and issued "run" but did not set "eob". When the breakpoint is hit, and ollydbg has control, what is the status of the script? paused or still running? if the script have setup "eoe", will it continue to intercept exception after this?

Can I clear eob and/or eoe after setting them?

thanks
psyCK0
06-29-2004, 09:10 AM
1. You can use the MOV command in a loop to move blocks of data. Maybe I'll implement a block move in next version.

2. If EOB is not set the script continues on the next line.
EOE will still work.

3. Can't clear EOB/EOE at the moment, this will come in next version.


Result of DBH

RCE Messageboard's Regroupment > OllyScript > Result of DBH
Anonymous
06-29-2004, 01:11 PM
I can't figure out what dbh does. In the docs it says that it hides the debugger, but I can't figure out what exactly that means. It doesn't make the debugger window go away, it doesn't apear to hide the debugger from the program being debugged.

If it does either of the above, I've gotta assume I'm using it wrong. If so, how do you use it?

-Chris
psyCK0
06-29-2004, 01:43 PM
DBH hides the fact that the program is debugged from the program itself. IsDebuggerPresent returns 0 when called from the debugged program. Just tested this and it works fine.
TheTwo
06-29-2004, 01:46 PM
Sweet, Thanks.

It apears that the program I am working with is a little more subtle in it's debugger detection. dbh does nothing for me. Oh well.
psyCK0
06-29-2004, 01:51 PM
it was only meant for the isdebuggerpresent. of course id be happy to add functionality to it, so if you can email me details on how your target detects olly id be happy to try and add it to dbh. =)
TheTwo
06-29-2004, 02:00 PM
Haha, yeah. I'd love to know how my target detects olly too! I have a feeling it's an int3 detection, but the code is very hard to follow (and I can't seem to find an in depth description of int3 detection).
psyCK0
06-29-2004, 02:17 PM
can it be the usual winclass name / appname detection? rename olly and try again? If the protection is a commercial one named after a small animal then it might work :)
TheTwo
06-29-2004, 02:28 PM
There are no small animals involved, and renaming didn't do anything. This is a commercial protection, but only a handfull of people have ever seen the program.

Before you get too into this, I gotta say I won't be able to tell you how I defeat this anti-debugger if I do (I'm all about spreading knowledge, but the company I work for isn't). EDIT: I'm really sorry. I know this place is all about spreading information. If there's anything I can do to get some info here I'll do it.
Anonymous
06-29-2004, 06:41 PM
i've tried dbh too, but it does no work! the api isdebuggerpresent returns 1 always, and the nag (vbox) catch me.
i don't know if i'm using right; the script is:
dbh

only?? or
dbh
ret

??
TheTwo
06-29-2004, 06:43 PM
I'm guessing you want:

dbh
run
psyCK0
06-29-2004, 07:33 PM
Anonymous: what program did you test it with? Just DBH should be enough - execute it and IsDebuggerPresent should return 0. If it doesn't please mail me telling what app you tested it on.

TheTwo: well, there are times when you don't spread the info. I'm all for SELECTIVE spreading. All info you are able to give will be appreciated, but of course you are free to not provide any at all. =)
TheTwo
06-29-2004, 07:51 PM
well, there are times when you don't spread the info. I'm all for SELECTIVE spreading.

If that means my suggestion was correct, I'm supprised.... it really was a guess. I've never had dbh block an anti-debugger. If I broke some kind of netiquite, I'd like to know privately. I don't (and can't) have icq, but the email I put in for registration is valid.
psyCK0
06-30-2004, 07:51 AM
TheTwo: I think you are reading hidden meanings where there are none. My comment about selective information spreading had nothing to do with this thread in particular. =)
Anonymous
06-30-2004, 09:25 AM
the apps are a spanish program for printing labels protected with vbox, and another protected with asprotect 1.23

i made a .txt with dbh in a line only, ran debugger till ep, execute the script and f9, and..... nag...

i did it right?
psyCK0
06-30-2004, 10:26 AM
write a test prog that calls IsDebuggerPresent and test with it
TheTwo
06-30-2004, 08:05 PM
I think you are reading hidden meanings where there are none. My comment about selective information spreading had nothing to do with this thread in particular. =)

Ahhhh.. Silly me. I get it now.
Anonymous
07-04-2004, 01:45 PM
i made a test in windows98 and neither dbh nor isdebuggerpresent plugin didn´t work.
in both cases isdebuggerpresent returned 1.

i use ollydbg 1.10b, last version ollyscript, win98, and last version isdebuggerpresent plugin.


Feature Request

RCE Messageboard's Regroupment > OllyScript > Feature Request
Anonymous
06-29-2004, 01:13 PM
Could it be possible to add an instruction that does the same thing as CTRL-F2? There are some things I need to do to dynamicaly analyze a couple programs, but it needs to restart frequently.

-Chris
psyCK0
06-29-2004, 01:49 PM
Sure, will be added in next version


looks like a bug

RCE Messageboard's Regroupment > OllyScript > looks like a bug
orion
06-29-2004, 02:16 PM
"jbe" is not working correctly (ollydbg 1.10, ollyscript 0.85)

this script:

var size1
var size2

mov size1, 4000
mov size2, 4b00

cmp size1, size2

jbe below

log ">"
ret

below:
log "<="
ret

will show ">"
psyCK0
06-29-2004, 07:37 PM
its a bug. will be fixed in next version (coming some time next week).


help with olly

RCE Messageboard's Regroupment > General > help with olly
lake82
06-29-2004, 06:48 PM
I keep getting an entry point alert stating " Module 'wbhelp' has entry points outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting break points!" so i click ok to that but when i set a breakpoint the computer freezes right up any suggestions
Ricardo Narvaja
06-29-2004, 07:46 PM
the computer freeze but not for this message, is other problem of your computer.

Ricardo
lake82
06-30-2004, 01:21 AM
well my computer shouldn't be that bad i got 512mb ram and an old 800 but it still shouldn't freeze should it
Ricardo Narvaja
06-30-2004, 05:28 AM
What SO you use XP or 98?

The problem can be in this program than freeze your computer but this messagebox is only a message ina packed program always this message appear, thats not the problem. Maybe ollydbg is detected and the program freeze your computer.

Ricardo
lake82
06-30-2004, 06:28 PM
yeah i am using xp i got rid of the message but when ever i set a break point and then try running the program up to the break point it freezes the computer up
Ricardo Narvaja
06-30-2004, 09:33 PM
Try putting hardware BPX

in comand bar type for example

HE MessageBoxA

Ricardo Narvaja


WIN32 Debug API

RCE Messageboard's Regroupment > General > WIN32 Debug API
yousky
06-29-2004, 07:42 PM
Hi all,

First of all, thanks to Iczelion for his tutorial on Win32 Debug API.

I've read different examples of the use of WaitForDebugEvent. I've implemented that in a little programm to handle Exception by the $CC (Int 3). All works fine except when i've rewrite the original memory code by the $CC.

Explanation:

- CreateProcess of the target
- WriteProcessMemory to put the $CC code at the right memory address for the breakpoint
- WaitForDebugEvent
- Handle the EXCEPTION_BREAKPOINT
- GetThreadContext
- WriteProcessMemory with the original 1 byte memory code at EIP - 1 to continue the execution of the target program
- SetThreadContext with the EFlags using $100
- ContinueDebugEvent
- Handle EXCEPTION_SINGLE_STEP
- WriteProcessMemory to put the $CC code at the right memory address for the breakpoint
- ContinueDebugEvent

=> The code of the target programm is executed after the breakpoint.

My problems is that after that, the WaitForDebugEvent give me EXCEPTION_ACCESS_VIOLATION so the target programm freeze and loop.

Do you have an idea for that problem ?

Thanks for your help.
Yousky
synku
07-30-2004, 09:29 AM
Yes the INT 3 is executed so EIP is after it. So when you replace with the original byte, you have to set EIP=EIP-1


Script for PESpin v0.7

RCE Messageboard's Regroupment > OllyScript > Script for PESpin v0.7
hacnho
06-30-2004, 06:32 AM
/*
////////////////////////////////////////////////////////////////////// ///////////////////////
// PESpin v0.7 OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
//You can download my unpackme at http://nhandan.info/hacnho/tuts/unpackme_PESpin_07.zip for //test this script.
//Note: Not work with Delphi (OllyDBG will be crash when loading).
////////////////////////////////////////////////////////////////////// ////////////////////////
*/
MSG "Do not clear memory breakpoint! Thanx for using my script!"
var temp
sti
sti
findop eip, #61E9#
bphws esp,"r"
mov temp,esp
run
eob Break1

Break1:
run
esto
esto
esto
esto
eob Break2

Break2:
esto
esto
esto
esto
esto
eob exit

jmp exit
exit:
log eip
cmt eip, "Script by hacnho/VCT2k4"
MSG "Please press Shift+F9 one times! When you trace to a jump (E9 XXXXXXXX). Press Enter, you'll still on OEP! Ctrl+A for analyze."
ret
loveboom
07-04-2004, 11:04 AM
I has one,and i wll post it,
Pansemuckl
07-05-2004, 11:49 AM
Tried on PeSpin v0.7 -> endless loop
Check it yourself:

h**p://cyanid.de/rn/todo/simpleapi[pespin.v.0.7].zip
hacnho
07-07-2004, 01:06 AM
Your packed file is simple for find OEP. Because i am busy now, so i can not write a script for find OEP. But i can show the way for find OEP.

- 1. In Olly Options, choose SFX tab, check radio button " Stop at entry of selt-extractor"!

- 2. Load simpleapiP.exe into OllyDBG!

- 3. Press Shif+F9. A dialog will appear. Choose "No"!

- 4. Press F8 two times!

- 5. We now need to get to the address in the ESP register and set a hardware breakpoint.
click on the Hex dump window and do Ctrl+G and type in the value from the ESP register then enter.
you will end up here. Highlite the first two values in dumpscreen,
(these values are from the EDI register and is how we will find the OEP.)
right click on the values and select Breakpoint -> Hardware, on Access -> Word.

- 6. Press F9 to run.

- 7. Press Shift+F9 7 times! You will still here:

00417088 - E9 53A0FEFF JMP simpleap.004010E0 ---> Jump to OEP...
0041708D A2 F94B8EE5 MOV BYTE PTR DS:[E58E4BF9],AL
00417092 26:37 AAA ; Superfluous prefix
00417094 20F9 AND CL,BH
00417096 54 PUSH ESP
00417097 6E OUTS DX,BYTE PTR ES:[EDI] ; I/O command
00417098 D4 5E AAM 5E
0041709A 21FC AND ESP,EDI
0041709C 90 NOP
0041709D 2F DAS
0041709E B4 F4 MOV AH,0F4
004170A0 C079 BC 83 SAR BYTE PTR DS:[ECX-44],83 ; Shift constant out of range 1..31
004170A4 3F AAS

- 8. Just press Enter! You will still on OEP.

004010E0 /EB 10 JMP SHORT simpleap.004010F2
004010E2 |66:623A BOUND DI,DWORD PTR DS:[EDX]
004010E5 |43 INC EBX
004010E6 |2B2B SUB EBP,DWORD PTR DS:[EBX]
004010E8 |48 DEC EAX
004010E9 |4F DEC EDI
004010EA |4F DEC EDI
004010EB |4B DEC EBX
004010EC |90 NOP
004010ED -|E9 98A04000 JMP 0080B18A

Use PEiD detect : Borland C++ 1999

Regards

hacnho
Mario555
07-07-2004, 11:09 AM
For PESpin.exe, simpleapi[pespin.v.0.7] and other progs with "jmp..."
-------------------------
var temp
var l
var wr_addr

mov l, eip
shr l, 8
shl l,8
eoe lab1
eob lab1
esto

lab1:
cmp [eip], FFFFFFFF
log [eip]
je lab2
esto

lab2:
mov wr_addr, l
add wr_addr, 99a
mov [wr_addr], #807FFF007413807FFFE975E766C747FFFF258957018902EB0 3890290595FC3#
mov wr_addr, l
add wr_addr, 0f69
mov [wr_addr], #9090909090#
find l, #041FEBFB7C8304240CC3E861# // signature of "start Stolen code "
mov l, $RESULT
add l, 0c
log l
bp l
eob lab3
eoe lab3
esto

lab3:
mov temp, eip
sub temp,4
mov temp, [temp]
cmp temp, 61e8c30c
je loc_end
esto

loc_end:
bc l
msg "Stolen bytes here and you may set EP here ;)"
ret
-------------------------

If file use PESpin_iat you must add in dump function for redirect and recombine Orig_iat on PESpin_iat. And set EP on start of this function.


(more) feature request

RCE Messageboard's Regroupment > OllyScript > (more) feature request
Anonymous
06-30-2004, 03:42 PM
Hi

before the next version is finished, can i ask one more feature?

in the menu, add a "dump" or "status" entry that will dump current line#, all the variables and eob, eoe setting into ollydbg log.

thanks
psyCK0
07-01-2004, 05:12 AM
Sure. I actually have such a command implemented internally, so it'd be a piece of cake. =) Next ver will be available in a couple of days.


minor double click bug

RCE Messageboard's Regroupment > Bugs > minor double click bug
Lord_Looser
06-30-2004, 04:24 PM
(fast) double click combo: select a line (left mouse click) – keyboard up or down – select first line (left mouse click) --> marks wrong line


minor "file changed" dialog bug

RCE Messageboard's Regroupment > Bugs > minor "file changed" dialog bug
Lord_Looser
06-30-2004, 04:32 PM
(warning: don’t save any changes)
open executable window - view executable file (right mouse click on selected module) – change something inside the file – close window – "file changed" window appears – cancel(!) --> should not close window, only yes/no should do this


Safedisc v3

RCE Messageboard's Regroupment > General > Safedisc v3
aSieR
06-30-2004, 05:05 PM
Hello ,
I wish to know if someone could crack a SAFEDISC with ollydbg...
I was reading some tuts , and all is sice , I adapt the methods to ollydbg and it can't do it... so I like to know if someone did it... hehe :D
psyCK0
07-01-2004, 05:10 AM
I'm too tired for writing the usual insulting comments so I will state it in clear text:
THIS IS NOT A CRACKING FORUM!

Thread closed


My First Script: Stack based generic a s p r u n p

RCE Messageboard's Regroupment > OllyScript > My First Script: Stack based generic a s p r u n p
orion
07-01-2004, 01:11 AM
//////////////////////////////////////////////////////////////////////
// generic (I hope) a s p r oep finder and import recovery
// Author: Orion
// Email: oriontrooper@yahoo.com
// OS : WinXP SP1, OllyDbg 1.10, OllyScript 0.85
// Note: ignore all exception but memory access and invalid op
// Usage:
// 1. run the script
// at first pause, most import entry are recovered, import table
// location is shown in log. verify it.
// 2. resume
// this will decrypt almost all the remaining entry.
// 3. if you think there are entries outside of the range shown in log,
// enter start and end address in eax & edx, otherwise don't do anything
// 4. resume the script.
// 5. repeat 3 and 4 if nessesary
////////////////////////////////////////////////////////////////////// /

dbh

// this the number of exceptions to wait after
// import table is fixed. After this memory range
// breakpoint is set to find oep.
// Adjust it for better performance.
// Too large will miss the oep,
// Too small will create extra delay when a s p r does
// CRC check on code segment (it will still work, but slow)
var memdelay
mov memdelay, 2

gmi eip, MODULEBASE
var mbase
mov mbase, $RESULT

gmi eip, CODEBASE
var cbase
mov cbase, $RESULT

gmi eip, CODESIZE
var csize
mov csize, $RESULT

var pe
mov pe, mbase
add pe, 3c
mov pe, [pe]
add pe, mbase

log mbase
log cbase
log csize
log pe

var gp
gpa "GetProcAddress", "kernel32.dll"
mov gp, $RESULT
log gp

var iat
var iat_value
var stk
var arg
var foundCount
var first_iat
var last_iat
var lastBlock
var iatCount

// dummy initial value that will not change.
mov iat, mbase
mov iat_value, [iat]
mov first_iat, FFFFFFFF
mov last_iat, 00000000

var count
mov count, 0

// time to set memory range breakpoint
var memcount
mov memcount, 100 //large value

eoe onException
run

onException:

add count, 1
log count

cmp count, 1
je lab_gp

cmp count, memcount
jne loc_1

log "set mem breakpoint"
bc gp
bprm cbase, csize
eob onException
esto

loc_1:
cmp count, memcount
jb loc_2

// are we in original program code?
GMI eip, MODULEBASE
cmp $RESULT, mbase
je lab_last

esto

loc_2:
esto

// set bp on kernel32.GetProcAddress
lab_gp:
bp gp
eob onGPA
esto

onGPA:

mov memcount, count
add memcount, memdelay

// saved values from last breakpoint
cmp [iat], iat_value
je goodBoy

//log "nauty! stolen code, will restore"
//log iat
//log iat_value
//log [iat]
mov [iat], iat_value

goodBoy:

var stk
mov stk, esp
add stk, 8
// arg is pointer to function name or ord number
mov arg, [stk]
add stk, 20

mov foundCount, 0

findloop:
add stk, 4
cmp [stk], arg
je foundArg
cmp [stk], mbase
jne findloop

log "stack search failed"
ret

// find import address table entry using stack pattern
// may be more stable then code search.
foundArg:
add stk, 0c
mov stk, [stk]
mov iat, [stk]

cmp first_iat, iat
jb loc_3
mov first_iat, iat
loc_3:
cmp last_iat, iat
ja loc_4
mov last_iat, iat
loc_4:

rtr
// can not write to [iat] now - a s p r will change it later
// save it
mov iat_value, eax
run

lab_last:
log "got oep"
bc gp
log first_iat
log last_iat

cmp [iat], iat_value
je last2
log "fix last iat"
mov [iat], iat_value

last2:
bpmc
jmp step2

step2:
msg "To decode encrypted iat, resume this script"
pause

// find out what each encryprted entry really points to
// by calling them and intercept calls to "GetProcAddress"

bp gp

var saveeip
var breakreturn
var saveesp
var saveop

mov saveeip, eip
mov breakreturn, eip
add breakreturn, 3

mov saveop, [eip]
mov [eip], #60# // pushad
sti // save registers
dec eip
mov [eip], #33c0c390# // xor ax, ax; ret; nop

sub esp, 100
mov saveesp, esp
log saveop

bp breakreturn

var repairstart
var repairend

mov repairstart, first_iat
mov repairend, last_iat

mov iat, repairstart
eob onBreak

process_iat:
cmp [iat], 0
je nextiat

// if iat points to a dll function already,
// gmi will return the modulebase of that
// library, which is not zero
gmi [iat], MODULEBASE
cmp $RESULT, 0
// already points to dlls
jne nextiat

mov eip, [iat]
mov esp, saveesp
mov [esp], cbase //this is an invlid arg to GetProcAddress
sub esp, 4
mov [esp], 0
sub esp, 4
mov [esp], breakreturn

// call this iat
run

nextiat:
add iat, 4
cmp iat, repairend
ja iatfinish
jmp process_iat

onBreak:
cmp eip, gp
je hitGP

// returned to breakreturn
cmp eax, mbase
// if you call GetModuleHandleA with 0,
// current modulebase is returned
je api_gmh

//pause
jmp nextiat

api_gmh:
GPA "GetModuleHandleA", "kernel32.dll"
mov [iat], $Result
log [iat]
jmp nextiat

hitGP:
rtr
cmp eax, 0
// if GetProcAddress fails, and none of the dlls are missing
// (make sure your program runs first!). The only possibility is
// it is directly called from this script with wrong argument.
// which means this iat entry jump to GetProcAddress directly
// instead of call it to get a pointer.
je api_gpa

mov [iat], eax
log [iat]
// change address to our dummy library function
mov eax, saveeip
run

api_gpa:
// GetProcAddress
mov [iat], gp
run

iatfinish:
mov eax, 0
msg "Put start address in EAX, End address in EDX to manually decode, or leave it at 0"
pause
cmp eax, 0
je goodnight

mov repairstart, eax
mov repairend, edx
mov iat, repairstart
jmp process_iat

goodnight:
bc gp
bc breakreturn

mov esp, saveesp
add esp, 100
mov eip, saveeip
mov [eip], #61# //popd
sti
dec eip
mov [eip], saveop

cmt eip,"!!!!!!!!!!!!!!!!!!"
an eip
dbs
ret
orion
07-01-2004, 01:19 AM
tested on a s p r 1.2x. Also tested with 1.3 with very good result.
EDIT: No target names plz! /psyCK0

A few notes:

There is no reference to specific code positions in this script. It uses stack pattern which I think it is less frequently changed.

packers can not mess with system dll's code but we can :)

If packer allocate a new block of memory and run code there, we can use it to our advantage (GMI comes handy)
orion
07-01-2004, 01:20 AM
as you can see, I used a s p r with space to fool search engines.
orion
07-01-2004, 01:33 AM
To make dll fully relocatable, don't forget to correct reloc table address in pe header, lucky a s p r keeps reloc table intact so it is a easy job.
psyCK0
07-01-2004, 07:35 AM
Nice one... Do you want me to put it on the OSC site?
orion
07-01-2004, 12:22 PM
Yes, so more people can test it with different versions to see how generic it really is. The script will change quite frequently though as I intend to improve/fix it often.
orion
07-01-2004, 06:47 PM
How embarrassing, I was wrong when I say it works on one point three. The script worked on c32asm.dll, not c32asm.exe. The two file are protected by different schemes.
Anonymous
07-04-2004, 02:13 PM
Maybe it sounds stupid, but it's enough to copy & paste some plugin to txt file to work properly? Coz when I check psyCKO page, all plugins are in HEX? format not plain text. How do you psyCKO save plugin here posted to file ? Thx for explanation.
psyCK0
07-04-2004, 02:44 PM
All scripts are in plain text format on my site.
shERis
07-05-2004, 08:16 PM
Hi orion!
I tested your script on d z p h p e d . e x e (from download (http://www.dzsoft.com/download/dzphp20.exe)).
This proggy is packed with an a s p r -version.
But your script does´nt work. It causes the error "Stack search failed".
Is a newer version of a s p r used ?
The api calls are indirect and direct in a s p r code!
psyCK0
07-05-2004, 09:49 PM
orion: Added your script to my site =)


Attachtoactiveprocess problem

RCE Messageboard's Regroupment > Plugins > Attachtoactiveprocess problem
kotzeesser
07-02-2004, 12:02 PM
hi,

i'm trying to use Attachtoactiveprocess function through a plugin to attach to a process.

if i call this function from within a workerthread, olly stops responding and consumes 100% cpu load. the log shows only the imagename of the attached process.

are there problems using Attachtoactiveprocess from workerthreads ?

thanks


PESpin 0.3x - 0.4x -> cyberbob Unpack Script v0

RCE Messageboard's Regroupment > OllyScript > PESpin 0.3x - 0.4x -> cyberbob Unpack Script v0
loveboom
07-04-2004, 04:48 PM
/*
//////////////////////////////////////////////////
PESpin 0.3x - 0.4x -> cyberbob Unpack Script v0.1(only for vb)
Author: loveboom
Email : bmd2chen@tom.com
OS : WinXP sp1,Ollydbg 1.1,OllyScript v0.85
Date : 02:06 2004-07-05
Config: Ignore other exceptions except 'Invalid or privileged instruction'
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

code:
msgyn "Setting:Ignore other exceptions except 'Invalid or privileged instruction',Continue?"
cmp $RESULT,0
je lblret

var addr
var espval //esp value
var iatstart //iat start address

var cbase
var csize
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

start:
dbh
run
esto
esto

lbl1:
gpa "LoadLibraryA","kernel32.dll"
bp $RESULT
esto

lbl2:
bc $RESULT
rtu
cmp eip,70000000
jb lbl3
sto
rtu

lbl3:
findop eip,#830A00#
cmp $RESULT,0
je lblabort
go $RESULT
mov iatstart,edx
rtr
sto

lbl4:
mov espval,esp //esp value
add espval,4 //esp+4
bphws espval,"r"
run

lbl5:
bphwc espval
bprm cbase,csize
run

lbl6:
bpmc

lblfixoep:
mov addr,eip
add addr,6
log "OEP is:"
log addr
mov [addr],68
add addr,1
mov espval,esp
add espval,4
mov [addr],[espval]
add addr,4
mov [addr],#E8F0FFFFFF#
add addr,5
log "IAT start address is:"
log iatstart
cmt addr,"Please Open log window,you will see iat start address."

lblend:
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"

lblret:
ret

lblabort:
msg "Error,Script aborted!,Maybetaget is not protect by PESpin 0.3x - 0.4x -> cyberbob"
ret
psyCK0
07-05-2004, 09:51 PM
added to site =)


Plugin idea, need comments

RCE Messageboard's Regroupment > Plugins > Plugin idea, need comments
psyCK0
07-05-2004, 10:44 PM
Hey all,
Well, an hour ago I sat and played with SIce and found an interesting feature - when you stop at a breakpoint it shows you where you came from (previous EIP). So I did a quick search on Google and found some info on module specific registers (MSRs) that are available in kernel mode and that allow you to get this info (among other). So I was thinking it would be pretty neat to implement this feature in a plugin for Olly. My idea is writing a kernel-mode driver that the plugin can communicate with. What do you think? Is there some other nifty way of doing it or will I for once have to use SIce for its intended purpose - debugging kernel-mode drivers that I myself have built? I know all this sounds vague, but thats because I have absolutely zero experience with ring0 stuff... So I really need some comments from more knowledgeable people (you there focht? =) ).
kotzeesser
07-11-2004, 07:16 PM
some days ago, i wrote an olly plugin, which simulates the BPLOAD feature of SIce (breaking on module load, its usefull for service debugging)

it consists of a very simple ring0driver, which registeres an image load callback and a usermode dll, which is the plugin.

it could show you, how to write a simple driver and how to communicate from usermode with it

let me know, if you are interested


Breakpoints on programs that steal focus?

RCE Messageboard's Regroupment > General > Breakpoints on programs that steal focus?
Pinchy
07-05-2004, 11:32 PM
Im working on a trainer for a game and
theres an instance when I need to set a bpx on mem access and return to the game only to find when the access occurs that the game freezes but focus hasnt returned to olly.

Is there some way to set a breakpoint and have it report the registers quietly and continue execution?

Is that possible utilizing the plugin system?
oh me anon
07-07-2004, 12:57 PM
instead of the regular break points setting log break points and telling olly not to break but log all always lets you see the contents or what ever you choose to log
i use this when debugging full screen app which also freeze if a regular bpt is hit and focus isnt returned to olly for stepping
also you can try using run trace and analyze it
Pinchy
07-09-2004, 04:27 AM
Thanks, theres just so much to learn in olly it gonna take a while to learn it all.

Im so used to softice that I would like to see some more standard function keys. It seems olly is more mouse based than anything. Some stuff just cant be accessed without a mouse.

Is there some way to assign function keys et al in olly?


Saving DLLs

RCE Messageboard's Regroupment > General > Saving DLLs
TheTwo
07-06-2004, 12:12 PM
Hello,

I'm in the process of changing a dll, and I'm not sure how fixups work. I know they change the target addresses of some instructions, but I don't know where that info comes from or how it's done. Does olly handle changing fixup info? Is there a good website for describing the fixup process? Thanks


How does Ollydbg determine if a file might be pack

RCE Messageboard's Regroupment > General > How does Ollydbg determine if a file might be pack
1bitshort
07-07-2004, 01:54 AM
When you open some packed files you might see a message like this:
Module 'target' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!

Ive always found it very interesting how OllyDbg is able to determine that. I know its a fairly simple and quick method, but the actual algorithm behind it makes me curious -- does anybody here know what might be happening? For example, does it look at the "BaseOfCode" and "BaseOfData" values, or the values of the VirtualOffset/RelativeOffset of each section, or the flags of each section, or what? If somebody can provide a "pseudo-algorithm" describing the procedure Id be very grateful. :)
Thankyou for your time
psyCK0
07-07-2004, 07:06 PM
Just a guess:

section = GetSectionForAddress(eip);
if(section.characteristics != Characteristics.executable)
ShowMessage();
1bitshort
07-08-2004, 12:32 AM
Thankyou! I know what you mean by section.characteristics, but what do you mean by executable.characteristics?
psyCK0
07-08-2004, 07:24 AM
I meant:

if(section characteristics != exacutable)


ollybd Fader plugin

RCE Messageboard's Regroupment > Plugins > ollybd Fader plugin
CWJ Owl
07-08-2004, 04:08 PM
My First plugin for ollybd.

I was sick of minamizing or resizing ollybd to see what the other application I was debuging so I put this plugin together.

It uses SetLayeredWindowAttributes that work only on windows 2000 or XP to changer ollybd transparent. Source code included.

http://www.btinternet.com/~cwjowlsoft/Fader.zip
JDog45
07-08-2004, 04:59 PM
Thanks for the nice plug-in, I'll be putting it to use..:)
CWJ Owl
07-08-2004, 05:24 PM
Cool, I found it help full :)

any feedback is much appreciated thanks. Not bad for a first attempt at this type of plugin esspecialy in C++ My usual codeing is in VB or delphi :)
psyCK0
07-09-2004, 08:10 AM
Nice plugin! Maybe you could add a dialog for custom fading (0-100%)?
CWJ Owl
07-09-2004, 10:31 PM
I'll have a go, but it'll be after the week end, hopfully monday.

It should be easy enough, it's just a case of adding a Custom fader in the menu which will open an inputbox, with a little jigery pokery so that the input is only an number :)
CWJ Owl
07-13-2004, 04:58 PM
Here it with a custom InputBox, Just enter Numbers, as letters will crash ollybd.

http://www.btinternet.com/~cwjowlsoft/Fader2.zip

atleast untill I have time to sort it out properly *Source code included* a few changes have been made also for something else I plan to add.

RUSH JOB - but it works.
kittmaster
08-16-2004, 03:46 PM
I really like this plugin but it is causing issues with the step over and into routines. When you hold either of them down, it steps very slowly. When I remove the plugin, the system steps as normal. Any ideas?

I'm using a laptop with radeon mobility 9200 video card with all the current drivers.

Chris
CWJ Owl
08-16-2004, 05:33 PM
Thanks kittmaster

I'll try and get it to disable before steping or I might just add it to the menu, but again it'll be when I have to some time.


How to use CommandLine Plugin

RCE Messageboard's Regroupment > Plugins > How to use CommandLine Plugin
JimmyClif
07-08-2004, 05:30 PM
I do have the cmdline.dll and all files associated with it but no help file. How can I pass a couple parameters through Olly to my exe?

Cheers,
Jimmy
JimmyClif
07-08-2004, 05:53 PM
Nevermind... Found the CmdLine.hlp in the OllyDbg subfolder. (I expected it to be with the plugin)


[plugin] OllyScript v0.9

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.9
psyCK0
07-09-2004, 10:32 AM
A brand new version of the plugin is released and waiting for you on the site. Visit http://ollyscript.apsvans.com

From the readme:
+ New commands: ASK, BPL, BPLCND, COB, COE, EVAL, EXEC/ENDE, TICND, TOCND
+ Execution of code in the target process context
+ String concateration with ADD or EVAL
+ Input box
+ Logging breakpoints
+ Removal of EOB and EOE
+ Tracing with condition
# Fixed bug with JBE, hopefully it was the last of the Jxx bugs
# OllyScript now REQUIRES OllyDbg v1.10. No other versions are officially supported.

Have fun!
//SHaG
psyCK0
07-09-2004, 10:39 AM
Some quite big changes were done in this version. Please report new bugs to me as soon as you find them!
Ricardo Narvaja
07-09-2004, 10:41 AM
A request for the plugin.

When in olly i look in a address which go to an api, OLLY automatically put the name of this api.

example if in my machine 75432167 is messageboxa when i type

JMP 75432167

olly changes to JMP MessageBoxA

will be nice if the plugin have a command to realice that work, put the address of an api and return the string of the api, this will be very useful for repairing IATs and if olly can make this work the plugin too i think.

Ricardo Narvaja
psyCK0
07-09-2004, 06:08 PM
So you want something that takes an address and returns a string with API name?
Ricardo Narvaja
07-09-2004, 08:37 PM
yes

A command you enter and address, and if is an address of one api return the string of the name of this api.

Ricardo Narvaja
psyCK0
07-10-2004, 06:34 AM
Should be possible. I will see what I can do for 0.91 =)
psyCK0
07-10-2004, 08:38 AM
v0.91 out
A bug related to pausing the application fixed, the GN command added (for Ricardo =) ), ASM returns $RESULT.

See site for more details
loveboom
07-10-2004, 09:34 AM
hi psycko:
a few question about ollyscript.more information i was send a mail to you!
Ricardo Narvaja
07-10-2004, 10:10 AM
THANKS PSYCKO YOU ARE GREAT.

jeje
Ricardo
Ricardo Narvaja
07-11-2004, 01:11 AM
Work perfect the GN function, thanks.

The last request , is if you can put in two variables, in the 1 the name of the dll, and in the 2 the name of the api, is this possible?

for example

GN adresss

$RESULT=MessageBoxA
$RESULT1=Kernel32.dll

Is possible?

If is not possible let GN in the actual form, work perfect for me, and is very useful.

Thanks fot your great JOB
Anonymous
07-13-2004, 02:54 PM
site down
psyCK0
07-13-2004, 04:31 PM
Damn web hosting shit... Can someone recommend me a good cheap webhost?


Safedisc v3 ( NOT A REQUEST ¬_¬ )

RCE Messageboard's Regroupment > General > Safedisc v3 ( NOT A REQUEST ¬_¬ )
aSieR
07-09-2004, 02:08 PM
So , psyck0 , u didn't understand me... I like to crack safedisc 3 , but I have a problem :
When I pass the antidebugger checks it does a loadlibrary32 and olly says , Thread XXXX terminated , exit code 0 , with softice there is no problem in there , but I like to know , why that error appears.... thank u all
psyCK0
07-09-2004, 05:58 PM
Please please please DONT use the word CRACK on this forum. The only protection discussions allowed here are related to OllyScript scripts.
Nobody knows anything about why this or that protector is behaving this or that way in SIce and in Olly... Find it out for yourseff if you are interested. You can also post on some other board and let JMI flame you (he's better than me, more practice you see)...
I think you misunderstood, its not REQUESTS that are disallowed, its ALL CRACKING-RELATED DISCUSSIONS EXCEPT UNPACKING OLLYSCRIPTS.

Thread closed again.


Msn Messenger.

RCE Messageboard's Regroupment > General > Msn Messenger.
firedance
07-09-2004, 02:49 PM
Well I opened msnmsgr.exe in ollydbg and searched for the word "BYE" and i found one
(Text strings referenced in msnmsgr:.text, item 4299
Address=0043432C
Disassembly=DD msnmsgr.00434670
Text string=ASCII "BYE")
and when trying to brakepoint it it says like "you are trying to set bp on data".
Is there any way to still make it brake when the string is used or so?
psyCK0
07-09-2004, 04:44 PM
Breakpoint on memory access
firedance
07-09-2004, 06:44 PM
Okay, that workt first time i tryed but then it didnt work anymore.
And I got a new question =) , in a dll loaded (msgslang.dll) i know there is lots of strings but when i do search for all reference strings it dusent even start to scan for them.
psyCK0
07-09-2004, 08:15 PM
I would use Ida for that...
Dunno why the memory bp dont work, try setting it again
oh me anon
07-12-2004, 06:11 AM
well i would suggest you to find referances for that string and put a breakpoint on the referance

it should be some thing like
push address (where address points to this string)

yes memory break point on access should work
but once accessed the vb like programs use var copy var move and shit and doesnt access it again but accesses its copied string for use and use varfree etc iirc

well to view string view --->executable modules
follow entry
search for all referanced strings should be able to do it
like this

Text strings referenced in ASYCFILT:.text, item 0
Address=01296EC6
Disassembly=PUSH ASYCFILT.012AB050
Text string=ASCII "MS_AsyncImage_DCWait"


Need Help In Unpacking FSG 2.0!!!!!!!!

RCE Messageboard's Regroupment > General > Need Help In Unpacking FSG 2.0!!!!!!!!
hell
07-09-2004, 03:28 PM
Hi guys !!!!
I'm to this forum and new to cracking as well.Last 2 days i got a target packed with FSG 2.0(PEID). I got the OEP and dumped the process using olly dump plugin. Ok then i rebuilded the import table using imprec and merged the dump as well as the IT.
The dump did not run. Does FSG steal bytes like ASPROTECT?
Secondly What are the options in the ollydump plugin mean--------
Rebuild Import
1) Method 1 -- blah blah
2) Method 2 -- blah blah

Do i need to tick this if build imports manually using imprec
JDog45
07-09-2004, 04:30 PM
lol, this will be closed soon...
psyCK0
07-09-2004, 04:31 PM
Hi hell!!

I see you are new to this forum! Great to see that even retards can find their way here.
Did you just get you internet connection at the mental institution where you live? Have ever heard of board rules? Well, I guess llearning to read is not prioritized for the mentally chalenged individuals like you. Please study your ABC, read the posting rules and come back (or don't, we sure won't miss you). Meanwhile let me summarize the rules for this board:
NO CRACKING-RELATED TOPICS!
Once again, so that even you people with the IQ of a carrot understand:
NO CRACKING-RELATED TOPICS!

Hope I made myself clear.
With all due respect,
psyCK0
garryw
07-10-2004, 12:28 AM
"NO CRACKING-RELATED TOPICS!" then why do we see scripts to unpack just about everything out there?
1bitshort
07-10-2004, 01:57 AM
Garry,
"NO CRACKING-RELATED TOPICS!" then why do we see scripts to unpack just about everything out there?

Unpacking and cracking are two completely different things. Packed files need to be unpacked so that their true contents can be analysed, for example to ensure that it doesn't contain any malicious code. This has nothing to do with cracking the program, just security.
psyCK0
07-10-2004, 06:27 AM
Most new virii are for example packed with executable packers (but hey, many people here wouldn't know that, leeching shareware from download.com and cracking it =) ).
Also, the majority of unpacking topics are related to OllyScript - thats the condition TBD set for allowing some unpacking stuff here.
hell
07-10-2004, 01:04 PM
Hey psyCKO u completely misunderstood me. Anyways i should have used the word unpacking rather than cracking. I did not even mentione the name of the software.How can u say that i downloaded the shareware to crack it. I downloaded FSG 2.0 and packed my notepad with it mainly to gain unpacking knowladge. So the target i referred to is not any proggy but notepad itself. I think u are a real psycko in reality too.
psyCK0
07-10-2004, 01:12 PM
My god, did I forget to lock this thread?
ONLY UNPACKING DISCUSSION IS THE ONE RELATED TO SCRIPTS RETARD!

As I wrote in my previous post (and you could read it if you wanted to, but I guess you are too busy drooling in that wheelchair of yours):
the majority of unpacking topics are related to OllyScript - thats the condition TBD set for allowing some unpacking stuff here.

You know why I like vBulletin more then miniBB? It has an IP-ban feature.


armadillo

RCE Messageboard's Regroupment > OllyScript > armadillo
shadiguy1
07-09-2004, 09:02 PM
armadillo
garryw
07-10-2004, 12:36 AM
see your armadillo and raise you two sloth.
psyCK0
07-10-2004, 06:20 AM
garryw: Hahahaha =)

Yeah, lets discuss Armadillo! Here is a nice place to start if you have Armadillo troubles:
http://www.msu.edu/~nixonjos/armadillo/problems.html


Tracing Code as it executes

RCE Messageboard's Regroupment > General > Tracing Code as it executes
Tom Smith
07-10-2004, 07:37 AM
I'm working with Ollydbg to analyze a program, and this is my first time using a debugger.

So I attach debugger to the program(process) I want to analyze, let's call the program I'm attaching to "DogBone".

What I want to do is have Ollydbg trace "DogBone's" assembler code as it executes, always displaying the current line of Assembler code being used by "DogBone".

That is, every time "DogBone" advances or goes backwards, I want Ollydbg to highlight the current corresponding Assembler code line.

Which function in Ollydbg allows me to do this.

Is it Animate? or Trace?

-Thanx
tom_smith3@hotmail.com
psyCK0
07-10-2004, 01:35 PM
You could just manually step through the program using the Step into/Step over commands or try the Animate into/Animate over features...

BTW, I've never seen a program go backwards. =))
Tom Smith
07-10-2004, 03:01 PM
Tom_Smith3@hotmail.com- Followup:

Let me clarify:

I want Ollydbg to show each Assembler code as it is executed by the "DogBone" program.

So, if I start the "DogBone", as I move around the program, I want Ollydbg to reflect this by moving to the line of Assembler code currently executing.

I don't want to do it manually. That is, the Step command requires you to move thru the program manually, and the Animate command appears to roll thru the code, but does not reflect which line of Assembler code in "DogBone" is being executed currently.

-Tom_Smith3@hotmail.com
oh me anon
07-12-2004, 05:31 AM
did you try hit trace it puts a little red marker as it executes commands

btw yes programs can run backward forward and diagonally psycko
go get cbj +q article and read
1bitshort
07-12-2004, 07:45 AM
oh me anon: Exactly which CodeBreakers journal article are you referring to? URL please? Thanks
oh me anon
07-12-2004, 10:21 AM
here is the url 1bit
i dunno you gotta register some thing now (the whole university is now kinda queer (old aunti was good ;))
when i first read it a year or some times back (the very first release of cbj) it was just plain download of a .zip
now everything is in pdf and whatnot
hxxp://www.codebreakers-journal.com/viewarticle.php?id=21&layout=abstr act

well now explore the possibilities of directionless execution or dynamic direction execution ;)
1bitshort
07-12-2004, 11:49 AM
Thanks, I read a lot of CBJ articles but had somehow missed that one. It's quite an interesting technique ("The Running Line") but it takes a while to set up and isn't overly practicle - more of a demonstration than anything else. Using it in an application for anti-debugging would be very cumbersome to set up (possibly to the point where it could take less time to crack than it would to implement), not to mention that code executing with the trap flag set executes quite slowly, although that should only be an issue if used with large blocks of code or code with lots of loops. Good read though nonetheless .. :)


Cracking and unpacking topics on this board

RCE Messageboard's Regroupment > General > Cracking and unpacking topics on this board
psyCK0
07-10-2004, 01:29 PM
Hello all,

Since I'm growing tired of locking threads and flaming people (you might not believe it but deep down there I'm actually a peaceful kinda guy) I will try to state the rules of this board as far as I know them. If TBD disagrees with me on something he's free to change this post:

1. No cracking discussions will be tolerated. EVER! Not even crackmes are to be discussed here. There are as you surely know a couple of nice boards for that kind of stuff.

2. No talk about warez/crackz/whatever is tolerated. NONE! Don't even CONSIDER requesting cracks here!!!

3. Unpacking topics are only allowed in OllyScript-related discussions in the appropriate part of the forum. Please don't start topics like "How do I unpack packer X?". You could however write a script for unpacking X and post it here and have other people discuss it and come with suggestions/ideas. Anyway TBD and I reserve ourselves the right to close topics that are too far off track.

4. While discussing unpacking-related issues do NEVER EVER mention ANY commercial applications packed with that packer!

5. Please read the manual before posting! I remember a forum (long gone now) that had a section salled "Stupid Idiot posts" where the most outrageous idiot questions were moved. We don't have any such here so the thread will be locked/deleted.

If anyone wants the rules clarified, they are free to post the questions here.

Regards,
psyCK0
cougar
10-31-2004, 07:46 PM
Hello,
I can say I do not need the rules explained to me! I completely understand "NO CRACKING DISCUSSIONS ALLOWED"!
My goal here is to learn, so if I'm at the wrong site please let me know. I do believe the word "Cracking" comes with a fine line and I need to know where that fine line falls!
To better understand my situation. Let me use this as an example;

Lets say you bought this car. Its because of this car you really got into driving! One day you started reading your cars' manual and find there is a place called "Options". Under Options it say 2 things,

1. To increase gas mileage from 20mpg to 300mpg, push this
button.

2. To raise horsepower from 150 to 400, push this button.

WOW what options!

Now what do you do when you go looking for those options the manual said you had only to find the buttons not there! Contact the Dealer, Automaker, call the Hotline phone number, find out they are no longer around , out of business! Gone! Even though your car is only 3 years old. So now what? You know very little about cars, but want those options, even if it means learning everything you can about automotive mechanics, you always wanted to learn but never had the time, until now.
You find this tool that might help you learn about your car and go to the website, only to find out you can't ask questions about engines and electrical circuits, but people can post their modifications to the tool that allows it to disclose information about their engine and/or electrical circuits.
Now I know my example is way outside the box here.

I have an Application that according to the manual says there are 2 options it should have, but are not there in the application.
The company that put out this application is no longer around, the forum website http that came with it is now a search engine.

I hope you guys can understand what I am saying here.
psyCKO, my email addy is wpt1114@yahoo.com
Would you email me so I can have a direct discussion with you so I don't cause the "Stupid Idiot Post" to be reinserted and/or a major flame that could cause this forum to have a melt down.

Oh yea, no kid here, Big 44 in 14 days!
Thanks cougar
1bitshort
11-01-2004, 10:42 AM
Just a bit of common sense is all that's needed. If it's just about unpacking then turn a blind eye - unpacking is afterall required in order to analyze packed programs to ensure theyre not infected/backdoored etc. If its crack-related then obviously shut the thread down and point them to the rules. Too easy
Anonymous
11-30-2004, 05:13 PM
psyCK0
Harold
12-05-2004, 06:02 PM
the main problem is that this server is located in the USA (can't stress this enough)

so everything here falls under the DMCA and other various copy-enforcemnt *cough*bully*cough* laws. So you have to be careful. You really should use woodman's forum for topics like these, it's not in the US and they're prepared.

This particular forum is for the particularities of ollydbg after all :)


Problem With Debugging Of Standalong DLLs

RCE Messageboard's Regroupment > General > Problem With Debugging Of Standalong DLLs
tmmm
07-10-2004, 04:14 PM
I am very interested in using Ollydbg's facility for calling into standalone DLLs. However, when I load my target DLL and select "Debug|Call DLL Export", Ollydbg informs me via the status bar: "Unable to locate DLL". Any idea why this is? I thought maybe the DLL was calling on other DLLs that were not present. But all of the DLL's import DLLs are present and accounted for.

Note that as a baseline, I tried loading user32.dll as shown in the help file. I was able to open the "Call DLL Export" dialog just fine.

-Mike M.


to psycko:ollyscript v0.9 has a bug?,more informat

RCE Messageboard's Regroupment > OllyScript > to psycko:ollyscript v0.9 has a bug?,more informat
loveboom
07-10-2004, 11:33 PM
to psycko:ollyscript v0.9 has a bug?,more information see your email.
psyCK0
07-11-2004, 09:00 AM
My damn web hotel sucks - goes down all the time


code ripper

RCE Messageboard's Regroupment > Plugins > code ripper
lump1
07-11-2004, 09:12 AM
i have started to code a plugin like the tmg ripper studio tool to extract a smal part of code to reuse this with masm.
my question, is there already exists a plugin like this ?

if the answer no, is anyone interested ?

Regards,
lump1
psyCK0
07-11-2004, 11:47 AM
Great idea lump1!
But I think IDA already does it?
lump1
07-11-2004, 02:21 PM
yes, maybe via idc script but unfortunately i don't have this one.
my idea is, to ripp the code recursive with all sub functions ( exclude system modules), ready to used in the assembler e.g. masm
with ollydbg i can trace to a position, where all datarefs,tables, etc are build and rip this to the new source file.

yesterday i have started and now the plugin contain the following parts:
1. placed as submenu in the disass. window
2. runable on a call cmd, extract the code to a new file.
3. automatic label for jmp/call/etc
...

needed:
- correct the lines for the label
- data reference processing
- control gui for more options
...

if anyone interested, i can make the source public to complete this.

Regards,
lump1
ILCH
07-19-2004, 04:45 PM
NICE...i think it very usefull
psyCK0
07-19-2004, 08:43 PM
yeah, IDA cant do that! Would be a great plugin!
ILCH
07-25-2004, 12:03 PM
Can you send my your Ripper Plug via Email ???

DooMdaStic@web.de
lhrt
08-04-2004, 07:18 AM
i am also intersted. Can u send me in seeker7@softhome.net
bye
lump1
08-07-2004, 07:10 AM
Hi,
unfortunately the plugin is not ready.
It's only my first try, to realize.

missing functions:
- processing datareferences
- FileOutputDialog, at this time the plugin write the output to c:\\test.asm
- maybe output format correction ?
- many more ;)

Now i haven't the time to finish my work :(

--------------------- cut -------------------------

#include <vcl.h>
#pragma hdrstop

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <algorithm>
#include <string>
#include <map>

/*
Aufgabe:
- Datenreferenzen verarbeiten
- Kommentare ausgeben
- ...

*/

#include "plugin.h"

#define TAG_RIPPER 0x236D420AL // RIPPER record type in .udd file

void trace(unsigned long adress,int type);

//@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

using namespace std;

struct line_t
{
string cmd;
int ltype;
string label; // optinal, wenn sprung hier her führt !
};

typedef map<unsigned long, line_t> decodelist_t; // key = adresse
typedef decodelist_t::value_type value_t;

decodelist_t decodelist; // hier werden alle kommandos gespeichert !
//@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
//------------------

// globale Variablen
HINSTANCE hinst; // DLL instance
HWND hwmain; // Handle of main OllyDbg window
//-------------------------------------------------------------------

// Entry point der dll, hier bekommen wir den handle zur dll !
//-------------------------------------------------------------------

BOOL WINAPI DllEntryPoint(HINSTANCE hi,DWORD reason,LPVOID reserved) {
if (reason==DLL_PROCESS_ATTACH)
hinst=hi; // Mark plugin instance
return 1; // Report success
};
//-------------------------------------------------------------------

//-------------------------------------------------------------------

// gibt den Namen und die Version and Olly zurück
//-------------------------------------------------------------------

extc int _export cdecl ODBG_Plugindata(char shortname[32]) {
strcpy(shortname,"Ripper"); // Name of plugin
return PLUGIN_VERSION;
};
//-------------------------------------------------------------------

//-------------------------------------------------------------------

// wie der name schon sagt !
// return 0 = alles ok
// return -1 = plugin wird nicht benutzt
//-------------------------------------------------------------------

extc int _export cdecl ODBG_Plugininit(int ollydbgversion,HWND hw,ulong *features)
{
// stimmt die Version ?
if (ollydbgversion<PLUGIN_VERSION) return -1;

// sichere handle vom olly fenster
hwmain=hw;

// schreibe ins logfile
Addtolist(0,0,"ripper plugin v1.00");

return 0;
};
//-------------------------------------------------------------------

//-------------------------------------------------------------------

// Hauptschleife
//-------------------------------------------------------------------

extc void _export cdecl ODBG_Pluginmainloop(DEBUG_EVENT *debugevent)
{
};
//-------------------------------------------------------------------

//-------------------------------------------------------------------

// trägt plugin in die systemmenus ein
//-------------------------------------------------------------------

extc int _export cdecl ODBG_Pluginmenu(int origin,char data[4096],void *item) {
int i,n;
t_dump *pd;
switch (origin) {
// Menu creation is very simple. You just fill in data with menu pattern.
// Some examples:
// 0 Aaa,2 Bbb|3 Ccc|,, - linear menu with 3items, relative IDs 0, 2 and 3,
// separator between second and third item, last
// separator and commas are ignored;
// #A{0Aaa,B{1Bbb|2Ccc}} - unconditional separator, followed by popup menu
// A with two elements, second is popup with two
// elements and separator inbetween.
case PM_MAIN: // Plugin menu in main window
strcpy(data,"0 &About");
return 1;

case PM_DISASM: // Popup menu in Disassembler
// First check that menu applies.
pd=(t_dump *)item;
if (pd==NULL || pd->size==0) return 0; // Window empty, don't add
// Start second-level popup menu.

strcpy(data,"0 rip this now");

return 1;
default: break; // Any other window
};
return 0; // Window not supported by plugin
};
//-------------------------------------------------------------------

// This optional function receives commands from plugin menu in window of type
// origin. Argument action is menu identifier from ODBG_Pluginmenu(). If user
// activates automatically created entry in main menu, action is 0.
extc void _export cdecl ODBG_Pluginaction(int origin,int action,void *item) {
t_dump *pd;
if (origin==PM_MAIN)
{
switch (action)
{
case 0:
// Menu item "About", displays plugin info. If you write your own code,
// please replace with own copyright!
MessageBox(hwmain,
"ripper plugin v1.00\n"
"Copyright (C) 2003-2006 PsyJoe",
"Ripper plugin",MB_OK|MB_ICONINFORMATION);
break;
default: break;
}
}

else if (origin==PM_DISASM)
{
pd=(t_dump *)item;

if(action==0)
{
// rip now :o)
decodelist.clear();

// decodiere erstes commando unf folge ihm
//-----------------------------------------
t_disasm da;
char cmd[MAXCMDSIZE];

if(Readcommand(pd->sel0,cmd)<=0) return;
char *pdecode=NULL; //keine analyse
int cmdlen=Disasm(cmd,MAXCMDSIZE,pd->sel0,pdecode,&da,DISASM_CODE,0);

if(cmdlen<=0) return;
if(da.jmpaddr==0) return;
trace(da.jmpaddr, ((da.cmdtype&C_TYPEMASK)==C_CAL)?0:1);

// speichere ergebnis ab
//----------------------------------------
FILE *out=fopen("c:\\test.asm","wt");
if(out<0)
{
//Fehlermsg
return;
}

// sort(decodelist.begin(),decodelist.end()); // sortiere nach adressen

for (decodelist_t::iterator i=decodelist.begin(); i != decodelist.end(); ++i)
{
switch((*i).second.ltype)
{
case 1:
fprintf(out,"\n\n;############################################# ####### #\n");
fprintf(out, ";## Function ##\n");
fprintf(out, ";################################################# ####\n");
fprintf(out,"%s\n",(*i).second.label);
break;

case 2:
fprintf(out,"%s\n",(*i).second.label);
break;
};

//fprintf(out," %X %s\n",(*i).first,(*i).second.cmd);
fprintf(out," %s\n",(*i).second.cmd);
}

fclose(out);

}
}

}

// This function receives possible keyboard shortcuts from standard OllyDbg
// windows. If it recognizes shortcut, it must process it and return 1,
// otherwise it returns 0.
extc int _export cdecl ODBG_Pluginshortcut(int origin,int ctrl,int alt,int shift,int key,void *item) {
return 0; // Shortcut not recognized
};

// Function is called when user opens new or restarts current application.
// Plugin should reset internal variables and data structures to initial state.
extc void _export cdecl ODBG_Pluginreset(void) {
};

// OllyDbg calls this optional function when user wants to terminate OllyDbg.
// All MDI windows created by plugins still exist. Function must return 0 if
// it is safe to terminate. Any non-zero return will stop closing sequence. Do
// not misuse this possibility! Always inform user about the reasons why
// termination is not good and ask for his decision!
extc int _export cdecl ODBG_Pluginclose(void) {
// For automatical restoring of open windows, mark in .ini file whether
return 0;
};

// OllyDbg calls this optional function once on exit. At this moment, all MDI
// windows created by plugin are already destroyed (and received WM_DESTROY
// messages). Function must free all internally allocated resources, like
// window classes, files, memory and so on.
extc void _export cdecl ODBG_Plugindestroy(void) {
};

//##################################################
// udd Datei zugriffe
//##################################################

// Time to save data to .udd file! This is done by calling Pluginsaverecord()
extc void _export cdecl ODBG_Pluginsaveudd(t_module *pmod,int ismainmodule) {
return;
};

// OllyDbg restores data from .udd file.
extc int _export cdecl ODBG_Pluginuddrecord(t_module *pmod,int ismainmodule,
ulong tag,ulong size,void *data) {

return 0;
};
//-------------------------------------------------------------------- -------
/*
trägt das decodete in eine Liste ein !
*/
void saveToList(unsigned long adress,t_disasm *da)
{
//sprintf(buffer,"debuginfo2 %d [%s] [ref: %X] [cond %x]",cmdlen,da.result,da.jmpaddr,da.cmdtype);

line_t line;
line.label="";
line.l
WEC
02-14-2005, 05:54 AM
My Cureosity is peeked.......can u send me the plugin and source

WEC
Nonameo
04-03-2005, 07:39 PM
I had an idea like this but unfortunatly i currently lack the coding ability to carry out such a task. You have my 100% support. i think there will be lots of people out there that will LOVE this plugin. cant wait :)

-Nonameo-
_Servil_
05-08-2005, 06:43 AM
I have already done that task in Code snippet creator for Ida.
Recursive traversing is implemented, and with OllyDbg help resolves most runtime (OOP) evaluated calls.
URDust
07-02-2005, 06:59 AM
i want to help you in your code ripper.

email: dave198201@yahoo.com
URDust
07-02-2005, 07:28 AM
Hi
Some1 can send me the list of functions prototypes and return codes we need to export and implent when creating plugins for OllyDebug??

There is any list o doc?
HAANDI
08-30-2005, 07:55 PM
Is there something going on about this plugin or is the developement on ice?
Fatmike
11-20-2005, 09:15 AM
Check out Asm2Clipboard plugin :-)

http://rapidshare.de/files/7860111/Asm2Clipboard_V0_2.zip.html

For more information see thread "new OllyDbg plugin"


CPU disassembler Code vs Executable

RCE Messageboard's Regroupment > General > CPU disassembler Code vs Executable
Tom Smith
07-11-2004, 09:26 AM
What is the difference betweem the code in the CPU disassembler Window and the code in the Executable File
(viewed by right clicking in disassembler Window and choosing
View==>Executable File.)
Mario555
07-11-2004, 10:27 AM
CPU disassembler Window - memory
View==>Executable File - file on disk


Beta testers for 2.0??

RCE Messageboard's Regroupment > General > Beta testers for 2.0??
kittmaster
07-11-2004, 02:10 PM
has 2.0 gone into a beta yet? If so are you looking for anyone to do beta testing on it?

I'd be willing to volunteer if so. Please advise

Regards,
Chris
psyCK0
07-13-2004, 04:35 PM
Your willingness to sacrifice yourself for the tedious task moves me deeply! ;)
kittmaster
07-13-2004, 05:12 PM
I try......any news on a timeline?
psyCK0
07-13-2004, 05:53 PM
Zero. Nada. Zip.
I think mid-2005 in the earliest...
kittmaster
07-13-2004, 10:29 PM
ok cool thanks for the update

Chris
1bitshort
07-14-2004, 12:38 PM
My guess is that "it will be ready when it's ready" ;)
I'm sure that if Oleh needs beta testers he would contact people he already knows who are also very familiar with Ollydbg v1.x and have contributed in some way shape or form to Ollydbg already - being able to beta test unreleased software isn't something that's just given to random strangers who ask, it's something of a privilege, so if I was you I wouldn't waste my time asking about v2 until it's made public. Until then lets just let Oleh do his thing. :)
kittmaster
07-14-2004, 12:41 PM
Well you are not me, and unless you ask how would you find out if you didn't ask.

The question was asked and answered, your nickels worth of advise is useless as your post. You know nothing about me or what I've contributed.


Finding Addresses in Disassembler Window

RCE Messageboard's Regroupment > General > Finding Addresses in Disassembler Window
Tom Smith
07-11-2004, 07:55 PM
In the CPU Window displaying disassembled code, , how do I "GOTO" an (hex) address?

I know I can right click in the window, choose View>Execuable file,
and in the Executable file Window you can right click and use the
"Go to offset" command, but there doesn't seem to be a corresponding command in the CPU disassembler Window.

Tom_Smith3@hotmail.com
oh me anon
07-12-2004, 05:18 AM
didnt "RTFM" help you :(
doesnt "CTRL+G" help you then i dont understand your question :(


Script for PesPinv0.7

RCE Messageboard's Regroupment > OllyScript > Script for PesPinv0.7
loveboom
07-12-2004, 02:22 AM
/*
//////////////////////////////////////////////////
PESpin v0.7 Stolen Code Finder v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : WinXP sp1,Ollydbg 1.1,OllyScript v0.85
Date : 2004-7-10
Action: Auto fix IAT,Removed Junkcode,fix oep code(if target is vb's program)
Config: Ignore other exceptions except 'Invalid or privileged instruction'
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

var addr
var isvbapp //target is a vb application??
var espval //esp value
var iatstart //iat start address
var cbase
var csize
var isasm
var isvc

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

start:
msgyn "Setting:Ignore other exceptions except 'Invalid or privileged instruction',Continue?"
cmp $RESULT,0
je lblret

lbl1:
dbh //Hide your debugger
run
esto
esto

lbl2:
gpa "LoadLibraryA","kernel32.dll" //GetProcess
mov addr,$RESULT
bp addr
esto

lbl3:
bc addr
rtu
cmp eip,70000000 //System is wixp and target is a Vb program ?
jb lblnext
sto
rtu

lblnext:
mov isvbapp,[ebx]
findop eip,#830A00# //find 'OR [EDX],0'
cmp $RESULT,0
je lblabort
mov addr,$RESULT
go addr
mov iatstart,edx
rtr
sto

checkvb:
mov espval,esp
add espval,4
cmp isvbapp,4256534D //is that a vb application??
jne lbl4
msgyn "Target like a vb program,go vb module??"
cmp $RESULT,0
je lbl4
mov isvbapp,1
jmp lblbpesp

lbl4:
find eip,#8944241C61# //found 'mov ss:[esp+1c],eax'
cmp $RESULT,0
je lblabort
mov addr,$RESULT
mov [addr],#36890290# //Replace to 'mov ss:[edx],eax'
find eip,#8902EB# //found 'mov ds:[edx],eax'
cmp $RESULT,0
je lblabort
mov addr,$RESULT
fill addr,2,90 //Replace to 'NOP'
findop eip,#7635# //found 'JBE SHORT Address'
cmp $RESULT,0
je lblabort
mov addr,$RESULT
mov [addr],#EB# //Replace 'JMP SHORT Address'
find eip,#83C704# //Target is a MASM program?
cmp $RESULT,0
je lblabort
mov isasm,$RESULT
bp isasm
find eip,#EB06??8907# //Target is a VC/Delphi program?
cmp $RESULT,0
je lblabort
mov addr,$RESULT
add addr,3
mov isvc,addr
bp isvc
run

lbleob:
cmp eip,isasm //If target is a vc/delphi program then goto vc/delphi module
jne lblvc
bc isasm
mov [isasm],#66C747FFFF25#
add isasm,6
mov [isasm],#895701EB05#

lblbpesp:
bphws espval,"r" //set a hardware breakpoint esp+4
cmp isvbapp,1
je lblvb
run

lbl5:
bphwc espval
cmp isvc,1 //if Target is a VC/Delphi program then clear code
jne lblnext1
fill filladdr,30,00

lblnext1:
repl eip,#EB01??#,#909090#,FF
msg "Junk Code has been Removed!"
cmt eip,"Stolen code,"

lblend:
msg "Script by loveboom[DFCG][FCG],Thank you for using my script!"

lblret:
ret

lblabort: //if error then abort script
msg "Error,Script aborted!Maybe target is not protect by PESPIN v0.7 or your config error!"
ret

//////////////////////////////////////
//
// Vb module
/////////////////////////////////////

lblvb:
run
lblvb1:
bphwc espval
bprm cbase,csize
run

lblvb2:
bpmc

lblvbfixoep:
mov addr,eip
add addr,6
//eval "OEP is: {addr}"
//cmt addr,$RESULT
mov [addr],68
add addr,1
mov espval,esp
add espval,4
mov [addr],[espval]
add addr,4
mov [addr],#E8F0FFFFFF#
add addr,5
//eval "Target's IAT start address is {iatstart}"
//cmt addr,$RESULT
jmp lblend

////////////////////////////
//
// VC/Delphi module
//
///////////////////////////

lblvc:
var addr1
var addr2
var addrval
var filladdr

bc isvc //Clear Break point
mov addr1,isvc
mov [addr1],#E9#
mov addr2,cbase
add addr2,csize
sub addr2,2c
add addr1,1
mov addrval,addr2
sub addrval,addr1
sub addrval,4
mov [addr1],addrval
mov filladdr,addr2
mov [addr2],#609CBB#
add addr2,3
mov [addr2],cbase
add addr2,4
mov [addr2],#B9#
add addr2,1
mov [addr2],csize
add addr2,4
mov [addr2],#8B133BD7750C#
add addr2,6
mov [addr2],#8B17891383C3#
add addr2,6
mov [addr2],#0483E903EB03#
add addr2,6
mov [addr2],#83C301E2E99D61E9#
add addr2,C
add isvc,5
sub isvc,addr2
sub addr2,4
mov [addr2],isvc
mov isvc,1
jmp lblbpesp


Syntax Highlighting for OllyScript in UltraEdit

RCE Messageboard's Regroupment > OllyScript > Syntax Highlighting for OllyScript in UltraEdit
TQN
07-12-2004, 02:46 AM
I am using UltraEdit, and alway view and edit OllyScript in UltraEdit. I have created a language define for OllyScript in UltraEdit to enable syntax highlighting. If you enjoy, you can copy the below text, append to the wordfile.txt file in UltraEdit folder, and change the Lxx"OllyScript" to the next free language number.

/Lx"OllyScript" Nocase Line Comment = // Block Comment On = /* Block Comment Off = */ Escape Char = \ String Chars = "#? File Extensions = osc
/Delimiters = ~^&*()-+=|\/{}[]:;"'<> ,. ?
/C1"Reserved variables"
$RESULT
$VERSION
CODEBASE CODESIZE
MODULEBASE MODULESIZE
/C2"Commands"
#INC
#LOG
ADD AI AN AND ASK ASM AO
BC BP BPCND BPL BPLCND BPMC BPHWC BPHWS BPRM BPWM
CMP CMT COB COE
DBH DBS DEC DM DMA DPE
EOB EOE ESTI ESTO EVAL EXEC ENDE
FILL FIND FINDOP
GN GPA GO GMI
INC
JA JAE JB JBE JE JMP JNE
LBL LOG
MOV MSG MSGYN
OR
PAUSE
REPL RET RTR RTU RUN
SHL SHR STI STO SUB
TI TICND TO TOCND
VAR
XOR
/C3"Registers"
EAX EBX ECX EDX ESI EDI EBP ESP EIP
/C4"Flags"
!CF !PF !AF !ZF !SF !DF !OF

We also can enable help for keyword of OllyScript in UltraEdit by add an item to OllyScript.chm into UltraEdit help menu . UltraEdit supports the CHM help file. But the current OllyScript.chm did not build with index support. We need a new OllyScript.chm file.

Hope you will like it.
Regards !
TQN
g30rg3_x
07-12-2004, 02:25 PM
woah, its more great reading scripts with this add

thanks TQN
hacnho
07-13-2004, 06:50 AM
i use EmEditor 4.04 for write my script. Me too, I have created a language define for OllyScript in EmEditor to enable syntax highlighting

View the demo at
http://nhandan.info/hacnho/temp/OllyScrip_EmEditor.jpg

Use: Copy this code and save as script.esy

; EmEditor Syntax File
;
; To import this file to an existing configuration, select Configuration
; under the Tool menu, select Define Configurations, select a configuration
; you want to import to, press [Properties], select the Highlight page, and
; press [Import].
;
;Syntax for OllyScript (http://ollyscript.apsvans.com)
;written by hacnho/VCT2k4 (hacnho@hotmail.com)

#Highlight=on
#BeginTag=
#EndTag=
#CommentBegin=/*
#CommentEnd=*/
#LineComment1=//
#LineComment2=
#SingleQuote=on
#DoubleQuote=on
#ContinueQuote=off
#Escape=
#ScriptBegin=
#ScriptEnd=
#SpecialSyntax=off
#HighlightBraces=off

#Keyword color=3,word=on,rightall=off,case=off,insidetag=of f,regexp=off
EAX
EBX
ECX
EDX
ESI
EDI
EBP
ESP
EIP

#Keyword color=7,word=on,rightall=off,case=off,insidetag=of f,regexp=off
!CF
!PF
!AF
!ZF
!SF
!DF
!OF

#Keyword color=5,word=on,rightall=off,case=off,insidetag=of f,regexp=off
$RESULT
$VERSION
CODEBASE
CODESIZE
MODULEBASE
MODULESIZE

#Keyword color=4,word=on,rightall=off,case=off,insidetag=of f,regexp=off
^#INC
^#LOG
ADD
AI
AN
AND
ASK
ASM
AO
BC
BP
BPCND
BPL
BPLCND
BPMC
BPHWC
BPHWS
BPRM
BPWM
CMP
CMT
COB
COE
DBH
DBS
DEC
DM
DMA
DPE
EOB
EOE
ESTI
ESTO
EVAL
EXEC
ENDE
FILL
FIND
FINDOP
GN
GPA
GO
GMI
INC
JA
JAE
JB
JBE
JE
JMP
JNE
LBL
LOG
MOV
MSG
MSGYN
OR
PAUSE
REPL
RET
RTR
RTU
RUN
SHL
SHR
STI
STO
SUB
TI
ICND
TO
TOCND
VAR
XOR
psyCK0
07-13-2004, 04:34 PM
Hehe, nice stuff gentlemen! Will be added to site as soon as its up =)


Soft Ice 4.05

RCE Messageboard's Regroupment > The Heap > Soft Ice 4.05
Bilal
07-12-2004, 03:51 AM
Hello,
Can anyone tell me where I can find xp patches for SoftIce 4.05 or download an xp version of SoftIce x.xx(any version).
Thank You.
g30rg3_x
07-12-2004, 02:19 PM
yo can find here (patches and softice NT/XP):

Link removed

but it's very good debugger olly, why use softice??

grettings from mexico
psyCK0
07-13-2004, 04:32 PM
No warez links please
g30rg3_x
07-14-2004, 01:01 PM
ok psyCKO
thanks for warning
cools
12-18-2004, 08:07 AM
When I launch Softice 4.05 from start\prorams\numega\start softice the screen apears and dissappears verry quickly.What should I do?
cools
12-18-2004, 08:08 AM
I realy would need an answer NOW plz
Anonymous
12-19-2004, 08:02 AM
forget softice its getting worse and worse during time
do with olly
karthikbalaguru
01-07-2005, 03:10 AM
hi Cools,

>>>When I launch Softice 4.05 from start\prorams\numega\start softice
>>>the screen apears and dissappears verry quickly.What should I do?
>>>>>

here is an answer for your problem ->
u should change the initialisation settings. By default, it will be having
X. It is nothing but, exit from Softice !! So, remove X and give softice
a try . Now softice will not disappear. Enjoy madi !!

Cheeeeeeeeeeers,
karthik bala guru


FOR PSYCKO PLEASE HELP ME

RCE Messageboard's Regroupment > OllyScript > FOR PSYCKO PLEASE HELP ME
Ricardo Narvaja
07-12-2004, 04:38 AM
The GN command store in variable $RESULT the string of the name of the api, this is perfect, but i need store this name in a position of memory.

My script

var ju
var pu
var ta

mov ju,403184
mov ta,401000

mov pu,[ju]

gn pu

log $RESULT

mov [ta],$RESULT

ret

[ju] is an address of an API, in $RESULT is the name of the api, but is impossible store this name in any form with MOV [ta],$RESULT

How i can STORE the name of the api in a memory

THANKS IN ADVANCE

This is very important with this i can make a incredible tute, thanks.

Ricardo
psyCK0
07-13-2004, 05:26 PM
Will come in v0.92 which is coming as soon as the site is up again.
BTW, do you want it as
kernel32.ExitProcess
or just
ExitProcess ?
Ricardo Narvaja
07-13-2004, 08:53 PM
If is possible can be stored kernel32 in one variable and ExitProcess in other variable?

If this is possible my tute will be very great a new revolutionary method in rebuilding tables with your great help, thanks in advance.

Ricardo
psyCK0
07-13-2004, 09:10 PM
GN will return:

$RESULT - kernel32.ExitProcess
$RESULT_1 - kernel32
$RESULT_2 - ExitProcess

This is not a good solution, but I cant come up with any better. Therefor the $RESULT_1 and $RESULT_2 will be kinda undocumented features - I won't guarantee what they will be if the address passed to GN is not for an API. =)
Ricardo Narvaja
07-13-2004, 09:33 PM
thanks is good for me, thanks.

Ricardo


Freeze when tracing

RCE Messageboard's Regroupment > General > Freeze when tracing
Tom Smith
07-14-2004, 01:29 AM
I've attached Ollydbg to several non-system programs on several reasonably fast computers (like Pentium IVs, 1GHz or better, 256gmb RAM or better).

When I start Run, the program I'm debugging runs briefly, then freezes.

I can't even open the window of the program I'm debugging.

I try the Alt-F9 thing, and I'm still frozen.

Any suggestions?

Tom_Smith3@hotmail.com.


General tutorials

RCE Messageboard's Regroupment > General > General tutorials
lhrt
07-14-2004, 04:27 AM
hi all,
its my first post and im really new with ole. so somebody give me some general tuts of ole. most of them found are app specific. and the one with ole is little bit difficult.
bye
JDog45
07-18-2004, 07:24 PM
www.google.com (http://www.google.com)


[plugin] OllyScript v0.92

RCE Messageboard's Regroupment > OllyScript > [plugin] OllyScript v0.92
psyCK0
07-14-2004, 04:34 PM
v0.92
A big bug in script synchronization fixed (thanks loveboom!).
GN behaviour updated.
MOV can now write strings to memory.

v0.91
A bug related to pausing the application fixed, the GN command added, ASM returns $RESULT.

v0.9
+ New commands: ASK, BPL, BPLCND, COB, COE, EVAL, EXEC/ENDE, GN, TICND, TOCND
+ Execution of code in the target process context
+ String concateration with ADD or EVAL
+ Input box
+ Logging breakpoints
+ Removal of EOB and EOE
+ Tracing with condition
+ Get name of address
# ASM now returns assembled length in $RESULT
# Fixed pause crash bug
# Fixed bug with JBE, hopefully it was the last of the Jxx bugs
# OllyScript now REQUIRES OllyDbg v1.10. No other versions are officially supported.
Ricardo Narvaja
07-15-2004, 06:05 PM
Work perfect thanks PsyCKO.

Ricardo Narvaja
Ricardo Narvaja
07-15-2004, 07:18 PM
A new question (sorry psyCKO)

If the $RESULT is in a loop using GN function, when GN found an api, $RESULT is a string, and when not is an api $RESULT is 0

if in this loop i put

cpm $RESULT, 0

when $RESULT is a string the script make an error message for compare an string with an integer (cero).

How i can compare $RESULT for look if is an api address or a cero, without error.

Soory for my problems

Ricardo Narvaja
psyCK0
07-15-2004, 08:14 PM
Stupid bug. New build posted on site.
Ricardo Narvaja
07-16-2004, 05:24 AM
Well i download the new version and the error si the same

cmp $RESULT_1,#0000
Je salto:

or

cmp $RESULT_1,0
Je salto:

if $RESULT_1 has a string the script stop in a error in this line

Ricardo
Ricardo Narvaja
07-16-2004, 06:49 AM
Other bug

this is my script

When you reach the oep of a packed program, after you dump the file, the script fill the zone 401000-xxxxxx with the name of the dll, the api, and the IAT posicion.
Before run the script is needed fill the zone 401000-xxxxxx where the plugin will write the names with zeros (right click-BINARY-FILL WITH ZEROS) for the script acomodate the names.

Look the script is a alfa version with the results of this i can rebuild the table in the dumped file perfect but there is a bug jeje
---------------------------------------------------------------------- ----------------
var ju
var pu
var op
var end
var tu
var zero

mov op,401000

ask "INGRESAR INICIO DE TABLA"
mov ju,$RESULT
cmp ju,0
je fin

ask "INGRESAR FINAL DE TABLA"
mov end,$RESULT
cmp end,0
je fin

log "TABLA DE FUNCIONES IMPORTADAS"

pipi:
mov pu,[ju]

log pu
cmp pu,0
je cero:

gn pu

log ju
log $RESULT_1
log $RESULT_2

mov [op],$RESULT_1

find op, #00#
mov op,$RESULT
mov [op],".dll"

find op, #00#
mov op,$RESULT

inc op
log op
log $RESULT_2
mov [op],$RESULT_2
find op, #00#
mov op,$RESULT

log $RESULT

inc op
log op
mov [op],ju
add op,5

sigue:

add ju,4
cmp ju,end
jae fin
jmp pipi

fin:

ret

cero:
mov zero,op
log zero
mov [op],#00000000000000000000#
add op,11
jmp sigue:

---------------------------------------------------------------------- -

WELL the plugin work but never go to cero:

in the log i can see values of pu=00000000

but in

log pu
cmp pu,0
je cero:

NEVER JUMP TO CERO and not log zero this is a fail in cmp or je

cero:
mov zero,op
log zero
mov [op],#00000000000000000000#
add op,11
jmp sigue:

Ricardo Narvaja
Anonymous
07-16-2004, 08:32 AM
je cero: is incorrect.
maybe you meant je zero ? =)
Ricardo Narvaja
07-16-2004, 08:50 AM
je cero

go to

cero:
mov zero,op
log zero
mov [op],#00000000000000000000#
add op,11
jmp sigue:

zero is a variable

Ricardo Narvaja
Ricardo Narvaja
07-16-2004, 08:52 AM
I complete the script with the fill with 00 before the script start, with this, and the bug resolved, the script wiil be perfect for the tut of manual reconstruction of iat without IMPORT RECONSTRUCTOR.

Ricardo Narvaja
psyCK0
07-16-2004, 10:13 AM
Great... but still about the supposed bug:
Your script posted above is:
log pu
cmp pu,0
je cero:
...
cero:
mov zero,op
log zero

you wrote:
je cero:
but you meant
je cero // (without the colon (:) )

Does it still not work if you make those changes?
Ricardo Narvaja
07-16-2004, 03:23 PM
Yes thanks this was the bug the final script for make a list of dlls, apis and adresses of IAT for use in my tuts of manual rebuilding of IAT without IMPORT RECONSTRUCTOR.
The other bug in cmp $RESULT,0 when $RESULT is a STRING, is unresolved but i don't use in this script, if you resolve this bug i can improve this script better.
---------------------------------------------------------------------- ---------------

var ju
var pu
var op
var end
var tu
var zero
var zona

mov ju,403184
mov op,401000

ask "INGRESAR INICIO DE TABLA"
mov ju,$RESULT
cmp ju,0
je fin

ask "INGRESAR FINAL DE TABLA"
mov end,$RESULT
cmp end,0
je fin

log "TABLA DE FUNCIONES IMPORTADAS"

mov zona, ju
sub zona, 5

sub zona,401000

log zona

fill 401000, zona, 00

pipi:
mov pu,[ju]

log pu
cmp pu,0
je cero

gn pu

log ju
log $RESULT_1
log $RESULT_2

mov [op],$RESULT_1

find op, #00#
mov op,$RESULT
mov [op],".dll"

find op, #00#
mov op,$RESULT

inc op
log op
log $RESULT_2
mov [op],$RESULT_2
find op, #00#
mov op,$RESULT

log $RESULT

inc op
log op
mov [op],ju
add op,5

sigue:

add ju,4
cmp ju,end
jae fin
jmp pipi

fin:

ret

cero:
mov zero,op
log zero
add op,16
jmp sigue

---------------------------------------------------------------------- ---------------

Ricardo Narvaja
psyCK0
07-16-2004, 05:43 PM
The other bug in cmp $RESULT,0 when $RESULT is a STRING, is unresolved

Damn. Uploaded new build. This script now works:
var x
mov x, "0"
cmp x, 0
je ok
ret

ok:
msg "ok"
ret
Ricardo Narvaja
07-16-2004, 08:34 PM
Thanks i try

Ricardo
Ricardo Narvaja
07-17-2004, 02:28 PM
Yes works perfect i put the new tute in my FTP thanks.

Ricardo Narvaja


Saving Changes In Olly Debugger

RCE Messageboard's Regroupment > General > Saving Changes In Olly Debugger
Bilal
07-15-2004, 01:20 AM
If I have made some changes in any file then how can I save file along with new changes.
TBD
07-15-2004, 05:46 AM
after some time, you get tired answering to questions that can be avoided if the one who asked the question, R T F M !


Ctrl+A in Olly Debugger

RCE Messageboard's Regroupment > General > Ctrl+A in Olly Debugger
tydit
07-15-2004, 12:17 PM
I analyze packed EXE files and I can't use this function - Ctrl+A.
Can I do something to work this?

Analyze is a usefull function...

Can you help me? Thank's
psyCK0
07-15-2004, 02:24 PM
Clarify your question or RTFM
tydit
07-16-2004, 04:48 AM
I have packed EXE file, Entry Point is 401000, BaseOfCode is 1000
I can use Ctrl+A (Analyse Code)
I'm tracing and I see JMP 405000 - to other sections
and there (405000) at popup menu Analysis is only 'Scan object files'

Function Analyse Code is disabled

I'd like use this function but I don't know how (at 405000)

I'm sorry, I don't speak english well.
Lord_Looser
07-16-2004, 05:52 AM
OllyDbg isn’t able to analyse memory sections which haven’t a module(!) owner inside the “memory map” window.
tydit
07-16-2004, 07:40 AM
I tested it and it isn't complete.

I use program packed UPX. I can use Ctrl+A to UPX code but when I'm at OEP original program I can't use Ctrl+A.
psyCK0
07-16-2004, 08:42 AM
Tested and confirmed - cant analyze at UPX OEP. Humm, I wonder why?
oh me anon
07-18-2004, 07:03 AM
psycko
may be i should now tell you to "RTFM" HAHAHA
any way see this
Extend code section to include extractor

Many OllyDbg's goodies, like analysis, are available only for the code section of executable module. If this option is active and module is self-extractable, OllyDbg formally extends code section so that it covers self-extractor.
psyCK0
07-18-2004, 07:41 AM
hehe oh me anon I usually DO read the manual before posting. =)
Even with that option the analysis does not work on the OEP of a UPXed target. Do you mean it works for you?
Kharneth
07-30-2004, 12:56 PM
Hello!
It seems you just have to change the base of code of the program to its original value while the option is active or not.
I tested and it works.


OllyScript site back online

RCE Messageboard's Regroupment > OllyScript > OllyScript site back online
psyCK0
07-15-2004, 08:09 PM
After having switched hosting provider the site is now back.
As usual: http://ollyscript.apsvans.com


OllyScript mailing list gone =(

RCE Messageboard's Regroupment > OllyScript > OllyScript mailing list gone =(
psyCK0
07-15-2004, 08:12 PM
After switching servers all membership data for the OllyScript mailing list has been erased... Sorry. Please re-register!


alternative ollyscript dload site?

RCE Messageboard's Regroupment > OllyScript > alternative ollyscript dload site?
DudE
07-15-2004, 09:22 PM
is there any alternative ollyscript dload site
site still wont work for me....
and every link i find points to the same addy ...
DudE
07-15-2004, 09:44 PM
nm, got a hold of it
psyCK0
07-15-2004, 10:58 PM
Umm... http://ollyscript.apsvans.com ? If it doesn't work please try later, maybe all the DNSes have not been updated yet.
sirius
07-17-2004, 03:20 PM
website dont work, please i need download it

Error in website:

Warning: mysql_connect(): Access denied for user: 'apsvans_web@localhost' (Using password: YES) in /home/apsvans/public_html/ollyscript/index.php on line 6
I cannot connect to the database because: Access denied for user: 'apsvans_web@localhost' (Using password: YES)
psyCK0
07-17-2004, 09:25 PM
fixed


Searching commands

RCE Messageboard's Regroupment > General > Searching commands
Bilal
07-16-2004, 12:27 PM
Can anyone help me that how can I search a special command
like
jmp 00476E8C
Thank You
psyCK0
07-16-2004, 01:28 PM
Ctrl-F in CPU window.
Next time read the f*cking manual!
TBD
07-16-2004, 02:23 PM
Bilal: 2nd warning ... as psyCK0 said: RTFM !

if you post again questions regarding stuff that is already in the help file you will be banned !
Bilal
07-17-2004, 06:33 AM
I am really very Sorry for that psyCK0 and TBD.Please forgive me for that.And what is R T F M.
psyCK0
07-17-2004, 08:02 AM
If you enter RTFM in the Google search box I am sure you will find the answer.

Here are a couple of links for you. Familiarize yourself with the content.

http://www.altgeek.org/methuselah/rtfm/

http://www.catb.org/~esr/faqs/smart-questions.html


Olly Vulnerabilty

RCE Messageboard's Regroupment > General > Olly Vulnerabilty
mango
07-18-2004, 06:27 PM
This is interesting/worrying

http://www.securitytracker.com/alerts/2004/Jul/1010728.html


Security risks with OllyDbg ?

RCE Messageboard's Regroupment > General > Security risks with OllyDbg ?
Neitsa
07-18-2004, 06:29 PM
seen here:

http://www.securitytracker.com/alerts/2004/Jul/1010728.html

topic:

OllyDbg Format String Flaw in OutputDebugString() Lets Remote Users Execute Arbitrary Code .

Haven't tested it myself but it seems to be true.

Olly should correct this security hole, even if it's little. Now it has been revealed...

Neitsa.
deli
07-25-2004, 11:40 AM
;)

"OllyDbg Format String Flaw in OutputDebugString() Lets Remote Users Execute Arbitrary Code ."

yes and a executed exe , too!


My first Script

RCE Messageboard's Regroupment > OllyScript > My first Script
Candyman
07-21-2004, 11:11 AM
this my first script for olly i hope you like it
im a lil new to olly script but did my best with this one

/*
//////////////////////////////////////////////////////////////
// EZip 1.0 OEP finder
// Author: Candyman
// Email : qwertosu@hotmail.com
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript >= v0.85
//////////////////////////////////////////////////////////////
*/
MSG "EZip 1.0 OEP finder By Candyman"
sti
to
bphws esp,"r"
cmt eip, "Bang This is The OEP !!! Made By FTS-TEAM Candyman Kondor Ma622"
MSG "Now Just Dump and fix the IAT With Olly Plug & use LordPe to Rebuild the OEP , Enjoy :)"
psyCK0
07-21-2004, 02:00 PM
Nice work! Can't put it on site because there already is a script for EZip, but keep up the great work!


How to set a breakpointer on a button clicked mess

RCE Messageboard's Regroupment > General > How to set a breakpointer on a button clicked mess
yokishiro
07-23-2004, 03:06 AM
I want to set a breakpointer when a button is clicked, so I can start debugging.
psyCK0
07-23-2004, 07:46 AM
I am sorry to say this, but please RTFM!


Looking for spanish tutorials

RCE Messageboard's Regroupment > General > Looking for spanish tutorials
OtupAtpaxa
07-23-2004, 04:53 PM
Excuse my poor english. I'll try to improve
I have some doubts that I'd like to make, but before that someone answers myself with a RTFM, I'd like to know if someone could say me where to find some generic tutorials in Spanish.
I have read very good tutorials (Akira, Houdini, JoeCracker, etc ..), but frequently they were about concrete programs.
I believe that in Ricardo Narvaja's FTP existed tutoriales that I were looking for, but I believe that this direction already is not available.
Thank you in advance.
pzalps
07-24-2004, 02:12 AM
http://crackslatinos.hispadominio.net/
Ricardo Narvaja
07-24-2004, 02:00 PM
Y la lista crackslatinos esta trabajando a full si queres podes suscribirte es gratis y ahi tendras mucha orientacion y ayuda.

Subscribirse: crackslatinos-subscribe@gruposyahoo.com.ar
Borrarse de la lista: crackslatinos-unsubscribe@gruposyahoo.com.ar
Moderador de la lista: crackslatinos-owner@gruposyahoo.com.ar

Página de CRACKSLATINOS
http://www.crackslatinos.hispadominio.net/

Enlaces de Yahoo! Grupos
Para visitar el sitio web del grupo, andá a:
http://ar.groups.yahoo.com/group/crackslatinos/
Para cancelar tu suscripción a este grupo, enviá un mensaje a:
crackslatinos-unsubscribe@gruposyahoo.com.ar

Ricardo Narvaja
OtupAtpaxa
07-25-2004, 02:34 PM
Hello:
Already I am a member of the list of CracksLatinos and there I have found what was searching. In fact, I believe that already I have documentation for the rest of my life (for my children and even for my grandsons)
Thanks to all.

PD: Gracias Ricardo. Desde mi modesta posición como recién llegado a este mundo quería daros las gracias a aquellos que empleáis vuestro tiempo en que otros podamos evolucionar.
Un saludo.


dump file

RCE Messageboard's Regroupment > Plugins > dump file
deli
07-24-2004, 02:45 PM
hi
i try to get in touch with the olly api.
therefore i try to code a plugin which works like the code pervertor made by z0mbie.this tool changes the syntax of a assembler commands but not the meaning.for example ( xor eax,eax -> sub eax,eax)

but my problem is how can i save/dumb a changed file?

first i use the section ->exe save option of olly , but if olly saves the exe it don't saves the changes , why this ??? is there any option to
flush a buffer , so olly can recognize the changes ??

i also use ollydbg, but the problem is that 60% percent of the times the files are currupted.....

thanks for help
deli
07-27-2004, 12:31 PM
is this question too stupid, or is it not understandable???

i hope anybody can help

best regards
Scarabee
07-27-2004, 01:11 PM
Not sure exactly what you mean, but:

After your changes, rightclick mousebutton and select COPY TO EXECUTABLE -> ALL MODIFICATIONS then select COPY ALL.

On the window that pops up, again press right mousebutton and select SAVE FILE.

Hope this is what you were looking for.
deli
07-27-2004, 02:14 PM
thanks for help.
i tried of course the "COPY TO EXECUTABLE" feature from olly, but this is my problem.

if i change code by "hand" and select COPY TO EXECUTABLE i can save it without a problem.

but if my plugin
calls
readmemory()
then do some changes in the code
and then i call writememory() to write the changes back

then i see in the cpu windows all changes but they are not highlighted, as whenn i change it manually , and when i
select COPY TO EXECUTABLE -> ALL MODIFICATIONS
the only option is SECTION.

whenn i choose this olly tells me , "do you really want save a unchanged file bla bla" i click yes.
and as you can guess no modifications are saved by olly.

why ??

must i call another api than readmemory() writememory() ??

thanks for help


disassembling a exe

RCE Messageboard's Regroupment > General > disassembling a exe
DalKiT
07-25-2004, 12:43 PM
hello

I want to use disasm.zip but i don't know how to do to disassembling an executable with disassemble function

thanks


Error

RCE Messageboard's Regroupment > General > Error
Bilal
07-25-2004, 01:11 PM
When I load a program to olly its behaviour is normal but when i run the file using F9.A message pop ups and says:

"Don't know how to step because memory at address FFFFFFFF
is not readable.try to change EIP or pass exception to the progrm."

I have also changed program exceptions in option->exceptions and checked all.
Please Help ME.
telophase
07-29-2004, 02:20 PM
I could help if you could specify the Operating System you
are working on and the Module which you r trying to load??


module help

RCE Messageboard's Regroupment > General > module help
lazerhus20
07-25-2004, 09:17 PM
Hi, I'm new to the board and using Olly in general. Does anyone know how to stop a module from loading? I checked the help file but I'm not sure exactly what the functions technical name was so I may have passed it up. Thanks in advance.
telophase
07-29-2004, 02:17 PM
There is one way of stopping modules although it doesnt apply
to system modules like Kernel32.dll, User32.dll etc..

But if its a program customised module like important.dll then maybe if
you set a break point LoadLibrary and then before the actual
function is called just modify the EIP register thus preventing the
module from getting loaded!


GODUP - Godfather+ Olly Debugger Universal Plug-i

RCE Messageboard's Regroupment > Plugins > GODUP - Godfather+ Olly Debugger Universal Plug-i
xxxxx
07-25-2004, 10:19 PM
Hi TBD, here it is finally

GODUP - Godfather+ Olly Debugger Universal Plug-in
ver. 1.0

This plug-in consist of 5 handy tools:

1. Map loader
2. Resource viewer
3. Process info
4. IDA signature loader
5. Notepad

1. Map loader - use it for loading map files produced by compiler or by
IDA. You can use it to load label names and/or to load comments from .map file.
There is no any checking if map file match currently debugged process.

2. Resource viewer - use it for looking to your resources ;-) This is
probably only viewer which works through direct memory access - means that you
can even look to resources of compressed (protected) executables.
NOTE: Still in experimental phase.

3. Process info - Give you basic information about process + try to
recognize compiler and protection mechanism. . Process info use signature file
signs.txt from PE tools v1.5 (NEOx, .Cryorb) Fell free to add your own
signatures and share it with us.

4. IDA signature loader - probably mostly wanted add on for Olly debugger -
now you can use IDA signature without IDA ;-) Just look to process info - find
your compiler and select and apply matching IDA signature. It's not problem if
you apply wrong one, you can apply another also. Only what you must do is to set
proper path to IDA signatures, and you need sigdump.exe file from IDA resource
kit.

5. Notepad - Simple but smart notepad which load your notes per process
automatically every time.

you can find file at: http://www.exetools.com/forum/showthread.php?t=4691

godfather+

PS. Delphi plugin framework - comming soon
TBD
07-26-2004, 08:11 AM
thanks godfather+!

[edit] Stuph page updated !
TBD
07-26-2004, 08:12 AM
btw, we have on PDF for Delphi, by TQN. did you check it ?
mango
07-26-2004, 04:47 PM
Very nice and very useful plugin. Thanks for sharing
Necr0Potenc3
07-26-2004, 05:14 PM
Great plugin.

nice job dude
xxxxx
07-26-2004, 06:58 PM
@TBD

I check it today and only can say that TQN make good job

- super clean conversion and also some stuff which I din't know how to convert (thise union thing (i solve it like common same lenght sturcture) and some of exotic functions declaration)

- I will compile new version of GODUP with this TQN conversion

There is one error - but not from TQN - from Borland

C++ Builder have CONTEXT structure DIFFERENT than Delphi so please correct t_thread record like this:

t_thread = packed record // Information about active threads
threadid: ULONG; // Thread identifier
dummy: ULONG; // Always 1
ltype: ULONG; // Service information, TY_xxx
thread: THandle; // Thread handle
datablock: ULONG; // Per-thread data block
entry: ULONG; // Thread entry point
stacktop: ULONG; // Working variable of Listmemory()
stackbottom: ULONG; // Working variable of Listmemory()
context: CONTEXT; // Actual context of the thread
ExtendedRegisters: array[0..511] of byte; //Delphi context missing this 512 bytes!!!
reg: t_reg; // Actual contents of registers
regvalid: Integer; // Whether reg is valid
oldreg: t_reg; // Previous contents of registers
oldregvalid: Integer; // Whether oldreg is valid
suspendcount: Integer; // Suspension count (may be negative)
usertime: LongInt; // Time in user mode, 1/10th ms, or -1
systime: LongInt; // Time in system mode, 1/10th ms, or -1
reserved: array[0..15] of ULONG; // Reserved for future compatibility
end;

@mango, NecroPotenc3 - Thx

@ALL i hope that this will bring us a lot of nice plugins written in Delphi
gf+
TQN
07-27-2004, 01:42 AM
xxxxx ! (Wow, a strange name)
You have done a excellent job. I only say: Thank you !
It is great with IDA Signature load. I will play with it.
And I will revise the PDK for Delphi with the CONTEXT problem.
Regards !
TQN
TQN
07-27-2004, 03:35 AM
Hi xxxxx !
You are right. The CONTEXT record declared in Windows.pas (and .dcu) of Delphi 6, 7 is incorrect. It missed the ExtendedRegisters field.
I have some idea about GODUP plugin:
- All control in all forms of GODUP plugin will be placed and resized incorrectly when user resize form. You can correct it with Anchors property.
- The grid in Signature list did not have full row select property. I found that it is hard to view.
- When I view resource of a Delphi app packed with PECompack, Interger Overflow exception raised. You can turn off it with {$O-}.
- The default directory of path of text file name in Notepad could be the path of exe, not plugin directory.
Best regards !
TQN
xxxxx
07-30-2004, 07:26 AM
@TQN

xxxxx is my 'forum' name which I use for forums access only ;-)
I repairing GODUP and applling your ideas. Hope I will finnish today.

I see also your signatures for D6 and D7 - work excelent with GODUP :-))))))

I need only one small correction - please when you build singature set PE flag so GODUP can load them automatically, by default I loading only PE file signatures.

godfather+
TQN
07-30-2004, 07:53 AM
Thank godfather+ for trying my signature.
But I think we have some misidentical with PE flag here. Below is my result ouput when building and dumping D6/D7 signature:
----
IDA signature file dumper by Ilfak Guilfanov. Version 1.19
Signature : Delphi 7 RTL, 4455 modules
Features : compressed
Processor id : 0 Intel 80x86
OS types : 0002 WIN
App types : 017F CONSOLE GRAPHICS EXE DLL DRV SINGLE-THREADED MULTI-THREADED 32BIT
File types : 00010C00 COFF PE AR
-----

The output of sigmake.exe -hf is:
-----
00000004L Binary File
00000008L MS DOS Driver
00000010L New Executable (NE)
00000020L Intel Hex Object File
00000040L MOS Technology Hex Object File
00000080L LiExecutable (LX)
00000100L LiExecutable (LE)
00000200L Netware Loadable Module (NLM)
00000400L Common Object File Format (COFF)
00000800L Portable Executable (PE)
00001000L Object Module Format (OMF)
00002000L S-record format
00004000L ZIP archive
00008000L OMF library
00010000L ar library
00020000L User-written loader
00040000L Executable and Linkable Format (ELF)
00080000L Watcom DOS32 Extender (W32RUN)
00100000L Linux a.out (AOUT)
00200000L PalmPilot program file
00400000L MS DOS EXE File
00800000L MS DOS COM File
01000000L AIX ar library
------

And the sigmake.txt says about flags:
-f... file format types the signature may be applied to.
Combination of bits. When in doubt, set a bit.
(list of bits can be displayed by -hf switch)
00000001 MS DOS EXE File
00000002 MS DOS COM File
00000004 Binary File
00000008 MS DOS Driver
00000010 New Executable (NE)
00000020 Intel Hex Object File
00000040 MOS Technology Hex Object File
00000080 Linear Executable (LX)
00000100 Linear Executable (LE)
00000200 Netware Loadable Module (NLM)
00000400 Common Object File Format (COFF)
00000800 Portable Executable (PE)
00001000 Used-defined format
00002000 Object Module Format (OMF)
00004000 S-record format
00008000 ZIP archive

When I build D6,7 Signature, I have detected the misidentical between the sigmake.txt and sigmake.exe.

Regards
TQN
xxxxx
07-30-2004, 09:51 AM
Sorry, sorry, sorry - my mistake

I forgot to mask bytes to find out if PE flag is set
(i just check if it is PE file.type = $800 and not
(file.type and $800)=$800

In new version of GODUP it´s fixed.

Thanx for pinpoint on error.
gf+
xxxxx
07-31-2004, 09:01 PM
Hi, new version is out:

ver. 1.1 2004-08-01

add: Resource viewer can show DIB resources
add: Resoruces saving
add: Signature loader selector - selecting full row in grid for better visibility
add: Settings pannel
add: Possibility to decide where your notepad files will go
add: Notepad files have name builded from short process name + _dbg.txt

fix: Incorrect PE flag reading for signatrue files (thx TQN)
fix: Correct position of components on form after resize
fix: Support for executable packers which expand resources in memory out of
resource section defined in PE header (PeCompact)
fix: Some minor fixes

from this release I use TQN version of coverted plugin.h
(my is not so perfectly converted)

look on exetools for it. until tbd don't update it here.
godfather+
mango
08-07-2004, 11:54 AM
Hi,

has the olly plugin site been updated with the new version of GODUP yet? I cant download off exetools :/
xxxxx
08-08-2004, 09:36 PM
ver. 1.2 2004-08-09

add: Resource viewer can show Delphi and Borland C builder forms
add: Resource viewer can show dialogs
add: Resource viewer can show version infos

fix: Problem with executing dumpsig.exe if full path have space in it
fix: Memory leak with showing bitmap resources

Experimental - Resource viewer - automatic breakpoint search on static
events from Delphi or BCB form - Works ONLY for DELPHI and BCB

@mango - sended to TBD, hope that he will put it soon here
TBD
08-09-2004, 04:53 AM
Stuph page updated. thanks gf+ !
xxxxx
08-09-2004, 07:37 AM
Wow, that was fast. ;-)
BlackRose
08-09-2004, 11:36 AM
Hello,
thats really great plugin!

But I found small mistake in IDA sig. loader: When analyzing program which is using Miracl Library, some names are not decoded so as using the same signature in IDA. For example Miracl function named "_mirvar" is decoded as "_ecurve_add".

Do You know about this?
xxxxx
08-09-2004, 11:46 AM
Plug-in in this version can recognize 85%-90% functions from IDA signature
files. I still missing logic, which guys from Datarescue use, when procedure or
function has same first 32 bytes.(Then you must use checksums for rest of
procedure etc… pretty complicated without proper documentation)

And now I use only first entry from patern file - so thats why you get wrong recognition.

Actually I need help with this pattern files. I try to make binary reader for .sig files - but at end it was to complicated to do that. I have spend some weeks until I didn't succed to read header (names) from sig files correctly.

Now I use dumpsig.exe and process textual file which he created.

You can examine this files if you execute:

dumpsig.exe signature.sig signature.txt

Any suggestions are welcome.

gf+
wsx
08-13-2004, 12:12 PM
help
who know, where is delphi6 signature file find ?
kittmaster
08-15-2004, 11:08 PM
can you create a local link? I've signed up at exetools almost 2 weeks ago and STILL don't have membership yet......:(

Chris
wrecked
08-29-2004, 11:13 AM
I have the following problems, please solve:

1. Can't get any resource of delphi prog, had tried analysis 1,2,3 and delphi version 5,6 and 7 but can't get any resources
2. Any delphi prog scanned for signature is showing delphi verions 3.0, please advise
Bob
09-02-2004, 12:02 PM
The signs.txt was ripped from PEiD, that was on NeoX PE-Tools and now GodUp.. Delphi 3 comes up because it is before 6/7 in the list and PEiD uses internal checking to determine version.

As for no resources.. Have you tried any other res viewing programs ? PE-Explorer, Res-Hacker etc ? It's probably packed with something..
xxxxx
09-06-2004, 12:51 PM
@wrecked
FIRST load and START program, than try to start analyses again. It should work. If not please send me link to program so I will try to fix problem.

gf+
Alex Globa
09-10-2004, 12:44 PM
Please anybody send me a version 1.2 of this plugin.
I don't have access to exetools/forum attachements.
fkma@mmtools.ru
wrecked
10-03-2004, 02:14 PM
@xxxxx
It looks like I am making mistake, i am doing following:

1. Loads application to be debugged (e.g. delphi 2.0 app)
wrecked
10-03-2004, 02:19 PM
@xxxxx
It looks like I am making mistake, i am doing following:

1. Loads application to be debugged (e.g. delphi 2.0 app)
Analysis is made by Olly itself
2. Step single instruction
3. Goto Plugins > GODUP Plugin > Process Analyse
result is as below
Analyses of program show possible match to: Borland Delphi v3.0
Additional possible match: Borland Delphi
4. Goto Plugins > GODUP Plugin > Resource Analyse
Founds no Resource (list/memoboxes are empty)

Please tell me where am I going wrong. I have tried with other delphi progs too but found no resources. (even my own complied progs in delphi 2.0,5.0, 6.0, 7.0)
xxxxx
10-04-2004, 06:31 AM
@Alex Globa
go to stuph part of the forum

@wrecked
Please click on button read resources ;-)

so you can
- reread resources also after attaching on program
- if program is packed/protected - you can first start program than you can read resources after they are depacked/deprotected in memory

tip 1 - allways look which module is loaded in cpu window - resource analyse will be done on this module
tip 2 - If program is not protected/packed you can read resoruces immediately after load - you don't need to make analyse. For protected/packed you should first run program than try to read resources

(you can choose different module from which you want to read resources - from menu view-execuatble moduels or ALT+E)

gf+
wrecked
10-05-2004, 12:17 AM
@xxxxx

Ok

I tried to locate button read resources but where is it :-(
as i see no such button on the GODUP PLUGIN>Resource Analyse
however, GODUP PLUGIN>Process Analyse is having a button captioned "Get Process Info"
xxxxx
10-05-2004, 09:32 AM
@wrecked

Hmmmm... strange.... it should be on small panel direct above status line in right down corner. On this panel should be save button too.

try to maximise window and than check again, and please check which version of GODUP you have.

It looks like some Delphi problem with pannels and anchors....

Do you have some settings in windows like large font for example, and which wersion of windows you use?

@all who use GODUP
any have similar or same problem?

thx gf+
ViGaN
10-12-2004, 06:37 PM
With resolution 800x600 I have the same problem but setting to 1024x768 it dont appear....The plugin work fine...
I have definitively fixed the problem in this way:
1) unpacked plugin with "c:\upx.exe -d godup.dll"
2) replaced text "poDefault" with 0x00 at offset 000DC044 (TForm.Position: poDefault --> poDesigned)
Now the problem is resolved, the plugin work with any resolution :)

ViGaN
wrecked
10-17-2004, 02:24 PM
I will try as Vigan mentioned, yet the buttons were maximised using SPY and plugin is working nice

Request XXXXX to adjust in future release.

Thanks Vigan
nonebox
12-01-2004, 04:05 PM
Unfortunately, stuph page is not accessible, and I have problems to download from exetools.

Can anybody share latest plugin in alternative location?

Thanks
dmownz
12-29-2004, 09:01 PM
Anyone know an alternate link for this site? The one in stuph appears to be broken...


Load File Error?

RCE Messageboard's Regroupment > OllyScript > Load File Error?
Anonymous
07-26-2004, 12:30 AM
when I load a file larger than 4M,OllyDbg can not load it.


Stopping a module from loading

RCE Messageboard's Regroupment > General > Stopping a module from loading
remlapw
07-26-2004, 02:16 AM
Stopping a module from loading

Hey Guys I was just wondering how i can stop a criminal module from loading...

If anyone can help it would be greatly appretiated sine im totally new to this

Thanks,
Rem
1bitshort
07-27-2004, 07:51 AM
Rename the file.
telophase
07-29-2004, 02:18 PM
There is one way of stopping modules although it doesnt apply
to system modules like Kernel32.dll, User32.dll etc..

But if its a program customised module like important.dll then maybe if
you set a break point LoadLibrary and then before the actual
function is called just modify the EIP register thus preventing the
module from getting loaded!


MOVNTPS (SSE instruction) not supported by OllyDbg

RCE Messageboard's Regroupment > Bugs > MOVNTPS (SSE instruction) not supported by OllyDbg
Mazzze
07-26-2004, 12:29 PM
Hi, I'm new here, but I've got a lot of programming experience (8 years of PASCAL/Delphi, C/C++, TASM/FASM).

Olle, your Debugger is the best I've seen for Windows.
It is compact, easy to use (for those who know debuggers), effective & free. RESPECT!

But the headline says it: there is 1 BUG: It doesn't support the iPentium III+ instruction MOVNTPS!

It would also be nice to implement 64/128bit integer/float types for the CPU & memory dump (perhaps for OllyDbg v2.0).

Greatings to everyone who spends his spare time for coding assembler in our days, to the CCC in Hamburg in especially to ya, Olle!

Mazze MCD - the inevitable return of the Mad Computer Doggy

-|| / ;;
||-+|
|| ||


[NEW]Ultra String Reference v0.11 for Chinese

RCE Messageboard's Regroupment > Plugins > [NEW]Ultra String Reference v0.11 for Chinese
luocong
07-27-2004, 08:15 AM
Ultra String Reference lets you to find Simplified Chinese string reference in a PE file. I wrote this plugin because OllyDbg doesn't support Chinese string reference very well.

Please get it at http://www.luocong.com/myworks.htm#ustrref
pzalps
07-27-2004, 05:04 PM
Great plugin !!
Thank you
drifterli
03-21-2005, 08:47 AM
Very good!
Thank you!
rocket_lei
03-23-2005, 12:02 AM
Great plugin and great site ^_^
pluna
03-29-2005, 05:28 AM
Thank you
Teerayoot
03-29-2005, 04:10 PM
...


Strange thing while attaching a process

RCE Messageboard's Regroupment > General > Strange thing while attaching a process
thatsthelargestnickIveeverchoosen
07-27-2004, 04:25 PM
hello,
it's normal that when I attach a process into ollydbg it doesn't load the modules imported by the process? I can't even set a bp MessageBox since it doesn't know what MessageBox... if I do restart it does, but I can't do it.....thanks

-thatsthelargestnickIveeverchoosen
telophase
07-29-2004, 02:12 PM
Well......
When you attach to a process (at least in XP/NT )
you land ur self in Kernel32.DLL and for your kind information
MessageBox function is Exported by User32.DLL and not Kernel32.DLL
so you cant find it in kernel32.dll.

What you can do i press Alt + E which will list all the modules
currently loaded by your process then select you process and then
select view names and then set a breakpoint on import.

Maybe this will help!


right OEP in upx

RCE Messageboard's Regroupment > General > right OEP in upx
superbaby
07-29-2004, 11:58 AM
I was try to upack notepad packed with upx 0.6
what I did first is use softice go to the jmp OEP and typed a [enter] - jmp eip [enter] - [enter]. and quit softice then go to procdump and dump full, but after I change to the right OEP ( entry point - OEP ), THE NOTEPAD STILL CRASH !
anyone know what happed to this program ?
superbaby
07-29-2004, 12:01 PM
sorry about the previous post, there was a mistake I made it was OEP - Image base, but the notepad still crash
telophase
07-29-2004, 02:08 PM
Maybe because the Import Table is messed up!

Try using ImpRec 1.6 Final to rectify the import table of the dumped
process

Chow!


Debugging DirectX and other Full Screen Mode Progr

RCE Messageboard's Regroupment > General > Debugging DirectX and other Full Screen Mode Progr
telophase
07-29-2004, 01:34 PM
Hello! People I am new to this forum's.

I have beign wondering for quite a long time of how to debug
Full screen Mode Programs ??

Here is my problem:
Whenever i run a program which uses full screen mode and Olly breaks on a breakpoint the whole screen is blocked by Black
Window and the Olly Debugger window is also hidden due to it

Is there any way to debug such programs?
Also can i find a plugin which will let me hide such specific windows
so that the view in Olly Debugger is Clear to me?

Thankyou For Reading!
Goudaman
08-01-2004, 02:45 AM
I think the only way of getting around this is to use a dual display setup and run olly or vstudio or whatever on the secondary display...thats what i do.
telophase
08-01-2004, 01:02 PM
Can u help me in setting up a dual display?
I mean what will be the requirements?
Teerayoot
08-11-2004, 05:23 AM
[i]Whenever i run a program which uses full screen mode and Olly breaks on a breakpoint the whole screen is blocked by Black
Window and the Olly Debugger window is also hidden due to it
i]

I also got this ploblem but it's solved.
Just make OllyDbg always alltop (Alt+F5) or another solutions
use my prog (Process Memory Manipulator 1.0 ) can be download on www.exetools.com (http://www.exetools.com) or cracking.accessroot.com
to make the game window no always alltop you will debugging that game fine.
jayte
08-11-2004, 07:05 AM
Quote: Is there any way to debug such programs?

You might find relief in Odb2, as there's a chance it'll support "remote"
debugging. That is, you control and view the debugger on a remote
system, while *it* runs and controls your program on the target system.
Would be extremely valuable, imo, but... graphics is kinda one of my gigs.

J


Symbols for win98?

RCE Messageboard's Regroupment > General > Symbols for win98?
David Jackson
07-29-2004, 02:52 PM
Where can I get symbols for win98? I installed the win98 DDK, but the only symbols they have are the old style .sym format. Any ideas?

Thanks,
Dave


Swiches

RCE Messageboard's Regroupment > General > Swiches
firedance
07-30-2004, 07:29 AM
Well I Dont understand how the swiches in odbg work. (well they are prolly the same as asm so i looked at this: http://www.winpicprog.co.uk/pic_tutorial2.htm )

but i still dont understand how "push 5" can be case 3 and
MOV EDX,DWORD PTR SS:[ESP+8] can be case 4.
and something that seems to point to nothing can be case 1,6,7,8.


dll detecting olly, cant disassemble

RCE Messageboard's Regroupment > General > dll detecting olly, cant disassemble
imashane
07-30-2004, 05:54 PM
While trying to disassemble a dll, it detects olly and exits. I cant view the disassembly. Is there anyway I can see the code without executing it?
psyCK0
08-02-2004, 05:39 AM
I would suggest using a disassembler (not a debugger) for the job.
1bitshort
08-02-2004, 10:20 AM
While trying to disassemble a dll, it detects olly and exits.
It can only do that if it runs. If all you want to do is disassemble and look at its code, then set "Break on new module (DLL)" in Debugging Options | Events

psycko - are you saying Ollydbg's disassembler isnt good enough? :)
psyCK0
08-02-2004, 11:38 AM
1bitshort: hehe, to each his own. Personally I prefer IDA (after shelling out $200 for a license I kinda HAVE to use it, right? =) ).


general question about debugging

RCE Messageboard's Regroupment > General > general question about debugging
deli
07-31-2004, 09:18 AM
hi,

i have a question generally about debugging,
i try to understand how a debugger works, so i play around with some code lines.
i tried to hook a function with a " int 3".

first i call
SetUnhandledExceptionFilter(rr);

and when the breakpoint is reached the function rr() gets controll,
in rr() i try to replace the BP with the orginalbyte and jump to my
replacedment function(where i do some checks and call the orginal function again)

but this don't work and i don't understand why, the application terminates.

has anybody a simple/short code which explain me how a debugger work ??

thanks a lot


dump with win98

RCE Messageboard's Regroupment > General > dump with win98
naceur
08-01-2004, 06:22 AM
can somone dump with win98,i think is harder than w2k or wxp


script under asprotect

RCE Messageboard's Regroupment > OllyScript > script under asprotect
Anonymous
08-01-2004, 08:02 AM
ollyscript can't find the correct byte sequence under asprotect 131, can't log $RESULT, and incorrect display of the indirect value--> log [eip].
psyCK0
08-02-2004, 05:36 AM
Please mail me more info about the problem and I will check if it's a OSC bug.
britedream
08-02-2004, 03:55 PM
hi psyCk0,
please try this in any target:

set bp and run the following script:
run
eob fx

fx:
bc eip
exec
mov eax, dword ptr ss:[esp-18]
ende
ret

it will loop for ever.

now for byte sequence just find a target protected by latest asprotect and try to find some opcode inside asprotect, in olly you will find it but not by olly script, if you try to display the opcode under eip by logging, you will get the wrong one.

thanks psyck0
psyCK0
08-04-2004, 07:14 AM
Will check ASAP.
Much at work atm...
britedream
08-25-2004, 07:04 AM
Thanks psycko!

I did solve the problem of looping when exec is used.

regards.


Create program to patch excutable

RCE Messageboard's Regroupment > General > Create program to patch excutable
shivia
08-01-2004, 09:57 PM
Obviously new to this.

Is there an option in ollydbg to create a program to patch just certain lines of a program (lets call it cool.exe) , so you wouldn't need to distribute the certain excutable (cool.exe). Instead I could disrubte a program (call it cool-patch.exe) with a smaller filesize. I want to do this to keep bandwidth down, so the users wouldn't need to download the hole program (cool.exe) again, they could just download cool-patch.exe with a smaller filesize, then excute the patch program, cool-patch.exe, and it would just patch the sertain lines I need to change in cool.exe

Thanks
psyCK0
08-02-2004, 05:35 AM
Yes there are.
If you bothered searching Google you would soon find out that there are a lot of such patch creators. I suggest you try searching for information yourself before coming to a forum and asking off-topic questions.
shivia
08-05-2004, 04:58 AM
If you bothered to take the stick out of your ass, you would find it a lot easier to give at least one example program, to point a direction to. Although I have found one it would be nice if someone could mention the most popular/advanced features.
Lord_Looser
08-05-2004, 10:30 AM
CodeFusion Wizard Version 3.0 Freeware
http://come.to/kobik
psyCK0
08-05-2004, 11:07 AM
Lord_Looser: you are far to generous. =) There are people who never learn to do anything themselves because others do it for them.

shivia: Instead of concerning yourself with the health of my behind you could enter "executable patch creators" into the Google search box you would get a relevant link as the second hit...
TBD
08-06-2004, 04:37 AM
I think I must put that image with Bart writing on table:
"I will use google before asking dumb questions. I will use google ..."

image search on google (http://images.google.com/images?q=i%20will%20use%20google%20before%20asking %20dumb%20questions&hl=en&lr=&ie=UTF-8&sa=N&tab=wi)
psyCK0
08-06-2004, 05:52 AM
Please do, TBD
TBD
08-06-2004, 07:57 AM
psyCK0: not yet, I dont want to increase the bandwith for this silly things. from now I will not bother to answer questions that have answers on google or by searching this forum.


PESpin v1.0

RCE Messageboard's Regroupment > General > PESpin v1.0
cyberbob
08-02-2004, 06:24 AM
hi Olly lovers

PESpin 1.0 was out
http://pespin.w.interia.pl


New funcionality of OllyScript ?

RCE Messageboard's Regroupment > OllyScript > New funcionality of OllyScript ?
shERis
08-02-2004, 04:42 PM
I downloaded and used OllyScript. It´s really a great tool! Many thanx for that! And of course Olly for his great debugger.

But now I would need some more functionality of OllyScript.

This is my desire to debug a proggy without running it:

1. A function OPCODE addr, which sets the $RESULT variable to the opcode bytes, $RESULT_1 variable to mnemonic opcode (i.e. MOV ECX,EAX) and $RESULT_2 to the lenght of the opcode. If an invalid opcode appears, $RESULT_2 should be 0.

2. A function NEXTOP addr, which sets the $RESULT variable to next opcode of addr. If any error occurs, $RESULT should be 0.

3. A function PREOP addr, which sets the $RESULT variable to previous opcode of addr. If any error occurs, $RESULT should be 0.

4. A function REF addr, which works as "Find references to .. Selected command" and "Find references", Ctrl R, in OllyDbg. Now the problem is, that there are not defined arrays. The $RESULT variable should now be set to the first reference addr and $RESULT_1 to the opcode if available and $RESULT_2 to the comment (like reference window).

5. A function NEXTREF addr, which works as REF, but results in the next reference. Another call of NEXTREF should result in the next reference and 0 if no more is found.

6. Another way could be to extract data of the references window with some get functions.

7. It would be useful to directly write something to a specified file with a WRT (Write) and WRTA (Write append) function.

This should be enough for today.

If there is an ability to realize this functions, I would be very, very glad ;-))

Many thanx for your work

Bye

~hERi~
psyCK0
08-03-2004, 06:48 AM
Will see what I can do. =)
At the moment I'm in the middle of a quite intensive project at work, so I really don't have too much time for the plugin...
~heri~
08-03-2004, 06:54 AM
Perhaps you have some time !

Thanx psyCKO :-)
shERis
09-17-2004, 08:03 PM
Hi psyCKO!

I have another wish from you for OllyScript:

more arguments for GMI:

gmi addr,MEMBASE and
gmi addr,MEMSIZE

The $RESULT variable is set with the base memory adress / the memory size of an new allocated memory block (VirtualAlloc).

If addr is in module the result could be MODULEBASE/MODULESIZE. (MODULEBASE and MODULSIZE now returns 0 if an address outside module is used.)

Thanx for implementing :-))

~hERi~
Ricardo Narvaja
09-18-2004, 01:05 AM
I think other option for more suitable use is needed.

When i need use a script , i go to plugin - OLLYSCRIPT, and load the script.
I have script is need repeat 50 times. Each time i go to OLLYSCRIPT-OPEN etc.

Is posible if i need only use the same last script, a button type play-stop, for execute the last script charged in memory, and only if a need a new script, go to OPEN again? Is very important to me, thanks.

Ricardo Narvaja
psyCK0
09-18-2004, 06:59 AM
Great ideas! Will implement asap
Anonymous
09-19-2004, 03:05 PM
here is another wish list for next version..

for repl command can get the value from variable

var find
var replace
repl eip, find, replace, 100

for asm command can get the value from variable

var addr
mov addr, 401000

asm eip, "jmp {addr}"
the output should be "jmp 401000"


How uncap PKLite32 1.1?

RCE Messageboard's Regroupment > General > How uncap PKLite32 1.1?
brunomaestro
08-02-2004, 09:00 PM
Please, how uncap PKlite32 1.1? Exist any program for unpack this? ProcDump not found!!!!
psyCK0
08-03-2004, 05:17 AM
Read the forum rules.


bug in OllyScript 0.92 !

RCE Messageboard's Regroupment > OllyScript > bug in OllyScript 0.92 !
shERis
08-06-2004, 03:00 PM
Hi psyCKO!

I found a bug in OllyScript 0.92.

Test this script:

var apiname
var apilib
var apiaddr

mov apiname,"InitCommonControls"
mov apilib,"comctl32"
gpa apiname,apilib
mov apiaddr,$RESULT
log apilib
log apiname
log apiaddr

gn apiaddr
mov apiname,$RESULT_2
mov apilib,$RESULT_1
log apiname
log apilib

gpa apiname,apilib
mov apiaddr,$RESULT
log apiaddr
ret

apiaddr is pointing to neverland.

Please test it.

shERis
shERis
08-06-2004, 03:17 PM
Its the same for WS2_32 and wsock32!

shERis
psyCK0
08-15-2004, 03:36 PM
should be mov apilib,"comctl32.dll"
shERis
08-26-2004, 02:44 AM
Hi psyCK0!
This problem only occurs in some a s p r protected progs. I am testing out.

shERis


asprotect

RCE Messageboard's Regroupment > OllyScript > asprotect
Anonymous
08-07-2004, 05:53 AM
asprotect
garryw
08-07-2004, 11:06 AM
always, and regular medical check-up's are a good thing ;)
psyCK0
08-08-2004, 06:04 PM
retard


Animate Into

RCE Messageboard's Regroupment > General > Animate Into
bluesign
08-07-2004, 10:20 PM
Hi,

When I try to "animate into" (any application), I always get ACCESS VIOLATION exception in kernel32.

Then I tried to load it with CreateProcess (DEBUG_PROCESS) and Single Step myself. But same result.

Isn't it possible to "single step" the whole application?

deniz
Lord_Looser
08-08-2004, 05:43 AM
check your OllyDbg option:
Debugging options – exceptions – ignore memory access violations in Kernel32
bluesign
08-08-2004, 06:43 AM
Lord_Looser: Thank you for your reply.
I know I can disable memory access violations in Kernel32, but my question is why there is a exception down there?

Isn't it possible to "single step" the whole application?

I am just trying to figure out the source of exception. And difference between trace over (or animate over) and animate into.

Any help will be appriciated.

deniz


Ollydbg analysing over and over

RCE Messageboard's Regroupment > General > Ollydbg analysing over and over
lux
08-09-2004, 08:26 AM
Absolutely newbie on this side
I'm trying to 'look inside' a program that uses a teLock packed dll.
I unpacked the dll, at least tried to, but it seems to work, as the packed dll did. Details below.
The problem is: every time I load and reload the prog in Olly, with my unpacked dll, Olly re-analyses the code. (gr8 chance to stop and use the brain rather than staring at the program :)
Looking at the log, I find:
File 'prog.exe'
New process with ID 0000007C created
00797042 Main thread with ID 00000724 created
00400000 Module prog.exe
Import Lookup Table outside .idata
CRC changed, discarding .udd data
10000000 Module dll.dll
10001000 Code size in header is 00000000, extending to size of section '.neolite'
Import Lookup Table outside .idata
...
(noticed 'CRC changed, discarding .udd data') This thing is rather annoying, because all breakpoints etc. are lost between one run and the other.
Needless to say, the prog and the dll do not change. I took md5 sums of them and they are always the same. If I use the original packed dll, the problem disappears.
Some hints and background info:
the prog is about 4,5MB, the packed dll 34KB, the unpacked one 72KB. If I run Olly on the prog with the packed dll, it produces .udd file of about 4,3MB; if I run with the unpacked dll, the .udd file produced is 8,5MB instead.
About the unpacked dll: (as I wrote, I'm completely new to not only Ollydbg, but assempbly too so please don't flame me!); I was not able to unpack the dll using Olly because it keeps terminating saying that it won't run with an active debugger, or that the CRC changed. So to unpack it I took a dump of the running dll with LordPE and rebuilt the AIT with ImpRec. So I was not able to recover the OEP, but as I said the unpacked dll works.

Anyone has some suggestion for me?
Thanks
Lux
lux
08-10-2004, 02:14 PM
I found the answer myself:
the DLL was patching the prog's code on startup. Quite simple.
Disabled the option 'security - Ignore CRC of code section' and Olly stopped analysing every time.


Detach OllyDbg Debugger and let's vitim runni

RCE Messageboard's Regroupment > General > Detach OllyDbg Debugger and let's vitim runni
Teerayoot
08-11-2004, 05:32 AM
Hi all,
I just finished my project for the program that can make your debugging experian more funny.

How about when you debuged(patched/cracked) it you no want to close the process for some reason.

Look in my tool "Process Memory Manipulator " can be download on www.exetools.com (http://www.exetools.com) or http://cracking.accessroot.com .
and lot of more functions u can play with.

For you r "Reverser" as i be ,i think you will like it .

Regards,
Teerayoot.
Ricardo Narvaja
08-11-2004, 01:47 PM
i try but no sucess, the tool have no explanation, i open a victim in OLLY and open process menipulator 1.0 and click in detach but nothing happens.
Your tool only work with ollydbg named ollydbg.exe, not work in renamed ollydbg with other name?
If you can make work in any olly with any name will be more useful i think.

Ricardo Narvaja
Teerayoot
08-11-2004, 05:15 PM
Hi Ricado.
I not sure do you using which version.
My prog are update daily the lasted version (on 10/8/2004) can be download on exetools .

For the stop debugger usage i add two functions
-DebugActiveProcessStop and Detach Parent Debugger

I add two because
First (DebugActiveProcessStop ) right click on Debugger Process(OllyDbg,Parent Armadilo ;)

i can't find the child pid to stop and you need to give pid in inputbox when program asking child pid to stop

the implement of this function come from your explain in OllyDbg long time ago (in GetRight 5.0) Ricado :)

that just push child pid and call DebugActiveProcessStop
for me just hook that function ,yes it's very stable and will let' vimtim running good and debugger can be kill selfly .

and 2 "Detach Parent Debugger "
in this func just click on child process the parent debugger will be detach and debugger can be kill selfly also.

No plob for the name of debugger,for me it's name "JackDg.exe" ;) it's working fine.

And another things is would be nice for stop the Debugger is
when u map new memory ,OllyDbg can't go to that address (try your self Ctrl+g to new allocate address)
,if so just stop the debugger and debug it again now u can go to that expand address.
Ricardo Narvaja
08-11-2004, 06:39 PM
in exetools there are one post and i download the file of this post

Process Memory Manipulator 1.0
Process Memory Manipulator 1.0

***************Hot key***************
-F5 refresh process list
-Alt+F1 Bring window to top(mostly use with alway alltop)

**************Feature****************
-write/restore memory on target process
-allocate/free memory on target process
-raw memory dump
-load/unload modules on target process
-suspend/resume target processs
-view all import/export modules
-Send message to target process
-Debug/Detached debugger process
-Force Kill process
-Window Manipulator
-Set Priority Boost

**************History*****************
11/8/2004
Added Window Manipulator(set (ex)style/width/height/window text/etc)
-Added Set Priority Boost
10/8/2004
Added DebugActiveProcessStop
9/8/2004
Memory patcher bugfixed
Allocate on given memory address(Thank to MaRKuS-DJM )
8/8/2004
Added -Rawdump
Greatly improve on Memory patcher
7/8/2004
-1.0 First release

***************Bug found*************
-Pm/Mail Me

**************Usage Note ****************
Write Process Memory
when you make a patch,the patch is remember per process
so you can switch betwean process and make patch/restore safely.
DebugActiveProcessStop
First select debugger and input the child pid to stop.
Detach Debugger Process
Just select child process (this not work if the a process do not launce by debugger)
Unload Modules
Module lists do not update when process change so make a refresh
when u want to unload/view imports/exports
Allocate Memory
If the start address is 0 ,the start address will choose by system.
Kill process
Beaware when use this cauze of he can kill the critical process

I hope you will like it as i did

Teerayoot@bugsgroup.com
Attached Files
PPM.zip (864.8 KB, 36 views)

i download this file press DETACH PARENT PROCESS nothing happens, press DEBUGACTIVEPROCESS nothing happens, olly is in the desktop, the victim is in the olly and i can continue tracing in ollydbg without changes and nothing happens jeje.

What is the trick?

Ricardo Narvaja
Ricardo Narvaja
08-11-2004, 06:41 PM
well appear the window ask me for the pid of the child i put this value (is prewrite) and nothing happens, olly don't close, the victim don't run, and i can beginning the work in olly in the ep of the program how if nothing was applied.

Ricardo
Teerayoot
08-11-2004, 08:05 PM
If the parent process not debugging the stop debugger do not work!

Why? The function that i implement do nothing special ,it' just hook the "WaitForDebugEvent" and call DebugActiveProcessStop

if the debugger in oep it don't process that Event not call that "WaitForDebugEvent" .
For stop sucessfull the debuggee have to in running state.

Here take a screen shot ,
After we patched all and run target ,i using NotePad.exe as example

First select OllyDbg(also work for all debugger)
the inputbox will ask you child pid (if some1 can help me on finding chid pid please help) ,input will fill with lower process in process list(it's not alway correct )
http://www.intechhosting.com/~access/Teerayoot/images/pll.jpg

then MessageBox will promtp for sure of child process if the process name message show do not correct debugged child so let fill by hand .

http://www.intechhosting.com/~access/Teerayoot/images/ask.jpg

After that if "enjine.dll" injected and hook "WaitForDebugEvent" sucsessfull MessageBox will show the sucsessfull stop the debugger.

http://www.intechhosting.com/~access/Teerayoot/images/finished.jpg

After child had been stoped debug,the debugger do not close .
We can see OLLY still assume debugged it but he can't acess any memory on target process ,and if we select "execable modules" all modules will unload.

Hey,do it working now? :D

I can't link to my screen shot.
Ricardo Narvaja
08-11-2004, 08:27 PM
i don't understand well you say but this not work for me, the links for images are forbidden.

Forbidden
You don't have permission to access /~access/Teerayoot/images/pll.jpg on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
Apache/1.3.31 Server at www.intechhosting.com (http://www.intechhosting.com) Port 80

I open a crackme in ollydbg, when stop in the EP, i press detach debug parent, or debugactiveprocess, in one option nothing happen, in other option a window with the correct PID of the crackme appear, i press ok and nothing happens, messagebox of succesful don't appear and olly and the crackme remains untoched and you can continue working with olly debugging the crackme, the tool not realize never action in olly or the crackme.

Ricardo Narvaja


Olly open file but don't stop to EP!

RCE Messageboard's Regroupment > General > Olly open file but don't stop to EP!
djneo
08-11-2004, 07:58 AM
Hello, it's my first message to this forum and i would want to greetz Ricardo for his tuts really good!

My problem is a prog when it loaded in ollydbg, directly start and make invalid lock sequence exception. When i want to bypass this , i have the message "unable to debug this program" and it terminate.

I see instruction LOCK NOP but i don't know what it is.
How the prog can start?

PS : (for Ricardo) i tried to unpack armadillo protection but i found different tricks.
I can detach son of his father because there is just a WriteProcessMemory of 2 bytes,after i can find magic jump and rebuild IAT, but after there is anti debug with jmp in another section don't dump and it seems to have nanomites.
i'm just a newbie, so i would know if you can help me.

thank you
Ricardo Narvaja
08-11-2004, 01:51 PM
Well armadillo is not for newbies jeje is very difficult.

If olly dont stop use ollydbg 1.10, quit the plugins and try again, and if dont stop try and old ollydbg 1.08 i think and look if stop in this program.
And there are programs than detect debugger before reach OEP, is difficult to think by is so.

Ricardo Narvaja
djneo
08-11-2004, 02:07 PM
Thank you for youir answer.

The program which is packed with armadillo is not the same that it don't break in OP.

For armadilled program, my problem is that i have to solve nanomite and anti debug in the same time to have valid dump but it's not easy.

For the other prog, i think it is packed because all sections have strange name.
I use ollydbg 1.10, but I don't understand "quit the plugins and try again".

Just a little question.
If I put an int3 with a hex editor on the OEP what ollydbg is gonna do?
Ricardo Narvaja
08-11-2004, 03:04 PM
quit the plugin , is if you have plugins installed quit and next try again, but i think is a trouble with version 1.10 try 1.08 or 1.09 for look if program stop.
If you put CC in the oep (INT3) and configure olly in OPTIONS - JUST IN TIME DEBUGGING- MAKE OLLY JUST IN TIME DEBUGGER and when you run the program in the cc make an exception an autimatically olly atachs to a process, and replace the cc for the original byte and ready.
The same is if you replace the first two bytes for EB FE (infinite loop) when you run the program nothing happens, atach olly manually to the process and replace for the original bytes and RUN.
Use olly 1.08 or 1.09 and have no troubles and stop in the start.

Ricardo Narvaja
djneo
08-11-2004, 04:12 PM
the problem is not ollydbg, it's just because the prog is packed

when i break on a int3 after i trace a little and i see it write in the first section. But after there is int1 and debugger crash.
Ricardo Narvaja
08-11-2004, 04:29 PM
packed or not any program may stop in the entry point , and there are few programs don't stop in the entry point in olly 1.10 if you don't want try in other old 1.09 or 1.08 ollydbg don't try.
I have programs stop in EP in 1.08 and 1.09 and don't stop in 1.10.

Ricardo Narvaja
tigerheart
08-11-2004, 04:45 PM
djneo, the problem is that the PE's section flags are not set right. I've had that problem many times before, just open LordPE (or another PE editor), and change the section flags to 'E0000060' which is for Executable as code, Readable, Writable, Contains executable code, and contains initialized data. That should fix the problem.

Tigerheart
djneo
08-11-2004, 06:34 PM
I tried with 1.09c and it's the same thing.

if I put sections at E0000060 , the prog don't run.

->Section Header Table
1. item:
Name: .text
VirtualSize: 0x000D7000
VirtualAddress: 0x00001000
SizeOfRawData: 0x00000000
PointerToRawData: 0x00000400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000020
(CODE, EXECUTE, READ, WRITE)

2. item:
Name: s5w7v5wh
VirtualSize: 0x00019000
VirtualAddress: 0x000D8000
SizeOfRawData: 0x00000000
PointerToRawData: 0x00000400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000060
(CODE, INITIALIZED_DATA, EXECUTE, READ, WRITE)

3. item:
Name: .data
VirtualSize: 0x00115000
VirtualAddress: 0x000F1000
SizeOfRawData: 0x00000000
PointerToRawData: 0x00000400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

4. item:
Name: .rsrc
VirtualSize: 0x00088000
VirtualAddress: 0x00206000
SizeOfRawData: 0x0002B000
PointerToRawData: 0x00000400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

5. item:
Name: 7hah8k9c
VirtualSize: 0x00012000
VirtualAddress: 0x0028E000
SizeOfRawData: 0x00000000
PointerToRawData: 0x0002B400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE2000060
(CODE, INITIALIZED_DATA, DISCARDABLE, EXECUTE, READ, WRITE)

6. item:
Name: ch8fvvpj
VirtualSize: 0x00001000
VirtualAddress: 0x002A0000
SizeOfRawData: 0x00000000
PointerToRawData: 0x0002B400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

7. item:
Name: 2b6salod
VirtualSize: 0x0004E000
VirtualAddress: 0x002A1000
SizeOfRawData: 0x00000000
PointerToRawData: 0x0002B400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000020
(CODE, EXECUTE, READ, WRITE)

8. item:
Name: o41w0a9e
VirtualSize: 0x000DC000
VirtualAddress: 0x002EF000
SizeOfRawData: 0x000DBE30
PointerToRawData: 0x0002B400
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000060
(CODE, INITIALIZED_DATA, EXECUTE, READ, WRITE)
Ricardo Narvaja
08-11-2004, 07:20 PM
tre problem start in version 1.09 c try 1.09 b or less

Ricardo
djneo
08-11-2004, 07:29 PM
i tried with 1.08b version but it's exactly the same thing.

If i uncheck all box in exception tab, the first break it' in int3.

After the code copy data in the first section and after there is
INVALID LOCK SEQUENCE with LOCK INT3 and code F0:F1
Ricardo Narvaja
08-11-2004, 07:56 PM
Well sorry

Ricardo Narvaja
djneo
08-11-2004, 07:58 PM
Really strange this protection, any detector knows protection, so I think it's a manuel protection.

I'm not good enough for that.

But what prog do when there is int3 and no debugger?
Ricardo Narvaja
08-11-2004, 08:50 PM
execute the exception (RING0) and when return to RING 3 the next line executed is seh handler.

Ricardo


How attach to a process not visible?

RCE Messageboard's Regroupment > General > How attach to a process not visible?
djneo
08-11-2004, 12:50 PM
When i want to attach to a launched process, i can't because it's not visible in the olly's list.

How can I attach to it?
Teerayoot
08-11-2004, 05:32 PM
"Process Memory Manipulator 1.0 " can show that hidded window.
For next release i will chang name "Process Memory Manipulator 1.0 "
to "Process Manipulator 1.0 "

because he can do more not even Memory Manipulator ;)
djneo
08-11-2004, 06:41 PM
Where can I find this prog.

I searched it on google but I only found 0.2 version :-(

Edit : I saw you give link fot exetools.com but i'm not register so i can't donwload it.
Teerayoot
08-11-2004, 08:26 PM
Hey i just have finished 7/8/2004 ,it took me 5 days for developing .

I think goole can't trace into my machine ;)

The prog u can download on my friends forum
http://forum.accessroot.com or
Great place
http://www.exetools.com

Why not register new user there ,before no allow new user registration on exetools .Take a chance.
djneo
08-12-2004, 11:23 AM
I've tried to register to www.exetools.com (http://www.exetools.com) forum but I not received mail for activation yet.

How many time am i waiting?
it seems to be a great forum!
yalcm
04-02-2005, 01:26 AM
It seems that www.exetools.com (http://www.exetools.com) does not accept new-user registration for not a short time. So who can give me an invitation to there ?
thanks in advance.


Function name of CALL <JMP.&MFC42.#xxx>

RCE Messageboard's Regroupment > General > Function name of CALL <JMP.&MFC42.#xxx>
OnoSendai
08-12-2004, 08:32 AM
hello all,

does anybody know how to get the function names for calls like:
CALL <JMP.&MFC42.#825>

thanks!
Lord_Looser
08-13-2004, 06:51 AM
To get more info for export functions the simplest way is to add import libraries.
OllyDbg – menu – debug – Select import libraries – Add “mfc42.lib” – Process (restart OllyDbg)
(OllyDbg – menu – Debugging options – Addresses – Demangle symbolic names)

To get library functions' info you have to copy *.PDB (e.g. MFC42.PDB) file into you system32 folder.
OnoSendai
08-14-2004, 05:19 PM
i had to install a service pack to get the mfc42.lib but now it works perfectly.

thank you very much!


DebugActiveProcessStop Plugin for OllyDbg

RCE Messageboard's Regroupment > Plugins > DebugActiveProcessStop Plugin for OllyDbg
Teerayoot
08-12-2004, 08:44 AM
DebugActiveProcessStop Plugin for OllyDbg
==========================
[Stop debug target and let's target running]

Date: 08.12.2004
Author: Teerayoot <Teerayoot@bugsgroup.com>

Download

http://www.intechhosting.com/~access/Teerayoot/Download/DebugActivePro cessStop.zip
(http://www.intechhosting.com/~access/Teerayoot/Download/DebugActiveProcessStop.zip
)

Feature
---------
-Stop Ollydbg debugger and victim still running
usefull when debug critical system process.

Works on
--------
-WindowXp

Installation
------------
-Copy the DebugActiveProcessStop.dll into OllyDbg's plugin directory. Make sure that if you have an entry
named "Plugin Path=" in your ollydbg.ini it points to the directory you just
dropped DebugActiveProcessStop.dll in.

Usage
-----
-when CPU windows open on main thread just click on Stop plugin menu.
psyCK0
08-12-2004, 09:18 AM
Great work Teerayoot! Maybe you can include the source?
Ricardo Narvaja
08-12-2004, 10:38 AM
Well sorry i understand this is a great job and you have a hard work making programs and plugins but i need say if there are a trouble, sorry.
This plugin only work partially.
If i open a crackme in OLLYDBG and the crackme is paused in the OEP, when i press STOP in the plugin, the crackme try to run and the screen of olly is empty, but the crackme crash in the entry point, and stop in a error, if i have OLLY how JIT opens other OLLY and the crackme is in the EP again sttoped.
For me only plugin works if i make a EB FE infinite loop in the EP, and put RUNNING the crackme looping, next i press STOP in the plugin, and crackme don't report errors, go to pupe, replace EB FE with original bytes and crackme continue running perfect.

Ricardo Narvaja
Teerayoot
08-12-2004, 11:18 AM
psyCK0
Great work Teerayoot! Maybe you can include the source?
Well,the source is in Bcb 6.0 and also i using Madkernel
just 2 line of code in Stop command

Anyway ,i already included source can download on first post,may be my plugin can stay on the stubh page :)

Ricado.
For me when i try to stop on OEP the exception occur because olly set "CC" instruction there and show message box about exception we can click cancel to debug it again.

If want to detach debugged process just Hit F9 and click "Stop" on plugin menu,the target will running well.
Ricardo Narvaja
08-12-2004, 12:17 PM
well i press F9 and put the program running and nexy press stop in the plugin and the program execute till y press the menu plugin-stop, varios lines, and in this lines maybe the program can detect the debugger and close.
Is not posible the same plugin put the program run and next detach when i press STOP, this was more quickly if i press by hand.

Ricardo Narvaja
Ricardo Narvaja
08-12-2004, 12:19 PM
Well if I press F9 and put the program running and next I press stop in the plugin, the program execute till I press the menu plugin-stop, various lines, and in this lines maybe the program can detect the debugger and close.
Is not posible the same plugin put the program run and next detach when i press STOP, this was more quickly if i press by hand.

Ricardo Narvaja
TBD
08-13-2004, 12:13 PM
Teerayoot can you send me the plugin to put on the Stuph page as I cannot download it from your post (404)
Moonbaby
08-14-2004, 03:21 PM
Very sorry Teerayoot, could you check your link ?

I can't load thast file .

Thank.
Teerayoot
08-14-2004, 08:15 PM
I already mail to TBD,if he can get it ,i think it will be avail for download in Stuph page.
jrs13579
09-02-2004, 11:21 AM
I can not download it,will you please send me one? jinrs@163.com
Thanks a lot!
Teerayoot
09-04-2004, 01:58 PM
My plugin is so lame ,TBD not decide to put on Stuph page maybe because of i using Madkernel .

Just 2 lines of code implement on stop process
Anyway i got real pain when try to get PID from thread id using "ZwQueryInformationThread" ,No succeed(WHO CAN HELP)?.
.
Look USEFULL PLUGIN but Not Powerfull Source included!

Try this locations mate http://www.johnwebsite.com/teerayoot/DebugActiveProcessStop.zip
focht
09-14-2004, 06:40 PM
Hi,

why dont you use the debuggee PID supplied by Ollydbg plugin api?

Plugingetvalue( VAL_PROCESSID) should give you the desired information.

Regards
Teerayoot
10-17-2004, 06:51 PM
Ok ,thank q focht.

I re written in pure cpp for small in size & faster download
can be Download at

http://intechhosting.com/~access/forums/index.php?act=Attach&type=post &id=83
(http://intechhosting.com/~access/forums/index.php?act=Attach&type=post&id=83
)

source included.
heishadow
11-08-2004, 11:53 AM
3ks!I`ll Try


Ollydbg and 64bits processor?

RCE Messageboard's Regroupment > General > Ollydbg and 64bits processor?
djneo
08-12-2004, 12:02 PM
I would like to know how ollydbg could work with a 64 bits processor and a 64bits OS?


some noob questions

RCE Messageboard's Regroupment > Plugins > some noob questions
badc0der
08-13-2004, 12:31 AM
1. Is there any documentation for the plugin API other than the sample source... I looked a bit but couldn't find anything that looked better than the sample source.

Regarding the following two functional descriptions what is the implementation state (available in the main program, available with a plugin, plugin needs to be written, unimplementable)?

1. Logging register state (instead of breaking) on break points either to the Olly log or to a file

2. Dumping log messages to a file so that they are not lost if the debugged application crashes the system

3. memory diff/access recording. Basically I want to step over a call and be able to see what memory was changed and optimally see what memory was accessed.
TBD
08-13-2004, 12:15 PM
http://home.t-online.de/home/Ollydbg/pdk.htm

you can find a .hlp in the zip


[req] Step/Autotrace Recorder n Compare (just idea

RCE Messageboard's Regroupment > Plugins > [req] Step/Autotrace Recorder n Compare (just idea
kepeto
08-14-2004, 01:04 AM
hi,
i'am newbie in debugging,
anyone can code plugin in olly that possible to Track the Step/Stepinto in automation way, then record this into a file,
my idea is, we specify range address to track, then record the
changes, or if we like, we can break when the state is change,
data format maybe something like this..
First Record
[address] [asm] [first state]
[******] [***] [1 ]
[******] [***] [1 ]
[******] [***] [1 ]

Second Record
[address] [asm] [first state]
[******] [***] [1 ]
[******] [***] [1 ]
[******] [***] [0 ]

Mix Two Record
[address] [asm] [first state] [address] [asm] [2nd state]
[******] [***] [1 ] [******] [***] [1 ]
[******] [***] [1 ] [******] [***] [1 ]
[******] [***] [1 ] [******] [***] [0 ]
The step:
1. [First Record] make range of address to record [xxxx]...[yyyyy]
2. Step/Step into when the breakpoints hit our address range
(ex: we hit button in a form).
3. [Second Record] is the same with step 2, but in different data
4. Analyze, or make rules how to break....
anyone can help me
thank you....


TApplication.Initialize not identified

RCE Messageboard's Regroupment > Bugs > TApplication.Initialize not identified
popcron
08-14-2004, 03:29 PM
Hi ,
I am new to OllyDbg 1.10 ....
I try to de-asm a delphi 6 program , and use RTL.LIB , VCL.LIB as Scan object ,

I found many function name not be identified , like

TApplication.Initialize
TApplication.CreateForm

But the Mechine code I found there are exists in RTL.LIB , VCL.LIB ..

Can anyone can tell me what happen ?

Thanks a lot
MARcoDEN
08-26-2004, 12:38 PM
1) download GoDup 1.2 plugin
2) use IDA signature loader
3) i recommend this special sig-pack (http://wasm.ru/tools/20/D67RTL.zip)
oh me anon
08-27-2004, 06:03 AM
or get dede by da fixer and export a map from its projects and use mapconv plugin in olly

Names in make_res, item 264
Address=004021DC
Section=.text
Type=Export
Name=Unit1::Initialize

Names in make_res, item 26
Address=00401A00
Section=.text
Type=User
Name=<-TForm1@FormCreate
popcron
08-27-2004, 03:51 PM
after a hard hard hard testing , i had found OllyDbg 1.10
only identified up to 64 funcs each OBJ ...
i believe the author has his reason to make this limit...
any way , tks to shareware authors , tks to all !
Lord_Looser
08-28-2004, 06:32 AM
try to use this libs as import libs in ollydbg
menu – debug – select import libraries – add + process
then restart ollydbg
popcron
08-28-2004, 07:25 AM
it's seem to that import libraries function just only convert import function's Ord number to it's name.

By now Dede really help !


Save File Bug

RCE Messageboard's Regroupment > Bugs > Save File Bug
Bob
08-16-2004, 10:48 AM
When you do

Copy to Executable

and the window pops-up, and you go to

Save File

if you save the file, and then change something else, if you try to do it again the file seems to be left open (which is really annoying) and you have to save a different name..


GOOD JOB

RCE Messageboard's Regroupment > OllyScript > GOOD JOB
Ricardo Narvaja
08-16-2004, 01:02 PM
I think we report the bugs of ollyscript and maybe the author think we only report the bugs and nothing more, for this reason, i need say to psycko the plugin is the most great, and is a terrific help for unpacking and working with the new packers and programs, and if i don't have this plugin only manually i come a old man unpacking only a new asprotect 1.31 by example, and with the script the worst part is unpacked in minutes.
Thans for your great work and continue working with this plugin, is the most valuable tool for unpackers today and any user of olly today.

Your work is unvaluable i'm checking always for new versions with new additions.
Ricardo Narvaja
shERis
08-27-2004, 01:15 PM
I would say: there is nothing to add!

There are abilities you never dream of.

Congratulations for your wunderful work, psyCKO!

~hERi~
psyCK0
08-29-2004, 08:57 AM
Hey, thanks guys! I really appreciate you reporting bugs - it shows there is interest in my plugin! I'm really sorry I haven't had time to update the plugin for a while now, but I hope that would change soon - my project at work is soon finished.

Thank you all OSC users!


Instruction addresses in run traces

RCE Messageboard's Regroupment > General > Instruction addresses in run traces
TheTwo
08-16-2004, 02:43 PM
Hello,

I'm trying to write a tool to anylize run traces from ollydbg. Everythings going great so far, and ollydbg gives me plenty of info. Unfortunatly it does too much work for me. I need to know the address (in hex) of every instruction executed. Ollydbg attempts to translate every address executed into a name. For instance: if I had a function named 'func', the first instruction in that function would be recorded as being at address 'func' instead of it's real numeric address.

Is there some way to turn that feature off, or could that option be given in ollydbg?

-TheTwo
tonyxxy
08-16-2004, 04:23 PM
Hi,

You can turn this off. Go to debugging options, diasm, and uncheck everything. That way Olly won't try to assign names to functions.

Hope this helps.

Regards,

tonyxxy
TheTwo
08-16-2004, 04:54 PM
Just tried that and didn't work. Almost everywhere addresses are not translated, but the address of the executed instruction is still translated.

Thanks for trying, but that didn't do it :(

-TheTwo


Finding MessageBox text

RCE Messageboard's Regroupment > General > Finding MessageBox text
imashane
08-16-2004, 04:52 PM
Lets say I have a program that displays in a messagebox: "Hello World!". I want to find where this messagebox is by searching for the string "Hello World!" instead of searching for MessageBox calls. Is there any way I can do this? I've tried searching for All refrenced text strings, however it was not in there. Thank you.

Shane
Ricardo Narvaja
08-16-2004, 05:52 PM
go to view-memory

right click - search and put hello in asc box and serach in all memory.

But the string can be decrypted in runtime and you not found nothing.

Ricardo Narvaja


Learn scripts/plugins now or wait for Ollydbg v2?

RCE Messageboard's Regroupment > General > Learn scripts/plugins now or wait for Ollydbg v2?
1bitshort
08-17-2004, 02:53 AM
Itd be good if Oleh could give us an estimation for when he expects to release a public build of Ollydbg v2 - a few months? a year or more? Is it worth learning the PDK now when Ollydbg v2 might not be compatible with it?


IsDebugPresent

RCE Messageboard's Regroupment > Plugins > IsDebugPresent
JaZoo
08-17-2004, 05:28 PM
I'm looking for OllyDBG Plugin - IsDebugPresent

Can anybody tell me where to download it from?

thanks,

JaZoo
Lord_Looser
08-17-2004, 05:36 PM
http://ollydbg.win32asmcommunity.net/stuph/
http://ollydbg.win32asmcommunity.net/stuph/SV_IsDebug14.zip
JaZoo
08-18-2004, 06:20 AM
All thanks Lord_Looser!!!

Thanks for help and quick reply.

JaZoo


im a newb (i dont even know what my problem is =D)

RCE Messageboard's Regroupment > General > im a newb (i dont even know what my problem is =D)
morrowasted
08-17-2004, 11:34 PM
Okay so I've been playing this game at a website (dont wanna link it so i dont get flamed for advertising), and they have challenges for you to crack their little programs. Now, before you get mad because this is a "help me crack it" post... it REALLY is just a game (and I'll give you the link if you want it). This program by default counts from 100-200, and states that the program will only give you the password if the counter reaches zero. So I downloaded this program by recommendation from a peer and opened the program. I have no idea what all this is, but I managed to find some lines in code (or whatever you wanna call it).

00401573 . 6A 00 PUSH 0 ; /Timerproc = NULL
00401575 . 6A 14 PUSH 14 ; |Timeout = 0. ms
00401577 . 6A 01 PUSH 1 ; |TimerID = 1
0040157E . FF15 F4214000 CALL DWORD PTR DS:[<&USER32.SetTimer>] ; \SetTimer
00401593 . 6A 01 PUSH 1 ; /TimerID = 0
00401599 . FF15 F8214000 CALL DWORD PTR DS:[<&USER32.KillTimer>] ; \KillTimer

On a side note, I edited a couple of lines under the impression that I could control+z to undo what I did, to no avail. Even after deleting and redownloading the program, the lines I changed remain, which baffles me.

Anyway, I'd simply like to know what it is I have to do to change the timer to count down to zero rather than up to 200.

Eh, read the sticky, looks like you guys wont even help on this kind of stuff. Thanks anyway, sorry for disrupting.


File | Open, sometimes the exe actually runs

RCE Messageboard's Regroupment > Bugs > File | Open, sometimes the exe actually runs
1bitshort
08-18-2004, 01:56 AM
Sometimes (but not very often) when I open an exe (File | Open) in OllyDbg, the exe actually executes. Usually I then just go Debug | Restart, and it's usually OK then (breaks before any code executes).

Im just wondering if anybody else has encountered this? It represents a bit of a security problem - I dont want to analyse a malicious piece of software if theres a chance it could execute


Debugging C++ apps bail with access violation

RCE Messageboard's Regroupment > General > Debugging C++ apps bail with access violation
Santa Clawz
08-18-2004, 06:34 AM
When trying to debug several different C++ based apps (not at the same time mind) it analyses the code OK but when I hit F9 to run it the app, bails with

'Access violation - No RTTI data!'

Am I doing something wrong? How do I get round this? I don't get this in other debuggers (e.g. gdb on Linux) I can't seem to pass the exception to the app either with ctrl+F9 etc.

Any help appreciated

Regards

Santa Clawz


Finding the main loop

RCE Messageboard's Regroupment > General > Finding the main loop
caty
08-19-2004, 04:43 PM
how to find the main loop of a program that breaks always and is it possible to increase the size of exe sections ?if yes pls guide me:)

thanks


A way to autodetect the script application??

RCE Messageboard's Regroupment > OllyScript > A way to autodetect the script application??
kittmaster
08-19-2004, 09:52 PM
Is there a way to make the ollyscripts autodetect the proper unpacker from the local side scripts stored and apply then to them to the disassemled executable?

I ask because there are several asprotects, aspr's, armidillo etc. and it seems you have to "guess" which is the correct version unless you launch PE tools to verify the version.

I think it would be a cool adjustment and save a lot of time and would probably help the noobs. I've never coded a plugin for olly so I'd be combatting the SDK curve and then the compression/packer signatures and it would take forever.

Is there someone who could combine them all and have an auto detection?????

Chris
Anonymous
08-28-2004, 07:08 PM
PEiD


soy nuevo con el olyydbg

RCE Messageboard's Regroupment > General > soy nuevo con el olyydbg
elchino
08-20-2004, 12:22 AM
soy nuevo con el ollydbg alguien podria decirme como funciona o donde encuentro el manual.
rRicardo Narvaja Gracias eres sin darte cuenta mi mentor
Ricardo Narvaja
08-20-2004, 01:31 PM
Escribime a mi privado y te doy acceso a mi nuevo FTP que alli esta toda la info sino podes entrar a la pagina de crackslatinos pero alli no esta todo.

http://crackslatinos.hispadominio.net/

seccion MEMBERS

Ricardo Narvaja
elchino
08-20-2004, 03:14 PM
gracias por la data no se como escribirte al privado por otro lado los crackme estuvieron faciles pero el problema es que nesecito crackear un programa que necesita de parche y no como se usan disculpa las molestias
Genocyber
01-05-2005, 06:06 PM
Ricardo Narvaja hola tamb soy nuevo en el foro, y me gustaria tamb alguna ayuda, tamb tengo problemas con el upx, vemos.
TBD
01-05-2005, 06:22 PM
please use English language !
Ricardo Narvaja
01-06-2005, 07:04 AM
mi mail is ricnar456@yahoo.com.ar

ese es mi mail

Ricardo Narvaja


How to compile the Source code?

RCE Messageboard's Regroupment > Plugins > How to compile the Source code?
limee
08-21-2004, 04:45 AM
I downloaded the source code of IsdebuggerPresent,
but I don't know how to compile it.
please tell me,3Q


How to set BreakPoint on IsDebuggerPresent or Writ

RCE Messageboard's Regroupment > General > How to set BreakPoint on IsDebuggerPresent or Writ
winwin
08-21-2004, 07:46 AM
How to set BreakPoint on IsDebuggerPresent or WriteProcessMemory ? in Olly?
winwin
08-21-2004, 07:52 AM
oh i find it :D thx
npcracker
09-20-2004, 05:46 AM
Hi winwin,

i am also seeking for methods to set BP on calls like u mentioned. now can i set on GetWindowTextA?

npcracker
FreaX
10-13-2004, 04:05 PM
How do to that?
I tried the following:
Alt+F1: BPX IsDebuggerPresent

And than?

Thx, FreaX


2 questions about Delphi progs

RCE Messageboard's Regroupment > General > 2 questions about Delphi progs
MARcoDEN
08-22-2004, 06:45 AM
hello everybody!
i have two questions:
1) OllyDbg analyses Delphi applications not so good as VC ones. All the time i see CALL OGSoft_F.00408DC8 instead of usual StrToInt function. Of course, IDA does the trick, but switching between them is really unconvenient for me. I know it's possible to load specific libs. Here is my first question: which libraries namely do i need in order to get normal names of functions?
2) The second question: can i rename unrecognized calls? e.g. "CALL Prog_F.00403AEF" rename to "CALL DecodeFile".
oh me anon
08-23-2004, 12:36 PM
hello marco,

have you tried using the mapconvertor plugin
it can be used to rename the functions ida style
open the proggie in ida and create a .map then use the plugin

for your 2nd question are you going to label them manually if yes then you can do it by all means

when you are on call blah press enter to follow
when you are on the first command of call press : (colon)
it will pop up a dialog (enter name of label blah) type what ever yu want like ("this call is just garbage") and press ok

you will see olly changing the call blah to call this call is garbage at all instances of the call

you can also try labeller plugin or labelmaster plugin though i had some problems when i tried them
MARcoDEN
08-24-2004, 06:27 AM
oh me anon, thank you for such detailed instructions! i appreciate it. but where can i download the mapconvertor plugin? i've searched in google, yandex and other search systems but without result.

and please tell me, this plugin is for IDA or Olly?
oh me anon
08-24-2004, 08:25 AM
well marco ,

if you want to program and debug programs then you will need to be more attentive to some things that are called earmarks
it seems you haven't even searched this very site so google and yandex are very far away from the context try clicking the stuphlink in the top of this page

there is whole subforum called plugins here in this forum if you had skimmed through it you would have got hold of the plugin and many info

also if you going to use a forum make it a habit of reading these first even before your first post :

1) the rules page (may be just know and understand how to break them is a good motive to read them but make sure you read them)

2)the announcements page
this almost always contain things that you find to be very usefull in the long run BELEIEVE ME had you read the announcements forum you would have noticed the address of plugin updates thread

3)skimmming through the posts that were made before you think of posting something there is a sure shot possibility (odds are greater than 100) that it may have been asked already and answered precisely and concisely

4)and make sure you utilise the search function of any forum
("with key words like how to spell s@#$") and you will see you can find thousands of ways to spell s@#$

5)and then make it a point to experiment and find out yourself answers for questions like is this plugin for ida or olly
if it were for olly then you found a new toy it if were for ida then you found a new tweak and you profit in both ways

6)these are no criticisms these are my firm opinions on the subject
and there is no offence meant in the process
hope you read through and see what iam trying to make you see

regards


how to hide the OD in win98

RCE Messageboard's Regroupment > Plugins > how to hide the OD in win98
limee
08-22-2004, 07:15 AM
the plugin isDebuggerpresent take no effect!
who can tell me the way? thx
Ricardo Narvaja
08-22-2004, 07:33 AM
Use OLLYGHOST or better change to XP, ollydbg in XP is more powerful

Ricardo Narvaja


What does TRACE do?

RCE Messageboard's Regroupment > General > What does TRACE do?
trope
08-22-2004, 11:46 AM
Could someone give me a high level explanation of what tracing does in Olly?

Thanks. I am very new at this, and appreciate any help offered.

Trope
1bitshort
08-22-2004, 01:22 PM
Have you looked in the help file?
trope
08-22-2004, 02:42 PM
Yes, I looked. I found this:

"Run trace is the way to backtrace program execution that precedes some event. You can also use run trace for simple profiling. Basically, OllyDbg executes debugged program step-by-step, like in animation, but it doesn't redraw windows and - most important - logs addresses, contents of registers, messages and known operands to the run trace buffer. "

Am I correct in assuming that I can step backwards through my program by tracing -possibly checking register values, or a particular value in memory?


where is the zero flag?

RCE Messageboard's Regroupment > General > where is the zero flag?
Todesengel
08-24-2004, 12:13 AM
i use olly v .10

and i cant find the zero flag. it supposedly makes it so you dont have to take a jump.

supposedly its a big z in the top right side of the program. but i cant find it.

any help would be great.
MARcoDEN
08-24-2004, 06:34 AM
look at the picture: http://md-soft.webhost.ru/zero_flag.jpg
Todesengel
08-24-2004, 11:32 AM
they must be down right now...

ill check back later

ive got more college orientation to do >_<
Neitsa
08-24-2004, 08:57 PM
Hello,

just check under the registers, on the left of the registers window, you 'll find those letters:

C 0 ; carry flag
P 0 ; parity flag
A 0 ; auxiliary flag
Z 0 ; zero flag
S 0 ; sign flag
T 0 ; trap flag
D 0 ; direction flag
O 0 ; overflow flag
Todesengel
08-25-2004, 12:41 AM
im sorry you have me totally lost..i dont see registers either

<img src="http://gamefaqsinfo.net/boards/upload/99516122olly.JPG">

that is what i see..when i open up olly
1bitshort
08-25-2004, 03:13 AM
Todesengel, I can see the Zero flag in your screenshot, so why cant you? :)

In your screenshot, look at the far right hand side and you'll see the registers - EAX, ECX, EDX, EBX, ESP, etc etc - some of them in red, as theyve just been modified. Now keep looking down, you'll see ESI, EDI, EIP ... THEN you'll see C, P, A, Z, etc etc ... the Z is the zero flag.
Todesengel
08-25-2004, 06:25 PM
ahahahahahahahahaha

i didnt look under the actual title and menu bars

damn im a dumbass

thanks..for..all..the help?


Mew 11 SE v1.1 script

RCE Messageboard's Regroupment > OllyScript > Mew 11 SE v1.1 script
hacnho
08-24-2004, 10:18 AM
;----------------------
/*
//////////////////////////////////////////////////////////////
// MEW 11 SE v1.1 -> Northfox [HCC] OEP finder
// Author: hacnho/VCT2k4
// Email : hacnho@hotmail.com
// Website: http://nhandan.info/hacnho
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript v0.85
////////////////////////////////////////////////////////////
*/

sti
sto
sto
sto
sto
sto
eob Break
findop eip, #50AD#
bphws esp,"r"
run

Break:
an eip
log eip
cmt eip, "This is the OEP! Found by hacnho/VCT2k4"
MSG "Dumped and fix IAT now! Thanx for using my Script...!"

ret
;--------------------------

PS: sign for this packer

;-----------------------------------------

[MEW 11 SE v1.1 -> Northfox [HCC]]
signature = E9 ?? ?? ?? FF 0C ?0
ep_only = true

;------------------------------------------


Breakpoint when user type and others

RCE Messageboard's Regroupment > General > Breakpoint when user type and others
muttley
08-24-2004, 04:42 PM
Hi

I want to find aserial number, but the application only enable the button only when the user typed the correct serial number

I would like to know , is there a breakpoint for when the user type ?

How Can I to know , if the button is enabled or disabled with Ollydbg?

Where Can I to find some tutorial for Ollydbf ?
Ricardo Narvaja
08-24-2004, 08:17 PM
type 9898 and serach the memory for 9898 next add other number for example 7 and look if the 7 is added next 9898 and if you look 98987 this is the adress where stores the fake serial, you can put a BPM ON ACCESS in this bytes and continue running when stop you are in teh zone than the program start working with the fake serial (i suppose) i f i don't look a program is hard to see.
There are apis too for enter a byte right click and search for names in this module and look the apis with GET....

for example GetDlgItemInt try putting BPs in the apis you found in the list than begin with GET.

Try using POINT H, try putting BMSG (BREAKPOINT ON MESSAGES), you have very alternatives.

Ricardo Narvaja
muttley
08-25-2004, 08:19 AM
Hi Ricardo

But I do not understand, because I type the numbers 14327 and in the ollydbg I put Ctrl+B and search 14327 but do not find
Ricardo Narvaja
08-25-2004, 09:37 AM
you go to VIEW-MEMORY and serach in all memory?

Well there are other options the most important is use BMSG, i wrote a tut with an idea i read in this forum named messagespy in OLLYDBG, for help using BMSG, is in spanish.

Ricardo Narvaja
TBD
08-25-2004, 11:53 AM
this thread is walking on thin ice.

please keep the discussion on Olly specific and not how to get serials. if not, the thread will be closed.
oh me anon
08-26-2004, 10:03 AM
why not try using olldbg first exploring its every buttons etc before trying to find out about hidden or grayed buttons in the debuggee

there is a menu called windows in ollydbg
it will show all the windows in a specific program that is loaded
when you right click on it you can set break points for winproc
or break point for any message

like wm_char,wm-command,or whatever

you can log the arguments
to look at them

olly has got a wealth of options for a good user try to understand olly before trying to understand programs

hint in the above case the edit box is probably superclassed or subclassed so it hooks wm_char and relies on it go find how to set a bpt on wm_char
or if you dont understand what subclassing is go read iczelions tutorial on subclassing
you will automatically come to know how to break anywhere whereever you wish to break
regards


Search for name in current module crash

RCE Messageboard's Regroupment > Bugs > Search for name in current module crash
casterle
08-26-2004, 01:54 AM
I'm using OllyDbg to debug a fairly large BCB6 program.

I've used Plugins/GODUP Plugin/Map Loader/Load Labels to load my .map file.

When I try to look at my symbols using Search for/Name in current module I get an exception, 0xC0000005 at 0x202c2926. I've got nearly 70,000 symbols loaded, so I expect that my large symbol list is the problem.

I'd appreciate suggestions for work-arounds, or at least a hint as to how to unload my symbols so I can edit my .map file and try again. I'd rather not kill my .udd file for this project if possible.

Thanks - and thanks to Oleh for an impressive program.
casterle
08-28-2004, 07:17 PM
As a follow-up, it seems that this is not related to the number of symbols loaded. I think it must be a bug in GODUP.

While OllyDbg crashes while displaying symbols after using Load Labels, Load Comments works find.


BEST Olly Options for SCript Use

RCE Messageboard's Regroupment > General > BEST Olly Options for SCript Use
ILCH
08-26-2004, 09:44 AM
Can someone help me with Olly script...
tell me the best Options for Using Ollyscript...
All Exceptions etc...

Thanks
ILCH
MARcoDEN
08-26-2004, 09:56 AM
It's impossible to have unified options for all cases using OllyScript. fairly often authors define the conditions (usually apply to exceptions) in their scripts. so you can open a script file with any text editor and read instructions in it.


Problems with unpacking and dumping upx

RCE Messageboard's Regroupment > OllyScript > Problems with unpacking and dumping upx
Anonymous
08-26-2004, 12:31 PM
hi! i have 2 problems with unpacking upx-compressed apps.

the 1st problem concerns programs compiled with C++Builder. the test .exe i used was builded with C++Builder 6.0 and packed using UPX 1.25 with '--best' option. after that i loaded the app into Olly, stopped at OEP and dumped it with 'Rebuild import - Method 1' option. at last, i got 'dumped.exe' with empty import table! really strange! i've only succeeded in getting a working dump using LordPE and ImpREC. but i want to note that this problem disappears when applications are coded in VC or ASM.

the 2nd problem concerns programs compiled with Delphi 5.0. and again, UPX :). i made the same actions as i mentioned before. this time i failed to get a working dump since it terminates after launch. even LordPE and ImpREC didn't help me.

to make the situation clear, i made the video which shows my actions.
click here to download .RAR archive (http://md-soft.webhost.ru/video_unp.rar) (size: 2.68mb)
i'd appreciate if somebody downloads it and tells me what is the matter?
Ricardo Narvaja
08-26-2004, 01:25 PM
this link don't work

Ricardo Narvaja
MARcoDEN
08-26-2004, 04:12 PM
hi Ricardo!

the link isn't broken. i've checked it. maybe server was temporarily unavailable...

P.S. Ricardo, can you tell me your e-mail? i'll send you the file personally.
P.P.S. i posted this topic as Anonymous accidentally :)
Ricardo Narvaja
08-26-2004, 08:23 PM
ricnar22@yahoo.com.ar
Ricardo Narvaja
08-26-2004, 08:24 PM
upps sorry

ricnar456@yahoo.com.ar

soory

Ricardo Narvaja
Bob
10-21-2004, 06:49 PM
hehe, cool I never seen somone make a video for a question before.. kinda like seeing cracking in a hollywood movie :)

I think the import problem is the way that borland do imports..
It's backwards to the normal way and has to be checked.

Did you try unpacking the upx file from PEiD using generic unpacker or the UnUpx plugins ?

~Neil/BobSoft~
yahia
10-22-2004, 10:48 AM
@MARcoDEN
I unpacked many UPX packed files, so here r some useful tools :
1-UP X Generic Unpacker .It's only for unpacking UPX apps .
2-File Scanner .Generic Unpacker for many Protectors/Packers .I prefer it .

Regards .
Anonymous
10-23-2004, 09:34 AM
hehe 2.7 mb of video
i downloaded it thinking ill look into the upxxed exe and look into whats the problem with dumping it but all i get is a cool movie that runs a little bit too fast :)
1bitshort
10-23-2004, 11:11 AM
What program did you use to make that video? Like the previous poster said it runs a bit too fast to be able to make out what's happening so it's not as helpful as it could be. Also, most of the displayed text is in Russian which will make it harder for most people here to understand.

But we're only talking about UPX here, it doesn't even have any anti-debug code, so come on boys! :)

1) Does upx -d not work?

2) Can't you just breakpoint on the "popad/jmp" and dump and rebuild?

3) If it's protect by a "UPX patch" type of program, most are very simple. One simply adds a NOP in front of the code and decrements the Entrypoint by 1 to point to the NOP. Another simply adds a jump which then does other stuff before jumping back to the normal UPX code. Either way they're easy to dump also.

Sorry I know i'm not being very useful, I've just never encountered a UPX-packed program before that has been hard to unpack so I don't quite understand your problem, that's all!
yahia
10-23-2004, 12:05 PM
@1bitshort
You'r right, UPX has no anti staff, we shouldn't even call it PROTECTOR !! but as some one who unpacked too many UPX packed files, I would tell U that some programs use the UPX project to create their own packers, so some proggys like Packers/Protectors detectors would tell U that such files are packed by UPX & when using (upx -d Packed.exe) this command would fail .
I prefer using FileScanner (fs.exe) .It does all that damed hard work for U, cuz I don't think any one of us would spend time unpacking UPX Packed file using OllyDbg .

@MARcoDEN
Use FileScanner (fs.exe) and leave the work to it .
I use :
fs -u Packed.exe
fs -spl -rn Packed.exe
fs -c Packed.exe
Anonymous
10-24-2004, 04:06 AM
well unpacking a upx packed executable which used the latest beta version (1.92 iirc)with the stable 1.25 release version will also fail if you use upx -d but it will unpack without problems if you use the exact beta version to unpack it :) (ah yes the beta has some image base relocation craps that i dont understand but yes i can unpack it without problems using ollydump)
and as far as i know no upx packed with whatever crap patching
ever failed me with ollydump yes if a vb exe is packed with upx there will be a glitch in finding the first thunk and image wont run at first try but loading it into a pe editor and editing the first thunk value (normally 3d8 to 1000) will make it work like a charm
dunno why upx should ever pose problem
btw i think you can get the source of upx its gnu public iirc
so there should be no problem whatso ever :)
and its same me the anonymous that posted above :)
1bitshort
10-24-2004, 04:55 PM
Got a URL for Filescanner (fs.exe) ?
yahia
10-26-2004, 12:13 PM
@1bitshort
How did U find it ?
NOTE : U need to get the latest version to unpack many Protectors/Packers .If U don't have it, then send me e-mail to give U the link .
If I could post the link here, so TBD please say that .
TBD
10-26-2004, 01:08 PM
.... you can post a link ;)
1bitshort
10-26-2004, 04:50 PM
@1bitshort
How did U find it ?
I dont have it, that's why I'm asking for a link :D
Sounds like an interesting program
Bob
10-27-2004, 07:03 AM
Really, all it takes for unpacking Upx program..

Load into OllyDbg
Scroll to end of code (untill you see zeroes)
move back until you see popad (or pushad if it's upx protector-ed)
bp on jmp
F9 (now you're at bp)
F7 (now you're on OEP)

I dunno about wasting time, but it takes me like 30 seconds to get to the program when upx'ed.

~Neil/BobSoft~
yahia
10-27-2004, 12:16 PM
@1bitshort
When U said (got a url) I thought U got one, but it seems that I can't post a link here .If U want the link from me, so mail me .

@Bob
The (Wasting Time) happens when doing same jop for a lot of time .
Bob
10-27-2004, 03:05 PM
Fc is a dodgy Dos program, use PEiD it's far better and has UnUpx plugin and a generic unpacker plugin .. The generic unpacker will unpack Upx, scrambled or not.

Google for PEiD plugins, theres a few :)
1bitshort
10-28-2004, 01:05 AM
Yahia,
TBD already said you can post a link to it. Everyone is still waiting!

Bob,
I dont think Filescanner and Fc are the same program ...
yahia
10-28-2004, 11:52 AM
@1bitshort
It seems like I need eye glasses ! I'm very sorry but I was in a hurry so I didn't read carefully .I recieved the last version from my friend, so I did put the packaged files in my site .I'll leave it for a week so many members would be able to download it .Here is a direct link : http://www.yahia-rod.net/fs.zip .
Hope I did something useful to U .

@Bob
FS is a DOS program but it's generic unpacker and will do what ProcDump can't with some programs packed with many packers .
Anonymous
11-14-2004, 01:14 AM
Thanks for the nice app guy.
codeX
11-14-2004, 01:17 AM
Ok thanks again from me also.

It performs well.
hosiminh
11-14-2004, 11:55 AM
Manually unpacking UPX
OS: Win Xp

Load target into Ollydbg

type this into CommandBar: bc GetProcAddress . Press F9 .

Now press "ALT+F9" (Return till user code) and you are 3 step before OEP.


My flexlm script

RCE Messageboard's Regroupment > OllyScript > My flexlm script
Haldir
08-26-2004, 03:17 PM
Flexlm script...
--------------------------------------------------------
// Second Version of Haldir's Flexlm Seedfinder Script for Ollydbg
// Supported should be every Flexlm version >=7.2
// Remove all BP in the code before running this script
// Codebase is usually 00401000 for .exe or 10001000 for .dll
// In more recent Flexlm versions you need a faked license (like Feature f1 <vendorname> 1.000 permanent uncounted HOSTID=ANY SIGN=12345678)
// otherwise it might not work

var jobstruct
var codebase

// start
msgyn "Did you remove all BPs?"
cmp $RESULT,1
je setup
ret

setup:
ask "Enter Codebase of the Flexlm Module"
cmp $RESULT, 0
je cancel
mov codebase, $RESULT
jmp findlsg

cancel:
msg "Please enter Codebase"
ret

// It searches for a cmp with 0x87654321, which is located below a call to l_sg
// Then we calculate the offset for the call and execute to it
findlsg:

var pos
var callpos
find codebase, #81BD????????21436587#
mov pos, $RESULT
cmp pos, 0
je error
mov callpos, pos
sub callpos, 07
sub pos, 03
add pos,[callpos]
eval "l_sg is at: 0x{pos}"
msg $RESULT
go pos
jmp lsg

error:
msg "An unknown error occured"

// The call to l_n36_buff is a call dword ptr, so we calc its offset again and execute to it
lsg:

var pos
var n36pos
mov pos, eip
find pos, #FF15????????#
mov pos, $RESULT
add pos,2
mov n36pos, [pos]
mov pos, [n36pos]
eval "l_n36_buff is at: 0x{pos}"
msg $RESULT
go pos
jmp n36buff

// We patch the Jobstruct at the EB05 jmp shortly above the vendor name loop
n36buff:

var pos
mov pos, eip
find pos, #EB05#
mov pos, $RESULT
go pos
jmp findjobstruct

// We check the registers to find the job struct (we check only edx and ecx (haven't seen anything else yet))
findjobstruct:

var check
mov check, [edx]
cmp check, 66
mov jobstruct, edx
je found
mov check, [ecx]
cmp check, 66
mov jobstruct, ecx
je found
jmp error

// Now we delete the rand() values in the job struct and execute to the end and fish the seeds from there
found:

add jobstruct, 04
fill jobstruct,10,00
rtr
var seed1
var seed2
var struct
var tempstruct
mov struct, ebp
add struct, 10
mov tempstruct, [struct]
add tempstruct,4
mov seed1, [tempstruct]
add tempstruct,4
mov seed2, [tempstruct]
eval "Your seeds are Seed1: 0x{seed1} and Seed2: 0x{seed2}"
msg $RESULT
ret
psyCK0
08-29-2004, 08:52 AM
Thanks, Haldir. Sorry I didn't have time to put it on site, too much work... I will make a web-based interface for script submission next week. =)


To psyCKO: Need help!

RCE Messageboard's Regroupment > OllyScript > To psyCKO: Need help!
shERis
08-26-2004, 04:21 PM
Hi psyCKO!

I have a great problem and I assume, Ricardo Narvaja could help me! The problem is to great to discuss in this forum. I would be very glad if you can email me the email adress of Ricardo. I assume, you have this adress. Ricardos ftp´s are down too.

I stay in hope

~hERi~
Ricardo Narvaja
08-26-2004, 08:26 PM
mi ftp is not down

http://www.ricnar456.dyndns.org/

ftp://www.ricnar456.dyndns.org/

user:crackslatinos
pass:fiaca22

mail:ricnar456@yahoo.com.ar

Ricardo Narvaja
shERis
08-27-2004, 01:10 PM
Hi Ricardo!

Thanx for your reply!
I had an old address.

I will mail you soon.

Bye

~hERi~
Lager
09-20-2004, 10:10 PM
Que onda Ricardo, te envie un correo a tu cuenta de yahoo, espero te llegue. Me gustaria seguir aprendiendo de tus cursos y tutoriales, y una ayuda en un archivo que no puedo desempacar :(.
Saludos!


reading register contents

RCE Messageboard's Regroupment > General > reading register contents
Blox
08-27-2004, 08:05 AM
Hi

I need to read the contents of registers at various points in a program execution. After RTFM, it appears the easiest way is to set breakpoints. Unfortunately, doing this locks up the machine completely, forcing a re-boot and consequently the loss of all debug information. Yes its a video game I'm working with, but no, I'm not trying crack it, merely trying to alter the gameplay.

Is the another way to display register contents other than setting breakpoints on execution?

Any help would be much appreciated.
1bitshort
08-27-2004, 08:37 AM
Your question is confusing. You can see the contents of registers at any point in the program as long as the program is paused (Ollydbg has control). To do that, yes you can set breakpoints, or you can press F12 to pause execution. I dont see how setting a breakpoint could lock up your machine, can you elaborate on that please?

Sorry I cant provide more help, but I dont really understand what youre trying to accomplish.
Blox
08-27-2004, 08:54 AM
Sorry if I'm being confusing.

Ok, I load and run the program, then pause it. But when I click on any lines in the disassembly, the contents of the registers in the right-hand window don't change, ever. I can click away merrily on any line of the disassembly and the register values don't so much as blink. Could it be something needs changed in the 'Options' menu?

Edit: It's mostly the ECX register I'm interested in. I assume it would change at some point in a 3MB plus program.

On the second point, if the game breaks on a really crucial point of the game engine it locks-up the whole machine. This happens if you are using any memory editor, not just Ollydbg. Maybe it's because video games are bypassing large parts of the operating system and talking more or less directly to the hardware (thru DirectX).

Sorry if i seem such a newb but i have to start somewhere.
1bitshort
08-27-2004, 09:56 AM
But when I click on any lines in the disassembly, the contents of the registers in the right-hand window don't change, ever.
Clicking on a line of code doesnt do anything as such. All it's useful for is selecting a line of code to set a breakpoint on, or selecting multiple lines of code to copy to the clipboard, etc. Registers only change when the debugee (the program being debugged) changes them, which usually occurs after each instruction has been executed. To do that you have to step into each instruction.

Sorry if i seem such a newb but i have to start somewhere.
Yes you do have to start somewhere, but start at the beginning. If you dont understand debuggers enough to figure out why the registers arent changing then youve got no chance of modifying a game like you said you wanted to. Sorry, but you've got to do some homework first, there's no way around that. Start with Iczelion's tutorials and go from there...

PS. Im not sure why you're so interested in the ECX register - any register can be used to store data, so you should be equally interested in EAX, EBX, EDX, EBP, ESP, ESI, and EDI as well - the other 32-bit registers.
Blox
08-27-2004, 10:16 AM
Thanks for your patience, much appreciated.

To explain, I have a whole bunch of addresses which I know alter stuff in the game. I've garnered these addresses mostly through Brute Force Attack, using a memory editor. Now I'd like to follow them through in a debugger/disassembler.

ECX is of interest at the moment purely because I'm currently looking at a whole series of lines containing things like [ECX + 90], [ECX + 1c], etc, and I'd like to know what the value of ECX is in each case (or at least know the starting value of ECX). I believe that ECX is mostly used as a counter.

I'm trying to learn some assembler, downloading a few tutorials ( including stuff by Iczelion) and am searching for a book on protected mode assembly. But in the meantime will continue poking various values and observing any effects they have on the game.

Thanks once again.
focht
09-14-2004, 06:36 PM
Hi,

if you are interesting in game hacking i suggest to register one of these forums:

http://www.mpcforum.com/

and

http://www.unknowncheats.com/forum/

There are plenty threads how start making hacks, tutorials and tools of trade.

Regards
oh me anon
09-15-2004, 10:12 AM
well if it is a fullscreen app it seems to freeze because the control is not transferred back to ollydbg
(that is olly window is not on top) because of DDSETBLAH
if you use ctrl+alt+del or ctrl+shift +esc and bring taskmgr up and force olly to bring to front you will see that olly has broken on your break point (the display will be very odd but you can single step ;)

but the point of this post is not that many times you can log all the contents of any register you wish without pausing the program
using log break points and use the games break option to minimize it and look at log to know its values (alt+enter),pause game whatever

if you set log break point you can find what function is called when [eax+50] is called

0040145D . FF35 19304000 PUSH DWORD PTR DS:[hWnd]
00401463 . A1 E9304000 MOV EAX,DWORD PTR DS:[lpDD]
00401468 . 50 PUSH EAX
00401469 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0040146B . FF50 50 CALL DWORD PTR DS:[EAX+50] ; <DDRAW.DDSETCOOPERATIVELEVEL>
focht
09-15-2004, 06:17 PM
How about windowed mode ;)
Most dx games support it...


OllyDbg doesn't find source code for a BCB6 p

RCE Messageboard's Regroupment > Bugs > OllyDbg doesn't find source code for a BCB6 p
casterle
08-28-2004, 07:24 PM
While debugging a BCB6 program, I wanted to look at my source code in context. View/Source Files shows a list containing all of my modules but the Source and Source Path columns are empty (the Source path displays (Absent)).

Scanning all of the object files in my project, then running Analyze does not solve the problem.
oh me anon
08-29-2004, 07:54 AM
you need to compile and link with debug info and put the .pdb files in the folder
find your linker and compile switches accordingly for masm i give the post below

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=40 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=40)
casterle
08-29-2004, 04:16 PM
Thanks for the quick answer, but no luck. In the thread you reference, someone said that they were having success with both Delphi and BCB, but given the age of the thread that must have been with a previous version of Ollydbg.

I'm already building with full debug information, and the .tds file (what Borland produces instead of .pdb) and .map files are located in my project directory. The Borland debugger is finding the source code without problems.

Perhaps version 1.10 doesn't work with Borland debug info?
oh me anon
08-31-2004, 08:36 AM
sorry i dont use bcb but with masm i can fairly well use view source
in all the versions of ollydbg

so i googled a little for some info on subject matter

and here is a link from borland
http://cc.borland.com/codecentral/ccweb.exe/listing?id=15344
it tlaks about some blah to dbg try palying with it

hope it helps you a little
casterle
09-01-2004, 08:23 PM
Thanks for looking into this for me.

I've already got the program you found at Borland Code Central, but unfortunately it produces an older version of the dbg file which is not compaible with current debuggers. Such is life!

I've run into another problem with OllyDbg that is much more serious and precludes me from using it on my current project - I'll start another thread on it after I find time to document the issue.
casterle
09-08-2004, 04:00 PM
Follow up: The problem I was refering to above is not in OllyDbg. I am seeing the same behavior in WinDbg and the Borland debugger.


Scripts to: JDPack, wwpack32, NeoLite v2.0, PePack

RCE Messageboard's Regroupment > OllyScript > Scripts to: JDPack, wwpack32, NeoLite v2.0, PePack
DeAtH HaS cOMe
08-29-2004, 08:30 PM
Well, i send here some scripts that i've programmed, i think they work perfectly, but if you find any bugs please report me. I test it with OllyScript v0.92, and i haven't found any problem :). Thanks friends!Ciao!

/*
OEP Seeker Script [ JDPack v1.01 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.91
Date : 07.18.2004
Config: No BreakPoint sets
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

#log
eob Rompe
findop eip, #E2EB#
inc $RESULT
inc $RESULT
bphws $RESULT, "x"
run

Rompe:
bphwc $RESULT

eob Rompe2
findop eip, #8944241C#
add $RESULT, 6
bp $RESULT
run

Rompe2:
bc $RESULT
sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret

The other:

/*
OEP Seeker Script [ WWPack32 v1.20 Demo ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.91
Date : 07.17.2004
Config: No BreakPoints sets
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

eob Rompe
findop eip, #2E038595#
bphws $RESULT, "x"
run

Rompe:
bphwc $RESULT
sto
sto
sto
sto
sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret

More:

/*
OEP Seeker Script [ PePack v1.0 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.91
Date : 07.18.2004
Config: No BreakPoints sets
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

sto
sto
eob Rompe
findop eip, #8944241C#
bphws $RESULT, "x"
run

Rompe:
bphwc $RESULT
sto
sto
sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret

And the last:

/*
OEP Seeker Script [ NeoLite v2.0 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.91
Date : 07.19.2004
Config: No BreakPoints sets
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

eob Rompe
findop eip, #FFE0#
bphws $RESULT, "x"
run

Rompe:
bphwc $RESULT
sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret
Ricardo Narvaja
08-30-2004, 08:41 AM
jeje crackslatinos is the most jeje.

Saludos DeAtH HaS cOMe

Ricardo Narvaja
DeAtH HaS cOMe
08-30-2004, 08:20 PM
Hi Ricar, I find you everywhere jeje.
CracksLatinos is power! :P
Nos vemos por la lista amigo ;)
Ciao!


How to emulate single step execution?

RCE Messageboard's Regroupment > Plugins > How to emulate single step execution?
luocong
08-31-2004, 01:42 AM
I want to write a plugin that must execute instructions step by step, so i use this method:

for (i = 0; i < 10; ++i)
Sendshortcut(PM_MAIN, 0, WM_KEYDOWN, 0, 0, VK_F8);

but it doesn't work, it can only execute one time(the left 9 times are ignored), why this happened? Can anybody give me some suggestions?

Thanks!
psyCK0
09-02-2004, 01:57 PM
Because while the first shortcut is executed asyncronously, the rest (9) are run. You have to queue your requests.


How to set breakpoints on memory read/write?

RCE Messageboard's Regroupment > The Heap > How to set breakpoints on memory read/write?
flipdascript
08-31-2004, 06:37 AM
Hiyas!

I'm playing with the windows debug api and am wondering how one sets breakpoints on memory read/ memory write.
I know how to set code breakpoints (int 3, single step, etc) but I have no idea how to set memory breakpoints.

In an other forum someone suggested to use VirtualProtect wit NO_ACCESS and catch these exceptions.
Is that the way to go?

Thanks in advance
1bitshort
09-03-2004, 07:03 AM
Just right-click on any dump window (such as the memory dump window, or the main CPU/code window) and a menu will pop up that has a Breakpoint 'submenu'. In this submenu you'll see "Memory, on access" and "Memory, on write" as two options, amongst others.

In an other forum someone suggested to use VirtualProtect wit NO_ACCESS and catch these exceptions.
Is that the way to go?
That's a different avenue of attack. It does work and can be useful in some cases, but there are usually better ways. If you do want to do that, right-click on a section of memory in the Memory window and you'll see a "Set Access" submenu, which has "No Access" (amongst others)
oh me anon
09-04-2004, 06:17 AM
well playing with debug apis is a different subject the debugger would handle all messages and would be useless in case of debug apis i think

flipdascript setting page access can be done with view memory
access but it didnt give me proper results when i tried
focht
09-14-2004, 07:10 PM
Hi,

well playing with debug apis is a different subject the debugger would handle all messages and would be useless in case of debug apis i think

not necessarily.
I used the two methods of memory breakpoints in some client code, which gets injected into enemy process space.
Basically it detects when certain process memory locations are read/written.

1. Method: hardware breakpoints (limited to 4 at a time)
2. Method: VirtualProtect() with PAGE_GUARD (one shot, can "protect" all of process' committed memory)

Method 1 produces exception code "STATUS_SINGLE_STEP"
Method 2 produces exception code "STATUS_GUARD_PAGE_VIOLATION"

The address for these is in pExceptionInfo->ExceptionRecord->ExceptionInformation[1];

Now you might wonder how to hook the existing SEH chain without much hassle and even catch these exceptions _before_ attached debuggers?

AddVectoredExceptionHandler() is the magic.

Be aware - it only works from XP/W2k3 upwards.

Go, play with it. Its fun ;)

Regards


Format String vulnerability patch ?

RCE Messageboard's Regroupment > General > Format String vulnerability patch ?
gmm
09-02-2004, 03:57 PM
Sorry if this has been covered previously, but is there a patch
either available or forthcoming for the Format String bug
in OllyDbg published by SecurityTeam last month?
<http://www.securiteam.com/windowsntfocus/5ZP0N00DFE.html>

Thanks.

-gm
1bitshort
09-03-2004, 12:12 AM
I'm not aware of any patches (yet). A patch should work, but the only problem is that malware can easily undo the patch if it knows about it. The only proper solution is for Oleh to add a string handler before parsing anything to OutputDebugString, but I guess we'll have to wait for Ollydbg v2 for that.

I don't see it as a huge threat though ... press F9 to run the program and code will execute - you don't need to feed junk through OutputDebugString to accomplish that.
gmm
09-03-2004, 02:41 PM
> press F9 to run the program and code will execute - you don't need to feed
> junk through OutputDebugString to accomplish that.

Good point. Tx.

-gm


Program will not load into OllyDbg

RCE Messageboard's Regroupment > General > Program will not load into OllyDbg
Mz_66
09-03-2004, 12:13 AM
when I open an exe file I get a message that stats (setup.exe is probably not a 32-bit portable executable try to load it) if you press yes the exe file takes over and nothing is loaded into ollydbg.

My question is:

Is there a way that OllyDbg can Debugg this type of file??
1bitshort
09-03-2004, 06:59 AM
Ollydbg is for 32-bit executables. You're probably trying to debug a 16-bit executable. Try something else like Win32dasm or IDA
Mz_66
09-13-2004, 12:17 AM
Thanks for your reply "1bitshort"
the programe is a 16-bit
and i tried to load it into win32dasm no good
win32dasm opens the file but will not load the programe


tracing in stack

RCE Messageboard's Regroupment > General > tracing in stack
asteroid
09-03-2004, 01:39 PM
hi
can any body explain me how i can keep eye on stack , i mean did we have a stack simulator which may simulate the changes in the stack . Also one thing can i keep watch two memmory dumps at the same time , like if i want to c the transfer of bytes from loc pointed by ESI to loc pointed by EDI using MOVSB etc instructions.
oh me anon
09-04-2004, 06:08 AM
well you need eye for that if you had a pair or atleast a single one you would have seen the stack in bottom right and would have watched all the push and pops
also you would have noticed a big k in the toolbar and clicked it
and would have found how many calls are in stack
and also you would have right clciked and folllowed in dump
both edi and esi then used + or - (plus or minus)to see them

instead of posting six threads in two different forums asking same lame questions again and again which no one in his right mind replies now spend some time experimenting with ollydbg
find a easy program and single step through it and watch every changes and investigate why they change you will learn a lot by that way rather a lot


Armadillo Question

RCE Messageboard's Regroupment > OllyScript > Armadillo Question
dante999
09-04-2004, 04:10 AM
I'm begginer

i have .exe file
this is packed "Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks"

so download script and run

ing..... ollydbg stop

next ...

what do i do ?

dump?
how to use dump debugged process about input value?

and

Import Reconstructor use ?

then how to use Import Reconstructor about input value?

please help me~
1bitshort
09-04-2004, 04:32 AM
"I'm begginer"

Then start from the beginning (Lamecrypt, then UPX) and work your way up to the more advanced packers. If you cannot unpack Lamecrypt, UPX, FSG, ASPack etc then you will have absolutely no chance unpacking a commercial packer with strong protection techniques such as Armadillo, so save yourself the time now. Apologies if I sound too negative.
psyCK0
09-06-2004, 06:31 AM
dante999
This type of posts does NOT belong here! This is NOT what i call scripting-related unpacking topic!


how can I unpack Armadillo

RCE Messageboard's Regroupment > General > how can I unpack Armadillo
MS4cah
09-05-2004, 06:36 AM
Q1:How can I unpack Armadillo 1.xx - 2.xx-3.xx -> Silicon Realms Toolworks ?

-----------------------------------------------------------
Q2:How can I Unpack SVKP 1.X

Plz help me

very important
psyCK0
09-05-2004, 08:28 AM
A1: (INSERT SOME OBSCENITIES HERE). You can try asking somewhere else. Not here. This is NOT an unpacking forum. (INSERT SOME INSULTS HERE).

A2: See A1


how hide ollydbg under win98

RCE Messageboard's Regroupment > General > how hide ollydbg under win98
linhanshi
09-05-2004, 06:54 AM
hi

how can I hide my ollydbg1.1 under win98?
can someone help me

thanks
__________________
http://linhanshi.blogone.net
1bitshort
09-05-2004, 12:23 PM
How do i hide a program
That depends on the extent you wish to hide it. Just packing the .exe and renaming it from ollydbg.exe to something else might be enough. Also try renaming the window captions from "OllyDbg" to something else. There are dozens upon dozens of ways to detect a program though... for instance, ReadProcessMemory.
Ricardo Narvaja
09-05-2004, 05:19 PM
There are various forms of detection

For the api IsDebuggerPresent, you need edit kernel32.dll for this api always return a zero.
Maybe the plugin for olly OLLYGHOST hide ollydbg of the detection of this api.

For the name of the process, copy OLLYDBG.exe to other folder and rename PEPE.exe or the name you want, recopy pepe.exe to olly folder and you have the two exes, the original OLLYDBG.exe and PEPE.exe, use PEPE.exe.

For name of the window detectionuse windows hacker, or edit the name of the window OLLYDBG.
PD:change to NT/2000 or XP olly is better in this sistems, in 98 is very limited.
Ricardo Narvaja


OllyScript: Script uploading

RCE Messageboard's Regroupment > OllyScript > OllyScript: Script uploading
psyCK0
09-05-2004, 08:32 AM
Hello everyone,

I've been quite busy lately so I haven't had time to add any of the scripts you people emailed to me to the OllyScript site. So today I got a free hour and thought it'd be cool to let you add the scripts yourselves. That resulted in a simple web interface for script submission. So if you want you script to appear on the OllyScript site, please click the link below the "Scripts" header and fill the form!

Thank you for writing all the great scripts!

Regards,
SHaG / psyCK0
Anonymous
09-13-2004, 01:02 PM
Hi,

I know this can be thought of as l33ching ... but is there a way you can provide all the scripts in one archive (with your new uploading functionality) >????

Thanks
Lager
09-20-2004, 10:13 PM
What form PsyCKO?????????????
regards
psyCK0
09-22-2004, 05:37 AM
Find this on the site:
Scripts
You now can upload your own scripts. They will be reviewed by SHaG before appearing here.
Click here to open the upload window!

Click on the word "here" (its in bold) and the upload form will open as a popup.


SetUnhandledExceptionFilter() and win32_2.dll

RCE Messageboard's Regroupment > General > SetUnhandledExceptionFilter() and win32_2.dll
deli
09-05-2004, 04:20 PM
hello
i have a coding problem.
i have written a dll which sets a breakpoint on WSARecv(), mainly i followed this post.

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=12 5&forum=1&page=-1
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=125&forum=1&page=-1
)

but i have a big problem, if i set a breakpoint (0xcc) in a kernel32.dll function it works well.

but if i do the same at WSARecv i catch this execption
"
0xC0000026 EXCEPTION_INVALID_DISPOSITION
"

and the execption means that i didn't return a correct value.
but i return from the exc. handler with
return EXCEPTION_CONTINUE_EXECUTION;

please give me a hint!!!!

thanks a lot
focht
09-14-2004, 07:32 PM
Hi,

hard to tell from that information.
Never encountered this exception type.
Sounds like something is either messed up badly during breakpoint operation or buggy compiler generated code.

Regards


OllyDbg Source Debugging impossible with lcc-win32

RCE Messageboard's Regroupment > General > OllyDbg Source Debugging impossible with lcc-win32
gibran
09-06-2004, 09:51 AM
Hallo I succesfully used Source Debugging with Ollydbg and VisualStudio Express beta 1.

But I use these freeware compiler because they compile very fast and I'm still learning C basics.

http://www.smorgasbordet.com/pellesc/
http://www.cs.virginia.edu/~lcc-win32/

Using Ollydbg with the debug exe versions compiled with these compilers does not enable Source viewing in View menu.

lcc -win32 uses NB09 format (Microsoft CodeView)
Pelles C uses Codeview and/or COFF Format.

What debug formats Ollydbg reads?


Entry point outside of the code?

RCE Messageboard's Regroupment > General > Entry point outside of the code?
Zov
09-06-2004, 10:50 PM
"Module 'testprog' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!"

Why do I keep receiving this message when I run a sample program I've written with NASM? Does anyone else experience the same thing when running programs they've written and assembled in NASM, in other words is this just the how this assembler functions? Maybe it's just something I'm doing, here is my code:

;;;;;;;;;;;;;BEGIN CODE
%include "INC\win32n.inc"

EXTERN GetModuleHandleA
IMPORT GetModuleHandleA kernel32.dll
EXTERN RegisterClassExA
IMPORT RegisterClassExA user32.dll
EXTERN CreateWindowExA
IMPORT CreateWindowExA user32.dll
EXTERN GetMessageA
IMPORT GetMessageA user32.dll
EXTERN DispatchMessageA
IMPORT DispatchMessageA user32.dll
EXTERN ExitProcess
IMPORT ExitProcess kernel32.dll
EXTERN DefWindowProcA
IMPORT DefWindowProcA user32.dll
EXTERN PostQuitMessage
IMPORT PostQuitMessage user32.dll
EXTERN MessageBoxA
IMPORT MessageBoxA user32.dll
EXTERN SendMessageA
IMPORT SendMessageA user32.dll
EXTERN TranslateMessage
IMPORT TranslateMessage user32.dll
EXTERN ShowWindow
IMPORT ShowWindow user32.dll
EXTERN DefWindowProcA
IMPORT DefWindowProcA user32.dll

segment .data USE32

wcx:
istruc WNDCLASSEX
at WNDCLASSEX.cbSize, dd WNDCLASSEX_size
at WNDCLASSEX.style, dd 0
at WNDCLASSEX.lpfnWndProc, dd WndProc
at WNDCLASSEX.cbClsExtra, dd 0
at WNDCLASSEX.cbWndExtra, dd 0
at WNDCLASSEX.hInstance, dd 0
at WNDCLASSEX.hIcon, dd 0
at WNDCLASSEX.hCursor, dd 0
at WNDCLASSEX.hbrBackground, dd COLOR_WINDOW
at WNDCLASSEX.lpszMenuName, dd 0
at WNDCLASSEX.lpszClassName, dd Windowclassname
at WNDCLASSEX.hIconSm, dd 0
iend

Windowname dd "Test Window!",0
Windowclassname dd "classname",0
Windowhandle dd 0

mMSG dd 0,0,0,0,0,0,0

WindowMessage_1 dd "THIS IS A TEST!",0

segment .code USE32

;..start
mainentry:

push dword 0
call [GetModuleHandleA]

mov [wcx+WNDCLASSEX.hInstance], eax

push dword wcx
call [RegisterClassExA]

push dword 0
push dword [wcx+WNDCLASSEX.hInstance]
push dword 0
push dword 0
push dword 500
push dword 500
push dword CW_USEDEFAULT
push dword CW_USEDEFAULT
push dword WS_OVERLAPPEDWINDOW
push dword Windowname
push dword Windowclassname
push dword WS_EX_CLIENTEDGE
call [CreateWindowExA]
mov [Windowhandle], eax

push dword SW_SHOW
push dword [Windowhandle]
call [ShowWindow]

MessageLoop:
push dword 0
push dword 0
push dword 0
push dword mMSG
call [GetMessageA]
or eax, eax
jz QuitProg
push dword mMSG
call [TranslateMessage]
push dword mMSG
call [DispatchMessageA]
jmp MessageLoop

QuitProg:
push dword 0
call [ExitProcess]

WndProc:
push ebp
mov ebp, esp

cmp dword [ebp+12], WM_CLOSE
je CloseMSG
cmp dword [ebp+12], WM_LBUTTONDOWN
je MouseDown

push dword [ebp+20]
push dword [ebp+16]
push dword [ebp+12]
push dword [ebp+8]
call [DefWindowProcA]

_end:

mov esp, ebp
pop ebp

ret 16

CloseMSG:
push dword 0
call [PostQuitMessage]
xor eax, eax
jmp _end
MouseDown:
push dword MB_OK
push dword Windowname
push dword WindowMessage_1
push dword 0
call [MessageBoxA]
jmp _end
;;;;;;;;;END CODE
Umulius
09-07-2004, 01:28 AM
the file is packed with an exe packer
try get peid to check the file !!
seems its not a prg of ur own so dont expect much help in this board since its not allowed to talk about cracking here :-)
psyCK0
09-07-2004, 04:47 AM
Umm, I think the guy stated that the program was the one whose source he posted?
TBD
09-07-2004, 07:09 AM
Zov: the PE header is not correctly filled and OD thinks it is packed.
Zov
09-07-2004, 04:36 PM
psyCK0: Thank you for actually reading my post. :) Yes, this is my code and is the program I'm receiving this message from.

TBD: OK I see. I thought the problem may have been NASM's ..start symbol used to specify the entry point. So I replaced it with:

global mainentry
mainentry:

and then specified the entry with alink and when I attach to the process it still says it. How exactly does the program run if the entry point is outside the code?

I'm assembling and linking as follows:

With symbol ..start:

nasmw -fobj testprog.asm
alink -oPE testprog

With global entry:
nasmw -fobj testprog.asm
alink -oPE -entry mainentry testprog.obj

This isn't necessarily a problem, but it's driving me insane when I try to debug my ASM programs.
Umulius
09-08-2004, 12:10 AM
sorry my bad :-)
TBD
09-08-2004, 09:15 AM
Zov:I think it is Nasm fault that is not PE 100% compliant.
you can see the PE header in OD
1.Executable modules,
2.right click on your module,
3.View executable file,
4.right click,
5.Special|PE Header
sysXcep
09-29-2004, 01:39 PM
I had the same problem with nasm and Olly. Google told me to check this this (http://sourceforge.net/mailarchive/forum.php?thread_id=3297563&forum_id=35705) post of the nasm-users mailinglist.
The solution: add "class=code" to the segment declaration:

segment .code USE32 class=code

This way Olly will find the correct entry point.


Another submenu "View Script"

RCE Messageboard's Regroupment > OllyScript > Another submenu "View Script"
1bitshort
09-07-2004, 07:45 AM
Just under "Run Script" submenu itd be good to have a "View Script" one that simply opened the file in Notepad - should be very easy to add
Thanks
Eggi
09-07-2004, 09:39 AM
would be nice if you could add a option to choose your own Editor (like UE).
1bitshort
09-07-2004, 10:30 AM
Shelling the default .txt handler would be fine (HKEY_CLASSES_ROOT\.txt\)
psyCK0
09-07-2004, 11:47 AM
will be implemented


armadillo

RCE Messageboard's Regroupment > OllyScript > armadillo
SynthaxError
09-07-2004, 03:35 PM
armadillo
psyCK0
09-07-2004, 04:00 PM
Humankind's stupidity never ceases to amaze me...


Log data: Syntax error; cause of source code issue

RCE Messageboard's Regroupment > General > Log data: Syntax error; cause of source code issue
casterle
09-08-2004, 04:35 PM
I am using OllyDbg to debug a Borland BCB6 program I am working on. In another thread I mentioned that I can't get Olly to find any of my source files, and even with the generous help of others here have still not been able to solve this issue.

Today I discovered the "Log data" window (I've still got a lot to learn about Olly!), and perhaps the cause of my source code problem. In that window I find an error message:

> New process with ID 00000994 created
> 00402DF4 Main thread with ID 00000C40 created
> 00400000 Module PwrMon.exe
> Debugging information (Borland format) available
> Line 2: Syntax error in ' "" PTR'

PwrMon.exe is my program. I see that Olly correctly finds that I have built the project with debug info and identifies the format correctly. Then it reports a syntax error in line 2, but doesn't indicate which file contains the error.

Since the error message refers to a line number, it must be having a problem with a text file, no? But I've searched my .map file and find nothing of the form indicated in the error message. Then I used FileLocator Pro to grep through every file in my project (even binary files) and find no matches to the offending string.

Can someone tell me how Olly goes about locating debug info? Is it read from the .map file? Is it read from the .tds file?

Most importantly, how can I fix this problem?

Thanks,
Leroy
oh me anon
09-09-2004, 03:22 PM
well i dont know but i use windows search for text mostly to find some strings in any files it almost always works
start -->search-->files or folders--->containing text PTR
you need to parse a little but it will list all files that has the string ptr i dunno about filepro so cant comment on its usage

or if this fails i use the dos find.exe
cd\
cd "your path"
find /i "ptr" *.* > results.txt
casterle
09-09-2004, 05:26 PM
oh me anon, do yourself a favor and check out FileLocator Pro. Its name doesn't reflect its function - best windows grep I've seen:

http://www.mythicsoft.com/default.aspx

$12.99 US
oh me anon
09-10-2004, 08:27 AM
hehe you named it differently
why didnt you say ransack ,well i have ransacked a lot
yeah pretty good especially when the file is system and hidden and read only like most of virii out there
oh me anon
09-10-2004, 10:30 AM
well i thought of editing the post above but i will make a new one since it covers lot of ground
btw just since i didnt understand why some thing didnt work

i downloaded the bcb 5.5 free commandline tools and searched through google to find a tut

here is the tut i followed to create my first c++ program

http://www.webnotes.org/bcc55eng.htm

here is the dbghello.cpp in c:\borland\testdos
#include <stdio.h>

int main ()
{
printf("helloworld");
return 0;
}

i used this to compile it
c:\borland\testdos>bcc32 -v hellodbg

C:\Borland\testdos>bcc32 -v hellodbg
Borland C++ 5.5.1 for Win32 Copyright (c) 1993, 2000 Borland
dbghello.cpp:
Turbo Incremental Link 5.00 Copyright (c) 1997, 2000 Borland

C:\Borland\testdos>

well it created three files
1)hellodbg.exe
2)hellodbg.obj
3)hellodng.tds

so i opened the hellodbg.exe in ollydbg
here is the dissembly

00401150 >PUSH EBP
00401151 MOV EBP,ESP
00401153 PUSH dbghello.0040A128 ; /format = "helloworld"
00401158 CALL dbghello.___org_printf ; \___org_printf
0040115D POP ECX ; dbghello.00407C8E
0040115E XOR EAX,EAX
00401160 POP EBP ; dbghello.00407C8E
00401161 RETN

here is my log details
Console file 'C:\Borland\testdos\dbghello.exe'
New process with ID 000002CC created
00401000 Main thread with ID 00000114 created
00400000 Module C:\Borland\testdos\dbghello.exe
Debugging information (Borland format) available
77E10000 Module C:\WINNT\system32\USER32.DLL
77E80000 Module C:\WINNT\system32\KERNEL32.DLL
77F40000 Module C:\WINNT\system32\GDI32.DLL
77F80000 Module C:\WINNT\System32\ntdll.dll
75E60000 Module C:\WINNT\System32\IMM32.DLL
77DB0000 Module C:\WINNT\system32\ADVAPI32.DLL
00401150 Main program

here is the source it shows
in cpu pane
EBP=0012FFB8
dbghello.cpp:3. int main ()

if i use ctrl+f5 i can see that the cursor is positioned in line no 3

here is the call stack details
Call stack of main thread, item 0
Address=0012FF90
Stack=00407C8E
Procedure / arguments=Maybe dbghello.main
Called from=dbghello.__startup+16F
Frame=0012FFB8

here is obj file scan results in analyse
Unnamed window
Object file Group Scanning results
dbghello.obj 1 No matches

so i think olly properly recognises .tds file and also shows the source without problems there is no need for .pdb files as i believed or any .map files may be only the .tds file is enough

and line nos may be the line nos in your source code
i cant attach a photo here else i would have attached a screenshot
here

PS SO AFTER I POSTED THIS I ASLO TESTED A MSG BOX (TEST WIN)
with this bcc32 -tW -v
and loaded it in olly bingo i see the source

EBP=0012FFB8
hellodbg.cpp:4. WINAPI WinMain (HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
and it recognises that .tds file
Log data, item 14
Message= Debugging information (Borland format) available
and the cursor is on line 3 in source window
oh me anon
09-10-2004, 10:56 AM
and i view filed the hellodbg.tds
and i see it holding information like this
header
00000000 FB0A................. .Ð..L... ...L...%.P..~..'.
00000040 ..F...).. ”.0..+.. 4..Æ..0.. „..Œ........

*********************************************

000018B0 ..ˆ..‰..... BCC32 5.5.1.......CV.....................

***********************************************

000023F0 .....................ï......c0ntw.asm..hellodbg.c pp. HINSTANCE_
00002430 _.unused.WinMain..hInstance..hPrevInstance..lpCm dLine.nCmdSho
00002470 w.HWND__. MessageBoxA.std. @std@size_t.@std@ptr diff_t. @std@w
000024B0 int_t..@std@wctype_t.ULONG.USHORT.UCHAR.PSZ.D WORD.BOOL.BY
000024F0 TE.WORD.FLOAT.INT.UINT.POINTER_64_INT.LONG32 .INT32.ULONG
00002530 32.DWORD32.UINT32.INT_PTR.UINT_PTR.LONG_PTR.. ULONG_PTR..UHA
00002570 LF_PTR.HALF_PTR..HANDLE_PTR.SIZE_T.SSIZE_T..DWO RD_PTR.LONG64
000025B0 .INT64.ULONG64.DWORD64.UINT64.CHAR.SHORT.LO NG.WCHAR.PCH
000025F0 AR.LPCH.PCH.LPCCH.PCCH.NPSTR.LPSTR.PSTR.LP CSTR.PCSTR.T

*************************************************
0000BC30 _array$ui%@$bdtr$qv.þ@__rwstd@%__rb_tree$i75std@%p air$xi60std@%b
0000BC70 asic_string$c19std@%char_traits$c%17std@%allocator $c%%%100__rwst
0000BCB0 d@%__select1st$75std@%pair$xi60std@%basic_string$c 19std@%char_tr
0000BCF0 aits$c%17std@%allocator$c%%%i%12std@%less$i%93std@ %allocator$75s
0000BD30 td@%pair$xi60stWZrH.þ@__rwstd@%__rb_tree$i75std@%p air$xi60std@%b
0000BD70 asic_string$c19std@%char_traits$c%17std@%allocator $c%%%100__rwst

*********************************
end of file
0005FFF0 ........FB0A...
casterle
09-10-2004, 04:22 PM
Thanks for your help. No need to attach a photo, I believe it works for you<g>. From your log file:

> Console file 'C:\Borland\testdos\dbghello.exe'
> New process with ID 000002CC created
> 00401000 Main thread with ID 00000114 created
> 00400000 Module C:\Borland\testdos\dbghello.exe
> Debugging information (Borland format) available
---- I get an error message here in my log file --------
> 77E10000 Module C:\WINNT\system32\USER32.DLL

Now from my log file:

> New process with ID 00000994 created
> 00402DF4 Main thread with ID 00000C40 created
> 00400000 Module PwrMon.exe
> Debugging information (Borland format) available
> Line 2: Syntax error in ' "" PTR'

Your log doesn't have the syntax error after Olly reports finding debug info. Mine does. I expect this is the reason that I don't get source file integration.

My question is: How do I track down the error message I find in my log file? I should point out that my TDS file is a bit over 20MB so perhaps size is an issue. Also, since TDS files are binary, it seems strange that the error message refers to a line number.

I hope you (or someone) has a suggestion as to how I work out this error. OllyDbg is a great addition to my programming toolkit - it would be even better if I could integrate my source files.
oh me anon
09-11-2004, 09:56 AM
well i tried a scanf,printf combo
and to my limited knowledge the line nos point to your source line numbers like i already posted

00401150 >/. 55 PUSH EBP

EBP=0012FFB8
dbghe1.cpp:2. int main ()

00401154 |. 8D45 FF LEA EAX,DWORD PTR SS:[EBP-1]

Stack address=0012FFB7
EAX=00000001
dbghe1.cpp:5. scanf("%s",&v);

00401165 |. 8D55 FF LEA EDX,DWORD PTR SS:[EBP-1]

Stack address=0012FFB7
EDX=00792570
dbghe1.cpp:6. printf("hello %s",&v);

00401176 |. 33C0 XOR EAX,EAX

EAX=00000001
dbghe1.cpp:7. return 0;

0040117A \. C3 RETN

Return to 0040AB06 (dbghe1.0040AB06)
dbghe1.cpp:8. }

i also tried using the td32 debugger
here is the equivalent that it shows
main: int main ()
:00401150 55 push ebp
:00401151 8BEC mov ebp,esp
:00401153 51 push ecx
#dbghe1#5: scanf("%s",&v);
:00401154 8D45FF lea eax,[ebp-01]
:00401157 50 push eax
:00401158 6834D14000 push 0040D134
:0040115D►E86E2C0000 call scanf
:00401162 83C408 add esp,00000008
#dbghe1#6: printf("hello %s",&v);
:00401165 8D55FF lea edx,[ebp-01]
:00401168 52 push edx
:00401169 6837D14000 push 0040D137
:0040116E E8392C0000 call printf
:00401173 83C408 add esp,00000008
#dbghe1#7: return 0;
casterle
09-11-2004, 07:21 PM
I don’t doubt that this works fine for you. I expect that I would get the same results if Olly didn’t throw an error while it was (apparently) reading my TDS file. I have verified that Olly is indeed finding and reading my TDS file, so that isn’t the problem.

I’m trying to find a way to work around the error that is preventing Olly from reading in the symbolic information that allows it to relate an EIP address to a source line number.

It might be that BCB6 uses a different TDS format than the BCB5 (free) compiler and that is leading to the error in reading my debug info into Olly.
oh me anon
09-12-2004, 09:44 AM
It might be that BCB6 uses a different TDS format than the BCB5 (free) compiler and that is leading to the error in reading my debug info into Olly.

well my main purpose of posting so much crap was to make you do a small executable like hello world in bcb -6 as well as may be bcg5.5 etc an see if it reads the source and to see if the formats differ etc these small silly problems can be sorted out mostly by not being stuck at one single problem but to diversify your view of thinking rather

or why not cut you powermon whatever into a small component and compile it and see if it still creates the problem etc

if you create two .tds with two different compilers and
do fc/b myfir.exe mysec.exe >res.txt it should point out the differences between two two .tds

it is almost experiments that leads to solutions rather than problems

my 0.00000000000000005 cents
casterle
09-12-2004, 07:38 PM
> well my main purpose of posting so much crap was to make
> you do a small executable like hello world

I would have gotten your point sooner had you just come out and said it.

As it turns out, I've been converting godfather+'s MapConv plugin to work with Borland map files. If I load the DLL in OllyDbg, it does find the DLL source code properly. I then created a small (VCL) test project. Same thing, source if found OK.

It would appear that the problem is related to the size of (or the number of symbols in) the TDS file. Not much point in looking further as there's nothing I can do about it. Perhaps the author will look into this.

However, now that I can import Borland map files it is less of an issue, but I would like to be able to use my source files in conjunction with Olly.


Hardware debug registers

RCE Messageboard's Regroupment > General > Hardware debug registers
casterle
09-09-2004, 02:43 PM
I'm running OllyDbg under WinXP Pro, but for some reason when I open the Debug/Hardware registers dialog, everything is grayed out. Viewing the debug registers in the register pane shows them all zero'd with Dr6 == 0000200C. Thinking that perhaps OllyDbg reserved the HW bp registers when "Use HW breakpoints" on the Debug tab is checked, I tried it both ways with the same result.

Can someone tell me why I can't set HW breakpoints?
oh me anon
09-09-2004, 02:52 PM
to put a hardware break point you select the command in cpu pane
and right click on it
you will see break points
if you select it you will see some seven options
like toggle break point,memory break point (read ,write,access)
harware break points on execution etc
if you think you need execution break point you click hardware on execution

there you will get your bp
only four no of hw bp are allowed
if you need more you need to delete one of the earlier and set a new one
for deleting you need to go to view ,debug registers (it will be filled with four delete the one you dont want to set a new one )

if you need hw break point on read ,write ,or access you need to select data area in dump and right click

hope it is what you were searching
casterle
09-09-2004, 05:28 PM
Exactly what I was looking for. Thank!
focht
09-14-2004, 06:56 PM
Just a side note ... the "HW breakpoints" dialog might _not_ reflect the actual state of HW debugging registers.

I had that issue when injecting custom code (dll) into a debuggee, which was setting up HW bp's itself.
If the debuggee breaks due to some condition, the dialog doesnt decode/show the HW breakpoints for the thread (when set not by ollydbg itself) - although the register pane shows Dr0,1,2,3 and DR7 (control register) with valid values.


ida sdk api

RCE Messageboard's Regroupment > The Heap > ida sdk api
deli
09-09-2004, 04:43 PM
hello

can anybody gives me a hint where i can find more infos about the ida plugin sdk api ?

i have downloaded several plugins but i don't know the use of functions like for example "generate_disasm_line()"

where i find a good docu about the api ?

thnx


Symbol location problems/solution

RCE Messageboard's Regroupment > Bugs > Symbol location problems/solution
casterle
09-10-2004, 06:45 PM
I’ve been trying to get Olly to locate my .pdb symbols files without success. I have ‘Debug/Select path for symbols’ set to my symbols server directory, but no luck. I even tried copying the .pdb files from the various paths that MS’s symbol server sets up into one common directory, but that didn’t do the trick either.

Today, I ran FileMon (free at www.sysinternals.com (http://www.sysinternals.com) – you need all their utilities, so grab them while you’re there) and noticed something interesting – Olly wasn’t looking for my symbol files in the path I had selected!

I opened the Olly symbols path dialog, and instead of browsing to my symbols directory, I typed the path in and clicked OK. I closed/ran Olly again, and sure enough, Olly was looking in the proper path. But now it wasn’t looking for the proper files! It was looking for .sym and .dbg files instead.

I searched through my FileMon output for .pdb files, and found that Olly was looking for them in C:\Windows\System32 and System32\DLL and System32\symbols\DLL and even in its own directory,.but not in the path I had told it to look in.

I ended up copying all of the .pdb files into the Olly directory (I didn’t want to put them where VS.NET might find them and get confused), and sure enough, Olly finds them when it loads my project now.

Sadly, Olly still isn’t finding my source code files.
focht
09-14-2004, 06:50 PM
Hi,

i mentioned that too in earlier threads (just search em).
Ollydbg doesnt fully exploit dbghelper api nor work with new symbol server feature at all.

If you bugger the author, he might fix these issues in upcoming 2.x release ;).

Regards


Help

RCE Messageboard's Regroupment > Plugins > Help
Rockman99
09-12-2004, 03:31 PM
Where can I get the ollydump plugin STUPH is getting me nowhere.
casterle
09-13-2004, 09:02 PM
http://ollydbg.win32asmcommunity.net/stuph/g_ollydump221b.zip

Works for me.


Borland map file importer plugin

RCE Messageboard's Regroupment > Plugins > Borland map file importer plugin
casterle
09-12-2004, 08:19 PM
Here's an OllyDbg plugin that will import Borland map files. Source included.

Based on MapConv 1.4 by godfather+.

www.geocities.com/BusinessAsUnusual\BorlandMapImporter.zip (http://www.geocities.com/BusinessAsUnusual\BorlandMapImporter.zip)
KSA
09-13-2004, 04:13 AM
Page Not Found
casterle
09-13-2004, 11:17 AM
Please try again. I am having no problem downloading it.
oh me anon
09-13-2004, 11:29 AM
yeah me too i can get it
btw you could have compiled along with a map so that it would have been easier to test it or with debug info so that source could also be viewed

All names, item 37
Address=007812C4 BorlandM
Section=.text
Type=Library (Known)
Name=DllEntryPoint
Comment=Object module 'E:\Work\Leroy\Olly\BorlandMapImporter\Src\Main.c'

and size issue is a matter only if the .tds file crosses 32 mb it seems iirc you said it was 20 odd mb so :(
casterle
09-13-2004, 05:30 PM
> btw you could have compiled along with a map so that it
> would have been easier to test it or with debug info so
> that source could also be viewed

Bitch, bitch, bitch. Not that it does you much good since I didn't send along the .map and .tds files, but it is compiled with debug info.

I've uploaded another copy of the .dll (to make sure it matches the debug files) as well as the .map and .tds files. Enjoy.

http://www.geocities.com/BusinessAsUnusual/BorlandMapImporterDebugInfo .zip
(http://www.geocities.com/BusinessAsUnusual/BorlandMapImporterDebugInfo.zip
)

The size issue you mention is a totally different issue. The problem was that the Borland linker would throw an exception when the project got too large and/or tried to generate a .tds file larger than 32MB. The BCB6 linker seemed to solve this problem (until the project grew a bit more). Borland released an updated linker a couple of months ago that seems to solve the problem entirely.

I was speculating that Olly was perhaps having a problem with the size or symbol count in the .tds file, not that the .tds file was malformed due to the linker problem.
casterle
09-13-2004, 09:01 PM
I had a problem in my lexer that mangled some symbols. New version uploaded:

www.geocities.com/BusinessAsUnusual\BorlandMapImporter.zip
(http://www.geocities.com/BusinessAsUnusual\BorlandMapImporter.zip
)

Debug symbols (for oh me anon<g>).

www.geocities.com/BusinessAsUnusual\BorlandMapImporterDebugInfo.zip (http://www.geocities.com/BusinessAsUnusual\BorlandMapImporterDebugInfo.zip)
oh me anon
09-14-2004, 07:24 AM
Bitch, bitch, bitch

well some more
Source files, item 0
Module=BorlandM
Source=(Absent)
Source path=E:\Work\Leroy\Olly\BorlandMapImporter\Src\Mai n.c

;)

no i cant see your source either with ctrl+f5 or view source file

have fun

ps yes it says it added 713 labels and 713 comments (coincidence ?)
but if i try to find user defined labels or user defined comments they turn out to be nil
have some more fun ;)

and some more ps
i saw it saying borland blah was avl in log yesterday too thats why i asked fro .tds and .map not to bitch
casterle
09-17-2004, 12:51 AM
Unless you rebuild the project, it will look for source files in MY directory structure rather than yours (the paths are hard-coded in the binaries). If you create a directory structure identical to mine (that is, create E:\Work\Leroy\Olly|BorlandMapImporter\Src and copy the source files to that directory), the source should be found properly.

> ps yes it says it added 713 labels and 713 comments > (coincidence ?)

If it imports 713 labels, it should import 713 comments, nothing coincidental about it. When you import labels, you're updating the symbol table. When you import comments, you're importing the same symbols, but adding them as comments rather than updating the symbol table. This wasn't clear to me at first.

> but if i try to find user defined labels or user defined comments
> they turn out to be nil have some more fun ;)

Are you saying that the symbols aren't imported correctly? They work find on my system (yeah, yeah - heard that before) using Olly 1.10.

> saw it saying borland blah was avl in log yesterday too

I'm not following you here. What do you mean?

> thats why i asked fro .tds and .map not to bitch

Yes, sorry, 'bitch, bitch, bitch' is an American idiom. Meant to be humorous.
emb
09-17-2004, 02:57 AM
I can not login the Web,please send me one .

zhangyun_dx@hotmail.com
Thanks a lot!
casterle
09-17-2004, 03:47 PM
emb, it's on its way.


Olly through WinE on Linux

RCE Messageboard's Regroupment > General > Olly through WinE on Linux
Dedec0
09-13-2004, 07:33 PM
Hello.
I am tryibng to use Olly under WinE in Linux. Is there any reason that this can't work? Like things that Olly might need to use that WinE won't let it have, since it is emulating windows?

It didn't work first time, because it didn't find the .DLL my debugged program needed. But if I copy all these DLLs will Olly woek or will it crunch on something else?

Please, I don't know much about debugger's work, and nothing about debuggers in PM mode, etc. any help or comment is welcome.

Thanks.

Dedec0
focht
09-14-2004, 06:45 PM
Hi,

question: why do you want do debug with ollydbg under linux?
Even if you get ollydbg to work using Wine, only win32 binaries can be executed/debugged at all.

Just give it a start...

Regards
Dedec0
09-14-2004, 10:55 PM
Hello, focht. :)

I want to use Olly under linux because some window's applications are fun to debug. :) Id est, I have some Win32 programs I d'like to debug, thats all. It isn't a weird thing: if I use WinE for wathever reason, I should also be able to use debug the program I run with it, shouldn't I? And I like Olly a lot. :)

I am aware that I would only be able to debug win's programs that way. Linux has its own debuggers. :)

Regards.


Full Delphi 6 and Delphi 7 IDA signature

RCE Messageboard's Regroupment > General > Full Delphi 6 and Delphi 7 IDA signature
TQN
09-14-2004, 07:29 AM
Hi all !
I have finished creating the full IDA signature for Delphi 6/7 (RTL/VCL/CLX/BDE...). You can go to http://www.woodmann.com/forum/showthread.php?t=6372 to download them and use them with the great GODUP plugin in OllyDbg when we are debugging Delph 6/7 applications.
Best regards,
TQN
pzalps
09-14-2004, 10:29 AM
Great Work
Thank you
MARcoDEN
09-16-2004, 06:50 AM
Yeah, really useful


upx+sfx

RCE Messageboard's Regroupment > General > upx+sfx
ricstud
09-14-2004, 06:57 PM
i have unpacked a program packed with upx+sfx .after rebuilding the IAT the program didn't work.
may the problem is the sfx option.
somebody could help me?
thank you
focht
09-15-2004, 06:23 PM
Hi,

could you give more information?
Did you use some upx unpacker or manual unpacking (OEP+dump+imprec)?

Regards


Debug .Net and Powerbuilder programs?

RCE Messageboard's Regroupment > General > Debug .Net and Powerbuilder programs?
wincor
09-15-2004, 01:02 PM
Hi!

Is there any way to debug .NET or Powerbuilder applications?
Thanks in advance.
focht
09-15-2004, 06:14 PM
Hi,

ollydbg doesnt understand managed code (.NET) nor can debug it. You have to refer to other debuggers, like:

VS.NET 2002/2003/2005 integrate managed code debuggers(commercial)
Borland C# Builder and Delphi 8 integrate managed code debuggers (commercial?)
.NET SDK contains one: CLR debugger (free download)

You can build a debugger which understands managed code by using .NET debugger APIs (sample (http://www.microsoft.com/downloads/details.aspx?familyid=38449a42-6b7a-4e28-80ce-c55645ab1310&displaylang=en)

Regards
wincor
09-16-2004, 05:49 AM
Thank you for your reply.

I've found ILDASM.EXE in VS.NET, and it seems to be a useful
debugger tool.


Suspended thread

RCE Messageboard's Regroupment > General > Suspended thread
Gabbi
09-15-2004, 02:15 PM
When I attack a process child and I give F9 and F12 appears this message....

http://us.f2.yahoofs.com/users/414866aaz496907f1/a07e/__sr_/cff2.jpg?p hptGSBBA3oczf6K
(http://us.f2.yahoofs.com/users/414866aaz496907f1/a07e/__sr_/cff2.jpg?phptGSBBA3oczf6K
)

What I make?
JDog45
09-15-2004, 07:17 PM
A cake
Gabbi
09-15-2004, 08:17 PM
I thought that this forum was to help the members, does not stop making jokes
Gabbi
09-15-2004, 08:31 PM
link certain is here....

http://us.f2.yahoofs.com/users/414866aaz496907f1/a07e/__sr_/cff2.jpg?p hYUMSBBbGw3zf6K (http://us.f2.yahoofs.com/users/414866aaz496907f1/a07e/__sr_/cff2.jpg?phYUMSBBbGw3zf6K)
focht
09-16-2004, 03:59 AM
Hi,

when i visit the link, i get "You do not have permission to get the requested URL from this server. " error...

Maybe you get another free image hosting service?
Here is a list: http://www.free-webhosts.com/free-image-hosting.php

Regards
Gabbi
09-16-2004, 12:07 PM
Thanks focht and sorry....
May be its work:
http://img3.exs.cx/img3/1272/error20.jpg
Teerayoot
09-16-2004, 02:37 PM
In "Threads window" right click on that suspended thread then click Resume Or

If process have many threads suspended ,would better use another tool to resume threads whole process.
JDog45
09-16-2004, 04:12 PM
TY, forums are back up FYI...:)
Gabbi
09-16-2004, 05:40 PM
Ok Teerayoot!!
Already I made this but the program not wheel.
The problem is that Olly functioned perfectly and suddenly started to appear this message.
Already I reinstalled winXP and it did not decide.
What it can be... Configuration olly....
Teerayoot
09-18-2004, 04:21 PM
JDog.
I got this message when try to Register /Recieve Forgotten Password

Parse error: parse error, unexpected T_CONSTANT_ENCAPSED_STRING in /home/access/public_html/forums/sources/register.php on line 1020


about olly 2

RCE Messageboard's Regroupment > Announcements > about olly 2
mike
09-15-2004, 08:24 PM
is it ready???
JDog45
09-16-2004, 04:11 PM
if it was, don't you think we would have it??
psyCK0
09-18-2004, 07:00 AM
Delete or not delete, that is the question.
Teerayoot
09-18-2004, 04:44 PM
The answer is "Delete".
1bitshort
09-19-2004, 05:41 AM
Just leave it but lock it, at least then we'll only have one thread rather than one every week.
psyCK0
09-19-2004, 08:53 PM
Sure! =)


Stop WM_TIMER messages to an app that uses 100% cp

RCE Messageboard's Regroupment > General > Stop WM_TIMER messages to an app that uses 100% cp
Mac
09-15-2004, 09:46 PM
Hi folks,

Just stumbled across this forum and dlownloaded the debugger that everyone seems to like so well. It looks great, but unfortunately the app I'd like to modify is 16-bit.

It's a word game that my wife plays A LOT. It uses 100% cpu which hasn't bothered her comp so far, but am gonna give her another (slightly faster) one which runs a little warmer.

The game constantly gets WM_TIMER messages (I hooked it), but using a sleep in the hook only delays user actions, and cpu still remains at 100%.

I've dabbled with "AttachThreadInput" some but no luck so far (not sure it would even be useful here).

Any idea how to shut off those WM_TIMER messages?

BTW, I do some C programming but know very little about ASM.

Thanks, Mac :)
Mac
09-22-2004, 06:11 PM
50+ views and no replies... any ideas on this?

Possible? Impossible?

Tried some other versions (scrabble btw), but she REALLY likes this one.

Thanks, Mac
xtreem
09-29-2004, 01:30 AM
I think its unlikely the WM_TIMER messages are causing the 100% cpu usage. If you want to turn them off or slow them down though, find the SetTimer call and adjust the interval amount. The game is likely to behave strangely afterwards though.

Try running the game and pausing it now and then (or profile it with tracing) to see where the tight loop is. You could try putting a sleep or msgwaitformultipleobjects type call in there to stop it spinning.

I am not sure if this applies to 16bit apps though, I havent had much experience with those.


How to load/save binary snippets?

RCE Messageboard's Regroupment > General > How to load/save binary snippets?
MrSmith
09-18-2004, 08:48 AM
Hi everybody,

sometimes I assemble small pieces of code into a program that I'm debugging with Ollydbg. I would like to be able to save those short code snippets in binary form to a file and reload them later from this file.

Basically, the backup function of the disassembler window does what I want. But it seems I can only save and load whole memory blocks with backup. I would like to have a backup that also works on a small selection.

Any ideas who to do this ?

Many thanks,

MrSmith
focht
09-20-2004, 05:41 PM
Hi,

you might want to look at the "extracopy" plugin source (under "stuph").

Keywords: ODBG_Pluginaction/ODBG_Pluginshortcut -> item -> t_dump, t_dump->sel0, t_dump->sel1, Readmemory,

Regards


Aspack 2.12 Dll Unpack script doesn't work?

RCE Messageboard's Regroupment > OllyScript > Aspack 2.12 Dll Unpack script doesn't work?
ivan
09-18-2004, 08:50 AM
tested on 3 targets, didn't work on either of them... can somebody confirm this script works? :)
Anonymous
09-29-2004, 04:23 PM
For me it works, stops at OEP and show reloc start and size. But how do i dump such a dll into new file to change oep and reloc?
peace
10-25-2004, 02:33 AM
hi i test it
it's seem that it's work
but after the dump the exe doesn't work for me
please help??????????????????????????????><><><><><>}><{}><}{>}>}>}<>}
friedo72
10-27-2004, 11:56 AM
I have same problem!

All seems to work fine but after dumping nothing works.
imprec won´t find the iat automatically and the give RVA adress/length is not identical to IAT adress!
loveboom
05-08-2005, 02:06 AM
your can use lordpe dump target,and then use importrec fix iat,
last time,use lordpe fix reloc


about REPL in OllyScript ...

RCE Messageboard's Regroupment > OllyScript > about REPL in OllyScript ...
Anonymous
09-18-2004, 11:20 AM
i'm very new this script..

just wan to ask 1 question about repl command

is it possible let repl command get the value i wanted to replace from a variable??

example
var a
mov a, 91

repl eip, #90#, a, 100 <-- is this possible???

because the value a is not fixed.. have to find value a from the file...


Question about unicode translation in VB6 vs VB5

RCE Messageboard's Regroupment > General > Question about unicode translation in VB6 vs VB5
kittmaster
09-18-2004, 11:44 AM
I've noticed that in VB6 when debugging there seems to be a lot of unicoding translation in the FPU registers into readable ASCII, yet when using VB5 there is hardly any translation. Is there an option that I may or may not have set so that both will yield the same feedback results? It just seems hard to debug when you consistantly have to use a hex to ASCII translator to cut and paste ever line code.

thanks for any feedback

Chris


Saving Progress In Ollydbg

RCE Messageboard's Regroupment > General > Saving Progress In Ollydbg
getsome
09-18-2004, 04:41 PM
Hi Everybody,

I apologize if this has been addressed in an earlier post, but there are so many to scan.

I am new to ollydbg, and I am trying to save the state of my changes in ollydbg, so that when I restart, I can run the program and automatically generate the same changes during execution that I made in the previous run, and have it pause at the point of the save.

Is this possible, or do I have to do this manually everytime I restart.

Thanks in advance for your assistance.

Chase
getsome
09-18-2004, 05:08 PM
I shoudl have said that I have attempted doing a:

Right Click in CPU Window -> Copy To Executable

but there is no option for all modifications, only and option for selection. I have made numerous changes to both the assembly and the register values. Is it possible to do this.

Thanks
Teerayoot
09-18-2004, 08:11 PM
I playing with OllyDbg around 2 years.

I can say no possible to do that task,It would be nice if any plugin can do that task.


XP SP2 kernel32.LoadLibraryA F8 failed

RCE Messageboard's Regroupment > General > XP SP2 kernel32.LoadLibraryA F8 failed
BetterWang
09-19-2004, 08:35 AM
00401197 |. FF15 08304000 CALL DWORD PTR DS:[403008] ; kernel32.GetProcAddress
0040119D |. A3 0C304000 MOV DWORD PTR DS:[40300C],EAX ; kernel32.LoadLibraryA

here EAX = 7C882FC4, and

7C882FC0 0000 ADD BYTE PTR DS:[EAX],AL
7C882FC2 0000 ADD BYTE PTR DS:[EAX],AL
7C882FC4 >-E9 18C03276 JMP F2BAEFE1
7C882FC9 90 NOP
7C882FCA 90 NOP

if we press F8 at 7C882FC4 , we get EIP = F2BAEFE1, it fails to continue debug.

i think maybe this is a bug.
focht
09-20-2004, 05:10 PM
Hi,

hard to say ...
Post a bigger snippet with arguments, that is the LoadLibrary() and GetProcAddress() calls.
Post list of loaded modules with base address, especially the one, where the jump is referring to (former 0x7C882FCx).
The jump is suspicious ... looks like trampoline jump/code injector stuff.

Regards


W32Dasm FIX CPU usage

RCE Messageboard's Regroupment > General > W32Dasm FIX CPU usage
Lekara
09-21-2004, 09:52 PM
When I open a file in W32dasm and do nothing , the cpu goes 100% (2.0 GHz) , but when the menu is opened it is 3% (normal).

There must be some loop going on that is useless .

Q: 1.How to find that loop in O.D. ?
2.How to set break point ?

Eto hvala!

[email=][/pivoosjecko@yahoo.com]
jayte
09-22-2004, 12:05 AM
My guess, is that he (the program's author) is basically polling for Windows messages using PeekMessage in his main message loop, instead of GetMessage (which doesn't return 'till there's a message).

Anyway... this is why (the 100% CPU usage) that particular technique is somewhat ill-advised.

As for your questions... find the address of the program's Winmain, and WndProc... have a look.

Jeff
JDog45
09-22-2004, 06:38 AM
ditto ^^^


protection tests

RCE Messageboard's Regroupment > General > protection tests
yahia
09-22-2004, 09:08 AM
Are you a real cracker ?
did you crack a programs before ?
How professional are you ?
Could you crack a program protected using a very new and high technology ?

Till now, none could do this jop !!!!

If you are the above, Please download this protected file from :
http://www.yahia-rod.net/ROD%20(High%20TECH)%20.zip
britedream
09-22-2004, 05:43 PM
Not hard to unpack , I did unpack it , oep =4011d8, dump here and fix the It normally, I had to add the MSVBVm60 becuase it is missing after unpacking.
Regards.
psyCK0
09-22-2004, 05:49 PM
There are no hackers or crackers on this board.
BTW, nice work britedream :)
yahia
09-23-2004, 08:32 AM
OK, Where is that UNPACKED File britedream ?
Please post it if what you said is RIGHT ?

Regards .
1bitshort
09-23-2004, 08:42 AM
He's already done the hard work for you and told you what the OEP is, all you have to do is set an execution breakpoint on that, run it, then dump it.
yahia
09-23-2004, 08:44 AM
The Programm DOEASN"T WORK !!!!!!!!
yahia
09-23-2004, 08:48 AM
This program created using a technology that DESTROYs the file when even modifying it !!!
So what's the use of this program if it doesn't work ??????
1bitshort
09-23-2004, 08:57 AM
So what's the use of this program if it doesn't work ??????
Why do you want to use it/crack it/break it if it doesnt work?
yahia
09-23-2004, 08:57 AM
What I do need is the ACTIVATION CODE existing in that protected file .I DID what britedream said, but the file doesn't work and no ACTIVATION CODE AVAILABLE .
yahia
09-23-2004, 09:39 AM
This file is working in the first link I POSTED !, but once you try to play with it, it DESTROYS it self !!!!
Consider me a STUPID BEGGINER, but the only thing that makes me belive that this file is truely UNPACKED and the ACTIVATION CODE is correct is to see a post by any one contains the UNPACKED or DEPROTECTED copy of that file !!!!

If some one UNPACKED it, so why didn't he/she posted it ??
britedream
09-23-2004, 10:03 AM
If you are trying to use us to test your protection this is not going to happen, if you want to know the protection is unpackable or not just copy my post and give it to a good cracker, and he will explain to you what you don't know .

britedream
psyCK0
09-23-2004, 10:34 AM
yahia: if you want free testing of your protection it might pay to be less arrogant...
yahia
09-23-2004, 12:53 PM
psyCKO :I'm not arrogant at all, but the rule says if any one unpacked or deprotected any file, so the DEPACKED or DEPROTECTED copy should be at least POSTED !!!
I could tell you that I can fly but you wont belive that till you see it !

I'm sorry if I wasn't polite enough but please let any one tell me if that happened !

I'm just asking some help and if britedeam doesn't wanna post the DEPACKED or DEPROTECTED copy so please at least tell me the ACTIVATION CODE of this protected program .

If any could successfully do what britedream said about UNPACKING or DEPROTECTING that file, so PLZZZZZZZZZZZ post any virtual result .

Thanks to every one interested in this .

REGARDS, Yahia.
britedream
09-23-2004, 01:42 PM
enough game playing , you are asking us to help you on what?, it is your crackme protected with your protection, as your splash indicate,about unpacking I have told you the detail of that, if you want to register it , at address 412a9b is you serial entered, below it , is the memory address that it compare to, make these two pushes equal,by copying the value of the address to eax, or nopping the address and pushing eax again, target will display coooooooooooooooool registration done successfully. or you can enter this code as your Activation:

Asm.$fg APG MEdo2 113 1dsoGJF df$fgd`#d fg#@`g df*% @ ) *df@* g$@hjk$k d@%)(@* (%a s54532155gg#$%#J$K#:LKJL:J#:Lsgf732187321d* @(%a543ds 54sd*@(% *54554 DG:LDFG}E#$@%65 4gdf g^%$^%$&**- *-*+DG FL Dj``gp4h,`5p9@8h#4gp`. ,49h gGK* @GK GK3.9384 y,t9.,3hg9/*56/**654*87EROI$OI^%%O$*^FOR*E#YFG OJFG4%J$%45^$5456%$J$5@4%$

[NOTE]
please don't copy and paste ,it is sensitive to spaces , so you have to enter it, you can set bp on 7719c27A and watch the comparison.

Britedream
1bitshort
09-24-2004, 08:22 AM
Where should he send the cheque?
psyCK0
09-24-2004, 12:13 PM
http://www.yahia-rod.net/ROD%20(High%20TECH)%20.zip - 404 File not found :P

britedream: statements like yours ara usually ended by the word "dixi" - latin for "i have spoken" :)

yahia: changing the pe header wont stop anyone from getting the proggie into a debugger, its just plain annoying
Eggi
09-24-2004, 01:14 PM
and what is minimum protection ;)
yahia
09-25-2004, 08:32 AM
Sorry because I was tooo busy in the last time .
Good work BriteDream, although the result wasn't 100% currect,
and I don't know any thing about the UNPACKED file !!!
but you have just defeated the 4th Protection Level of my ROD TECHNOLOGY .
The file was protected with 3 Important Options Disabled !!!
I did that to test how hard is it !!
BriteDream: If you call that GAME so game it is .

psyCK0 : This is not HEADER PROTECTING !! but I did write some comments and I don't know what made you think the comments are protection ????
Just try modifying even one byte in the file and see the result .
You may then understand my TECHNOLOGY .

Anyway, still there are 3 protection levels, & the GAME didn't end at least for me !!!

If any one wanna continue the MORTAL COMBAT, so I'm ready !!

Please don't expect fast posts because I'm tooo tooooo busy .

Thanks flys to :
psyCK0, BriteDream .

Regards .
britedream
09-25-2004, 10:03 AM
Yahia!,
when I unpacked your file I did patch it by nopping and changing few bytes and it runs fine. so your protection is history.
[note]
please forgive me for being blunt , but if your protection is what you have just said, it is a stupid protection, how can you have disabled options with registered user.

britedream
Eggi
09-25-2004, 05:19 PM
Just try modifying even one byte in the file and see the result .
You may then understand my TECHNOLOGY .

What is so special in the result? It only shows an access violation.

And why dont you post a file with all protection options?
psyCK0
09-28-2004, 07:52 AM
yahia: i never said anything about the comments. i just remarked that changing the PE header is quite annoying =)
TBD
09-28-2004, 11:09 AM
this thread is closed. it has nothing to do with OllyDebug.


FIND from address upwards?

RCE Messageboard's Regroupment > OllyScript > FIND from address upwards?
RileyRR
09-23-2004, 01:56 AM
Been trying my hand out at scripting and have the following question. Is it possible to use the FIND command such that it searches from the ADDR upwards and not downwards? My entry point into my program is already below the point I want to find. I tried searching from MODULEBASE or CODEBASE, but, since the program is packed, they are no where near where I need to be. I know I can just subtract a certain amount from the program entry point and I will find what I need, but I was hoping that the script could be generic (not sure if subtracting a given amount will work on all types of these packed programs - may land outside the code region). It would be ideal if I could search upwards, or somehow identify the first valid instruction in the module. Thanks for your help.
psyCK0
09-24-2004, 12:15 PM
Noted for the next version. =)


Sporadic VCL violation in Delphi 6 (and 5)

RCE Messageboard's Regroupment > The Heap > Sporadic VCL violation in Delphi 6 (and 5)
karen
09-24-2004, 07:07 AM
hi.
I encounter a Delphi VCL access violation in a sporadic way.
This happends so rarely that I can't reproduce easily the error.

But what I know is that the violation is at adress 002D5934 (in my particular case) and here is the code at this offset :

MOV ECX, DWORD PRT DS:[EAX]

The global routine seems to load in EAX the name of the Delphi component that the mouse pointer is located on. (in the VCL60 module).

Most of the time, the code runs perfectly without raising any error but very rarely, without any reasons, there is a crash !

What could I do to observate the system so that to detect what makes it appear ?

I am almost sure that the memory has a particular state when it crashes.

Maybe am wrong ...

If u got any idea ...

(Sorry for my English ;-)

...


PAra Ricardo

RCE Messageboard's Regroupment > General > PAra Ricardo
Gabbi
09-24-2004, 02:44 PM
Desculpe iniciar um post para isso mas não consegui enviar-te uma PM.

Preciso muito de seus tutorials !!

Poderia enviar-me a direcion para poder download.

Obrigado

jcgabbi@bol.com.br
Ricardo Narvaja
09-25-2004, 08:09 AM
Escribime a mi mail y alli te digo de donde bajarlos

ricnar456@yahoo.com.ar

Ricardo Narvaja
NoLOcKs
12-16-2004, 08:31 AM
Alô Ricardo

Você pode dizer onde baixar os seus tutoriais sobre ARMADILLO .
Tenho um app. com armadillo 3.7.

por favor, responda: nolocks@hotmail.com
Ricardo Narvaja
12-17-2004, 07:59 AM
ricnar456@yahoo.com.ar this is my mail

write me and i send you mi ftp address

Ricardo Narvaja


compare

RCE Messageboard's Regroupment > OllyScript > compare
Eggi
09-24-2004, 02:46 PM
is it possible to do this with ollyscript

cmp dword ptr ss:[ECX],VALUE

i tried it in this way and also cmp [EDX],xxxx but it did not work :/.


Setting Ollydbg as system debugger

RCE Messageboard's Regroupment > General > Setting Ollydbg as system debugger
Triossosolfuro
09-25-2004, 12:53 PM
Hi everybody,

I want to replace Dr. Watson system debugger in Win Xp with Ollydbg, I think you must change the key in regedit but you also need the command line to start Olly and attach it on the crashed program, for example a thing like "C:\Ollydbg.exe -p <pid>" but this does not work, anyone know what is the right command line to attach it?

Thanks
Lord_Looser
09-25-2004, 01:19 PM
start OllyDbg
select menu - Options - Just-in-time debugging
Triossosolfuro
09-25-2004, 06:20 PM
Thanks!!!


a linking problem

RCE Messageboard's Regroupment > Plugins > a linking problem
deli
09-26-2004, 12:31 PM
hi

i used the "stay on top" plugin sources to code my own plugin, because i use vc 6++ , and i had problems with the example plugins which are included in the plugin110.zip package. but with the
"stay on top" source it works now, but now i need a function called
Dumpbackup() and this is not included in the lib which comes with "stay on top".

so if anybody has a lib and a def version 1.10 which works with vc6++. please mail me the files to.

guyincogito2@bk.ru

thank you very much


Scripts for LameCrypt v1.0 & MEW11 SE v1.2

RCE Messageboard's Regroupment > OllyScript > Scripts for LameCrypt v1.0 & MEW11 SE v1.2
DeAtH HaS cOMe
09-27-2004, 07:36 PM
Some scripts I've programmed, I think they work without problems... any bug, please report! Thanks!!

/*
Find target's OEP [ LameCrypt v1.0 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
Date : 09.24.2004
Config: -
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

findop eip, #FFE0#
go $RESULT

sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret

/*
Find target's OEP [ MEW11 SE v1.2 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
Date : 09.26.2004
Config: -
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

sto
findop eip, #C3#
go $RESULT

sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death_ech@phreaker.net WWW: http://www.ech2004.tk"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret


exp(in SoftICE) = ???(in OllyDbg)

RCE Messageboard's Regroupment > General > exp(in SoftICE) = ???(in OllyDbg)
MARcoDEN
10-01-2004, 03:08 PM
SoftICE has the command - exp, which returns an address of function.
For example, "exp GetModuleHandleA" shows "001B:77E79F93 GetModuleHandleA".
Does OllyDbg have anything similar to it?
Ricardo Narvaja
10-01-2004, 06:04 PM
in the commandbar put

? GetModuleHandleA

and return the address of this function

Ricardo Narvaja
MARcoDEN
10-02-2004, 06:55 AM
Thanks!


How to get the code selected by the user in the di

RCE Messageboard's Regroupment > Plugins > How to get the code selected by the user in the di
OllyView
10-02-2004, 03:54 PM
Hello

I have made a program (Delphi), which allows one to convert an ASM snippet from OllyDbg to HTML. (with colors)

I would like to create a plugin from this tool and i have a problem. (Im a newbie) :
How can i get the code selected by the user in the disasm window ? (Like Ctrl-C) :confused: . Do you have any example code i could study ? Thanks for your help.
TQN
10-03-2004, 08:14 AM
Download the ExtraCopy plugin and read the source code.
Good luck !
TQN
OllyView
10-03-2004, 10:40 AM
thanks !!

But it seems to be very complicated ...
And I must translate C++ to Delphi ...
TQN
10-04-2004, 02:00 AM
No, I don't think so. Translating C++ source to Delphi is not a complicate job. You can use my PDK for Delphi. Almost functions and structures are same.
TQN


TNG Delphi Plugin SQK Fix :

RCE Messageboard's Regroupment > Plugins > TNG Delphi Plugin SQK Fix :
Epsylon3
10-02-2004, 10:35 PM
the DLLProc of the sample TQN plugin is not correct

Here is the fix to correct the problem :

procedure DLLMain(dwReason: DWORD);
begin
case dwReason of

DLL_PROCESS_ATTACH:
begin
OutputDebugString(PChar(PLUGIN_NAME+' loaded by DLL_PROCESS_ATTACH'));
// Initialize code here

end;

DLL_PROCESS_DETACH:
begin
OutputDebugString(PChar(PLUGIN_NAME+' unloaded by DLL_PROCESS_DETACH'));
// Uninitialize code here

end;

DLL_THREAD_ATTACH:
begin
end;

DLL_THREAD_DETACH:
begin
end;

end;
end;

exports
...

begin
DllProc := @DllMain;
DllProc(DLL_PROCESS_ATTACH);

g_hmodOlly := GetModuleHandle(nil);
end.
Anonymous
12-01-2004, 09:14 AM
can u tell me where can i download TNG Delphi Plugin SQK?


I need Help

RCE Messageboard's Regroupment > Plugins > I need Help
th_hunter_fox
10-03-2004, 04:14 PM
How to get the olly's plugins?
OllyView
10-03-2004, 05:08 PM
http://ollydbg.win32asmcommunity.net/stuph/


Can’t load program in OllyDbg

RCE Messageboard's Regroupment > Bugs > Can’t load program in OllyDbg
kapusta
10-03-2004, 07:03 PM
Hi!
I can't load simple program in OllyDbg.
System: Windows 2000

Source code of program (console application):

.386
.model flat,stdcall
.code
start:
mov eax, 2
add eax, 3
ret
end start

When I’m trying to load program in OllyDbg, there are no assembly commands in upper left window. When I press F8, debugger displays message:

dont't know how to step because memory at address 793A87B3 is not readable, try to change EIP or pass exception to rpogram

Please, help!
oh me anon
10-04-2004, 08:33 AM
windows 2000 will not load any program that arent linked without any imports it needs atleast one import to be linked to your source code

386
.model flat,stdcall
.code
start:
mov eax, 2
add eax, 3

<-- here use invoke ExitProcess,NULL or whatever api
ret
end start

for this to load in windows 2000

it is not a bug in ollydbg windows 2000 is stricter os than w9x

w9x may load your above code without problems even without import
kapusta
10-04-2004, 12:20 PM
Thanks, oh me anon

But this code is loaded without problems in Windows XP too.
oh me anon
10-05-2004, 08:13 AM
winme < winxp < w95 < w98 < w2k
:) so you now know why


olly 1.10B?

RCE Messageboard's Regroupment > General > olly 1.10B?
kittmaster
10-04-2004, 01:04 PM
When I do an about olly I get 1.10 (no B listed). Is this the B version? Do people that have the B version show 1.10B?

Also where can I get a copy of the C version that everyone says is buggy?

Thanks

Chris
kittmaster
10-06-2004, 04:16 PM
No one knows??
Lord_Looser
10-06-2004, 07:44 PM
...
b) OllyDbg v1.10 (step 2)
c) OllyDbg v1.10 (step 3)
d) OllyDbg v1.10


program detect debugger attachment

RCE Messageboard's Regroupment > General > program detect debugger attachment
kbot
10-09-2004, 04:03 AM
when ever i try attaching ollydbg and other debuggers to this program , it will detect the debugger instantly (... well after i press f9 to resume the process when olly breaks on attaching)... any ideas ? also this is not the work of IsDebuggerPresent because i used the hide debugger plugin + i made a hook on that api to return 0 when testing other debuggers on it
yahia
10-10-2004, 09:59 AM
kbot : You didn't give a link to that program !!
do that so we may help you unpacking it a little if this is your purpose .
Important : IsDebuggerPresent is not the only way that detects if the DEBUGGER loaded or not !!

Regards .
voodoo
12-14-2004, 07:40 PM
Important : IsDebuggerPresent is not the only way that detects if the DEBUGGER loaded or not !!

can explain more?? what are the other ways???
Anonymous
12-15-2004, 03:24 AM
title: "My own tricks to detect OllyDbg" by +Pumqara

http://pe-lib.sourceforge.net/pumqara/html/code_protection/Detecting%2 0OllyDbg/DetectOllyDbg+Pum.htm (http://pe-lib.sourceforge.net/pumqara/html/code_protection/Detecting%20OllyDbg/DetectOllyDbg+Pum.htm)


Back agin with : Friendly Message ............

RCE Messageboard's Regroupment > The Heap > Back agin with : Friendly Message ............
yahia
10-10-2004, 09:53 AM
Like always, tooooooooooooo busy .But changed this time .
TBD : Thanks for your suggestions & solutions .You were right, it was like a troll .But now, no challenge avaiable for members in this forum .
The only challenge is for me which is how to get Britedream, psyCK0 as friends to me .

Britedream : you were the hero in that GAME .Although you didn't beat me completely .3 Levels remaining, but you are not envited to it as enemy !! but as a friend .

psyCK0 : Your comments were real important and meaningful, really .Hope you accept me as a friend TOO .

OK heros, lets continue the old game, every one is invited :

The 3RD level has just been released, so you can download it .
I told TBD that I'm planning on creating a special page for Security Professionals, so every security professional might send me a message to : secpro@yahia-rod.net
Send me every thing related to the way U wanna this page to be, appear, or become .Openions are taken seriously .
First people who are invited are :
TBD, Britedream, psyCK0 .

Accept me as a friend first, then a big thank is for you all .

thanks for understanding .

Regards .
yahia
10-12-2004, 07:14 AM
Previously ...

Britedream : how can you have disabled options with registered user.
Eggi : What is so special in the result? It only shows an access violation.
psyCK0 : changing the PE header is quite annoying .

Answers :

Britedream : This technology is strange maybe, but the truth is when I reach the 4th level, I should disable the rest high levels .And to enable the 3rd level, I should disable the 4th, 2nd, and 1st levels .And so on ..

Eggi : To test what I told you previously, you should use cracking tools, not just OllyDbg .Although Olly might ignore some results .
OllyDbg is a very powerful tool actually .None could deny that ...

psyCK0 : This technology restructure the PE, I don't do this manually .Try measuring the size of standard PE header and my programs header and you gona understand, really .

So, no news till now ! Well I'm still waiting for heros who could unpack my program .
Download it from : http://yahia-rod.net/ROD%20(High%20TECH)%20.zip
If the File was currepted, so please copy the EXE file to a new folder with a name U specify .It gona work .

Please post even comments, put don't be positive .

Regards .
yahia
10-13-2004, 01:30 PM
So, none unpacked my ROD !!!
Anyway, I'm still belive that this forum's members are the best .At least for me .

thanks, regards, & greetings flying to :
TBD, Britedream, & psyCK0 .....

Regards .
TBD
10-14-2004, 03:13 AM
yahia: I dont have time for this project, so I am out ;)

as no responses from other members, maybe you should rethink the approach.
Eggi
10-14-2004, 10:16 AM
there is a tutorial about unpacking your file on exetools.
yahia
10-15-2004, 10:15 AM
Eggi : Thanks for interesting .I really didn't know about those posts in EXETOOLS !!
I was too surprised when I couldn't even register in that forum !?
If you or any EXETOOLS registered user could send me a link or E-Mail me that package, I would be greatful to him .
At least I could test these Tutorials on the new release .
You may E-Mail me to : info@yahia-rod.net

Regards .
yahia
10-24-2004, 09:57 AM
Much much thanks goes to :
TBD, Eggi

Nice tut in exetools, but not that good to beat ROD .


Ollydbg Problem on XP SP2

RCE Messageboard's Regroupment > Bugs > Ollydbg Problem on XP SP2
ferrari
10-12-2004, 12:32 PM
I clean installed XP SP2 and whenever I load any program in Olly I get this error:

Unable to write memory of debugged process (7FFD8002...7FFD8002)

I disabled DEP(Data Execution Prevention) as a suspect but still problem exsist.

I hope the answer isn't-> Uninstall SP2 8-P

Regards.
kittmaster
10-12-2004, 06:10 PM
I'm running SP2 and have no issues at all...........I'll be curious to see what others have to say
yahia
10-13-2004, 01:24 PM
ferrari : You have to give more information about more staff ..
I have SP2 but didn't face any of your troubles !
I don't think it's a bug in OllyDbg, but what you have to think about is :
1- Is your copy of WinXP legal & have no problems ?
2- Did you install a software that controls your Mem or some staff that prevent Olly from accessing memory ?
3- Do you have problems in hardware ?
4- What kinda version of OllyDbg do U use .Is it the final one ?
5- Did you currectly install OllyDbg in your system ?
6- Did you enable/disable administrative options that belongs to Olly's issue ?

Be sure that you carefully did read the above & i hope that you get your answer your self .Because I don't think that you have to uninstall SP2 .

Regards .
ferrari
10-13-2004, 02:17 PM
Another member on ARTeam forum reported the same problem so I'm not the only one with this problem:

Register to view topic.

_http://intechhosting.com/~access/forums/index.php?showtopic=164

>>1- Is your copy of WinXP legal & have no problems ?

Illegal(compensate loss) coz I own legal crap Win ME and olly works on ME but not "Win XP SP2 which I slip streamed and did clean install and then problem started. Before this I installed SP2 on WinXP SP1 and Olly worked with no prob.

>>2- Did you install a software that controls your Mem or some >>staff that prevent Olly from accessing memory ?

NO coz I used Olly just after fresh install of XP SP2 and only basic softs like Office, Nero, Adobe, Zone alaram, AVG Anti virus were installed.

>>3- Do you have problems in hardware ?

No. It worked on Win ME so maybe not.

>>4- What kinda version of OllyDbg do U use .Is it the final one ?

Final

>>5- Did you currectly install OllyDbg in your system ?

Yes coz I'm using it for almost a year now so I'm sure I installed it correctly ;-).

>>6- Did you enable/disable administrative options that belongs to >>Olly's issue ?

First I was logged in as Power user and then I checked as Admin but problem persist.

---
If htere is no solution to this then I'll clean install XP SP1 and then install SP2 coz now I cannot follow the M$ KB to uninstall SP2 maybe coz I slipstreamed SP2 :-(

Hope The above info is enough

Thnx for reply

Ferrari
JDog45
10-13-2004, 03:56 PM
I also have that same issue. Running a clean install of SP2, Olly 1.10
goppit
10-21-2004, 10:08 PM
Hi Ferrari,

Sounds like I got similar setup to yours;

illegal XP Pro into which I slipstreamed SP2 and did clean install
AVGfree
Zonealarm
etc

I use Olly 1.10 final and I get this stupid error too
However it works OK on my old desktop running very lean installation of 98SE. M$ OS is getting worse not better. I also get new XP style BSOD at least twice a week.

If I see any info on this issue I will duplicate it here.

Kindest Regards,

Goppit.
MaRKuS TH DJM
10-24-2004, 01:23 PM
it's a plugin. the Olly Helper plugin.
go to options of this plugin, and disable "Auto Clear Debug Bit". error solved. this plugin doesn't support SP2
aka
10-24-2004, 04:27 PM
i copy the file Psapi.dll from OllyDbg11.zip, then run OllyDbg again and see a dialog box message which wants to overwrite the new one of XP SP2, click No.
JDog45
11-01-2004, 01:47 AM
Works like a charm, thanks MaRKuS TH DJM
alper
11-21-2004, 04:18 PM
MaRKuS TH DJM

markus good crack. pls give me your e-mail

regards.


aspack212 not support

RCE Messageboard's Regroupment > OllyScript > aspack212 not support
rtt
10-14-2004, 07:17 PM
I did download all aspack scripts but not support this program aspack212
how can I unpack this programs

http://www.billybear4kids.com/BigCatRescue/ColoringBook/BigCatColorboo k.exe
(http://www.billybear4kids.com/BigCatRescue/ColoringBook/BigCatColorbook.exe
)

http://www.billybear4kids.com/PrimateRescue/ColoringBook/MonkeyColorbo ok.exe (http://www.billybear4kids.com/PrimateRescue/ColoringBook/MonkeyColorbook.exe)
Anonymous
10-15-2004, 09:22 AM
Hit F7
In dump Hit CTRL+G and type ESP,
hightlight first 2 bytes , and set a BP hardware on access on word
Hit F9,
Hit F7 3 times....you are at OEP
rtt
10-16-2004, 06:07 AM
CTRL+G and type ESP, this key not work
error unknown identifier
Ricardo Narvaja
10-16-2004, 02:12 PM
there are hundreds of tuts of aspack is a protection defeated long time ago, download a tut and unpack is very easy.
And is not type ESP, in the register windows in ESP you right click and FOLLOW IN DUMP, and in the dump window mark the bytes (can be 2 bytes or 4 bytes is the same and put a hardware breakpoint on access, and RUN, when the program stop you are very close to oep trace with f7 twp or three lines and you are in the oep.

Ricardo Narvaja
rtt
10-16-2004, 09:16 PM
thanks for help
I can't not unpack and dump because this program extract a dll plug in.

I did used lordpe (dump) and improc 1.6 (dump fix)
but not run my dumped exe

how can I correct dump and unpack

thanks
Ricardo Narvaja
10-17-2004, 01:39 PM
well is difficult say without look the error of the dumped .

Ricardo Narvaja
Anonymous
10-19-2004, 06:16 AM
I have a similar problem with DLLs too.

I tried to use the simple way with aspackdie (unknown algo 3).
(But it seems that it could not be load using loadlibrary. In RVA there seems to be some mistakes i think)

Anyway, tried to use ollydebug with an aspack script. Found OEP and RVA. Dumping using Olly doesn´t work because of unreadable memory. Using Lordpe and correcting OEP doesn´t work. => not a win32 executable.... *grrr*

In every tut there´s only the OEP correction but the import sections seems to be okay so far. what´s about the relocate table? It seems to be unnecessary?
Ricardo Narvaja
10-19-2004, 08:29 AM
you need use IMPORT RECONSTRUCTOR to fix iat, is similar to an exe.

Ricardo
peace
10-25-2004, 02:29 AM
hi guys i have the same problem but with another prog but pack with aspack 2.12
can some help me please
the prog nam eis photo2dvd studio 3.2.0.6
thanks u
Anonymous
10-26-2004, 12:28 PM
you need use IMPORT RECONSTRUCTOR to fix iat, is similar to an exe.
I used Import Reconstructor but it seems that there are some relocations not correct. Even if i use aspackdie instead of manual unpacking. (aspackdie gives unknown algorithm 3 but seems to work, aspack 2.12b - dll).

The dll can be loaded once but after freelib and new loadlib it crashes while accessing undefined memory area!!

So what´s about this "relocations" the aspack 2.12-dll unpackscript shows? Do i have to change something more than Import Table?

Regards..
friedo72
10-27-2004, 12:00 PM
I have same problem.

Script find´s right OEP but not adress of IAT. Can somebody explain to me what the "Relocate Table" the dll-unpack script get´s is for??? (It´s definitely not the IAT adress...)

I have same problem. DLL can be unpacked but crashes after second load accessing wrong memory. (This could be a relocation problem because in first load the memory is defined but the main code is starting at another adress!)

thx


unknown identifier

RCE Messageboard's Regroupment > General > unknown identifier
rtt
10-14-2004, 07:36 PM
I dont aplied
Ctrl+G
Type [esp] -> Enter

error
unknown identifier


Newbie question about name mangling (VC6.0)

RCE Messageboard's Regroupment > Plugins > Newbie question about name mangling (VC6.0)
faina
10-15-2004, 08:56 AM
Hello there, I would like to learn how to create plugins, so I tried to compile the "bookmark" example, but linker says that

_Pluginreadintfromini

and many other functions are "unresolved external symbol".

I think that I should tell the compiler not to put the underscore before functions declared as "cdecl", but I really cannot find the right place: I'm using Visual Studio 6.0.

Thanks for any help,

faina
faina
10-15-2004, 01:06 PM
I gave a look into Ollydbg.def and it seems that the exported names should have the underscore: I really don't understand what I'm overlooking.

Noone uses Visual Studio 6.0 here?

Thanks,

faina
faina
10-15-2004, 02:37 PM
UPDATE.
I tried with the new "ollydbgvc7.lib" and it worked!
I also tried with the Command Line plugin and, from my early tests, it seems to work as the "official one".

Suggestions from the experts are appreciated anyway.

Thank you,

faina
duhru
03-05-2005, 11:47 PM
I tried with the new "ollydbgvc7.lib" and it worked!

Where did you find ollydbgvc7.lib? It doesn't seem to be in the plug110.zip. I'm also getting the same errors compiling with VS6.
duhru
03-09-2005, 03:06 PM
I found what I need, it's in the "Modified PDK from Alex Clarke":
http://home.t-online.de/home/Ollydbg/sdkupdat.zip


Logging all CALLs and RETNs

RCE Messageboard's Regroupment > Plugins > Logging all CALLs and RETNs
avaldes
10-15-2004, 02:26 PM
On a previous topic about this the answer was to wait for a new script plugin, but I don't know if has already be provided. I'm very interested in tracing the function calls of a program that is a windows service and can't be traced interactively.

Thanks in advance,


Who can unpack ActiveX DLL ??

RCE Messageboard's Regroupment > OllyScript > Who can unpack ActiveX DLL ??
atans
10-16-2004, 07:45 AM
I have ActiveX DLL file ,it is very difficult to crack
<u>the ActiveX DLL detail</u>
closest matches :: section 1
packer :: match
-
telock 0.95 :: 9.52%
telock 0.96 :: 9.52%
telock 0.92a :: 8.33%
ep 0.2 :: 8.00%
lamecrypt 1.0 :: 8.00%
pe-pack 1.0 :: 7.14%
neolite 1.0x [dll/ocx] :: 6.90%
telock 0.60 :: 6.45%
telock 0.90 :: 6.45%
bit-arts crunch 4.0.0.0 :: 6.25%
dbpe/phantasm 0.07 :: 6.25%
dbpe/phantasm 0.8 :: 6.25%
pcpec alpha preview :: 6.25%
pe-diminisher 0.1 :: 6.25%
spec b3 :: 6.25%
stone's pe-encryptor 1.0 :: 6.25%
stone's pe-encryptor 1.13 :: 6.25%
telock 0.98 :: 5.56%
ep 0.1 :: 5.00%
petite 1.3 :: 4.35%
upx 0.99.x [dll] :: 4.35%
winkript 1.0 :: 4.17%
upx 0.80-0.83 [dll] :: 4.17%
upx 0.84-0.90 [dll] :: 4.17%
upx 0.89x [dll] :: 4.17%
upx 0.92-0.94 [dll] :: 4.17%
pe-bundle 2.01.2-2.42 :: 3.70%
pencrypt 1.0 :: 3.70%
pencrypt 2.0 :: 3.70%
codesafe 3.x :: 3.57%
upx 0.99-1.23 [dll] :: 3.57%
pex 0.99b :: 3.57%
private-exe 2.2 :: 3.33%
dbpe/phantasm 1.5b3 :: 3.23%
pc-guard 4.03d-4.05d :: 3.23%
aspack 1.03b :: 3.13%
aspack 1.08.04 :: 3.13%
aspack 2.000 :: 3.13%
aspack 2.001 :: 3.13%
asprotect 1.1c :: 3.13%
asprotect 1.2 [dll/ocx] :: 3.13%
exe32pack 1.36-1.38 :: 3.13%
krypton 0.2 :: 3.13%
krypton 0.3 :: 3.13%
noodlecrypt 2 :: 3.13%
pelocknt 2.01 :: 3.13%
petite 1.2 :: 3.13%
spec b2 :: 3.13%
telock 0.85f :: 3.13%
xcr 0.13 :: 3.13%

if you can crack please write back to me
e-mail: atans_lanhamos@hotmail.com


dump registers to file?

RCE Messageboard's Regroupment > General > dump registers to file?
smarco
10-16-2004, 10:15 PM
Hello! Can I dump all EAX, ACX, EDX to file during the debug?

...Or break every "ASCII" key in that?

I'm sure that I can find registrastion key in that register!

Thanks...!


any simple why to get the debuged process's h

RCE Messageboard's Regroupment > Plugins > any simple why to get the debuged process's h
playar
10-18-2004, 04:48 AM
Is there any simple why to get the handle of the debugged process?
focht
10-22-2004, 08:44 PM
Hi,

you can try

Plugingetvalue( VAL_HPROCESS) // get debuggee handle

for other values like process id, main thread id, main thread handle consult Plugingetvalue() section in plugin.h of ollydbg SDK.

Regards,

A. Focht


A Script to find death list in messagebox

RCE Messageboard's Regroupment > OllyScript > A Script to find death list in messagebox
benina
10-19-2004, 05:05 AM
I used this script to find death list in messagebox. Let check it ,please
my mail: bhdao71@yahoo.com:

//===========================
// Set bp MessageBoxA use method Stack
// Author: Benina
// Date post: 7/10/2004
//Ver: 0.1
// For Newbie
//===========================
var x
var _api
var _dll

mov _api,"MessageBoxA"
mov _dll,"user32.dll"

gpa _api,_dll
cmp $RESULT,0
je label_exit

MSG "Exist one Breakpoint"
bp $RESULT
MSG "Program will run continuos, Press button Reg "
eob follow_in_desASM
run

follow_in_desASM:
bc eip

eob to_user_code
mov x,[esp]

bphws x,"x"
MSG "Program will run continuos, Press button OK "
run
to_user_code:
bpmc
rtu
label_exit:
ret//exits script
benina
10-19-2004, 08:52 AM
using guide:

-First: run program -----> appear a messagebox
-Return Olly, press F12 --->pause
-Run above script
benina
10-19-2004, 09:39 AM
You try it with:
Homepage : http://www.audio-recorder.net
Soft : Audio Recorder Deluxe v2.2.36
File : ard.exe (Microsoft Visual C++ 6.0)
1bitshort
10-19-2004, 10:26 AM
Looks very interesting, but can you please explain it in more detail? What is it for? Exactly how should it be used, and in what order?
Thanks
benina
10-19-2004, 10:44 AM
when you don't find the list in Olly by "search string", you use it---->location that pushed Stack
1bitshort
10-19-2004, 12:45 PM
... huh? :)
benina
10-20-2004, 02:53 AM
I'm sorry. So My English is too bad. If you don't understand than >>> Ignore
benina
10-20-2004, 03:12 AM
the string can be decrypted in runtime and you not found nothing.=========>use it
JDog45
10-20-2004, 06:46 AM
It sounds interesting, we just don't know what to make of it yet....O_o

Or does it just set a bp on messageboxa?
benina
10-20-2004, 10:37 AM
Example with "File : ard.exe":
If you search string "Incorrect code" than you not found nothing.
After use it, you will go to this location:
0041B20C . 68 48644E00 PUSH ard.004E6448 ; ASCII "Help"
0041B211 . 68 58674E00 PUSH ard.004E6758 ; ASCII "Incorrect code"
0041B216 > E8 59E10700 CALL ard.00499374
;))
benina
10-20-2004, 10:47 AM
If you load file ard.exe by W32dasm, you will look:

0041B20C . 68 48644E00 PUSH ard.004E6448 ; ASCII "Help"
0041B211 . 68 58674E00 PUSH ard.004E6758 ; ASCII "Hmbnqqdbs bncd"
0041B216 > E8 59E10700 CALL ard.00499374

So, string "Hmbnqqdbs bncd" is the string "Incorrect code" that be decrypted
JDog45
10-20-2004, 04:57 PM
Oh, I think I get it...:)

Thanks, I'll take a look at it..
benina
10-21-2004, 03:17 AM
:))
Anonymous
10-30-2004, 01:51 AM
Yes if the messageboxa api isn't found once the exe is deadlisted, u can use the script to set a BP on it without tracing through and waiting for modules to load etc.. (I think?) O.o
Bob
12-31-2004, 01:55 PM
It works well, although another bp at end of messagebox routine would be good, and clearing the hw bp.. :)
But, It does indeed pop on messageboxes even ones that you can't find, which is very useful! :)

~BoB~


Resize .CODE section

RCE Messageboard's Regroupment > The Heap > Resize .CODE section
ProfEich
10-19-2004, 04:40 PM
Hi!
Can someone tell me if there is a tool (or maybe a way with Ollydbg) to resize the .CODE section of a file?

Thanks for help
~Bye
1bitshort
10-20-2004, 12:37 AM
I havent done it before but LordPE might be able to
MARcoDEN
10-23-2004, 01:11 PM
You can do it manually with hex-editor. Save the code section, delete a part, load the section from disk and rebuild exe.
Be carefull with other values like SizeOfImage, etc

Good luck :)
ProfEich
10-23-2004, 10:12 PM
Hi!
Thanks for your help.
Well, I needed to add some code. Well the first application helped me through adding a new code section.
Is not that what I wanted to do, but it works :)

Thanks
yahia
10-24-2004, 09:54 AM
@ProfEich
What I got from ur last post is U didn't get what U want ?
If so, please be more specific ?
ProfEich
10-24-2004, 10:45 AM
Hi!
Sorry, I guess my English is just too bad.

First I thought, there might be a tool, which resizes the default code section of an EXE file to add own code and updates the memory addresses which are pointing on things in the .DATA section.
That was, was I wanted before. But adding a new code section at the bottom of the EXE file was enought for my use.

My problem is solved - but on another way I thought before - that's what I wanted to say with my last sentence.
Bob
12-04-2004, 02:14 AM
http://peidplugins.has.it

Plugin for PEiD called SecTool (Section Tool) it's to add sections, or areas in a program. One of the options is to insert space in code section, and the rest of the file is moved and the offsets updated.

~BoB~
Raygun
03-19-2005, 11:08 PM
Whatever LordPe, PEId can do you can do by hand, and better, if you
know a little bit about the structure of PE files.

Eg. whatever you need to do to enlarge the .code section can also be done
by adding a new section of anynew name and then jumping to it (this is what compressors do by the way). Often I've done things like --- replace some
instruction with a jump (to new section or to free space at end of .code section). At the new location first give the overwritten former instruction then
a whole bunch of new stuff (beginners can practice putting a messagebox call there) and finally a jump back to the original code.
This is the classic method for dealing with demo-disabled menu items etc.
Subhobroto Sinha
10-09-2005, 10:47 AM
Hello

I have written a little snippet which :

1. adds a new section to any PE, filling it with only two bytes - 0xEBFE; which is basically a self loop.
2. Replaces the AddressOfEntrypoint to point to this instruction
3. Fill up the whole of the section which previously held the entrypoint with 0xFF

As a result, you will expect ANY PE after "infection" from this snippet will keep on looping (because execution starts in the new section which just has a self loop).
This is really what has happened with 99% of the files I tested my snippet on, but there is one file which plain crashes.

This is an ebook produced by Nata eBook compiler and packed using UPX. I have tested other UPX packed files and they DO NOT crash.

Is seems that the crash is happenning inside NTDLL, and not even inside the program at all. Infact, I feel that it's Windows failing to load the PE and the ebook does not get to execute at all !

And the preliminary debugging I did using Olly and WindBag shows that NTDLL is trying to read from an address which is the value stored at the DWORD beginning from file offset 0x399e0, which is inside section UPX1 !

The ebook which crashes is available at :

http://www.geocities.com/subhobrotosinha/example.zip

The compiled snipet is available at :

http://www.geocities.com/subhobrotosinha/crapper.zip

You first need to patch the ebook using "crapper" by opening a cmd window and typing "crapper example.exe"

Then run the ebook and see Windows give an access violation message.

Any suggestions/comments regarding this scenario ?

PS : Please tryout "crapper" on your other PE EXEs too, and see if it works fine ! Feedback badly wanted !

Regards

Subhobroto Sinha
http://www.geocities.com/subhobrotosinha


Xp only problem?

RCE Messageboard's Regroupment > Plugins > Xp only problem?
Bonzo
10-20-2004, 03:30 PM
Hello all,
I'm adding some new features to cmdline plugin, but I've got a problem...
I added some commands, but one of them is not working on Xp and it's working fine on windows 2003. Command is "eip address", used to move eip.
Well if I do: "eip esp" or "eip address", on windows 2003 everything is ok, if I try the same on windows xp it's not working at all... Writememory command returns error (in windows xp, esp is not even translated to an address, in fact I get a parser error, on w2k3 I have no probz :/).
"eip" is implemented in this way:
1. read memory at current eip and store in a buffer
2. assemble a jmp to given address
3. step on this jump
4. restore memory at old location

Point 4. fails, but only on Xp... Can someone explain me why please? I can't find a logical reason and of coz it's not a memory protection problem, coz the same happens on short jumps (1 or 2 bytes ahead).
If you wish to download a pre-release version you can get it from http://quequero.org/store/various/qcmdline.zip
Of coz sources will be published soon (I have to add some other features). Thanx a lot!
Ricardo Narvaja
10-20-2004, 04:24 PM
And what are the commands availables?

The zip have no help, and when you type one only letter, there are no help, for know the commands.

Ricardo Narvaja
Bonzo
10-20-2004, 04:42 PM
Sry Ricardo,
I provided no help coz I upload it there only for backup :)
Btw until now I added an "e" command:

e eip 9090
e 00401000 bytes...
e register/address bytes

Like in softice, so u can edit memory directly from commandline (btw there seems to be a bug (or a feature, I don't know) in olly plugin engine, the first byte can't be a letter, that is: e eip CC returns error, you have to do something like e eip 90CC).

I added an "eip command":

eip address
eip register

for moving eip, with a special case:

eip eip

that assemble a "jmp eip", often useful when you need time to dump a program :).
A buffer overflow has been fixed ;p and I changed the style, now it's smaller, and I like it more ;p. There's still an history (browsable with up/down) and I added an alias for bp=bpx an bl (breakpoints list) for softice nostalgic ;p for now it's everything, I started to work on it only yestarday :)... But the bug described in my previous post is far from my comprehension :))... Really.

Thanx Ricardo.
Bonzo
10-22-2004, 01:36 PM
I'm trying to change eip using Get/SetThreadContext, I can change eip value in context, but, is there a way to "force" OllyDbg to re-read the context for using the updated eip? Thanx a lot :)
georgenio
11-04-2004, 12:59 AM
</table>okz


Softwrap 6.1.1

RCE Messageboard's Regroupment > General > Softwrap 6.1.1
Vengo
10-20-2004, 11:49 PM
Lo Guys,

First of all, no flaming please. I´m not askin for a crack nor anything. I´m just askin if it´s possible to unpack an Application or Game protected with Softwrap 6.1.1 using the assist of Olidbg.

If it´s possible a small tutorial would be nice :)

I´m still kinda new in disassembling, used w32dsm and hiew b4 with some of those old lame protection shemes

well

move eax,1 ret

;)
MARcoDEN
10-23-2004, 01:07 PM
There is the tutorial in Russian:
http://www.wasm.ru/article.php?article=cool3d
yahia
10-24-2004, 09:51 AM
I've unpacked a program protected with Softwrap to get it's resources (Pics, music, ect) they were real cool, but I don't know what kinda Softwrap version was it ! so if you pass a link to an app protected with 6.1.1, so I would give U a little tut .
MaRKuS TH DJM
10-24-2004, 01:20 PM
i unpacked several apps from different versions. i don't know if there are different protection options for these apps, but i did the following:
Tools:
Olly
Process Explorer by Sysinternals

Make Olly as your JIT (just-in-time) debugger

Load your target in olly, set a BP on ResumeThread. Press F9. maybe your target is showing up trial-screens and so on, skip it. when the ResumeThread breakpoint breaks, go into Process Explorer and search for your exe. there should be now a second process which was started by the other process. right click this, select debug. maybe you get a error-message now, just click ok. go to view > executable modules and double-click the attached exe-file. select the whole code-section, right-click, copy to executable > selection, and in the new window save file. save it under a different name. target should be unpacked now (if all softwrap-types are the same).
Anonymous
12-21-2004, 12:21 AM
Softwrap sucks!!!! I bought a program today, and had to redownload the software a couple hours later and now I can not register the software with the registration number provided to me by Softwrap. They are investigating it. How long does that take?
thomasantony
02-12-2005, 03:53 AM
Hi,
I got a program with softwrap 5.16. I tried dumping it and there is no
.locked process, only the actual one with the name of the exe. I will try MarkuS's method, but can someone translate that russian tut into english. Itried babelfish but its too bad.

Thomas Antony
TBD
02-12-2005, 04:24 AM
topic locked!
reason: cracking related.


Hey i need to know how to change this please guys.

RCE Messageboard's Regroupment > General > Hey i need to know how to change this please guys.
tyler
10-23-2004, 01:32 PM
http://www.rei-net.org/uploaded/meh f0r j00.GIF

could any1 please tell me how i could change this to my php auth system

thanks alot

im a newby :D
JDog45
10-24-2004, 07:57 AM
what does this have to do with Olly????
yahia
10-24-2004, 09:38 AM
@JDog45
Answer to ur Quistion :
The PICTURE ONLY !!!!

@tyler
Goto : http://www.php.net/contact.php and see what's ur problem, then send the currect e-mail .

Regards .


some technic to stop debugger... included OD

RCE Messageboard's Regroupment > General > some technic to stop debugger... included OD
j2innet
10-25-2004, 03:00 AM
some ppl use IsDebuggerPresent flag to switch to another routine to prevent something bla bla.. =)
but now, some technic that some thread behind will monitor for timing. Anything not right, it will kill the thread.
looking forward to have solution to over come this. anyone try this before? write C***ksMe and try it yourself.
1bitshort
10-25-2004, 02:07 PM
yep, most (probably all) debuggers are single-threaded so there's definately plenty of anti-debug party tricks you can play with in other threads
MaRKuS TH DJM
10-28-2004, 05:10 PM
if this thread just checks for timing... why not simply kill it?
Bob
12-03-2004, 06:29 AM
or freeze it


DLL Function Parameter Help

RCE Messageboard's Regroupment > General > DLL Function Parameter Help
FattyMiller
10-26-2004, 04:35 AM
Is there any tutorials out there that I can use to run me through step by step on how to use OllyDBG to run a DLL and have it break in OllyDBG when the program that uses the DLL calls a certain function.

The program that calls the DLL, does that need to be run through Olly or just as you would normally run it through explorer?

And when the DLL breaks at the function, do I just hit Ctrl+A to analyse the data and/or data types for each parameter for that function?

Thanks
Fatty Miller
MARcoDEN
10-27-2004, 02:02 PM
http://home.t-online.de/home/Ollydbg/Loaddll.htm


Decrypting file tutorials for olly debug?

RCE Messageboard's Regroupment > General > Decrypting file tutorials for olly debug?
vaxop
10-27-2004, 11:49 PM
Theres a file Id like to decrypt on my hard drive, another program decrypts it, but doesnt save the decrypted version anywhere on the HD or anything (it just stores it in memory i guess)

Are there any tutorials to decrypt files like these?
yahia
10-28-2004, 12:08 PM
@vaxop
Decryption is not as easy as U mentioned ! First, U need to know what kinda algorithem the ENC is ?
What I got from UR post is U have a Cipher File not EXE ?
And the DEC/ENCryptor program decrypts that file in mem ?
Plz be more specific so I could help U .


Help !!! Aspack 2.12 Not on EXE , Not on DLL...

RCE Messageboard's Regroupment > OllyScript > Help !!! Aspack 2.12 Not on EXE , Not on DLL...
manowar547
10-28-2004, 12:57 PM
Hi !!

I trying to unpack [removed by admin]

I have tried all the scripts..they all gave me the same OEP but nothing work... I'm almost sure the problem is the IAT table but I'm not able to rebuilt it.... Is there someone who ever had this kind of problem ???

Thanks...and please excuse my poor English...I'm French.
Anonymous
10-29-2004, 02:04 PM
just so you know there NO CRACK REQUEST HERE!!!!
manowar547
10-30-2004, 01:02 PM
I've just read me post again and again and I never saw any mention about a crack....I just want to unpack it.
Eggi
10-30-2004, 05:17 PM
its also not a unpacking board... there are better places for posting such things.
manowar547
10-31-2004, 11:19 AM
I think I'm in the OllyScript forum....and if you check the scripts available...they are use to UNPACK... By the way for those little girls who want to post for absolutly nothing read this:

If you can't help....don't post.
If you think I'm wrong...don't post just ignore me.
If you need some friends...don't post and go to chat.
If you want to beat the world's record of #1 poster...continue like you do.

I posted this (yes because I want to crack it but I never asked anybody about that). Just try to unpack it and you will see how hard it is.... It's like a dll and it's OEP is changing evrey time. So if you want to learn (or for educational purpose) just try it.
Anonymous
11-03-2004, 08:50 AM
most of the plugin is a dll.....
although the file extension is xxx.8bf
wat u need to do is just rename the file to .dll and unpack...
and remember after u have unpacked the dll u have to find the relocation for the dll..if not the dll wouldn't work....
Eggi
11-03-2004, 10:53 AM
4. While discussing unpacking-related issues do NEVER EVER mention ANY commercial applications packed with that packer!

btw: oep is 1000. and you can also try to use the loader (photoshop exe) and break on loadlibrary... then use pupe and patch the ep to EBFE.
manowar547
11-05-2004, 09:38 AM
Thanks for the tips...I will try this week-end..
Jimbow
09-27-2005, 09:53 PM
did you suceed in unpacking this 8bf file ? you need to fix reloc if you want that it works. I can't find original reloc and size to fix the dump... any one has a solution ?


Viewing variables in Ollydbg

RCE Messageboard's Regroupment > General > Viewing variables in Ollydbg
annointed3
10-28-2004, 06:03 PM
Hi,

I have a very simple program that I have loaded in olly. Below is source:

#include <iostream.h>
#include <stdlib.h>
#include <conio.h>
#include <stdio.h>

char *user32 = "user32";
char *shellcode ="\x90";

int Funct1()
{
char var1[15];
cout <<&var1<<endl;
cout <<"________1234567890abcd"<<endl;
cout <<"Enter Var1:";
cin>>var1;
cout<<var1<<endl;
return 0;

}

int main()
{
Funct1();
getchar();
return 0;
}

The problem that I have is that I can not find the variables *user32 and *shellcode. I need to find these variables so I can locate their addresses. Please help?
sgdt
10-29-2004, 05:38 PM
None of your code appears to be referencing "user32" or "shellcode", and thus they were probably optimized out. Place a reference and you should be able to find them quite easily.


help me

RCE Messageboard's Regroupment > General > help me
Sinner
10-29-2004, 07:06 AM
my ollydbg keep on auto closing...i cant do anything about first they say my psdpi.dll is lower then the correspoding dll in the system folder...help me.......


Why does Olldbg stop / Pause on this Code?

RCE Messageboard's Regroupment > Announcements > Why does Olldbg stop / Pause on this Code?
edwin56305
10-31-2004, 11:52 AM
Everytime i try to debugg this part of program called unpack
Olldbg stop at line BFF7851D (marked from me with ########### )
Trying to run further with F9 canges registers but nothing else will happen.
EBP or EAX is counting down from 965543 but it stop everytime it has conting
down......
I'm a newbit and i hope someone can help me with explaining me what i am doing
wrong.
Sorry for my bad english....

Thanks.....
Edwin56305

BFF784FC 8D4D 94 LEA ECX, [DWORD SS:EBP-6C]
BFF784FF 897D 9C MOV [DWORD SS:EBP-64], EDI
BFF78502 C745 94 270000C0 MOV [DWORD SS:EBP-6C], C0000027
BFF78509 C745 98 01000000 MOV [DWORD SS:EBP-68], 1
BFF78510 C745 A4 00000000 MOV [DWORD SS:EBP-5C], 0
BFF78517 51 PUSH ECX
BFF78518 E8 D0E1FEFF CALL KERNEL32.BFF666ED
BFF7851D 8B45 08 MOV EAX, [DWORD SS:EBP+8] ###################
BFF78520 8D4D E4 LEA ECX, [DWORD SS:EBP-1C]
BFF78523 51 PUSH ECX
BFF78524 897D E4 MOV [DWORD SS:EBP-1C], EDI
BFF78527 8945 E8 MOV [DWORD SS:EBP-18], EAX
BFF7852A E8 515C0100 CALL KERNEL32.UnhandledExceptionFilte>
BFF7852F FF75 08 PUSH [DWORD SS:EBP+8]
BFF78532 57 PUSH EDI
BFF78533 FF75 10 PUSH [DWORD SS:EBP+10]
oh me anon
11-04-2004, 08:59 AM
C0000027 (UNWIND)
it is a part of structured exception handling
and by the look of address it seems you are using win9x
which inherently does not allow you to trace inside system dlls
so this is a part of some antidebugging trick
you need to find where the exception is triggered from your user mode code and continue from there
if you need to read about seh (structured exception handling)
google for jeremy gordons (goasm author) seh tutorial and read through it


Labels do not persist (or do but don't get re

RCE Messageboard's Regroupment > Bugs > Labels do not persist (or do but don't get re
lickspittle
11-03-2004, 09:54 AM
Hi,

I am experiencing a bug with OllyDbg (the latest version 110 on the homepage) and was hoping someone could help me work around it.

The problem is that when the executable I am debugging calls into a dll, the labels I set there do not restore when I exit and come back to the same point. I think I see some of them in the .udd file, but they aren't used. If I exit ollydbg without finishing running the program, it saves a dllname.udd with information. But I have absolutely no idea how to get labels and comments to persist and restore in the called dll when I reproduce this. The labels and comments for the executable thats running save fine.

Also, when I click the right mouse button, while in the called dll area ollydbg crashes outright. But I don't care about that, I can use keyboard shortcuts to add labels and comments. The restoring of the labels in that area is the thing that would make ollydbg usable (as compared to very hard to use).

Please help,
Thank you.
oh me anon
11-04-2004, 08:49 AM
for labels and comments and breakpoints to persist on any othere
modules that are loaded apart from the main executable
you need to analyse that specific module so that olly is able to save the details in a .udd file that it creates other wise they dont persist
to analyze use ctrl+a in that module
or if you want to analyze every modules that are loaded
use executable modules and right click there and click analyze all modules

btw if you analyze the system modules they will also apply to other
executable that you may load
have fun :)
lickspittle
11-05-2004, 04:37 AM
Thanks for your reply, after some playing around, I think I have it worked out.

The module has to have the same filename, as thats embedded in the .udd file. And I need to "Actualize" the module before I can "Analyse" it (and have its persisted .udd file read in, if it exists) and I can force the .udd file to be flushed out as well with the executable modules menu.

Its looking pretty good,
Thanks again for your help.


PKLite 32

RCE Messageboard's Regroupment > General > PKLite 32
Bruno Maestro
11-03-2004, 07:34 PM
does anybody know as unpack PKLite 32?
JDog45
11-05-2004, 04:08 AM
Yes
TBD
11-05-2004, 04:31 AM
JDog45: a simple yes doesnt help him at all. please elaborate on the subject or stop posting ;)
JDog45
11-05-2004, 06:21 AM
Ok, I thought we weren't supposed to post anything that didn't have to do with Olly???
Bruno Maestro
11-05-2004, 09:48 AM
Please help me, I´m use Olly 1.10.
TBD
11-05-2004, 11:16 AM
JDog45: yeap. but add this to your comment ;)

Bruno Maestro: you asked this before.
have your tried R@dier script ? btw, why are you trying to unpack PKLite ? I hope it has nothing to do with cracking ;)
Bruno Maestro
11-05-2004, 01:56 PM
TBD, no where can i find R@ider Script? I want to unpack PKLite 32 v1.1 so i can know the code of the software.
1bitshort
11-05-2004, 04:51 PM
Eesh, from recent posts you'd think packers like UPX/PKlite etc had some seriously hardcore protection ;)

Bruno,
Packers like UPX, PKLite, FSG and so on really are very trivial to unpack - it takes longer to load a script to automate an unpacking of UPX than to do it manually (to do manually just breakpoint on popad and you'll be just an instruction or two away from the Original Entry Point). Usually all you need to look for is a jump that goes outside the main decompression code. There are things like OEP obfuscation that can work against you there, but that's only in packers with anti-debug capabilities. PKLite has no anti-debug capabilities or other protections, it's just a "vanilla" packer that does nothing more than it needs to.

I just had a quick look at it then (it's been a few years), and here's a disassembly (it's even easier than UPX!) ...

00475000 > $ 68 80504700 PUSH delphi7.00475080 ; /Arg3 = 00475080
00475005 . 68 FCF34A00 PUSH delphi7.004AF3FC ; |Arg2 = 004AF3FC
0047500A . 68 00000000 PUSH 0 ; |Arg1 = 00000000
0047500F . E8 E8A30300 CALL delphi7.004AF3FC ; \delphi7.004AF3FC
00475014 .^E9 5B87FEFF JMP delphi7.0045D774

That last JMP is to the OEP.

Thankyou, please drive through. :D


Question about Animate Over

RCE Messageboard's Regroupment > General > Question about Animate Over
vikrant_kpr
11-05-2004, 06:54 AM
Hi
I am just trying to see how an exe works so i load the exe and use Animate Into.My goal is to see how the code progresses in my EXE moudule only.
But when the animation starts it goes down deep to kernel level i suppose, ie it is going to system level.
Is there any way by which i can restrict the module level.
Any suggestions ?
MARcoDEN
11-05-2004, 01:39 PM
You can set a condition (CTRL+T) and use "Trace into" (CTRL+F11).


No fixed-width fonts? ie. [code] blocks

RCE Messageboard's Regroupment > General > No fixed-width fonts? ie. [code] blocks
1bitshort
11-05-2004, 04:54 PM
Is it not possible to use fixed-width fonts for parts of a post here? Im not familiar with miniBB but most other forum software allows for code blocks like this:
blah blah

It's really annoying not being able to make it fixed-width when posting disassemblies because they become unreadable, and considering the nature of this forum it's definately a necessity!

Thanks


Where is OLLYGHOST plugin

RCE Messageboard's Regroupment > Plugins > Where is OLLYGHOST plugin
omamiblou
11-06-2004, 10:53 AM
I am new to OllyDbg, and I try to find some useful plugins like OllyGhost. Where can I find it?
heishadow
11-08-2004, 11:42 AM
I want also!!
hosiminh
11-09-2004, 05:32 AM
You can get it here :

hxxp://biw.rult.at/vbb/upload/attachment.php?s=c7b821dd85fe62d4e425a60 51a76fba6&postid=1619 (6.1 KB)


FlexLm Seed finder help

RCE Messageboard's Regroupment > The Heap > FlexLm Seed finder help
rodeo_lar
11-06-2004, 01:40 PM
Hi,
I have tried using Haldir's seed finder script. I am trying it on version 8.2a.
It displays the contents of "l_sg" then it displays the contents of l_n_36_buff as "0x000000000" and OllyDbg terminates.
Can someone guide me on this?
regards
rodeo
swlepus
12-14-2004, 10:47 AM
add the following command to the begin of the script, open the log windows to see what happened.

#log
...


Help on FlexLm script

RCE Messageboard's Regroupment > The Heap > Help on FlexLm script
rodeo_lar
11-06-2004, 01:44 PM
Hi,
I have tried using Haldir's seed finder script. I am trying it on version 8.2a.
It displays the contents of "l_sg" then it displays the contents of l_n_36_buff as "0x000000000" and OllyDbg terminates.
Can someone guide me on this?
regards
rodeo


Flash favorite v1.31

RCE Messageboard's Regroupment > General > Flash favorite v1.31
derek olsen
11-06-2004, 03:09 PM
Anyone have a copy of this version of the program they can send me so that i can follow the Armadillo 3xx tutorial
Thanks
Eggi
11-07-2004, 11:19 AM
use google!
vrowang123
12-19-2004, 02:19 AM
yeah~
but u can find a better way to unpack arm from China
heihei~!
vrowang123
12-19-2004, 02:20 AM
yeah~
but u can find a better way to unpack arm from China
heihei~!


Can you hide Olly from 3dsmax?

RCE Messageboard's Regroupment > General > Can you hide Olly from 3dsmax?
roocoon
11-08-2004, 02:32 PM
Hello.
I have a problem starting up 3dsmax 6 or 7 under Softice or Olly.
Has anybody successfully hid Olly from this program and how?
Thanks in advance.


16 bit Program

RCE Messageboard's Regroupment > General > 16 bit Program
TuttoSommato
11-08-2004, 03:51 PM
Hello raga,
I want to debug a 16 bit program but Ollydbg don't open it.
What i do?
Ricardo Narvaja
11-08-2004, 06:44 PM
Ollydbg is a 32 bit debugger, for 16 bits use SOFTICE in W98.

Ricardo
hosiminh
11-09-2004, 05:42 AM
Alternative is to use Trw v1.23 from Liutaotao & Zhunanhao
It will handle old 16-bit "NE" executables.
TuttoSommato
11-09-2004, 07:38 AM
trw is for windows 9x only?
I have Xp!!
hosiminh
11-09-2004, 08:20 AM
Then try to debug it with "Borland Turbo Debugger v5.5"

Search for "td55.zip" in your favourite web browser :) in case you don't have it.
oh me anon
11-09-2004, 10:44 AM
there is a tr252 by liutaotoa it handles 16bit executables in nt (i ve used in in w2k) may be you should look for it


Load minidump into OllyDbg?

RCE Messageboard's Regroupment > General > Load minidump into OllyDbg?
nothingmuch
11-09-2004, 08:42 PM
Hi All,

Does anyone know of a way (or plugin) to load a minidump (or full user dump) into OllyDbg?

Thanks


commandline history?

RCE Messageboard's Regroupment > General > commandline history?
garryw
11-12-2004, 08:21 PM
Its been a while so my old brain may be playing tricks, is there a commandline history?, if so any ideas why it would no longer be displayed.
tia
oh me anon
11-13-2004, 07:50 AM
the commandline history is shown in the dropdown box in
debug-->arguments iirc it saves the last five arguments that were passed to it also you can look into the ollydbg.ini
if you wish to see what arguments have been saved
garryw
11-13-2004, 08:39 AM
hi oh me anon, should have made it clearer I really meant breakpoint history in the commandline plugin.
thanks again
oh me anon
11-13-2004, 10:46 AM
may be i should suggest you to "RTFM"
or click the little arrow in the flyup box
garryw
11-13-2004, 11:07 AM
If I hadn't RTFM oh me anon you would be right, I am talking about retaining the bp history after a ctrl-f2, which I thought olly did. Btw wouldn't harm you you to leave out the "F" and just use "RTM" would it?, nobody forces you to reply so GGF ok?.
oh me anon
11-13-2004, 11:15 AM
well now i forcefully suggest you to "RTFM"
if you cant type brk


CommandLine args?

RCE Messageboard's Regroupment > General > CommandLine args?
garryw
11-12-2004, 08:30 PM
debug a program that requires commandline args, how to enter args?
tia
oh me anon
11-13-2004, 07:42 AM
debug--->argument--->type your argument -->press ok --->olly warn about restart---->press ok---->restart

:)
garryw
11-13-2004, 08:33 AM
omg my eyes have gone too :) thanks oh me anon


Detecting Asm Instruction Execution

RCE Messageboard's Regroupment > The Heap > Detecting Asm Instruction Execution
Damaged Soul
11-13-2004, 07:41 AM
Is there any way to detect if a certain code instruction in memory has been executed? And if it has been executed, I want to run one of my own functions in my program. Someone explained to me that SetUnhandledExceptionFilter in the Win32 API could be used to detect any changes made to memory, but he wasn't sure if it could be used to detect execution of certain part of memory. And I'm also not too sure how to use that function anyways, as I can't seem to find too many examples of its use.

So my question is, can I detect when an assembly code instruction in memory has been executed using that function or perhaps some other way entirely?

It ocurred to me that this somehow must be possible, considering debuggers such as Olly are able to set breakpoints at certain points in memory. I just am not sure how to go about coding that sort of thing myself. All I would need to do is sort of set up a breakpoint at a memory location and execute my code instead of stopping execution of the program entirely.

Also, I need to detect when more than one section of code has been executed. So if such and such a code was executed at one address I need to call one of my own functions, but if it's at another address I would call a different function. These "events" that I would like to hook could potentially happen at any time. And I would definitely need to be able to call my functions more than one time as well.

Any help with this would be GREATLY appreciated.
oh me anon
11-13-2004, 07:46 AM
well simplest way is to set a break point and execute your app
if that command is executed olly will break
and you know it will be executed :)

btw try experimenting with hittrace it marks all code that are executed with a red marker
Damaged Soul
11-13-2004, 08:54 AM
Right, I understand how to use a debugger to accomplish this, that's why I referenced that.

Except how would I go about coding this myself? I imagine using structured exception handling would be a way of dealing with it, but I have tried that already and haven't had any success. I think I might be doing it wrong though.

I think I should refer you to what I said on another forum to help you to understand my problem a bit more, particularly my last reply in the post here (http://www.vbforums.com/showthread.php?s=&threadid=312149). My name is Dual Reality there. I hope that helps a bit more...
oh me anon
11-13-2004, 11:01 AM
coding what if you want to break on this this address

100841C7 8B5500 mov edx,[ebp+00h]

load the exe in ollydbg
click on cpu pane
press ctrl+g and type 100841c7 and press ok
you will be on this line
press f2 you will see the break point is set
now press f9 and execute your app
if this instruction is going to be executed olly will pause the execution and break on this line eip will point to this line which is the next instruction that will be executed

now what you want to do from here is upto you to decide
you can assemble anything you want in place in ollydbg

so that if you want to change that to jump to your code
assemble jmp 0x0040******* now if you single step you will land in the new address

i dont know why you are mixing seh and filling up all bytes with 0xcc
i actually did not understand one bit of that post

what is that utilpatch blah
why not use winapi WriteProcessMemory ,ReadProcessMemory etc

also i dont know if you would be able to use c++ directly to access
registers and stack contents
i think you should use inline asm to be able to access regs and stack from c or from any high level languages

please clarify what you are trying to achieve

edit
also using this position may not be correct 0x000841C7
if it is raw file then you need to use correct raw offset
if it loaded memory then you have to use 0x100084c17
writing to some 841c7 randomly without knowing that it will write to the correct position may lead to crashes only
Damaged Soul
11-13-2004, 12:58 PM
A couple things... here's the code for UTIL_PatchMemory_Byte. I also have other version for Words, Dwords, etc. The reason I am using that is because I plan on using this on Linux as well. So I already have linux compatible versions of those functions. As far as what I'm trying to achieve right now though, I want to get it working on Windows first before I attempt Linux.

void UTIL_PatchMemory_Byte(unsigned long address, char patch, bool gameDllContext) {
unsigned long realAddress;

if (gameDllContext) {
realAddress = gameDllAddress + address;
} else {
realAddress = address;
}

#ifdef __linux__
mprotect((void*)realAddress, BYTE_BYTES, PROT_WRITE);
#else
unsigned long oldProtect;
VirtualProtect((void*)realAddress, BYTE_BYTES, PAGE_READWRITE, &oldProtect);
#endif

*(char*)realAddress = patch;

#ifdef __linux__
mprotect((void*)realAddress, BYTE_BYTES, PROT_EXEC);
#else
VirtualProtect((void*)realAddress, BYTE_BYTES, oldProtect, &oldProtect);
#endif
}

gameDllAddress is defined and set elsewhere when my program is started. It holds the starting address of the DLL I am try to "hack". And you are right about my offset being raw, but with the use of my UTIL function it does get the correct address in memory. I know this already because I have used it elsewhere in project. Also BYTE_BYTES is defined as 1.

The reason I was trying to use SEH was because I thought that was how I could handle an exception which would have been thrown by me patching those specific bytes.

EDIT: If necessary, I'm willing to share my entire source if it will help, btw.
oh me anon
11-13-2004, 03:33 PM
if you are sure the address i correct then i have no problems with it
i was just raising a concern

anyway i just took a simple exe and transformed it to handle an int3
it is completely in asm i did it on the spot with ollydbg assembling
it works and it is just for an idea (i have not error proofed it not validated it for anything other than an int3
i have commented out the code you have to know asm a little to understand it

original
00401000 >PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
00401002 PUSH MSGBOX.00403000 ; |Title = "Iczelion's tutorial no.2"
00401007 PUSH MSGBOX.00403019 ; |Text = "Win32 Assembly is Great!"
0040100C PUSH 0 ; |hOwner = NULL
0040100E CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401013 PUSH 0 ; /ExitCode = 0
00401015 CALL <JMP.&KERNEL32.ExitProcess> ; \ExitProcess
0040101A JMP DWORD PTR DS:[<&KERNEL32.Exit>
00401020 JMP DWORD PTR DS:[<&USER32.Messag>

modified code
00401000 >JMP SHORT MSGBOX10.00401026 ; jump to set handler
00401002 PUSH MSGBOX10.00403000 ; not executed
00401007 INT3 ; |setting int3 change it to nop to execute without seh
00401008 NOP ; |not executed
00401009 NOP ; |not executed
0040100A NOP ; |not executed
0040100B NOP ; |not executed
0040100C PUSH 0 ; |returns here from exception handler
0040100E CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401013 PUSH 0 ; /ExitCode = 0
00401015 CALL <JMP.&KERNEL32.ExitProcess> ; \ExitProcess
0040101A JMP DWORD PTR DS:[<&KERNEL32.ExitP>
00401020 JMP DWORD PTR DS:[<&USER32.Message>
00401026 PUSH MSGBOX10.00401056 ; SE handler installation
0040102B PUSH DWORD PTR FS:[0]
00401032 MOV DWORD PTR FS:[0],ESP
00401039 PUSH 0
0040103B PUSH MSGBOX10.00403019 ; ASCII "Win32 Assembly is Great!"
00401040 PUSH MSGBOX10.00403000 ; ASCII "Iczelion's tutorial no.2"
00401045 JMP SHORT MSGBOX10.00401007

seh handler
00401056 ENTER 0,0 ; Structured exception handler
0040105A PUSH EBX
0040105B PUSH ESI
0040105C PUSH EDI
0040105D MOV EBX,DWORD PTR SS:[EBP+8]
00401060 TEST DWORD PTR DS:[EBX+4],6
00401067 JNZ SHORT MSGBOX10.00401087
00401069 CMP DWORD PTR DS:[EBX],80000003
0040106F JNZ SHORT MSGBOX10.00401087
00401071 MOV EBX,DWORD PTR SS:[EBP+10]
00401074 MOV EAX,0
00401079 ADD DWORD PTR DS:[EBX+B8],4
00401080 JMP SHORT MSGBOX10.00401087
00401082 MOV EAX,1
00401087 POP EDI
00401088 POP ESI
00401089 POP EBX
0040108A LEAVE
0040108B RETN

ask if you cant understand the code


Setting break points on DLL

RCE Messageboard's Regroupment > General > Setting break points on DLL
rodeo_lar
11-15-2004, 12:27 AM
Hi,
I am trying to follow the tutorial on the link below.
http://home.t-online.de/home/Ollydbg/Loaddll.htm
on how to use OllyDBG to run a DLL and have it break in OllyDBG when the program that uses the DLL calls a certain function.
The problem i am facing is when i load the DLL and try to use "Debug|Call DLL Export"
It flashes an error message "UNABLE TO LOCATE DLL".
Can some one please help me on this
Lord_Looser
11-15-2004, 05:47 AM
http://www.sysinternals.com/ntw2k/source/filemon.shtml

Use filemon to look where the file is searched.
Copy missed DLL in the search listing/folder.
rodeo_lar
11-15-2004, 10:55 AM
Hi,
I tried using filemon the following are the files that were listed as not found.
what is obvious is that it first finds a dll in a particualr place for example "NETAPI32.DLL" in "C:\WINDOWS\SYSTEM\" which a sucess and then tries to locate the same in its local directory and says file not found.
At the point when i use "CALL DLL Export" no missing file is reported by filemon.
could u suggest anyother cause or have i assesed this situation wrongly.

Ollydbg:FFF9EAA7 Open C:\WINDOWS\SYSTEM\NETAPI32.DLL SUCCESS
Ollydbg:FFF9EAA7 Attributes C:\WINDOWS\SYSTEM\NETAPI32.DLL SUCCESS
Ollydbg:FFF9EAA7 Close C:\WINDOWS\SYSTEM\NETAPI32.DLL SUCCESS
Ollydbg:FFF9EAA7 Open C:\ODBG\NETAPI32.DLL
NOTFOUND OPENEXISTING
ollydbg:FFF9EAA7 Open C:\ODBG\NETAPI32.DLL
NOTFOUND OPENEXISTING

Ollydbg:FFF9EAA7 Attributes C:\WINDOWS\SYSTEM\NETBIOS.DLL
SUCCESS Get Modify
Ollydbg:FFF9EAA7 Close C:\WINDOWS\SYSTEM\NETBIOS.DLL SUCCESS CLOSE_FINAL
Ollydbg:FFF9EAA7 Open C:\ODBG\NETBIOS.DLL NOTFOUND OPENEXISTING
Ollydbg:FFF9EAA7 Open C:\ODBG\NETBIOS.DLL NOTFOUND OPENEXISTING

Ollydbg:FFF9EAA7 Close C:\TEST\BIN\TARGET.DLL SUCCESS CLOSE_FINAL

Ollydbg:FFF9EAA7 Open C:\ODBG\TARGET.DLL NOTFOUND OPENEXISTING

Ollydbg:FFF9EAA7 Close C:\WINDOWS\SYSTEM\KERNEL32.DLL SUCCESS CLOSE_FINAL
Ollydbg:FFF9EAA7 Open C:\ODBG\KERNEL32.DLL
NOTFOUND OPENEXISTING READONLY
Noman
12-03-2004, 12:43 PM
Dear
Quote

i have a problem with me.

A simple DLL which is made by me opened by OLLYDBG .

While Clicking on Debug ->CALL DLL EXPORT
Dialog box is opened.from which i can see how many functions this method contain

but when another DLL is loaded, CLicking on the same opetion, no dialog is appeared and option is disabled
Pls reply it
Ok
Lord_Looser
12-03-2004, 02:45 PM
First press run button (F9) till OllyDbg DLL Loader appears in taskbar.


error in ollyscript

RCE Messageboard's Regroupment > OllyScript > error in ollyscript
britedream
11-15-2004, 09:04 AM
Hi psyCk0

I was testing some code and found that you used unsigned jumps , which produced logical errors:

var test

mov test,5

sub test,6

cmp test,5

ja notgood

ret
notgood:
msg "not good"
ret
it jumps , which is wrong. it compared 255 (-1) with 5

if jg [ signed jumps]is used insteadof ja [unsigned jumps] would produced the correct action.

Regards.

Britedreams
psyCK0
11-19-2004, 09:16 AM
Hey britedream,
Will correct this ASAP...
The project is moving kinda slow atm, coz of work and stuff...
But a patch will be made available...


IsDebuggerPresent

RCE Messageboard's Regroupment > Plugins > IsDebuggerPresent
Tom Smith
11-16-2004, 04:30 PM
I downloaded the IsDebuggerPresent plugin for Ollydbg 1.10.

It shows up at the top menu when I run Ollydbg.

Exactly how do I use the plugin?

Do I choose, in the Plugins>IsDebuggerPresent drop down menu, Hide or Restore or Option?

Or is the plugin always "on".

I wish the thing came with instructions.

I have an "IsDebuggerPresent" call in the program I am debugging, and Ollydbg pauses and will not resume when I attach it.

I am a newbie, so if you respond, please keep is simple and clear.

-Tom
TomSmith3@hotmail.com
Lord_Looser
11-16-2004, 07:16 PM
If “AutoHide” is deactivated:
start OllyDbg, debug application, hide...

much better plugin:
HideDebugger 1.2
Tom Smith
11-16-2004, 08:13 PM
Can you be a little clearer?

You're saying to put a checkmark in the AutoHide box?

And that will hide my debugger from the program I am debugging?

How many milliseconds should I enter?

And what if their is another anti-debugger scheme in there, how will I know if the IsDebuggerPresent plugin worked or failed, if another anti-debugger scheme is in play?

Do you have a link for HideDebugger 1.2?

Does it work with Ollydbg?

-Tom Smith
Tom_Smith3@hotmail.com
Lord_Looser
11-17-2004, 04:34 AM
OllyDbg plugin HideDebugger v1.2
http://cracklab.ru/f/files/_1144129978__HideDebugger1.2.1.rar
“This plugin allows to hide debugger from IsDebuggerPresent API function.“
rave
11-17-2004, 02:53 PM
Lord_Looser

i m a newbie .i call IsDebuggerPresent() but n open the file in ollydbg but it didn't work
garryw
11-20-2004, 09:12 AM
in what way is HideDebugger 1.2 a "much better plugin" ?, been using IsDebuggerPresent plugin for quite a while without problems.
Lord_Looser
11-21-2004, 05:28 AM
Perhaps I should say, easier to use and more functional to hide debugger. A nice addition. Only my opinion.


Removing hardware breakpoints

RCE Messageboard's Regroupment > General > Removing hardware breakpoints
Dikkesnoek
11-19-2004, 12:05 PM
Hi,

I am playing around with this great debugger. I've a question about breakpoints. I want to remove hardware breakpoints but I could not find where to disable or remove these kind of bp's.

Regards,

Marc
sgdt
11-19-2004, 01:35 PM
From the "Debug" menu, select "Hardware BreakPoints", and click one or more of the four "Delete" buttons.


Kegening by Ollydbg

RCE Messageboard's Regroupment > General > Kegening by Ollydbg
voodoo
11-21-2004, 06:40 AM
Is there any way to make a keygen by using ollydbg????

(I'm full newbie in keygening)

thanks.
j_petrucci
11-21-2004, 08:59 AM
definitely yes! :-)

just download and follow one of the hundreds tutorial you can find on the net... if you are italian, go here http://quequero.org

bye
Eggi
11-21-2004, 10:50 AM
I think a compiler would be better for making a keygen ;).
voodoo
11-22-2004, 07:36 AM
which one do you prefer??
Eggi
11-22-2004, 05:36 PM
i use an c compiler... but you should try a few languages and then decide which one you like best.


Dll and Debugger

RCE Messageboard's Regroupment > The Heap > Dll and Debugger
Kleopater
11-22-2004, 06:19 AM
Hello, im playing with my own debugger. I wrote simple debugger with breakpoints support which works very good. But the problem is when i try put code into dll, i really need it in dll which will be injected into proccess (eip manipulation - redirecting w/o patching). As i said in exe there is no problem, but with dll is - i cant set seh handler because of crash, i can put breakpoint, but when the func is executed proccess closes. Sorry for bad english.
focht
12-05-2004, 11:21 AM
i cant set seh handler because of crash, i can put breakpoint, but when the func is executed proccess closes.

Could you elaborate this a bit?
How do you setup SEH and breakpoints?

Regards


Need help using Ollydbg and NASM

RCE Messageboard's Regroupment > General > Need help using Ollydbg and NASM
pityocamptes
11-22-2004, 12:43 PM
Can someone please give me detailed steps on how to use ollydbg with NASM? Everytime I try to open a file in ollydbg it keeps telling me its not open or readable? Not sure why. Never used this debugger before. Any help appreciated. Thanks.
quasar
11-29-2004, 11:33 AM
Do link your exes by Alink? Ollydbg always worked for me with NASM exex linked by Alink or MS-LINK. Please attach your exe.


test post (forum working?)

RCE Messageboard's Regroupment > The Heap > test post (forum working?)
Harold
11-28-2004, 08:31 AM
test
oh me anon
11-28-2004, 12:01 PM
wow it is back thanks harold btw have you recuperated the win32asm too ??
going there to look :)

well posted it and editing it so test purpose is also solved

where has stuph gone :)
is it gonna be up again

anyway some thing is bette than nothing
TBD
11-29-2004, 04:44 AM
I think I will have the Stuph page disabled for a while (till OD 2.0)
Lord_Looser
11-29-2004, 06:03 AM
missing thread icons
http://ollydbg.win32asmcommunity.net/img/forum_icons/info.gif
.../windows.gif
.../sugg.gif
.../info.gif
.../earth.gif
.../generic.gif
.../cells.gif
TBD
11-29-2004, 07:14 AM
Lord_Looser yep. we are working on having the forum back on 101% :)
Bob
12-03-2004, 06:17 AM
Hurrah!

Great to see the forum back again, thanks Harold & team ! :)

~BoB~
Harold
12-04-2004, 08:24 AM
everything I had from stuph is online again, but I never kept a backup of that really

I assumed TBD would do that
tbd-admin
12-06-2004, 04:20 AM
the Stuph page will reopen on OD 2.0 release


Where is the link to the plugins download page?

RCE Messageboard's Regroupment > Plugins > Where is the link to the plugins download page?
Anonymous
11-29-2004, 03:53 PM
I can't find it.

Thx in advance!

Crick
Crick
11-29-2004, 04:06 PM
I can't find it.

I've found the answer:

TBD Said: I think I will have the Stuph page disabled for a while (till OD 2.0)

Sorry!
hosiminh
11-30-2004, 08:03 AM
Untill Stuph page is offline you can find some plugins here:

hxxp://www.pediy.com/tools/Debuggers/ollydbg/plugin.htm

Point-h plugin
hxxp://crackslatinos.hispadominio.net/paginas/tools.htm


Problem with coding Plugin

RCE Messageboard's Regroupment > Plugins > Problem with coding Plugin
fghmf
11-30-2004, 12:21 PM
hello,

i want to start writing a plugin for ollydbg. i started reading the manual today, so im totally new to it. what i need is to read the selected rows
hosiminh
11-30-2004, 03:05 PM
http://home.t-online.de/home/Ollydbg/pdk.htm
fghmf
12-01-2004, 04:05 AM
this post is not complete, please read the thread below! thanks.


Problem with coding Plugin

RCE Messageboard's Regroupment > Plugins > Problem with coding Plugin
fghmf
11-30-2004, 12:24 PM
hello,

i want to start writing a plugin for ollydbg. i started reading the manual today, so im totally new to it. what i need is to read the selected rows by the user...i found the function "Getsortedbyselection" but it seems like this function only gets one selected row. what i need is to get all selected rows. does anybody knows how to do that? thanks for your help!!!


Best for keygening

RCE Messageboard's Regroupment > General > Best for keygening
voodoo
11-30-2004, 06:05 PM
what is better for keygening C#.net or C++.net???

thanks.
sgdt
12-01-2004, 02:21 PM
IMHO, that's a bit like asking "Which has more towing capacity, a Honda Mo-Ped, or a VW Bug?".

If you like the .net languages, great, use them. You can even create a keygen in Java if it's a language you like and are comfortable with.

Personally, I like VC++ 6 and MASM (frequently use RADASM front end for things with UI's like keygens).

The reason is that keygenning can frequently be accomplished by cut-paste'ing code right from the target. The .net languages make using ASM a pain, but VC++ 6 and MASM make it easy.

Hope this makes sense. If you are going to be "coding", use the language your comfortable with. But a lot of keygenning doesn't require much coding at all IF you use a language that supports inline asm.
voodoo
12-01-2004, 04:46 PM
Thanks for your comments, almost every one say VC++ is the best.
An other quastion: Does VC++ soppurt inline asm????
thx
sgdt
12-01-2004, 11:58 PM
VC++ (6) does support inline asm, just wrap the entire piece in an _asm { } block.
Anonymous
12-04-2004, 09:15 AM
What about VC++.net???

Dose it work without .net firmwork????
Teerayoot
12-12-2004, 06:50 PM
What about VC++.net???

Dose it work without .net firmwork????

Yes,it work with out .NET.

I very like NET language ,it great cauze u can write your code(class) and can use(inherit) in anothor language.

ANd Now .Net is Open sourced !
Anonymous
12-14-2004, 07:20 PM
and Vb.net????
does it support inline asm????
Teerayoot
12-16-2004, 02:53 PM
and Vb.net????
does it support inline asm????

nope.
As i known
Pascal ,C++ are supported ,other not.


A new Powerful Plugins for OD

RCE Messageboard's Regroupment > Plugins > A new Powerful Plugins for OD
winroot
12-01-2004, 11:49 AM
http://www.luocong.com/om/

OllyMachine is a plugin for OllyDbg. We can use an assembly-like language called OllyMachine Script to write a script to automate OllyDbg.

OllyMachine have more API to write script.
TBD
12-02-2004, 05:04 AM
excellent plugin, similar to OllyScript. thanks for sharing!
Anonymous
12-02-2004, 11:00 AM
and works on windows98.......very good

thanks...
Eggi
12-02-2004, 05:50 PM
maybe you can add a command like the gn command in ollyscript which gets from an api adress the name of the dll and the api name.
psyCK0
12-03-2004, 09:58 AM
just curious, did you use any of my code for OSC or did you rewrite it all from scratch?


Armadillo

RCE Messageboard's Regroupment > OllyScript > Armadillo
r99
12-03-2004, 05:11 AM
who can get ARMADiLLO DETECTiVE v1.00 for olly script
from forum exetools.com?
psyCK0
12-03-2004, 10:01 AM
check OSC site


New OllyDbG Plugin

RCE Messageboard's Regroupment > Plugins > New OllyDbG Plugin
Anonymous
12-03-2004, 06:30 AM
Name: Asm2Clipboard
Version: 0.1
Url: http://www2.100mb4free.de/fatmike/OllyDbgPlugIn/Asm2Clipboard.dll

Description:
This little plugin can be used to copy selected asm code to clipboard. It only copies the offsets, the disassemblies and the comments to clipboard. It uses C/C++ comment delimiters for the offsets and the comments. Therefore the plugin helps you using inline assembler in your C/C++ projects.
Theres a second function which only copies the disassemblies to clipboard and fixes the jump destinations using inline assembler syntax.

Comment:
This plugin is still under development. The functions described in the "Descriptions" section work fine, but will probably improved in the future....Please let me know what you think of this plugin.

Fatmike
kittmaster
12-07-2004, 12:19 PM
this will make things a lot easier.

sweet
Moodsky
12-26-2004, 11:01 AM
very good, thank.
Lenus
12-27-2004, 02:17 AM
i have used it,it is a good plugin.
liuyilin
12-28-2004, 01:57 AM
i have used it too,it realy is a good plugin.
Fatmike
04-05-2005, 07:25 PM
The link doesnt exist anymore.
Please use http://www.cip-re.info/tools_download.php?id=32&dl=1
to download the plugin.

Fatmike
TBD
04-06-2005, 03:35 AM
Fatmike This plugin is still under development
please tell me when is released to add it to Stuph page. thanks
Fatmike
04-06-2005, 06:51 AM
@TBD

i dont have time to keep on developing it, the functions in the plugin all work fine, i havent found any bugs until now. u can add it to stuph page.

fatty
Kyd
05-08-2005, 09:25 AM
link dropped (
TBD
05-08-2005, 05:22 PM
Kyd: it is on Stuph page
oh me anon
05-29-2005, 12:34 PM
FatMike,
i dont know if you are still working on it
but i happened to use it for ripping code from (position independent code)
kernel32.dll paste it in masm for assmbling it sure works fine apart from this small problem which is kinda tedious

masm doesnt assemble this code as it is
mov eax dword ptr ds :[esp+c]
it would treat the c as a label and issue warning
one has to add 0 in front and h in end
like mov eax,dword ptr ds:[esp+0ch]

also masm assumes decimal radix
so mov eax,fs:[30]
if ripped and pasted directly will assemble as
mov eax,fs:[1e]

could you possibly add 0 and h to the fixed asm command
then it would be perfect to rip and recode

thanks and regards
Fatmike
10-25-2005, 05:35 PM
Thanks for your comment. Right now im really busy, so i cant promise when or if i will publish another version...if so, i will sure let you know.

greetings, mike
Fatmike
11-19-2005, 04:19 PM
There's a new version available of Asm2Clipboard (Version 0.2).
Full code ripping support for MASM and Inline ASM for C/C++.
I hope you like it.

Dowload:

http://rapidshare.de/files/7860111/Asm2Clipboard_V0_2.zip.html

Fatmike
Fatmike
11-19-2005, 04:21 PM
@TBD : You can add it to stuph page if you want!
Edit: I found 2 bugs (see below), dont add it to stuff page, i will fix it asap
HolyView
11-19-2005, 07:04 PM
@Fatmike : source code ???? :'(
pleeaaassseeee :)
Fatmike
11-19-2005, 10:29 PM
Known bugs:

1. If theres a constant with a leading 0, the code ripping won't work for
inline assembler
Example: and ecx,0FF will lead to and ecx,00xFF instead of and ecx,0xFF

2. If theres a constant a,b,c,d,e,ea,eb,ec or ed the code might be
ripped wrong
Example: CMP DWORD PTR DS:[ECX+74],0E will lead to
CMP DWORD PTR DS:[0EhCX+074h],0E instead of
CMP DWORD PTR DS:[ECX+074h],0Eh
because the 'E' of ECX is interpreted as the constant :-/

You need to correct this by yourself when you ripped some code, but i will fix these bugs asap and post the new file when im done.
Besides these 2 bugs the plugin works fine and saves time ripping code.
Download the current version here:

http://rapidshare.de/files/7860111/Asm2Clipboard_V0_2.zip.html

Fatmike
Epsylon3
11-20-2005, 10:58 PM
i think that could be fixed fast with regex....


Fullscreen Bug

RCE Messageboard's Regroupment > Bugs > Fullscreen Bug
bsaksida
12-04-2004, 05:29 PM
When you set breakpoint on memory accsess on any game with fullscreen. Then it will stop a game, but OllyDbg Will not be seen. I cant switch to any process except Task Manager. I am using Windows Media Center 2005 with sp2
focht
12-05-2004, 10:47 AM
Its not a bug - its by design.

Debug it in windowed mode if you can.
Most games have an option to run in windowed mode.

If not - you could make use of dual-monitor debugging (if you have them).

Another (more advanced) possibility is to hook directx interface of game to force it into windowed mode.
That usually means preventing "SetCooperativeLevel()" to use "DDSCL_EXCLUSIVE | DDSCL_FULLSCREEN" flags from being set.

Be aware: even in windowed mode, the are problems to force directx apps to lose input devices when hitting breakpoints (e.g. mouse can't be grabbed sometimes).

Regards


conditional log expression question

RCE Messageboard's Regroupment > General > conditional log expression question
kotzeesser
12-04-2004, 05:47 PM
hi

i need to print out two or more memoryvalues in one condition log breakpoint

i tried expressions like "[esp+4] + [esp+8]" but it wont work.

how could i do this?

thxalot
focht
12-05-2004, 11:18 AM
Hi,

i dont think its possible to evaluate multiple expressions at one log condition using the dialog gui (you get error "extra characters on line").

A quick solution would be to "waste" multiple log breakpoints before the desired instruction (if possible).

Another solution would be to use ollydbg's plugin api (but not the way the gui uses it).
You have to setup conditional bp (like you do normally) but without multiple expressions because the underlying ollydbg doesnt handle it.
When the debugger breaks and the plugin callback is entered you could evaluate any number of expressions one-by-one using api (and log them out) before resuming.

Regards
kotzeesser
12-06-2004, 01:09 PM
ok, thx


question about reading and writing sth to CPU window in a plugin

RCE Messageboard's Regroupment > Plugins > question about reading and writing sth to CPU window in a plugin
Anonymous
12-06-2004, 05:21 AM
How can I reading the Hex and Assemble data from CPU window and writing comments to it in plugin?
Thanks.
Anonymous
12-14-2004, 09:35 PM
The code (t_table *)Plugingetvalue(VAL_CPUDASM); can get the CPU window handle, but how can I access the lines in it?
telectronics
04-04-2005, 11:02 PM
I want to write a plugin that anlysis the calls and show their names into the comment row of cpu window, can anyone show me a way to get the command of cpu window and writing comment to it?


How do I do what is says?

RCE Messageboard's Regroupment > OllyScript > How do I do what is says?
Bob Nudd
12-06-2004, 11:19 AM
Hello,

I have been looking at all these scripts and most of them have something like this at the end:

Now Just Dump and fix the IAT
OEP found, please dump it and then use importrec Get import functions

How do you actualyl do this? Can someone tell me or point me in a direction of some tutorials.

Cheers
Bob


[NEW]OllyMachine v0.20

RCE Messageboard's Regroupment > Plugins > [NEW]OllyMachine v0.20
luocong
12-07-2004, 05:08 AM
Download page:
http://www.luocong.com/om/

OllyMachine is a plugin for OllyDbg. We can use an assembly-like language called OllyMachine Script to write a script to automate OllyDbg.

Its source code is also available.
britedream
12-07-2004, 08:19 AM
I tried to find the oppcode as follow:

Run
invoke FindOpcode ,eip,"8944240C"
invoke PrintNum, reg00,16
Halt

but it gave the wrong address with opcode being 0000.

this is in protected target, but olly gave the correct address for the opcode.

so you may want to look at this problem.

Regards.
Britedream
luocong
12-07-2004, 11:58 AM
Please use this:

invoke Find, eip, "8944240C"
or
invoke Search, eip, "8944240C"

thanks.
britedream
12-08-2004, 09:25 AM
using these instructions at an exception will produce an error , contrary to olly which works fine.

Regards.
Britedream
luocong
12-08-2004, 09:57 AM
using these instructions at an exception will produce an error , contrary to olly which works fine.

can you send me your test program and the script for debugging? thanks.

admin@luocong.com
cw2k
07-17-2005, 03:59 PM
Well I also tested Olly Maschine. first I was impressed. It seem to be more stable and also faster than ollyscript.
So I as tutorial I started for to unpack pecompact. And started like that

GO VirtualAlloc
GO VirtualAlloc
RTU

Whoops in Olly Maschine it's somehow different.
Well finally...

invoke GetProcAddress, "VirtualAlloc", "kernel32.dll"
mov reg01, reg00
invoke GO, reg01 ; that's for the decompressed loader code
invoke GO, reg01 ; that one is inside the loader code
RunToUserCode ; retrun to loader code main()

... did the job. Well for my taste there are somehow slighly too much of that not very meaningful 'invoke's but it's ok. It's asm pure and simple.
But when i needed to retrieve some memory values the code get's really ugly.
For ex to move from modulbase (0x00400000) to the PE-Header with help of the dos-header in OScript it looked like that

var PE_Header

// Just to keep things simple - better use 'gmi eip, CODEBASE' instead..
mov PE_Base,000400000

mov PE_Base,PE_Header
add PE_Header,3c
mov PE_Header,[PE_Header]+12

msg PE_Header

in Olly Maschine there is no mov a,[b] you have to use ReadMemLong instead. So it that's it in OSM

// get PE_Header => reg10

mov reg08,0x400000 ;Get modulebase

mov reg10,reg08
add reg10,0x3c ;DOS Headersize
invoke ReadMemLong,reg10,0x04
mov reg10,reg00
add reg10,reg08

invoke msg, reg10

Now I noticed that it will be no fun to write some code in OSM in that state.
Because you soon loose the overview about your own code.
1. It's not very nice to alway have a list aside to look up what i stored in reg10 or reg8 if I wanna use it later. So forgot about speakable variablenames. (Well I can write a comment behind ever reg10 what it actually is - but that's no fun)
2. There are formal things like '0x' in front of each number to show it is hexa... (Why not make hexa the default and force prefix/suffix for dec, oct or bin numbers?. )
and constructs like
invoke ReadMemLong,..,0x04
mov ..., reg01
that just blow up the code. One statement - one line.

Form on one side OllyMachine is really great. Only from the practical point of the programming language is currently too 'lowlevel' - which makes it hard to read and see the what's the idea and to retain overview over my own code. It laborious and how I feel no fun to write code on that level.

So what about some simple higher level preprocessor that will make it possible to define / predefines some marcos for ex mov reg02,[reg10]
that will resolved to ReadMemLong and replace variablenames with reg01..reg63.

In compare to ollyscript it's opensource and to me it seem to be build on rock solid code. Now it's just to build up something more on that basement
to make OllyMachine to ´that´ scripter for ollydbg.

So let's get the source and customize it and try out new ideas


Broken link on stuph page

RCE Messageboard's Regroupment > Bugs > Broken link on stuph page
nonebox
12-07-2004, 07:42 AM
There is a broken link to GoDup 1.2 plugin. Is it possible to fix it?

Thanks.
TBD
12-07-2004, 10:51 AM
nonebox: the Stuph page is disabled, sorry :(
it will be reopen with OD 2.0 release
Anonymous
12-08-2004, 04:31 PM
I uploaded some 'stuph' TBD

maybe check it out and let me know what should be altered?
I'll get you FTP access soon
Harold
12-08-2004, 04:32 PM
that was me, Harold
nonebox
12-14-2004, 01:23 PM
Following URL is broken:
hxxp://ollydbg.win32asmcommunity.net/GoDup1_2.zip

Is it possible either fix URL, or upload missing file?

Thanks in advance.


OllyDBG offset ?

RCE Messageboard's Regroupment > General > OllyDBG offset ?
Anonymous
12-07-2004, 09:58 PM
Bonjour,
Dans OllyDBG,
Comment puis-je trouver l'adresse offset d'une valeur hexadecimale ?
Merci d'avance.

<ENGLISH VERSION>
hi,
In OllyDBG,
How can i find offset adress of an hex value ?
Thanks.
</ENGLISH VERSION>
Eggi
12-08-2004, 02:22 PM
type ctrl+b and your hex value and you will find the value and then you can see the adress.


Source code

RCE Messageboard's Regroupment > General > Source code
Valka
12-08-2004, 03:15 PM
How to debug program using the source code instead of assembler opcodes, like it is possible in soft ice?
TBD
12-09-2004, 04:16 AM
as I know that you use MASM32 ;) maybe this will help
How can i use symbolic debugging information (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=621)


"Copy to executable" problem

RCE Messageboard's Regroupment > General > "Copy to executable" problem
Anonymous
12-10-2004, 07:10 AM
OllyDBG sometimes doesn't display "Copy to executable" - "All modifications" submenu but only "Selection" ? It really makes me mad. Using two different versions of same debugged program, one displays both submenus and the other only "Selection" (!!!)
Tried to erase ollydbg.ini, reinstalling it, using on different machine, still the same results.

Please help
MaRKuS TH DJM
12-11-2004, 07:36 AM
i'm not sure but i think there are much things which must be correct that it work. section properties where you want to save, code-base, data-base. take care of these.
oh me anon
12-11-2004, 07:46 AM
copy to executable all modifications pops in when there are more than one modification which are not continous bytes

for example you modifies a byte at 401000 then one byte at
401026 and one byte at 401076 (all of which are in .code section)

and the position of your cursor isnt on any of these bytes but some where
in 401189 and you select copy to executable
olly will pop up all modifications and then
if there is only one modification are if the modification are more than one but in different section then you will see it pops up only one option
Anonymous
12-12-2004, 09:10 AM
I have many modifications (more than ten) and "All modifications" still doesn't popup.
code-base, data-base. take care of these
I suspect something like that, but there is no Ollydbg docs that discribes those limitations.
oh me anon
12-12-2004, 09:59 AM
well use right click view executable change there and use save file
that will save all modifications where ever it is in the loaded pe
no section limitations you can edit
pe header charecteristics then change some code in .code section
change a string in .data sections
and save it in one go if you use view executable ,save file
Anonymous
12-13-2004, 04:09 AM
are much things which must

Some executable Programs may cause this problem,(not a real bug of OD I think) ,If you try another executable file you may find that the problem has gone.

Even only the "selection" on the menu, you can still copy your changes to executable by doing like this:

Select all your changes by using "Shift", that's to say, select from the first to the last, then right click - copy to executable - *selection - save!

Good Luck,
HillCat
Anonymous
12-13-2004, 04:52 AM
Even only the "selection" on the menu, you can still copy...

Yes i know that, actually is what i did to save changes.
Just wondering why that happens with some programs but not with others.


Help me

RCE Messageboard's Regroupment > Bugs > Help me
Anonymous
12-10-2004, 02:52 PM
while i try to run (F9) an executable OllyDbg displays the follow message:
inexact floating-point Use Shift + F7/F8/F9 to pass exception to program.
What can i do???
Thanks.
JDog45
12-10-2004, 04:39 PM
You usually can press Shift +F9 to bypass the exception.
Anonymous
12-10-2004, 10:10 PM
unfortunately even if i press Shift + F7 or F8 or F9 OllyDbg doesn't work equally.
Excuse me, i took it for granted that i had already pressed keys SHIFT + ..
Indeed I will say you more; when I press the aforesaid key, it is like if it made a loop of operations, and the message is always the same one.
i thank you for whichever useful information about it.
oh me anon
12-11-2004, 07:38 AM
you are probably working with a vb executable and you may have set a breakpoint in some place which it doesnt like so the seh trips in and produces the message
and without passing the exception to the handler it will keep on poppping up as many times as it errs
to pass the exception to the handler once olly pops it for the first time
go to debugging options (ctrl+o) --->exceptions-->add last exception-->press ok and check mark the ignore following exceptions checkbox
after that press shift +f9 if the exception is raised again olly wont pop up the message but will automatically pass the exception to the handler

but this wont guarentee that your app will run :) coz the next exception may well be cannot process exception and exit :)
to understand how seh works you need to find some tutorials on net
jeremy gordons tut comes to mind first there are others such as owl,comrade,rose,elicz,mattpietreks tuts on seh search for them and read them before you proceed :)
good luck
Anonymous
12-11-2004, 10:39 AM
oh me anon you are great!!!!
thanks to your precious advice now it works very well.


Incorrect page protection attributes

RCE Messageboard's Regroupment > Bugs > Incorrect page protection attributes
focht
12-10-2004, 07:20 PM
Greetings,

while dumping some arma stuff i noticed that process dumping sometimes fails due to "problematic" page protection attributes.
In this case OllyDump plugins or other tools like LordPE will bring up some error msg "unable to read process memory" or something similar.

The reason is clear for me: the "page guard" attribute has been set on some region which gets triggered on read -> exception handler.
Using LordPE's "dump region" and you will see under protect column the correct page protection attributes: "XR GUARD"
Ollydbg itself displays it as "RW" is plain wrong.
Closing and re-opening memory window doesnt help.

If i adjust page protection manually using "set access" in memory window to "Execute/Read" i can remove the page guard and the process memory can be read by plugins and tools again.

Regards
oh me anon
12-11-2004, 08:02 AM
Dear Focht,
Greetings

yes the rw display doesnt get actualized as far as i know
also setting access on some section doesnt work many times
but if you set access to pe header it is inherited by all other sections
i find it somewhat awkward but didnt have many chances to play with it

just an example this is the way it looks when i just started and olly has broken on ep

Memory map, item 14
Address=00403000
Size=00001000 (4096.)
Owner=Research 00400000
Section=.rdata
Contains=imports
Type=Imag 01001002
Access=R
Initial access=RWE

now i right click this and try to set all kind of access but it some how doesnt actualize so i change from imports to peheader

Memory map, item 12
Address=00400000
Size=00001000 (4096.)
Owner=Research 00400000 (itself)
Section=
Contains=PE header
Type=Imag 01001002
Access=R
Initial access=RWE

and set full access
:)
Memory map, item 12
Address=00400000
Size=00001000 (4096.)
Owner=Research 00400000 (itself)
Section=
Contains=PE header
Type=Imag 01001080
Access=RWE CopyOnWr
Initial access=RWE

and the imports also get the properties
Memory map, item 14
Address=00403000
Size=00001000 (4096.)
Owner=Research 00400000
Section=.rdata
Contains=imports
Type=Imag 01001080
Access=RWE CopyOnWr
Initial access=RWE

also some times i try code inline writable modifications which obviously fail due to not having executable flag so i am forced to set access to peheader and not this only one section where i need write access

i dunno and i did not wade into the problem a little deeper
if you have some further clarifications or tips
please do post

thanks and regards


break points in dll

RCE Messageboard's Regroupment > General > break points in dll
Noman
12-13-2004, 12:36 PM
I have a Dll which is built in VC++. I have no source code of it.
I want to add some more functioanlities in it for that i have to know its previous functions .
can any body tell me how to set break points using int3 or 0cch instruction from the scratch
Teerayoot
12-13-2004, 02:45 PM
hit ctrl+e then type CC on desired location ,then in debugging option make sure int3 exception not pass to victim.
Noman
12-14-2004, 02:08 AM
Thanx
Teerayoot ,

I have got another option by using hex editor but it is too much easy then that.

Again Thanx . I will also put some more queries when i will go to advance


reversing a dll

RCE Messageboard's Regroupment > General > reversing a dll
Noman
12-14-2004, 03:25 AM
I have a dll which is made in VC++. I have no source code of it.

I want to add some more functioanlity in it. For that i have to understand

the whole dll.

IS it possible that the dissassembled code of dll using IDA can be injected

directly into c or c++ . If possible than how.
OR

Firstly i have to reverse the dll first . For this i m using Ollydbg. But how I go to the proper function where the functionality of the dll is .

Pls write from the scratch.
Regards

With a hope that some one response
karthikbalaguru
01-07-2005, 03:32 AM
hmmmmmmmmmmm,
It has been Alsmost a month that u posted this question.
Maybe u would have did and finished off the job from
ur shelf.

I think , u can now post that info under the title
'Write from the scratch - reversing a DLL'.

I think, u can do it as u would have finished off the reversing job.

Cheeeeeeeeeeers,
karthik bala guru
Noman
01-09-2005, 11:23 AM
see the link

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=1022 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=1022)
Noman
01-09-2005, 11:25 AM
also this one

http://www.astalavista.com/?section=dir&id=111


Porting a single method of dissassbled dll in c / c++ / VC++

RCE Messageboard's Regroupment > General > Porting a single method of dissassbled dll in c / c++ / VC++
Noman
12-14-2004, 03:33 AM
Hi

As the previous posts i have posted.

I want to port a single method to be compileable with c / c++ / VC++ of the disassembled dll into c / c++/ VC++.

How it is done ?
M i right ?
From where i have to start ?

Regards

with a hope that some one response me
oh me anon
12-14-2004, 09:14 AM
dear noman
try to stick to just one thread for queries relating to same matter
do not create multiple threads for same topic
it is will be better for navigation and answering for you as well as us

as far as your query is concerned i would suggest you to get the LoadDll tut from olehs site and walk through with it once or twice till you understand the concepts

after that load your dll and run it and use debug-->view dll export context menu to peek into the function of dll and go on from there

btw i dont understand what you mean by using same code in c /c++ /vc++

c has a set of functionalites which c++ doesnt have and c++ has certain function which c doesnt have
the first this that comes to my mind is
#include <stdio.h> in c and #include <iostream.h> in c++
and then printf() to cout() scanf() to cin ()
would you please clarify yourself on what you want and clarify it to us and what do you expect as an answer
Noman
12-14-2004, 10:06 AM
Thanks anon

Ok u r right. Now i will do it to put whole problem in one query.

I have read the Loaddll tut from the OLLY's site and under stand it

But i have the problem.

A dll which is made by me and i m using it with VC++, do the same thing as the Olly's tut.

But with the required dll when Debug->Call dll export is pressed then nothing happen and no dialog appears and Call dll export option is disabled . So i can not see my functions there.

As u r saying that what is meant by using the same code in c/c++/vc++.

Because in each and every language, function can be implemented.

If i will get the required function and its working in the dll . that function can be implemented in c / c++ or vc++

One thing more i have an exe file which is using the dll dynamically.

So What i do.

In Olly debugger that dll is exporting only two functions one is <Module Entry Point> and the other is DriverProc.

I have got these exported functions from "Names(in Olly) " that the Dll is using, by
right clicking->seraching for -> Names(labels) in the current Module

Tell me .

What i will do next.
oh me anon
12-14-2004, 10:49 AM
well olly when loading a dll will stop at Module Entry point which is used for initialization of dll this does not mean that the olly has loaded the dll completely
for example when you load any exe it will stop at entry point and will not run the exe automatically it is same logic that is used in dlls too
you have to either single step or run the exe (f7,f8,f9,run to selection etc etc etc) like wise you have to run the dll first to let it complete its initialization process (the Module Entry point can be used to perform n number of actions search for a post by me in this forum i think the topic is error 11 there is an mskb link to the details about Module Entry point or better use google for updated info)
if you happen try the view debug dll export before the dll has initialized it wont be available

you should let olly complete the initialization of dll and say running in status bar instead of paused before you try to use the view debug dllexport menu

only then it wil pop up the dialog
after this you can look for its exported function ,view in dissembler,set bp
call function etc etc

now this can also be achieved if you have the exe that uses this dll
options --> debugging options--->events --->break on dll load
when a dll is loaded olly will stop and notify you of the event
then you can right click follow the ep and search for names on the specific
then do a find referance by right clicking on names window and set bp on
calls in the dll

or rather load the exe use find names in current module ,then find referances to it and set bp directly

there are lot of ways
some more hacks would be to hexedit the ep of dll to infinte jump
eb fe and make it loop for ever and then use f12 to pause

and some more hacks would be to change the dlls charecteristics to
that of exe and load it directly as exe instead of it being dll

or if you know that dll imports some standard functions and you are using
OS >= w2k then you can set bp on that fuction and when it breaks
look into call stack to see the call or its return and follow from there

i can go on and on and on :) so let me stop here
the only way you are going to understand every bit of my ramblings
would be to experiment and read the help file and especially GOOGLE
for info nothing will be available on a platter at one place but everything is available in bits and pieces some where on this whole wide world

well i dont think you are going to read till here :)
goodluck to you if you finished reading and find out what to do :)
Noman
12-14-2004, 12:12 PM
ep
eb
fe
stands for what, as bp is for break points
oh me anon
12-14-2004, 12:37 PM
as i said google would have given you the results even before you finished typing the post and posted it
hxxp://www.google.co.in/search?hl=en&q=infinite+jump+eb+fe&spell=1
and any way i am not going to spoon feed you
Noman
12-15-2004, 10:02 AM
thanx oh me anon

i m not finding words for thanx , ur small metetrial helps

me a lot. Now i landed into my own fuction . Again thanx.

It is done through ur first point in the second mail.

Regards


Changing a jump

RCE Messageboard's Regroupment > General > Changing a jump
voodoo
12-14-2004, 07:28 PM
when I change a jump like JE ==> JNE the line highlight disapeard!!!
what shulde i do about it?????
oh me anon
12-15-2004, 07:07 AM
options --> appearnce --> code highlighting ---> select your highligting scheme (viz jumps and calls) ---> select modified command ---->choose your back ground colour
done

when you undo it using alt+backspace to return to original code
use ctrl+ a (analyse) to get back the original background
voodoo
12-15-2004, 09:02 AM
very nice.
it fixed thanks.


New API Monitor

RCE Messageboard's Regroupment > The Heap > New API Monitor
Anonymous
12-15-2004, 10:05 PM
Hi everybody,

I want to introduce to you a new API Monitor (freeware for non-commercial use) that is written entirely in win32asm. Visit our page to download and test it. I hope you will like it.

KaKeeware
http://www.kakeeware.com
liuyilin
12-16-2004, 05:05 AM
It is very well.
3q
TBD
12-16-2004, 06:48 AM
nice tool! thanks for sharing
1bitshort
12-16-2004, 01:59 PM
Great little API monitor, especially for its size - the price is within my budget too. It doesn't have very many features though so it's not very useful at the moment, but then it is a new program, it's looking very promising

There are just two things that I would really like to see:
1) the option to see strings (like the data written in WriteProcessMemory)
2) show parameter names (as defined by C header files) like Olly does

For example, here is what your API monitor currently shows for a call to WriteProcessMemory:

004856D8 WriteProcessMemory, WinBase.h, kernel32.dll, BOOL
- 000000D0 (208)
- 10020000 (1577189376)
- 0012F686 = 5C3A4301
- 0000032E (814)
- 0012F9B4 = 7FFDF000

So i can see the source and target addresses, but not the data which is what is really needed. A hex dump (up to say 100 bytes) would be good!

Keep up the great work
Anonymous
12-16-2004, 05:50 PM
thx for your comments guys, actually, some of the above-mentioned functions are already implemented in a newer version of the proggie that I am working on simultaneously. I just wanted to post a simple working version before the end of the year :-)

KaKeeware
http://www.kakeeware.com
1bitshort
12-17-2004, 03:01 PM
Yep its a very good first release - ran smoothly, no bugs, feels very clean... the foundations have been laid very well so I'm personally very looking forward to seeing upcoming releases with new features. I don't think it will be long before this program becomes very useful :). But unfortunately until more features are added it isn't very useful at this stage because the output isn't very easy to read or have control over, but I can imagine that in a years time this program could be one of the best API monitors out there in terms of providing analysts with quality runtime information. Again, excellent first release :)
1bitshort
12-19-2004, 08:45 AM
Please post again here when there's another update to let us know, Im looking forward to seeing how this one evolves because I can see it quickly becoming the best API monitor available, but I realise a lot of work must be done first and I wish you all the best with that
Anonymous
12-20-2004, 05:12 AM
Hi,

As there's rather a good feedback on several forums, it seems that the proggie is worthy working on :-) Thx. There will be updates soon.

KaKeeware
http://www.kakeeware.com
1bitshort
12-22-2004, 12:43 PM
Looking forward to it! Btw, one good way of reducing your workload is to open up an interface for plugins so that other coders can write their own plugins to interpret particular API functions exactly how they want. For example in my case i'd like to be able to write a plugin which was called on WriteProcessMemory (so i could dump the data being written) and CreateRemoteThread (so i could dump the code being executed).
Anyway just throwing some ideas at you 8-)


Every Exe starts with OllyDebug- You canrt start any program except some like Explorer

RCE Messageboard's Regroupment > General > Every Exe starts with OllyDebug- You canrt start any program except some like Explorer
Anonymous
12-17-2004, 06:05 PM
Hi,
i think it is a Virus, every exe File i want to start(include rundll32.exe) starts in OllyDBg and not like normal in Windows, it lokks like OllyDbg has overtake Windows. It is very strange, but i need to execute my programs, i think some major environment variable of Windows are changed, but i cant get through to the Registry because evrythime i start Regedit it starts in Ollydbg and if you cancel it in Ollydg also the Prcess is killed completly.

Pleas halp me.

Whiskey
Teerayoot
12-17-2004, 06:23 PM
Seem your system corrupt.
U run program then exception raised then olly will fired .

try remove ollydbg from your system or reinstall new windows :)
Anonymous
12-17-2004, 08:14 PM
i cant uninstall ollydbg, because if i try to run the deinstallation, onllyd will start and not the deinstallation program.... :(
oh me anon
12-18-2004, 08:55 AM
as far as i know ollydbg does not need either installation or
uninstallation
it is just plain and simple unzipping into a new folder that is all
are you sure you are talking about real ollydbg
or some program which is masquerading as ollydbg

olly dbg if you want creates only two registry entry
viz
ust-in-time debugging is controlled by two entries in the system Registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger - contains command that invokes debugger;
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto - specifies whether to ask user before attaching.

if you want go to registry and try deleting this values if they are present
other wis ollydbg does not have any other registry entries

but if it is viral program masquerading as ollydbg
then probably it has hijacked your hkcr/exefile/shell open command

check your entry
REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

it should be like this if it has any other extra values instead of %1%
then it is a hijacked values

you may try running an antivirus program online like trend micro,bitdefender,panda etc

or you can visit some of the antispyware forums like
tomcoyote.org,spywareinfo.com and post a hijackthis log of your computer for review and help
1bitshort
12-19-2004, 08:43 AM
Ive experienced this behaviour as well. Its not virus related, it is an issue with Ollydbg. I don't experience it very often (maybe 1 in 50 programs that i analyze), but often i find that deleting the associated .udd file and restarting Ollydbg helps. Also make sure that "Options | Events | Make First Pause At" is set to Entry Point Of Main Module, because I think the problem might only be occurring when its set to "Winmain (if location is known)" but im not 100% sure about that
oh me anon
12-19-2004, 10:39 AM
i have succesfully operated with the entrypoint set on all three locations
i have never faced ollydbg overtaking and opening everything under its own only some virus have done that (i remember some bc5 blah.exe]

if regedit.exe cant be opened you can open copypaste regedit.exe to somewhere and rename it as regedit.com and doubleclick it
regedit works as .com also

1bitshort do you posses an application that happens to behave like this
if yes i would like totake a look
thanks
1bitshort
12-22-2004, 01:03 PM
oh me anon: it has happened with many different applications which would tend to imply that it is a problem with Ollydbg. It's hard to isolate exactly what the problem is because sometimes the program is loaded and suspended as youd expected, but sometimes it would execute straight away, almost as if Ollydbg had forgotten to set a breakpoint at the entrypoint. But even if it was a malicious program such as a virus-infected file it still shouldn't be able to run, and unfortunately that isn't always happening ...

Some could consider it a minor bug, but for those of us who analyse potentially-malicious code it is a real problem because you're essentially taking a gamble loading a program into Ollydbg - it may or may not run straight away. Hopefully this wont be a problem with Ollydbg v2 :)
oh me anon
12-22-2004, 04:03 PM
ah 1bitshort i see you talking about ollydbg executing right away
yes it happens if the peheader is modified and image base is relocated
and some dll is already sitting on the preferred imagebase

but if iam anlysing potentially malicious code then i would
prefer to 0xeb 0xfe the entrypoint and then let it loop and hit f12 and modify it and henceforth would not trust even a bugless debugger :)

yeah it also executes dlls that way without stopping in ModuleEntryPoint
but directly executing it i learnt the hard way when one of the
cws crap (that which used advanced data stream) executed
that way and it had littered craps like pigs sty in my box :)


HOW TO USE THE OLLY PLUGING present in txt ot html formats

RCE Messageboard's Regroupment > OllyScript > HOW TO USE THE OLLY PLUGING present in txt ot html formats
Anonymous
12-17-2004, 06:09 PM
plz can any one tell me ahow to use the plugings written n present in txt and html format that i have downloaded . Does the plugins needs to be compiled in to a dll or exe.How then .PLZ HELP.


Attaching to an executable

RCE Messageboard's Regroupment > General > Attaching to an executable
gabri3l
12-18-2004, 04:32 PM
When I use Olly to attach to a running process it attaches fine the first time.

If I close the process and start it again (Leaving Olly open) and then try to attach again. I get two suspended threads that I cannot resume. The only way to get Olly to attach correctly is to close Olly and then reopen it and attach. Has anyone else experienced this problem.?
Anonymous
12-19-2004, 07:57 AM
thats a known bug of ollydbg
you need to restart olly between sessions
i wonder it wasnt fixed yet
gabri3l
12-19-2004, 04:33 PM
Thanks for the quick response. Glad to know its just a bug.

Not a really big of a deal, I was just wondering if it was something I was doing incorrectly because it happened on both my computers.


What Api to hook to detect outgoing connection?

RCE Messageboard's Regroupment > General > What Api to hook to detect outgoing connection?
Anonymous
12-19-2004, 08:30 AM
what is the primery gateway api for all outgoing connections?

gracies
1bitshort
12-19-2004, 08:40 AM
Options | Events | Break On New Module

If ws2_32.dll, winsock.dll, urlmon.dll or anything like that is loaded then you can assume the program uses the network. From ws2_32.dll, the main APIs youll probably want to break on are send, sendto, recv, recvfrom, etc
Anonymous
12-19-2004, 01:32 PM
Yep I know well it uses winsiock (it is listed in imports directory).
But what API hook to? (its calling home)
Necr0Potenc3
12-19-2004, 10:42 PM
hook connect and listen


Ollybug?

RCE Messageboard's Regroupment > General > Ollybug?
Eggi
12-19-2004, 11:03 AM
I debugged a program which calls RaiseException with the follwing arguments:

0012BA34 77E749F4 /CALL to RaiseException from kernel32.77E749EF
0012BA38 40010006 |ExceptionCode = 40010006
0012BA3C 00000000 |ExceptionFlags = EXCEPTION_CONTINUABLE
0012BA40 00000002 |nArguments = 2
0012BA44 0012BC70 \pArguments = 0012BC70

after i executed the call to RtlRaiseException i get 3 error messages and after that olly closes... but i dont ignore this exception... so normaly olly should catch it and not close.
Eggi
12-19-2004, 12:29 PM
ok this gets called from the kernel32.OutputDebugStringA with the argument:
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s %s%s%s%s%s%s%s%s%s%s %s%s%s%s%s%s%s%s%s

and i think that it produces an buffer overflow in olly and so olly produces an error and kills himself :/.
VolX
12-20-2004, 01:00 AM
Armadillo 4 , hehe....
deli
12-27-2004, 02:54 PM
read this

http://www.securiteam.com/windowsntfocus/5ZP0N00DFE.html
Bob
12-30-2004, 11:16 AM
This works also with just 3 %s in a string anywhere..

eg passing "ab%Scdef%sghijklmnopqr%stuvwxyz"

to Olly thru OutPutDebugString will crash Olly.

~BoB~


Bug in OllyScript 0.92?

RCE Messageboard's Regroupment > OllyScript > Bug in OllyScript 0.92?
Anonymous
12-19-2004, 09:50 PM
The OllyScript ASM command appears to generate incorrect opcodes in some cases. For example,

ASM someaddress, "mov al, 01"

generates opcodes C6,C0,01 and $RESULT returns = 3.

(of course the correct opcodes should be B0, 01)

A number of other ASM commands also generate incorrect opcode.

I can't find any other references to this problem in the forum and I'm using the latest download of 0.92 OllyScript and Ollydbg 1.10.

Any help would be appreciated please.
focht
12-31-2004, 08:43 AM
Hi,

the generated opcode is valid (3-byte version: opcode, addressing mode byte, 1-byte immediate constant).
The other version (2 byte) is of course valid too.
There are several mnemonics which can be expressed with different opcode sequences.
For your case i assume the plugin uses ollydbg API function "assemble()" and returns the first version - which is the 3-byte version in this case.
This selection might not be optiomal in all cases but it's valid.

To get all possible opcode versions of one mnemonic the plugin would have to loop until error...

pseudocode:

char errtext[TEXTLEN];
t_asmmodel model;
int index=0;
while( assemble( <mnemonic>, <ip>, &model, index++, 0, errtext) > 0)
{
// do something with returned opcodes (model.code)

}

In your case "assemble( "mov al,01", ....)" would iterate 2 times, returning the 3-byte version and in 2nd iteration the 2-byte version.

Hope you understand the plugin behaviour now...

Regards
ABend
01-09-2005, 06:01 PM
Hi focht,
Thanks - I now understand what's happening here.

I am using a sequence of Ollyscript plugin "ASM" commands in a script to automate the injection of a lengthy bit of code. I now see why the Ollyscript generated code is not the same as if I use the "Assemble" (ie "space bar") command directly in Ollydbg itself.

For example, the Ollydbg "Assemble" command always generates the 2 byte opcode sequence for mov al, 1. The Ollyscript ASM eip, "mov al, 1" command always generates the 3 byte opcode variant. This behaviour in ollyscript for several instruction types makes it trickier to inject code in tight places.

It would be useful to be able to switch between ASM generated opcode variants in ollyscript to match exactly how ollydbg behaves.

There may also be some way to get ollydbg and ollyscript to generate the same opcodes?

Thanks again for your help

Regards
ABend
loveboom
05-08-2005, 02:10 AM
yup this is a bug in ollyscript v0.92.
haggar
05-08-2005, 06:42 PM
I don't know for you guys, but I noticed that lot my scripts produce some errors or incorect results which I cannot find reason.


safecast

RCE Messageboard's Regroupment > General > safecast
s3ct0r
12-20-2004, 03:32 AM
How I can load a autocad 2004 in ollydbg?, safecast kickme out. Ollydbg can handle the exceptions.


conditional BPX erased

RCE Messageboard's Regroupment > General > conditional BPX erased
Paul6253
12-21-2004, 01:07 AM
Hi , Im new here.
I set conditonal BPX (shift+F2) inside API calls of interest
so I could inspect the parameters through [esp+n]; this made much
more sense than the time consuming effort of bpx on
every call - they all go to the same code.
ALAS! after reloading (ctrl+F2) , my bpx were gone!
What can I do about this? bpx @ call [<&xxx>] always get saved
I would like to save bpx INSIDE api
thanks
Anonymous
12-21-2004, 02:28 PM
http://ollydbg.win32asmcommunity.net/stuph
download & install Cleanup Ex 1.12 plugin
breakpoints are saved into *.udd files
oh me anon
12-21-2004, 04:20 PM
well the above link wontwork as stuph is disabled till a future announcement by admin

btw you post doesnt convey clearly what you want to achieve
after reading itfor the third time
i assume you want ollydbg to preserve your breakpoint inside
system dlls
if that is true view executable modules ---> right click and analyze all modules loaded that way whatever break point you setupwill
get saved in whichever dll you place them

or you can analyze the modules individualluy and then set break points
so that theyare saved

only breakpoints that are set on analyzed modules are saved

other wise they are deleted
Paul6253
12-22-2004, 01:09 AM
Thank you 'Oh me Anon' !
Your advice worked.
The only thing that alarms me is the amount of disk activity
when closing olly or reloading the image.
Im just happy I can now easily re-use important bpx I've set in dll.
Im glad you understood me , sorry for not being clear enough.
regards,

--Paul


point.h breakpoint

RCE Messageboard's Regroupment > General > point.h breakpoint
Anonymous
12-22-2004, 10:42 AM
Hi,

if I put a breakpoint on memory access when entering string in textbox, program pauses in KERNEL32 or GDI32. How can I prevent Olly to stop in these dlls and stop only in main thread.

Thanks.
JDog45
12-22-2004, 04:45 PM
If you hit Alt+F9 that should take you back to the main module.
simple
12-23-2004, 06:17 AM
Hi,

if I do that it always stops in GDI32 when accessing buffer for displaying some text contained in this buffer. When reaches user code if moves control to program but when I activate program it returns to GDI32. Moment of activating program stops code in KERNEL32.
simple
12-25-2004, 12:22 PM
Hi,

I found what I was doing wrong. First step should be to break some window on eg. WM_LBUTTONUP, and then to set breakpoint on memory read.
JDog45
12-25-2004, 07:46 PM
Glad you solved it..:)


Some DRx Questions

RCE Messageboard's Regroupment > General > Some DRx Questions
Lenus
12-22-2004, 01:20 PM
as we known,in OD the hardware breakpoint use the DR0-DR3.
my questions are
1. F8 and F4 are also use these debug registers,but they still work after i set 4 hardware breakpoints.how can OD do?
2. when i set a memory breakpoint,it apprea in the DR0,but it is overlayed by another hardware breakpoint after i set the hardware breakpoint.fortunately the memory breakpoint still work. where is it?
3.at the memory map,we can set a memory breakpoint to a section with F2 or "right button" .what is the difference?
4.when set a memory breakpoint to a section,how can OD do?i means whether the OD use the DRx debug registers or not.if no,how can OD do it?
thx:)
Lord_Looser
12-22-2004, 03:28 PM
3. OllyDbg help file:
Set break-on-access (F2, available only under Windows NT/2000) - protects the whole memory block. After break happens, OllyDbg stops debugged program and removes breakpoint. This breakpoint is especially useful if you want to catch call or return to some module.

Remove break-on-access (F2) - removes break-on-access protection from the memory block.

Set memory breakpoint on access - sets memory breakpoint on the whole memory block. Program will stop each time memory block is accessed. OllyDbg supports only one memory breakpoint. Under Windows 95/98, debugged program may crash when system routines access memory blocks containing memory breakpoint. Use it as a last resort.

others:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memor y/base/virtualprotectex.asp (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base/virtualprotectex.asp)
Lenus
12-23-2004, 01:54 AM
it is very kind of u,Lord_Looser.
i do learn a lot of things from your reply.i think i must read the OllyDbg help file first and carefully.although there r some thing i still can't understand,thank u!!
focht
12-31-2004, 08:19 AM
Hi,

just some addendum ...
Memory breakpoint management based on page protection attributes (PAGE_GUARD) needs some polish-up in newer versions.

It is not clear if statement "OllyDbg supports only one memory breakpoint." refers to "per block/page" or whole section or whole mapped process address space.
Technically ollydbg should be able to support one memory bp per page.
This type of memory breakpoint should assigned an extra "show breakpoints" menu (to manage it).
Another option could be mixed view with traditional style bp's but extra info row to indicate its type.

Also the page protection attributes should be correctly displayed with "page guard" enabled when using this kind of memory breakpont ("memory map" view).

Regards


problems with DLL cond. bpx 's failing to match regexp

RCE Messageboard's Regroupment > General > problems with DLL cond. bpx 's failing to match regexp
Paul6253
12-22-2004, 03:23 PM
Hi ,
Probs with this:

Breakpoints, item 3
Address=77DD7883 ADVAPI32.RegQueryValueExA
Module=ADVAPI32
Active=When [[STRING esp+8]] == 'LoggedKeys'
Disassembly=MOV EDI,EDI
Comment=RegQueryValueExA Valuename Check

As you can see from
< Active=When [[STRING esp+8]] == 'LoggedKeys' >
in the above that I am checking the 2nd param to the function for a specific valuename...
well It's not working! Sometimes the match is dead on...sumx it
matches every other name under the sun, bpxing on every name
Whats wrong here? Is this a bug in Olly or is my Regexp not clear enough?
I've perused the Ollyhlp many x's ...my syntax appears to fit
Thanks for any help

Paul
Lord_Looser
12-22-2004, 04:13 PM
[[STRING esp+8]] == "LoggedKeys"
" " != ' '
Paul6253
12-22-2004, 07:31 PM
um....no
that did not help ...but I assume your cryptic " " != ' ' means I should
use double qoutes around the test string...
I tried,doesnt work either
Thanks anyway Lord :)
Anyone else have a suggestion???
garryw
12-22-2004, 08:01 PM
bp RegQueryValueExA STRING [[esp+8]]=="LoggedKeys"
Paul6253
12-23-2004, 01:59 AM
Nope ...didnt work
when run it breaked on :
0012F9CC 73792228 /CALL to RegQueryValueExA from DDRAW.73792226
0012F9D0 0000007C |hKey = 7C
0012F9D4 737622FC |ValueName = "Name" <-- nothing even close
0012F9D8 00000000 |Reserved = NULL a match!
0012F9DC 0012FB00 |pValueType = 0012FB00
0012F9E0 0012FC54 |Buffer = 0012FC54
0012F9E4 0012FAFC \pBufSize = 0012FAFC
Lord_Looser
12-23-2004, 05:29 AM
You have to modify conditional log breakpoint settings (Shift-F4) at RegQueryValueExA.
Change attitude "Pause Program" from "Always" to "On Condition".
Paul6253
12-24-2004, 03:19 PM
I did that...still dont work,
I even tried other match patterns...i
Thats not to say it's not working at all but it should run until it
sees my search expression and it does not...it breaks on EVERY
Valuename parameter
oh me anon
12-25-2004, 11:48 AM
your format string is not right so it does not break
where it needs to break

[STRING [ESP+8]] == "YOUR STRING HERE"

Breakpoints, item 1
Address=77DB858E ADVAPI32.RegQueryValueExA
Module=ADVAPI32
Active=Log "oh my shit" when [string [esp+8]] == "YOUR STRING HERE"
Disassembly=PUSH EBP

Log data
Address Message
77DB858E COND: oh my shit = YOUR STRING HERE
77DB858E CALL to RegQueryValueExA from 00401058
hKey = 30
ValueName = "YOUR STRING HERE"
Reserved = NULL
pValueType = 00403044
Buffer = 00403048
pBufSize = 0040303C
77DB858E Conditional breakpoint at ADVAPI32.RegQueryValueExA: YOUR STRING HERE


get stack context

RCE Messageboard's Regroupment > General > get stack context
deli
12-27-2004, 03:01 PM
i try to read stack context i.e parameters from wsarecv.
i have written a small plugin which sets a breakpoint at
wsarecv... but how did i then get the stack ???

void __declspec(dllexport) __cdecl ODBG_Pluginmainloop(DEBUG_EVENT *debugevent){

if(debugevent&&wsarecv)
if(debugevent->u.Exception.ExceptionRecord.ExceptionAddress==wsar ecv ){
Addtolist(0, -1, " !!!!!!!!!!!breakpoint");
// test =GetExceptionInformation();
Setbreakpoint(wsarecv,TY_TEMP,0);
}

if(wsarecv)
if(TY_INVALID==Getbreakpointtype(wsarecv,NULL)){
Setbreakpoint(wsarecv,TY_TEMP,0);
}

}

i tried
LPEXCEPTION_POINTERS GetExceptionInformation(void);

but i think this function is only useable in a exception handler, right ??

thanks for help
focht
12-28-2004, 02:53 PM
Hi,

use the CONTEXT esp value to get access to stack data.

Example (in your exception handler):

CONTEXT* ctx = ep->ContextRecord;
// query page info for stack value
MEMORY_BASIC_INFORMATION mbi;
VirtualQueryEx( pi.hProcess, (LPVOID) ctx->Esp, &mbi, sizeof(mbi));

BYTE stack[1024] = {0};
DWORD size = mbi.RegionSize - ctx->Esp + (DWORD)mbi.BaseAddress;
if( size > sizeof(stack) )
size = sizeof(stack);
// make a copy of stack
ReadProcessMemory( pi.hProcess, (LPVOID) ctx->Esp, stack, size, 0);

// do something with copy: access stack params like "stack[ offset]"

Hope this helps...

Regards


Memory Brekapoints

RCE Messageboard's Regroupment > General > Memory Brekapoints
ReVeR
12-27-2004, 11:19 PM
Hey.
how do i put a breakpoint on read/wreit to a mem adress?
thx
liuyilin
12-28-2004, 01:55 AM
Can check the string with WINHXE first.


Tip: Conditional bpx on CreateWindowEx when only a window class or title is known

RCE Messageboard's Regroupment > General > Tip: Conditional bpx on CreateWindowEx when only a window class or title is known
1bitshort
12-28-2004, 04:23 PM
The "View | Windows" tool in Ollydbg is very good at displaying all windows and children including the class name, class title, and ClsProc (handler function for that window), however it does not show you where the window was created so if you want to find out which call to CreateWindowEx created a specific window (which youd need to know if you want to stop a window such as a nagscreen from loading) then this must be done at runtime, which is why it is not possible for Ollydbg to show us.

Ollydbg's Conditional Breakpoint capability comes into play here to make things very easy for us. After using the View | Windows tool to find out the title or class of the window you want to break on, just do this (from the main CPU/disassembly window):
1. Press Ctrl+G, then type CreateWindowExA
2. Right-click on the first line of code in the CreateWindowExA function (it'll automatically be selected by the Goto), then select "Breakpoint | Conditional Breakpoint" (or simply Shift+F2)
3. Just enter the following to break when it creates a known window class:
[esp+8]=="Class text here"
Or this for known window titles:
[esp+12]=="Title text here"

Dont be afraid to play around with expressions and conditional breakpoints, theyre there to make things much easier for you and they dont take too much time to learn as the Ollydbg helpfile documents it well enough


Modules Functions

RCE Messageboard's Regroupment > Plugins > Modules Functions
Deadbeef
12-30-2004, 11:41 AM
Hi,

I want to save the list of the modules currently loaded by the MainFile. I have read the Plugins.hlp with the PDK and I see :
************************************************** ********
Module is an executable file (ususlly EXE or DLL) loaded into memory. OllyDbg keeps list of loaded modules in a table of sorted data consisting of elements of type t_module. You can receive pointer to table of modules by calling Plugingetvalue(VAL_MODULES) and casting result to (t_table *).
************************************************** ********

But where is the pointer to t_module ? I am not sure use of this two function : t_module* Findmodule(ulong addr); and Plugingetvalue(VAL_MODULES)

Especially for FindModule.

Greets
focht
12-31-2004, 07:53 AM
Hi,

you should cast the table/sorted table data value.

Example after reading plugin.h (straight off my mind):

t_table* table = (t_table*) Plugingetvalue( VAL_MODULES);
if( table != 0)
{
t_sorted& sorted = table->data;
// for all valid items
for( int index=0; index<sorted.n; index++)
{
t_module* module = (t_module*)( (int)sorted.data+(index*sorted.itemsize));
// use module members whatever
strncpy( buf, module->name, SHORTLEN);
// ...
}
}

Hope you get the idea...
If not, post your questions.

Regards

PS: anyone knows how to preserve spaces and/or tabs? This minibb makes posting snippets almost unreadable...


Crackers Kit

RCE Messageboard's Regroupment > The Heap > Crackers Kit
rurso
12-30-2004, 02:30 PM
I was having a problem with some things and a guy told me to get "Crackers Kit" but I can't find it,can anyone help,thanks.
s3ct0r
01-05-2005, 10:17 AM
Nothing special, only a ripped of some good tools.

"Crackers Kit"

h00p://home.no/dappa/CrackersKit.1.1-DappA.exe
servil
01-06-2005, 09:49 AM
Crackers kit is unavailing package, all tools bundled r freely downloadable from sites like protools.cjb.net or similair.
ppl dont knowing wot they need dont need this package neither.

btw it was outdated already when released.
anon 10
01-07-2005, 11:29 AM
Ollydbg Is a very good Dissam but to make it great it needs a plugin that generates flowcharts. Does anybody know if one is available or in the work. Thanks
DappA
01-09-2005, 02:28 PM
Crackers kit is unavailing package, all tools bundled r freely downloadable from sites like protools.cjb.net or similair.
ppl dont knowing wot they need dont need this package neither.

btw it was outdated already when released.

Well, maybe you can give me some updates regarding some of the included files then?

And as I've said before, this is just a collection of tools not a replacement.
servil
01-09-2005, 05:33 PM
sorry, nothing against your package, maybe the quick outdatening isnn much a problem, just what i mean if it was intended as all in 1 package it suffers from incompleteness coz essential tools like ida are missing so imo its always better get all necessary tools from a tool site,
only my suggestion.

regards
DappA
01-09-2005, 07:10 PM
No harm taken :-)

But as you may know, IDA Pro is a commercial software which i simply can't include both because of the filesize and i neither want to make this into an illegal package.

And ofcourse, it can't include everything. So I simply have to selected the few tools that are most common and used.

What other essential tools is there thats missing from the collection, other than IDA?
Soldier
04-03-2005, 06:55 AM
dappa i hope you dont mind but can i have a link to your tutorial on unpacking armadillo 4.xx i cant dl it on exetools because you have to be a member but the registration was cut off by the admins. so if possible could you kindly post up a link please
Snowski
04-15-2005, 08:14 PM
Yeah Dappa,

If you could share your armadillo 4 work here, that would be great!

Greetz,

Snow :)
TBD
04-17-2005, 03:29 PM
I suggest not to share the armadillo work here. this forum is about improving OD experience and not on 'how to crack' a protection, even if it is by using OD.

thanks
DappA
04-30-2005, 04:21 PM
I suggest not to share the armadillo work here. this forum is about improving OD experience and not on 'how to crack' a protection, even if it is by using OD

I dont see how having a tutorial on how to reverse a protection scheme, and having tons of OllyScripts on the site which does exactly the same thing is different :-)

Anyways, you should be able to find it by visiting teamicu.org/forum/

If you wont permit this link, just delete it TBD, i dont mind.


recognise operand typwe

RCE Messageboard's Regroupment > Plugins > recognise operand typwe
servil
12-30-2004, 08:20 PM
h

how do me recognize wot operand type from t_disasm struc

?
focht
12-31-2004, 07:10 AM
h

c plugin.h (typedef struct t_disasm)

r
servil
12-31-2004, 08:54 AM
t_disasm->optype[0] == DEC_????????????????????????

when op1 reg

wot else member can't fin it

t


i need tips for cracking of this chalange....

RCE Messageboard's Regroupment > General > i need tips for cracking of this chalange....
eran322
12-31-2004, 10:55 AM
i try to crack a shockwave game that need an email and password to validate.
i found the section of the calucation in the memory and i cant understand it...
i hope some one can help to me...
here is a snapshot of the code:
geocities.com/eran322/crack.jpg
1bitshort
01-02-2005, 03:50 AM
> i try to crack
Sorry buddy this isn't a cracking forum

However in regards to disassembly analysis, the code youve highlighted in the screenshot is simply a jump table (if "A" jump to A handler, if "B" jump to B handler ...)


Searching opcode

RCE Messageboard's Regroupment > Plugins > Searching opcode
vxx
12-31-2004, 11:37 AM
Hello,
I'm coding plugin, which searches specified opcode in debugged program memory from specified address. Is there function from Plugin SDK, which can do this job? I tried to find, but coudn't :(
Of course, I can do this manually, but... plugin function would be better :)
So, any ideas?


VCL api handling all data xfers via TcpIp?

RCE Messageboard's Regroupment > General > VCL api handling all data xfers via TcpIp?
servil
12-31-2004, 12:25 PM
greetz

what class function uses Vcl to send (upload) data?
low enough to handle ALL outgoing data but rather higher than i get lost in WinSock hell.

thx
servil
01-02-2005, 01:21 PM
no1 knows?....
i need patch bittorrent client so it wont upload annoyingli anymore
this one is clueless task

servil


Breakpoint handler

RCE Messageboard's Regroupment > Plugins > Breakpoint handler
vxx
01-01-2005, 04:22 AM
Hello,
Another plugin question. OllyScript plugin can set handler on breakpoints, so, question is... how it does??
I tried to find such function in Plugin SDK, but no result :(
Of course, I can manually check if breakpoint reached. Just need to compare eip and my breakpoint in main loop.
BUT! It's bad method. First, it's very slow. Second, it can't check hardware breakpoints on read/write and memory breakpoints...
So... maybe there is needed function?
eyeblue
01-04-2005, 04:56 AM
did you tried ODBG_Paused ?
eyeblue
01-04-2005, 05:01 AM
and ODBG_Pausedex ?
vxx
01-05-2005, 09:20 AM
Nice idea!
I already found good method from OllyScript sources (via ODBG_Pluginmainloop).
Anyway, thanks :)
anon 10
01-07-2005, 02:08 PM
Ollydbg Is a very good Dissam but to make it great it needs a plugin that generates flowcharts. Does anybody know if one is available or in the works. If not is there independent software that can generate flowcharts with a dissam. Thanks

Please excuse me I may have posted this query in the wrong section initiaklly.
oh me anon
01-07-2005, 02:21 PM
:( well as far as i know the wingraph (open source iirc) that is integrated into ida can generate flowcharts of disasm

datarescue.com/idabase/idadown.htm

look into datarescues site and play with wingraph and probably
you can write a plugin that would incorporate it into ollydbg too :)

also there is a thread in rea board

t=2030&highlight=wingraph

it has some pointers as to how could one do the gdl files do search and read it :)

edit
why cant you create a new topic for yourself why should you hijack others
thread and make it unreadable for the original poster :( i saw the hijack after i posted else i wouldnt have posted :(
TQN
01-07-2005, 10:36 PM
Yes, a flowchart plugin with wingraph will be a great plugin.
oh me anon
01-08-2005, 12:57 PM
well here is a small gdl file that i made to test the wingraph that comes with idafree 4.3 in standalone mode (ida deletes the .tmp it creates before displaying the graph it seems :( i cant find the .tmp that wingraph opens and reads)
either get the source code from data rescue and use builder to build the project as instructed in readme and or if you can get the executable from
ida folder use it in stand alone mode to test this file

usage of wingraph32
wingraph32 "this file"

copy paste the below code to notepad and rename the .txt as "this file" with or without extension :) unix style

graph: {title: "test graph"
node.color: lightyellow
node.textcolor: blue
edge.color: blue
edge.arrowsize: 5
edge.thickness: 1

node: { title:"21"
label: "Decision" shape: rhomb color: aquamarine }
node: { title:"20"
label: "ask Qusestion"}
node: { title:"19"
label: "wait"}
node: { title:"18"
label: "exit"}
node: {title:"17"
label: "wait for answer"}
bentnearedge: { sourcename:"21" targetname:"18" label: "exit" class: 1}
bentnearedge: { sourcename:"21" targetname:"20" label: "yes" class: 1}
bentnearedge: { sourcename:"21" targetname:"19" label: "no" class: 1}
edge:{sourcename:"20" targetname:"17"}
edge:{sourcename:"19" targetname:"21"}
}
now if any plugin writer wishes to write a plugin then it will be Great :)
may be the Godup plugin could be extended to use wingraph too as it already uses sigdump from ida folder


Paths for source files

RCE Messageboard's Regroupment > General > Paths for source files
fycom
01-01-2005, 10:32 AM
I have some DLLs that attach to the main executable during execution. They all have debugging information, but their sources reside in different directories.

So, my question is: How to force debugger to read and use these sources from that directories?

Currently it says that they are Absent...

:)
oh me anon
01-01-2005, 01:56 PM
here is a path list (the os is 9x here so it may not reflect all calls (those that are called through registers are jumped directly or whatever they are not recoreded here)
the app used is iczelions tut02 msgbox.exe

004AEFCA COND: D:\desktop\tut02\msgbox.exe
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.EXE
004AEFCA COND: D:\desktop\odbg110\MSGBOX.udd
004AEFCA COND: D:\DESKTOP\ODBG110\common.arg
004AEFCA COND: D:\DESKTOP\ODBG110\msgbox.arg
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.EXE
004AEFCA COND: D:\desktop\odbg110\MSGBOX.udd
004AEFCA COND: D:\desktop\odbg110\MSGBOX.udd
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.EXE
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.EXE
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.tds
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.EXE
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\symbols\MSGBOX.dbg
6D51B920 COND: dbghelp = C:\Symbols\symbols\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\ODBG110\symbols\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\MSGBOX.dbg
6D51B920 COND: dbghelp = C:\Symbols\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\ODBG110\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\MSGBOX.dbg
6D51B920 COND: dbghelp = C:\Symbols\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\ODBG110\MSGBOX.dbg
6D51B920 COND: dbghelp = MSGBOX.dbg
004AEFCA COND: C:\Symbols\symbols\sym\MSGBOX.sym
004AEFCA COND: C:\Symbols\sym\MSGBOX.sym
004AEFCA COND: C:\Symbols\MSGBOX.sym
004AEFCA COND: D:\DESKTOP\TUT02\symbols\sym\MSGBOX.sym
004AEFCA COND: D:\DESKTOP\TUT02\sym\MSGBOX.sym
004AEFCA COND: D:\DESKTOP\TUT02\MSGBOX.sym
004AEFCA COND: D:\DESKTOP\ODBG110\sym\MSGBOX.sym
004AEFCA COND: D:\DESKTOP\ODBG110\MSGBOX.sym
6D51B529 COND: dbghelp = D:\desktop\odbg110\MSGBOX.EXE
6D51B529 COND: dbghelp = D:\DESKTOP\TUT02\msgbox.exe
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\symbols\EXE\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\EXE\MSGBOX.dbg
6D51B920 COND: dbghelp = D:\DESKTOP\TUT02\MSGBOX.dbg
6D51B920 COND: dbghelp = MSGBOX.dbg

if your .dbg or .sym and your source is one of the above paths it should load it automatically and be able to show you the dbginfo in there

the exe for above is located in folder D:\desktop\tut02\
i ve set the global symbol path as c:\symbols
fycom
01-01-2005, 05:56 PM
oh me anon

8-/

Thanks, but it seems that I've messed up describing my problem, may be because of my poor english.... Sorry for that...

First of all, I use Borland C.
After compiling my source files I am getting two *.DLL's and one *.EXE. And then my project's directory tree looks like this:

c:\Project\DLL1\foo1.c
c:\Project\DLL2\foo2.c
c:\Project\main.c
c:\Project\foo1.dll
c:\Project\foo2.dll
c:\Project\main.exe

So, when I start to debug, the debugger searches for my source files only in c:\Project\ directory (and does not find it), while I need it to search them in c:\Project\DLL1\, c:\Project\DLL2\ and c:\Project\ directories, because they are really there...

Its inability to find them results in the follwing look of the "source files" panel:

Source files
Module Source Source path
DLL1 (Absent) C:\Project\foo1.c
DLL2 (Absent) C:\Project\foo2.c
EXE MAIN.C C:\Project\main.c

while must be:

Module Source Source path
DLL1 FOO1.C C:\Project\DLL1\foo1.c
DLL2 FOO2.C C:\Project\DLL2\foo2.c
EXE MAIN.C C:\Project\main.c

Is this explanation more plain now ?

So, my question remains the same: How to inform debugger where to search for source files of DLL's? Or, otherwise saying, how can I specify several directories of source files?

:)
fycom
01-01-2005, 06:02 PM
Sorry, that is more accurate:

Source files
Module Source Source path
FOO1.DLL (Absent) C:\Project\foo1.c
FOO2.DLL (Absent) C:\Project\foo2.c
MAIN.EXE MAIN.C C:\Project\main.c

while desired:

Source files
Module Source Source path
FOO1.DLL FOO1.C C:\Project\DLL1\foo1.c
FOO2.DLL FOO2.C C:\Project\DLL2\foo2.c
MAIN.EXE MAIN.C C:\Project\main.c
TQN
01-02-2005, 07:40 AM
The current version of OllyDbg only supports opening the source file in the executable directory, not in subdirectoris or another directories.
fycom
01-02-2005, 09:23 AM
TQN

Thank you very much! It is a pity if so :-(

May be someone also knows when this feature will be implemented?

It already exists in the old Borland's debugger td32.exe and seems very important for complex projects %)


DO not Get adress of winproc ,why ??????

RCE Messageboard's Regroupment > General > DO not Get adress of winproc ,why ??????
wenwen
01-01-2005, 05:53 PM
Options->Debugging options (Alt+O)->Security options->Allow code injection to get address of WinProc

But I did not get adress of winproc ??????why???
wenwen
01-01-2005, 06:04 PM
The os is xp sp1.
notepad.exe


Cannot find GODUP Plugin

RCE Messageboard's Regroupment > Plugins > Cannot find GODUP Plugin
Praveen
01-02-2005, 06:18 AM
Hi...
I have been searching the internet for more than two weeks...
But I am unable to get hold of the GODUP plugin.

The on eon EXETOOLS site cannot be downloaded as I am not a member there.

Thanks in advance for any help in posting a valid link...
hosiminh
01-02-2005, 12:25 PM
Here you can find it v1.2 :
http://ollydbg.win32asmcommunity.net/stuph/
Praveen
01-03-2005, 02:28 AM
No...I had tried that link long long ago and it was among the first attempts...
Only that single plugin cannot be downloaded!!!!

Please try it and see !!!

I had e-mailed the moderator also who had suggested that I post the request on the forum.

Thanks for the time to reply however...

And pls post a valid link if you happen to know and that which is NOT on EXETOOLS site...
TBD
01-03-2005, 03:02 AM
GoDup 1.2 (http://ollydbg.win32asmcommunity.net/stuph/GoDup1_2.zip)

I've updated the Stuph page. sorry for the delay, but I didnt have inet access lately :(
Praveen
01-04-2005, 07:56 AM
Thank you ver very much for the prompt response.
I have finally got hold of the plugin :-))))))

Thank you very much once again.
Praveen
01-04-2005, 07:58 AM
Yes...I had downloaded it from the Stuph page of course, after he updated it.


bug in analyze after patching

RCE Messageboard's Regroupment > Bugs > bug in analyze after patching
dnob700
01-02-2005, 04:14 PM
Sometime, when i patch some part of a program, the analyzer cannot annalyze, i mean it analyze nothing, just single byte decoded one after one in the disassembler window.

the only way to fix it is to delete the file in Olldbg directory with the name of the current executable so the process can restart from nothing, but then the comment are lost.


How do I make Olly treat .text section as code?

RCE Messageboard's Regroupment > General > How do I make Olly treat .text section as code?
Roger Head
01-03-2005, 01:07 PM
I have a .exe which loads with a large part of its address space (~401000 - 600000) blank, and classed as .text. During initialization it loads code into that area and then executes from it. But Olly still considers it as a non-code area (the 'Contains' column in the Memory Map window is blank), so I can't get it displayed in the Disassembler pane of the CPU window and set execution breakpoints etc.

I presume that this can actually be done, I just can't figure out how. Can someone give me a few pointers, please?

Regards,
1bitshort
01-03-2005, 02:50 PM
Change the characteristics of that section to code in the executable itself, Ollydbg should then disassemble it
garryw
01-03-2005, 07:37 PM
take into account if its protected chances are you are going to run into integrity check problems by doing as 1bitshort suggests though.
Roger Head
01-03-2005, 11:46 PM
Yes, thanks garryw, what I really want to do is to be able to tell Olly that the section is *now* (i.e. when I break at a time when the code has been loaded there) a code section.

I'm 2 days new to Olly, and quite like it. I would have thought that it would be a reasonably simple thing for Olly to be told to view address regions in different manners. Obviously there are considerations/dangers in treating sections in differing manners, but if the user is aware of the implications and is willing to accept the consequences, then so be it - software shouldn't prohibit you from doing something, even if it seems to be dangerous. Warnings, yes, even multiple warnings, but if the user really wants to do something, well...

Regards


values of C variables shown as their addreses

RCE Messageboard's Regroupment > Bugs > values of C variables shown as their addreses
fycom
01-03-2005, 02:08 PM
The watch window doesn't show values of C variables, but only their memory addresses... For integers the brackets can be used, but what with strings?....

Besides, it seems very annoying when the window focus switches to the code panel each time I step over CPU instructions :-(

Hmm.... in general I woud say that OllyDbg pays too many attention to CPU code analysis while the source file debugging is no less important (at least for me).
focht
01-03-2005, 07:08 PM
Hmm.... in general I woud say that OllyDbg pays too many attention to CPU code analysis while the source file debugging is no less important (at least for me).

Agreed.
If you have emphasis on source level debugging, you should use a decent IDE with integrated debugger.
My fav is the VC++ debugger (integrated with VS.NET 2003/2005 IDE) along with VC++ compiler.

Regards
fycom
01-03-2005, 10:33 PM
Every source level debugger must have ability of CPU code analysis just because of program optimization. So I do not see here a good reason to cut debugging from reverse engineering tool. And I really think that it wouldn't be so difficult to add some enhancements to make OllyDbg to overcome in both these applications.

Concerning IDE. Integrated tools are too superfluous for what I really need. Because my need (and preference of life style) is to have a collection of constructive blocks from which I could create my own "integrated environment" specialized on my personal needs and preferences. I want to have a chance to use my favorite source editor, compiler, resource editor, debugger and whatever other thing I want.

I like freedom. Any monopoly (like IDE) takes it away from you.
fycom
01-05-2005, 11:40 AM
Now I found a good alternative for Borland's Turbo Debugger.
It is a stand alone source level debugger from Microsoft - WinDbg.exe.

If someone else needs it too, you can download it from here: http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.3.17.0. exe (http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.3.17.0.exe)


Please Help.. Searching prog

RCE Messageboard's Regroupment > The Heap > Please Help.. Searching prog
GodSpeedGT
01-03-2005, 04:15 PM
Hi I am new to using this program and I havent been able to figure out much by experimenting.

Ok, I'm trying to delete every instance in a programs code that shows the programs name. What is the easiest way to go about doing this. The program is ProcessGuard v3.100 and all I know is that It has to be not visible if someone searched the program for ascii and unicode matches.


Kakeeware Application Monitor 1.0

RCE Messageboard's Regroupment > The Heap > Kakeeware Application Monitor 1.0
KaKeeware
01-03-2005, 11:20 PM
Hi All,

The new version of KAM is available.
Some minor bugs fixed and API database got a little bigger (1749 APIs as for now).

KaKeeware
http://www.kakeeware.com
p.s.
plug-ins will be available in the next release
TBD
01-04-2005, 03:42 AM
some minor comments:
* add an about menu item (with version and website/mail) - track changes
* rename Monitor|Apis in Monitor|APIs - faster on eye scanning
* redesign API selection - make a tree like categories, add load/save setups

keep up the good work!
1bitshort
01-04-2005, 04:57 PM
Its coming along very nicely, but as TBD pointed out it still needs a lot more functions and features to make it properly useful as an analysis tool. Looking forward to the plugin support


How can VC++6 save procedures as thunks

RCE Messageboard's Regroupment > General > How can VC++6 save procedures as thunks
Raygun
01-04-2005, 07:39 PM
I'm looking at code that seems to be imitating calls to import table functions.
In case you need review: a function like MsgBox gets called in the .text section like Call DWORD PTR DS:[534455] for eg, and of course 834455 is
an address in the .rdata section in the import table, and there you find the thunk value like 192735 (address where the name of the MsgBox procedure is saved)
Now the same idea is being used for other stuff, eg I see a Call DWORD PTR DS: [523348] which is calling out of the .text section into the .rdata section, but not the import table. At the address, is something like a thunk, that is another address but this time to a procedure back in the .text section.
Why is this happening: .text to .rdata back to .text,??
Of course the actual calls arenot with fixed numbers but come off the stack & the program id is that's its visual c++ 6.


Missin constants in plugin.h

RCE Messageboard's Regroupment > Plugins > Missin constants in plugin.h
servil
01-05-2005, 05:44 AM
i m strugling to determine if operand type is a register or address of register type

i get filled t_disassm struc but theres missin constants in plugin.h that could identify if and what register as opeand:

typedef struct t_disassm {
.
.
.
t_operand op[3]; // Full description of operand
.
.
}

well i look to t_operand:

typedef struct t_operand { // Full decription of command's operand
char optype; // DEC_xxx (mem) or DECR_xxx (reg,const)
char opsize; // Size of operand
char regscale[8]; // Scales of registers
char seg; // Segment register
ulong opconst; // Constant
} t_operand;

okeee so if the operand is register then i shuld compare to some DECR_xxx consts true? but where are they hidden or is it some stupid riddle??

really cant find it there, and my pluginh is not outdated: 06-06-04


Anti-ollydbg

RCE Messageboard's Regroupment > General > Anti-ollydbg
mike
01-05-2005, 02:31 PM
How can we detect that Ollydbg is used to debug an application
You know that message boxs that tell us to close Olly before we continue
I hate it!!!
mike
01-05-2005, 03:09 PM
And something else, is it possible olly can't attach to an active process?
I am getting an error msg "unable to attach to process"
hosiminh
01-06-2005, 04:36 AM
_http://pe-lib.sourceforge.net/pumqara/html/code_protection/Detecting% 20OllyDbg/DetectOllyDbg+Pum.htm

_http://pumqara.cjb.net/
mike
01-06-2005, 08:32 AM
That's good,thank you
Do you know any other ways to do that?
hosiminh
01-07-2005, 05:05 AM
Search yourself for a book "Crackproof Your Software" (author Pavol Cerven) . There are some other tricks.
TQN
01-07-2005, 10:38 PM
Allmost informations in "CrackProof.." book and of Pumqara is old, and can be bypass by some anti-anti-debugger plugins.
1bitshort
01-07-2005, 11:23 PM
Crack PROOF? Well there's a misleading title if ever i've heard one. From what ive read on Amazon it seems like a good book to help newbie programmers stop their programs being modified by newbie crackers, but that's about it.


upx? ayuda

RCE Messageboard's Regroupment > General > upx? ayuda
Genocyber
01-05-2005, 06:26 PM
hola soy nuevo en el foro, y tamb usando el olly, crakeando el Clean Disk Security v7.39, esta comprimido el exe con el upx, lo descomprimo con el olly, ollydump y con el REConstructor, lo ejecuto y todo bien, pero lo cargo en el olly para crackearlo, y me da Module '' has entry point outside; seguro que esta mal la descompresion aunque funciona, ayuda?.
TBD
01-06-2005, 03:36 AM
warning no.2
* no cracking
* only English language
PaLmiXe
01-12-2005, 09:25 PM
Está todo bien, asi es como funciona eso. Pero desempaca mejor, más rápido y FULL Guipex, conseguitelo.


Source-level debugging problem

RCE Messageboard's Regroupment > General > Source-level debugging problem
MazeGen
01-06-2005, 08:07 AM
Hi,
I already know how to use OllyDbg for full symbolic debugging and it works well for me.
Now, when I switch to source code view and press F7 or F8, the window is automatically reduced in order to fit in disassembly window. It seems the size can be only toggled between maximized view/reduced view.
And that is the problem: I need to resize the source code window according to my needs (the size is acctually too small for me), so how can I set user-defined size?
I hope Olly didn't hardcode it...
oh me anon
01-06-2005, 11:02 AM
you can dock them side by side and stretch the mdi windows to your size and it works fine as far as i know and i can watch it being f7nned or f8eed
in both source as well as disassembler window at the same time

i have a screenshot of what iam talking about if you think what i say would satisfy your requirement post a mail address or some uploadable address so that i can send it :)
MazeGen
01-06-2005, 04:19 PM
Thanks, oh me anon, for answer.

When I try to dock the reduced Source window, it always get maximized even after single mouse click.
If it is really working for you, please send me the screenshot to
mazegen [at] centrum [d0t] cz
oh me anon
01-07-2005, 06:54 AM
ok ill send it to you later today to that address as i am not in same computer at the moment
oh me anon
01-07-2005, 01:07 PM
well i have sent the screen shot :)
the content of mail being

Dear mazegen,

here is the Screen shot of what iam talking about
while it is setup like this i can f7 or f8 and see both the disassembler window and
source window at the same time

if you restart and want it to stay the same
go to
options ---> appearance-->general
and check mark the
restore window positions and apperance check box

if you want to look at sorce window in full
click the maximize button in source screen

if you want to view disassembler window in full click the maximize button in disassembler window
MazeGen
01-07-2005, 02:11 PM
Oh my Anony,
many thanks for your effort and please excuse my ingorance. It seems I have to learn some basics about windows, even though I thought I'm not a beginner. The Tile horizontal and Tile vertical do the job, so I'm happy now :)

Again thanks
Have a nice day
MazeGen
TQN
01-07-2005, 10:34 PM
Hope in the OllyDbg 2.0, all windows will have the dock style
oh me anon
01-08-2005, 09:14 AM
you can dock what ever window you wish even now TQN
if you wish to have all windows open use tile windows vertically or horizontally
in windows --- menu

if you have two windows open each will be given half the space
if you have 3 open each window will get 33%
if you have all windows they will divided by equla space of your
screen size
i sometimes operate with 15 windows open at one time and i am able to see all of them at the same time they are mostly dump windows of some
of the pointers that are open :)
TQN
01-08-2005, 10:16 PM
Thanks oh me anon.
I known about tile/cascade windows in a MDI app. But they are not same as docking windows.


tutorial for unpack any armadillo protection using OLLY 0.93 , (but a full one)

RCE Messageboard's Regroupment > General > tutorial for unpack any armadillo protection using OLLY 0.93 , (but a full one)
carlosg
01-06-2005, 05:32 PM
tutorial for unpack any armadillo protection using OLLY 0.93 , (but a full one)
im trying to learn how to unpack armadillo protection
step by step
or very detailed

plz help :-)
Eggi
01-06-2005, 05:51 PM
There are better places for asking such things... like woodman, exetools....
hosiminh
01-07-2005, 04:56 AM
_http://tothesky.us/

OLLY 0.93 ? As i know the last version of Ollydbg is 1.10 final


exe32pack 1.42

RCE Messageboard's Regroupment > OllyScript > exe32pack 1.42
dqtln
01-07-2005, 12:44 AM
find 8F85 , set breakpoint there
find FFE0 ... press Ctrl+G : "address+1" , set breakpoint there
find FFE0 final ... press Ctrl+G : "address+1" , set breakpoint there
JMP EAX -> OEP

what is command for "Ctrl+G" in OllyScript ?

/*
2h21 AM Wednesday January 05 2005
exe32pack 1.42 OEP Finder
Author : dqtln
Email : dqtlncrk@gmail.com
OS : WinXP Pro SP1 , OllyDbg 1.10 , OllyScript 0.92
For opinions & bugreport send me a email
Thank you very much
*/

findop eip,#8F85#
bp $RESULT
run
bc eip

dqtln:
findop eip,#7402#
bp $RESULT
run
bc eip
cmp eax,ebx
jne dqtln

sto
sto

findop eip,#AA#
bp $RESULT
run
bc eip

findop eip,#7401#
bp $RESULT
run
bc eip
findop eip,#7401#
bp $RESULT
run
bc eip

sto
sto

an eip
cmt eip,"This is the OEP - Found by dqtln"
msg "Dump and fix IAT now - Good day"
ret


OllyDbg used for Realtime debugging of Display Driver

RCE Messageboard's Regroupment > General > OllyDbg used for Realtime debugging of Display Driver
karthikbalaguru
01-07-2005, 03:16 AM
Hi,
Can OllyDbg used for Realtime Debugging of Display Driver
for windows 98.

At present i use Softice for sometime and Rterm98 for
sometime (both have their own problems and bugs).

So, i have thought of switching to OllyDbg. But i would like
to know the extent it can be used for debugging of
win98 display driver.

(mine will be having win98 .drv and .dll files)

Do let me know quickly,
Advanc thanx and regards,
karthik bala guru


Loading OllyDbg at BootTime

RCE Messageboard's Regroupment > General > Loading OllyDbg at BootTime
karthikbalaguru
01-07-2005, 03:26 AM
Hi all,
How could i use OllyDbg to take control at the start of the
boottime itself so that i can use it for debugging of
my win98 diplay driver ?

clearly,
That is, it should be able to take control at the initial stage itself
and be able to load other drivers/modules so that i can
identify the time at which mine gets loaded and step into it.

Do let me know,
Thnx in advanc,
karthik bala guru
hosiminh
01-07-2005, 06:48 AM
Ollydbg is Ring-3 debugger thus it cannot debug ring-0 processes (kernel od OS).
Softice (part of the DriverStudio) is ring-0 debugger , so you can debug kernel , display drivers and other processes that run on ring-0 privileges and of course all other processes .

A short word with those rings : you can "jump" from ring-0 to ring-1 (or higher) . You cannot jump from ring-3 to ring-0
oh me anon
01-07-2005, 06:51 AM
ollydbg is a ring 3 (user mode debugger) it is not a kernel debugger
and as such ollydbg doesnt need to be loaded at boot
ollydbg doesnt use any drivers to do the debugging
if you are planning to debug a driver and are looking for a kernel debugger then softice (a commercial debugger that works on standalone machine would be the best choice)
if not you can try to get windbg from microsoft (some kind of eula based
half baked free licenseware )
it is a usermode debugger as well as kernel debugger
the problem with kernel debugging with this debugger is you need
two computers one running debugger and other running the debuggee
connected through some thing called nullmodem cable (i think that is the term)
or if you are using xp or w2k3 server then you can even do local debugging of kernel upto certain extent
or this functionality can be extended to w2k if you get
livekd from sysinternals another freeware

but you want to debug a dll it seems from your other post
dlls can be debugged directly with ollydbg as they run in user mode
not in kernlemode afaik

hope the explanation helps
have fun :)


ollyscript gathering iat info script.

RCE Messageboard's Regroupment > OllyScript > ollyscript gathering iat info script.
lucian
01-07-2005, 06:42 AM
Hy

Dose somebody have this script?
garryw
01-07-2005, 11:19 PM
// For Gathering IAT infomation
// Start This at App.OEP
// Made By OrionOnion
//
// OllyDBG LogData Window Open
// Set LogToFile and Run Script
// 0x401000 is Code Image Base
//
// In my case, Virtual IAT address started at 0x003D????

var mem0
var mem1
var mem2
var mem3
var s_addr
var s_par

dbh

log "CALL ds:[0x003d????]"
mov s_addr,401000

l_call_begin:
findop s_addr, #FF15????3D00#
mov mem0,$RESULT
cmp mem0,0
jE l_call_end
mov s_addr,mem0
inc s_addr
mov mem1,mem0
ADD mem1,2
log mem1
mov mem2,[mem1]
log mem2
log [mem2]
jmp l_call_begin

l_call_end:

log "JMP [0x003d????]"
mov s_addr,401000

l_jmp:
findop s_addr, #FF25????3D00#
mov mem0,$RESULT
cmp mem0,0
je l_jmp_end

mov s_addr,mem0
inc s_addr
log mem0
mov mem1,mem0
ADD mem1,2
log mem1
log [mem1]
jmp l_jmp

l_jmp_end:

log " MOV R32,[0x003D????]"
mov s_par,0

l_mov_begin:
mov s_addr,401000

cmp s_par,0
JNE l_mov_ebx
//log "MOV EAX,[0x003D????]"
l_mov_eax_begin:
findop s_addr,#A1????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_ebx:
cmp s_par,1
jne l_mov_ecx
//log "MOV EBX,[0x003D????]"
l_mov_ebx_begin:
findop s_addr,#8B1D????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_ecx:
cmp s_par,2
jne l_mov_edx
//log "MOV ECX,[0x003D????]"
l_mov_ecx_begin:
findop s_addr,#8B0D????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_edx:
cmp s_par,3
jne l_mov_esi
//log "MOV EDX,[0x003D????]"
l_mov_edx_begin:
findop s_addr,#8B15????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_esi:
cmp s_par,4
jne l_mov_edi
//log "MOV ESI,[0x003D????]"
l_mov_esi_begin:
findop s_addr,#8B35????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_edi:
cmp s_par,5
jne l_mov_ebp
//log "MOV EDI,[0x003D????]"
l_mov_edi_begin:
findop s_addr,#8B3D????3D00#
mov mem0,$RESULT
jmp find_main

l_mov_ebp:
cmp s_par,6
jne l_mov_end
//log "MOV EBP,[0x003D????]"
l_mov_ebp_begin:
findop s_addr,#8B2D????3D00#
mov mem0,$RESULT
jmp find_main

find_main:
cmp mem0,0
je l_find_end

mov s_addr,mem0
inc s_addr
mov mem1,mem0
cmp s_par,0
je l_main2

INC mem1

l_main2:
INC mem1
log mem1
mov mem2,[mem1]
log mem2
log [mem2]

cmp s_par,0
JE l_mov_eax_begin
cmp s_par,1
JE l_mov_ebx_begin
cmp s_par,2
JE l_mov_ecx_begin
cmp s_par,3
JE l_mov_edx_begin
cmp s_par,4
JE l_mov_esi_begin
cmp s_par,5
JE l_mov_edi_begin
cmp s_par,6
JE l_mov_ebp_begin

l_find_end:
inc s_par
jmp l_mov_begin

l_mov_end:

MSG "Gathering Done!"
ret
lucian
01-10-2005, 04:08 AM
thanks very mutch m8.


where to get .exe file info?

RCE Messageboard's Regroupment > General > where to get .exe file info?
Raygun
01-07-2005, 07:30 PM
No not PE header stuff.
Where can one get info on how linkers do the fixups
and how they put stuff in the import table & import address table etc.
how is the order of thunk values determined etc. etc.
hosiminh
01-08-2005, 05:39 AM
LordPe ,PeID , Procdump can give you such info
Raygun
01-11-2005, 12:02 AM
Thank u hosiminh. I know your intentions are good. This is a good
answer to some other question.
Bob
01-12-2005, 01:24 AM
Microsoft.com has all the info you need..
search msdn for relocs or imports.. etc
Raygun
01-14-2005, 04:44 PM
I've looked at MSDN journal (and formerly MS Systems journal). They have some good articles on linkers and the windows loader, especially those in the "Under the Hood" column by Matt Pietrek. But details are few (even Matt alludes to this). Generally, as with most MS stuff its up to hackers to find the details, which is why I was wondering if anyone knew - if anyone had hacked the windows loader to see how it works etc. or hacked the visucal c linker etc. etc.
I know many crackers who think exe files are just assembly language instructions and they forget about the data sections in files. For eg in Vbasic the data sections contain are the control properties - you can get at this and change many things without doing any coding.


Good site for assembler info

RCE Messageboard's Regroupment > The Heap > Good site for assembler info
Raygun
01-11-2005, 01:14 AM
best on the net is

http://cs.smith.edu/~thiebaut/ArtOfAssembly/artofasm.html

second best (refers to same book, Art of Assembly by Randall Hyde)

http://webster.cs.ucr.edu/AoA/index.html

best explanation is file pc_asm-book.pdf at

www.drpaulcarter.com (http://www.drpaulcarter.com)
thomasantony
02-14-2005, 09:18 AM
Hi,
The best sites are :

http://win32asm.cjb.net
http://www.masm32.com
http://www.masmforum.com

and my own site:

http://www.tomasm.tk :-D
They really helped me with learing win32asm

Thomas Antony
Raygun
02-16-2005, 11:54 PM
I agree these are good sites ... if you're doing win32 assembly ...
But reversers often need to know other things besides
how the parameters to MsgBox are passed on the stack etc. etc.

Eg.
do you know how local variables are saved in a routine?
Do you know ebp+8 is referring to a passed in parameter
while ebp-8 refers to a local variable in the routine?

do you know for eg that call dword ptr [445672+4*eax]
is a call into an array of function pointers (eax is the array index)
etc. etc. etc.

Check out the other sites. It really isn't a my-dog-can-wip-your-dog
fight. Reversers should learn, learn, learn.


Forgotten (?) Feature request

RCE Messageboard's Regroupment > OllyScript > Forgotten (?) Feature request
TheTwo
01-11-2005, 11:50 AM
Anonymous

Posted: 29 Jun 2004 09:13:43
Quote

Could it be possible to add an instruction that does the same thing as CTRL-F2? There are some things I need to do to dynamicaly analyze a couple programs, but it needs to restart frequently.

psyCK0
Member

Posted: 29 Jun 2004 09:49:29
Quote

Sure, will be added in next version

Whatever happened to this feature? I mean no disrespect (Ollyscript is a wonderful piece of work), I'm just currious.

I tried implementing this myself with the ollyscript dll interface, but Ollydbg does program restarts very oddly (it apears this type of feature is impossible in a pluggin like ollyscript). Is this why it was never implemented?
zel
02-11-2005, 12:27 AM
do you any script for execryptor v 2.1.15? :)


loading a library

RCE Messageboard's Regroupment > General > loading a library
vmagic
01-11-2005, 12:24 PM
hello,

i am wondering how you would load a library into an exe. example, if i wanted to add some code to popup a message box into a simple hello world application, and i need to import the user32.dll, how would i do that.
Ricardo Narvaja
01-11-2005, 03:02 PM
with the api LoadLibraryA load the dll and with GetProcAddress you have the adress of any api of this library in your machine.

look WINAPIS32 is the help of the apis.

Ricardo Narvaja
vmagic
01-12-2005, 10:00 AM
when i use GetProcAddress, where does the address get stored so that i can use it?

thanks:D
oh me anon
01-12-2005, 01:32 PM
please grab a copy of win32.hlp
or downlaod platform sdk from microsoft
and go through them it will clearly state what will be returned

now where it returns is dependent on how you see it i believe

for example a line of hll program may look like this

if (ret = GetProcAddress( *dll ,*proc) !=0)
{
call ret (args);
do blah;
return success;
}
else {
get lost;
}
return iamlost;

now the same would be looking like this is asm
invoke GetProcAddres, ADDR name_of_dll, ADDR name_of_proc
mov return,eax

push args
call [return]

now if you are looking and coding under debugger
you can do like below

push addr
push addr
call GetprocAddress
push args
call eax

please look into winhlp
code some simple programs
run them under debugger get your self familiarized with
what return where and how

and btw i am not discouraging you but in this forum you cant expect
answers to questions like your because this forum is meant for questions
regarding ollydbg its usage its problems its plugins etc

try to visit win32asmboard if you are interested in coding in assembly
or may be read through forgers winprog tuts if you prefer
high level syntax

ps edit
i re read your original question
by a simple hello world program you mean you are coding with c or c++
and building it as console version ?? (a console version means it displays
the string in the black box called dos)
then you will have some more compatibility problems like
putting together gui code along side of cui
gui == graphical user interface
cui == console user interface
vmagic
01-12-2005, 05:42 PM
ok thanks.

why would it matter if its being in dos or not, because if im loading that library and calling code from there then would it really matter?

i know all about windows api and stuff, i was wondering where does the value returned from GetProcAddress go in asm? cause its not like one can use variables at the debugging level..


sysenter??

RCE Messageboard's Regroupment > General > sysenter??
rendari
01-13-2005, 02:06 AM
Alright, so I'm debugging a process, and I trace into a Kernel32 call. At some point I arrive at the sysenter command, and then when I trace over it, it says status: running, and does nothing. What does this mean, and what is the sysenter command??
oh me anon
01-13-2005, 07:05 AM
sysenter is a wrapper for passing from ring 3 (user mode code) to ring 0 (kernel mode code)
in windows you cant access kernel directly from user mode code
you need a device driver (called vxd wdm) to access kernel code

the ntdll.dll is a dll which takes user mode code referances
and passes it to NTExecutive (ntoskrnl.exe) or hardware abstarction layer
hal.dll

in w9x series there were vxdcalls there were many loop holes that allowed code to access kernel without having a device driver it was modified in w2k it was int 2e which was called NTcall it had some speed overheads iirc so it was modified to sysenter in xp

if you prefer to read about NTcalls
visit sysinternals website and find NATIVE API referances
or get undocumented windows internals some thing book by
sven_b_schreiber

simply speaking CreateFileA() that you code in your program
calls CreateFileW which in turn calls
ntCreateFile in ntdll which calls the NTExecutive with sysenter
the system creates the files and returns back to your code
focht
01-13-2005, 05:32 PM
I might point to some earlier post/answer by me regarding that topic ;)

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=680 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=680)

Hope it helps...
rendari
01-13-2005, 08:07 PM
Thanks focht, that helped a lot.


finding a a function by name

RCE Messageboard's Regroupment > Plugins > finding a a function by name
hernan
01-13-2005, 07:17 PM
how can I find a function by its name?

lets say kernel32.dll:createfilea?

i'm trying to use findlabelbyname and findimportbyname but both
have the arguments

addr0 - start of address range (included);

addr1 - end of address range (not included).

I have no idea what this range is. i tried with 0-ffffffff but it does't work.
any help will be appreciated.
thanks
bye
oh me anon
01-14-2005, 06:50 AM
click on cpu pane (top left )
right click and
select search for ---> names in current module
a new window will open
start typing CreateFile
if it exists in you exe olly will show and entry
now right click and select find referances to import
it will pop another window with all calls in your exe that calls CreateFile()
global short cut to names window is
ctrl+n

and reading ,understanding and experimenting with the methods in the help file might solve many other problems like this :)
hernan
01-14-2005, 03:13 PM
mm, man, i'm trying to do it programatically, from a plugin in C/C++.
I already know how to do it using the GUI.

if you answer me with the right answer this time, please I would appreciate if you can save for yourself your smart-ass comments.

thanks.
hernan
01-14-2005, 09:52 PM
now I'm trying the following:

char mybuff[2048];
Findname( 0, NM_ANYNAME, &mybuff[0]);

while( Findnextname( mybuff ) ) {
MessageBox(NULL, mybuff, mybuff, MB_OK);
}

but it is not working either
hernan
01-15-2005, 12:26 AM
ok, I think I now how to doit

with plugingetvalue(VAL_MODULES)
then go thru each module and obtain the proper t_module
using base and size, use findlabelbyname, with
arg0=base
arg1=base+size

lets see if it works
hernan
01-15-2005, 12:37 AM
OK, i did it, finally!
man, I love ollydbg, but the api and lack of documentation sucks :(

here's the code, you can pass a name, and the func will go thru the list of loaded modules and try to find the name of the function.
You can modify and/or create another version to look for function naames in specifid modules (aka dlls).

ulong getnameaddress( char *name )
{
t_table *t_modulelist =(t_table *)Plugingetvalue(VAL_MODULES);
t_module* tmodule;
ulong addr;

int numentries = t_modulelist->data.n;
tmodule = (t_module*)t_modulelist->data.data;

for(int n=0; n < numentries; n++) {
if( Findlabelbyname(name,&addr,tmodule->base,tmodule->base+tmodule->size) )
return addr;
tmodule++;
}

}

I'm adding this kind of stuff in dropzone.redirecme.net, you can go check it out.
thanks, bye


"STRING [ESP+4]" log breakpoint question

RCE Messageboard's Regroupment > General > "STRING [ESP+4]" log breakpoint question
kotzeesser
01-14-2005, 09:13 AM
hi,

if i set a logbreakpoint on some address the logexpression "STRING [ESP+4]" always evaluates to some weird values but not to the string that starts at the value of [ESP+4]

why does this not work?

thx
kotzeesser
01-14-2005, 09:19 AM
ok, [esp+4] contains only a pointer to some string
[[esp+4]] works fine

sorry for bothering


Is this new anti-debugging method or Ollydbg error?

RCE Messageboard's Regroupment > General > Is this new anti-debugging method or Ollydbg error?
Raygun
01-14-2005, 04:49 PM
At the moment I'm looking at a progam where (as is common now) the linker has merged the import table of the .idata section into the .rdata section .... but done it in a strange way so the import table is fragmented on either sides of the other data.

And the other data in the .rdata section is hard-coded addresses of subroutines that get called by the code in the .text section.

To reverse the code (which keeps calling the .rdata section to get the address of the routines to call ) you have to figure out how and why the linker did this. Or is it the linker at all? Or some new anti-debugging method? Or Ollydbg error? Has anyone seen anything like this before?
focht
01-16-2005, 04:51 PM
Check out with PEiD (http://peid.has.it/) and tell what it says...


getting list of breakpoint

RCE Messageboard's Regroupment > Plugins > getting list of breakpoint
hernan
01-14-2005, 10:29 PM
ok, ollydbg's plugins API is the wierdest thing i've ever seen :)

so, let me contribute with sthg that took me a while to figure out :):

getting list of breakpoints:

t_table *bptable;
t_bpoint *bpoint;
bptable=(t_table *)Plugingetvalue(VAL_BREAKPOINTS);
if (bptable!=NULL) {
int numitems = bptable->data.n;
bpoint = (t_bpoint*)bptable->data.data;
for(int n=0; n < numitems; n++) {
char buff[100];
sprintf(buff, "%.8Xh", bpoint->addr);
MessageBox(NULL, buff, "Breakpoint", MB_OK);
bpoint++;

}

}

bye :)


common.arg for MFC42 ??

RCE Messageboard's Regroupment > General > common.arg for MFC42 ??
MrSmith
01-16-2005, 07:49 AM
Hi everybody,

I just wonder if there is a common.arg file for MFC42 around ??

If I understand it correctly, OllyDbg could display the arguments for MFC42 calls in the same way as it can display the arguments for normal win32 API calls with such a custom function description file !?

Many thanx,

MrSmith


Labelmaster feature request

RCE Messageboard's Regroupment > Plugins > Labelmaster feature request
sigi
01-16-2005, 11:42 AM
two things that would be nice:

first: if labels from files could automatically be limited to length that ollydbg can take (256?). labels larger cause a crash. (undecorated names tend to be very long).

second: being able to supply a different base adress (since dlls are sometimes relocated).

labelmaster is a really nice plugin, very usefull...
focht
01-16-2005, 04:47 PM
Hi,

well for the case of "automatic limitation" the plugin author is not to be blamed because it's a shortcoming/inconsistency of ollydbg plugin interface iteself.

The plugin uses:

int Quickinsertname(ulong addr,int type,char *name);

(though same applies to Insertname())

which takes a "char*" as 3rd param.
There is no "max length" argument nor even a size limit mentioned in plugin docs.
Though one could "guess" the limitation by looking at other plugin functions which use "TEXTLEN" for char buffers.

For the "crash" case its not really ollydbg's fault but a plugin bug.
The stack gets overwritten due to large input line.

offending code (shortened)

<-- snip -->
....

while(ReadLine(fd,buf,bufsize) > 0) {
sscanf(buf, "%x %[\x20-\x7e]", &addr, label);

<-- snip -->

While the readline() call succeeds (bufsize limits the line reading) the sscanf() call will overwrite the stack due to insufficient "label" buffer.

Simple calculation:

char buf[550];
int bufsize = 550;
char label[512];

There is a "size" gap between line buffer and label buffer.
If you assume text file lines like "<hex addr> <label>" where the addr takes say 8 ascii bytes and 1 space the label length might exceed 512 bytes thus sscanf() overwriting buffer bounds.

Fix: Make label buffer size equal to buflen at least or use "%<maxlength>s" format string style.

>second: being able to supply a different base adress (since dlls are sometimes relocated).

I assume you mean the re-based address should be applied to imported labels?
Well that needs some change in stored file format, because relative virtual addresses (RVA) are needed for this.
One could save the image base as first line and all labels/comments using "<rva> <label>" style.
A feature extension like rebased image address can be then accomplished easily.

Regards
sigi
01-31-2005, 09:32 PM
now that's accurate information, thank's a lot...


ollyscript.dll ???

RCE Messageboard's Regroupment > General > ollyscript.dll ???
Dogit
01-16-2005, 05:04 PM
Hello,To all

Could someone please help me with this problem
where is this ollyscript.dll i had a look inside the
olly Folder & no luck

Thank you
focht
01-16-2005, 05:12 PM
Hi,

its a plugin, you can download it (including scripts) here: http://ollyscript.apsvans.com/

Regards
Dogit
01-16-2005, 05:42 PM
Hello,focht

Wow thanks that was fast may i ask how
do you save a txt file to a script type please

Thank you
focht
01-16-2005, 06:55 PM
Hi,

create/edit scripts with your favorite text editor and save it with ".osc" file extension (file save/save as dialog).
You can use/run any other file extension too ... just select "All" under "Files of type" in "Run script" dialog.

Regards
Dogit
01-16-2005, 07:54 PM
Hey,focht

Wow you the boss thank you
have a great one :)-------Me happy now hehe


JIT Debug Launch Issue

RCE Messageboard's Regroupment > Bugs > JIT Debug Launch Issue
Piers Plowman
01-17-2005, 03:37 PM
On my Win2k SP4 system I cannot use the Ollydbg as a system debugger as when it is set for this I only get errors on trying to open -aedebug.exe

I looked at the key at

HKLM\Software\Microsoft\WindowsNT\CurrentVersion\A eDebug\Debugger

and found the value to be

"C:\toolkit\OLLYDBG.EXE" -AEDEBUG %ld %ld

it does properly? parse the %ld %ld as the Process ID of the target process

Launching it from the commandline as ollydbg -aedebug <procid> also has the same error.

I tried removing the key and recreating it through the JIT options in Olly but the same key value is set.

Any ideas on what is wrong?

TIA
focht
01-17-2005, 05:20 PM
Hi,

well that registry key looks fine.
First parameter is process id (PID) and second one is event handle (to be signaled if process is attached).

To test it from command line you need to supply both parameters, e.g.:

ollydbg -AEDEBUG <pid> <event handle>

To test JIT, write some simple program which forces unhandled exception.

Regards
Piers Plowman
01-17-2005, 07:10 PM
Thanks for your quick response!

I didn't realize that the second parameter was for the event handle. The application I was envoking the debugger from wasn't passing that parameter and if you launch it from the commandline as I did previously it gives that anomalous error regarding -AEDEBUG.exe

Perhaps the error handling for insufficient/improper command arguments can be made more clear in a future version.

Thanks again! :)


problem with t_module.name

RCE Messageboard's Regroupment > Plugins > problem with t_module.name
hernan
01-17-2005, 10:46 PM
I think there's a problem with the t_module.name member.
I'm listing the modules, and for the kernel32.dll module, in the t_module.name member, I think there's a 0 missing.

When I obtain the contents of t_module.name I get

kernel32c:\windows\system32\kernel32.dll

it seems that the shortname is missing the 'NULL" terminator. and since the complete name of the module is the next item in the structure, i get that too.
is that possible?

for the other modules (the name of my .exe file, and ntdll) I get the expected result while listing the modules.

anyone has experienced this?
thanks!
bye
focht
01-18-2005, 04:40 AM
Hi,

-- snip plugin.h ---

typedef struct t_module {
...
char name[SHORTLEN]; // Short name of the module
char path[MAX_PATH]; // Full name of the module
...
} t_module;

...

#define SHORTLEN 8 // Maximal length of short name

-- snip plugin.h ---

What you see is valid.
A character style array like "char []" doesnt necessarily need to contain null terminator.
A string is a sequence of chars that ends with a null character (a char with the value 0, usually written as '\0' to emphasize that it's being used as a string terminator).

You can store a string into an array of char as long as there is enough
room in the array for the entire string plus the null terminator.
If an array of char contains a string, sizeof will still give the total
number of elements in the char array, while strlen() will give the
number of chars in the string contained in the array.
For an array A with a string stored in it, strlen(A) < sizeof(A) must be true.

In this case:

strlen( "kernel32") == 8
sizeof( t_module.name) == 8

which basically means the array of char lacks the null terminator because there is no more space.
The entry is fully valid of course (see my first sentence).

To get the data, you need to use the "strncpy" function like this:

strncpy( buf, module.name, SHORTLEN);

Your destination buffers should always be declared to contain extra room for the null terminator.
When calling strncpy(), pass it a length value that is at least 1 character less than the overall size of the destination buffer, and make sure that the extra room is intialized ot set to '\0' before the buffer is used after the copying.

So the final solution whould be:

char buf[SHORTLEN+1]
strncpy( buf, module.name, SHORTLEN);
buf[SHORTLEN] = '\0';

Regards


ODBG_pluginreset not good

RCE Messageboard's Regroupment > Plugins > ODBG_pluginreset not good
hernan
01-18-2005, 12:08 AM
ok, so my plugin sets breakpoints manually, but then, when the user
restarts the application being debugged, aka presses ctrl+f2, i want
to re-set the breakpoints.

But, if I try to do it on ODBG_pluginreset, I get an error, probably because ollydbg has not 'properly' loaded the debugged module yet..

so.. is there a way to do this? how can i re-set (re-set, set again, not reset :)) my breakpoints after the uses presses ctrl-F2?

thanks.
bye


Example of custom function for MFC42

RCE Messageboard's Regroupment > General > Example of custom function for MFC42
MrSmith
01-19-2005, 12:33 PM
Hi,
I tried to create a common.arg file for an MFC42 function, but run into problems.
In my program I have a call like this (demangling switched on):

push 1
mov ecx,esi
call <jmp.&MFC42.#5503_CWinApp::RegisterShellFileTypes>

My common arg looks like this:

info MFC42.#5503_CWinApp::RegisterShellFileTypes
stdfunc RegisterShellFileTypes
"bCompat" BOOL
end

In Ollydbgs Log window I see that Olly loads common.arg, but my disassembler listing remains the same, even after redoing "Analyse Code'".

Why is this? Why doesn't Olly recognise the function?
Could it have something to do with the demangling ?

Any help is welcomed,

MrSmith
Lord_Looser
01-19-2005, 03:55 PM
use stdfunc "#5503_CWinApp::RegisterShellFileTypes"
or stdfunc "#5503_RegisterShellFileTypes"
or deactivate debugging option - addresses - prepend ordinals to implib names and use
stdfunc "CWinApp::RegisterShellFileTypes"
or stdfunc "RegisterShellFileTypes"
(with "" !!) in common.arg

for me i tested it with:
info MFC42.#1200_AfxMessageBox
STDFUNC "#1200_AfxMessageBox"
"lpszText" INT
"nType" INT
"nIDHelp" INT
END
MrSmith
01-20-2005, 06:14 AM
many thanx,
now I'm getting somewhere.

cheers,

MrSmith


After unpacking UPX-File RCData still encrypted

RCE Messageboard's Regroupment > General > After unpacking UPX-File RCData still encrypted
Jaffar
01-19-2005, 01:58 PM
I want to translate a Program (Freeware, made in delphi I think) form russian into english. The File is packed with UPX 1.24. After unpacking it (i've tried it with several tools and selfmade with ollydbg) the rcdata is still encrypted. So I can't use tools like Resource Hacker to translate it. Has been used some kind of protector or scrambler to crypt it? Has someone an idea how to decrypt the data?

Some Infos:
program: Small CD-Writer 1.33
written in: Borland Delphi 6
packed with(PEID): UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo

thanks
KSA
01-20-2005, 08:30 AM
Did you try decompression with UPX it self.

upx -d FilenameToUnpack

KSA
ExE_SyS
01-24-2005, 08:39 AM
Hi,
Try use Restorator. It's very useful and universal tool. Search with Google or write to me! I hope I was helpful!
Jaffar
01-25-2005, 09:54 AM
Hi,
I can't unpack it with upx -d. I will try it with restorator. Thanks
for your help
Cylox
02-12-2005, 12:20 PM
I am having the same type of problem. upx -d doesn't work... it says: "CantUnpackException: cannot upack UPX ;-)" Even with restorator it says it is still compressed, even though i have dumped from the oep and fixed with ImpRec.... what gives??
dirtyoldm
03-10-2005, 08:44 AM
test
dirtyoldm
03-10-2005, 08:47 AM
From another forum on BartPE at
http://www.911cd.net/forums/index.php?s=18168298096062209e7cabb0de570f e3&showtopic=7564&st=30&#entry48414
(http://www.911cd.net/forums/index.php?s=18168298096062209e7cabb0de570fe3&showtopic=7564&st=30&#entry48414
)

"in hex-editor, go to offset 3E4 (after "UPX!"), replace FF to 0C, save and unpack with UPX -d filename.exe
But resources are crypted, i see this in PE Explorer as HEX code."

YES this works, I tried it.

Under RC Data the TFORMx items are garbage.
All begin AVF8X ascii.

!! Under PACKAGEINGO are 3 AVTxxxx items including 'AVTCript'.
Maybe the program decrypts each resource as needed.

AVTCript appears in the code at 000E07 EA, preceded by its ID, D210h.

The encrypted TFORMs must include the icons in the menus, can't find them elsewhere.
naceur
03-11-2005, 03:38 PM
i have same problem with asprotect

the exe file is unpacked but rcdata it not possible to change it
smarter
03-13-2005, 08:25 AM
Here has a tool which can get resource even the .exe is packed.
The following is the address,you can download it :

http://www.pediy.com/tools/Resource/freeRes/freeRes0.94.zip
dirtyoldm
03-21-2005, 02:36 AM
Getting the RC Data resources is no problem using Resource Hacker
http://www.users.on.net/johnson/resourcehacker/

Someone needs to
A) decrypt them
B) hack the EXE to remove the decrypting it does
C) Give the writer a smack up side his head for making his excellent work useless to the rest of the world!


How to find the OEP of a Crypkey protected program

RCE Messageboard's Regroupment > General > How to find the OEP of a Crypkey protected program
Praveen
01-20-2005, 07:09 AM
The problem was finding the OEP of the program. I was using olly and tried to break on GetProcAddress - The third one...
Then I tried to come into the caller prog and step until I came to a sub eax,ecx followed by a jmp eax instruction.
I am not sure whether I'd missed it but I didn't find EITHER of those instructions.

I will be very happy if you could please tell me the EXACT steps YOU'D do to get to the goal of finding the OEP.

In other words, the question is very simple... - How EXACTLY do i get the OEP of a program which is packed with Crypkey 5.6?
There is not much useful material on the net reg this point which I could follow.
And I'd spent almost 3 months researching about this Crypkey business.

I'm sure that there MUST be a simple and generic way to find the OEP of Crypkey programs...

Any guidance in this direction will be much appreciated...
Thanks....
1bitshort
01-20-2005, 07:31 AM
Try the OllyDump plugin, it has two generic OEP finders. No idea if it'll work on Crypkey though.
Praveen
01-20-2005, 07:41 AM
That was fast...
However that didn't work as there was no entry into a new section etc...

The entrypoint was initially itself in the 450000 range and so it was useless...

There MUST be SOME comands to bp on... And the question is what they are and how to exactly to bp on them...


execute functions in ollydbg

RCE Messageboard's Regroupment > General > execute functions in ollydbg
hernan
01-20-2005, 09:30 AM
is there a way to call a function in ollydbg?

like you do on gdb for example (you can call strlen() just from the debuggers cmdline), is there a way to do that?

or do I have to do it on my own? (copying code on the stack, changeing eip, ec et etc etc, what a mess... :( )

thanks, bye!
focht
01-25-2005, 04:29 AM
Hi,

you might look at "commandbar" plugin.
If you need gdb/windbg command(line) stuff, extend the plugin whatever...

If you think of calling debuggee functions with params at runtime i suggest either inline patching (jump gate + code cave) or better use a custom injector (dll).

Regards
hernan
01-25-2005, 08:04 AM
I only wanted to know if there was sthg already in place to call functions in ollydbg, I already know how to do it myself.

thank you anyways.


Break on Data

RCE Messageboard's Regroupment > General > Break on Data
Krakken
01-21-2005, 10:25 AM
Hi,

I'd like to know if there is a way to set a breakpoint to catch certain data such as a specified string during the program's execution.

By this, I mean for example, I set the string "Hello World" as a global breakpoint. If at any time the program see's that string, it will break execution.

Thanks in advance.
1bitshort
01-21-2005, 11:30 AM
I'm not sure if you could do it with a script. You'd probably need to write your own debugger (trivial, the debug loop is a very simply piece of code) that looks at each register as if it was a pointer and examines the contents of each (= slow).


Unpack UltraProtect or Anticrack Protector

RCE Messageboard's Regroupment > General > Unpack UltraProtect or Anticrack Protector
Vntalk
01-22-2005, 08:09 PM
This Is not a Crack Request.

I Try TO Use The Olly Script Ultraprotect by loveboom to unpack a soft.
But it does'nt work. When I run the script, it found the OEP. Then I use Olly dump to dump it. But it still does'nt work

Thanks for your help
KaGra
02-07-2005, 05:30 PM
http://www.coderz.gr/tutorials.php?cat=Nothing&id=45

;)
TBD
02-08-2005, 07:08 AM
hmm, if it is not cracking related, than what is it ? ;)
azuka
06-28-2005, 04:06 PM
bueno estos no es un unpacker o nose que sea pero no lo es por que no llego a entenderlo.

alguien puede colocar buenos manuales de como desempacar ultraprotector o que es lo mismo decir ac protector por favor?

disculpen no hablo ingles y estoy usando un traductor

Tranlation >>

Good these it is not an unpacker or nose that be but is not him because do not I come I understand it.

Someone can place good manuals of as to unpack ultraprotector or that is the same thing to say ac protective please?

excuse do not I speak groins and I am using a translator
Ricardo Narvaja
06-28-2005, 05:07 PM
pues tenes manuales de ultraprotect y hoy mismo saco uno nuevo NCR de ACPROTECT que es el nuevo nombre

http://www.ricnar456.dyndns.org/WEB/NUEVO%20CURSO/TEORIAS%20DE%20CRACK ING
(http://www.ricnar456.dyndns.org/WEB/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING
)

ahi tenes tutes de ultraprotect y acprotect, y lo de buenos no se a que te referis, si esos tutes se refieren a un programa empacado y quedo funcionando son buenos, si vos no lo entendes no es el tute que falla creo yo, porque funciono para el programa que se habla, ahora que se pretenda que un tute sobre un programa empacado con determinado packer sirva para todos los programas del mismo packers que tiene muchas versiones y variaciones eso ya es otro cantar, ningun tute sobre un programa sera identico en otro es solo una guia , el resto lo tiene que poner el que lo adapta porque nadie puede ni es humanamente posible hacer 1000 programas empacados con ultraprotect en todas sus versiones, para que el que intente tenga todo servido y no tenga que pensar ni un 1%, te reitero que es solo una guia y el resto lo tenes que poner vos, o consultar para adaptarlo a cada caso particular.
Yo veo eso en muchos nuevos unpackers si un tute dice apretar 10 veces f8, en vez de tratar de entender porque es eso, repiten lo mismo hasta que el programa cambia un poco y ese metodo quizas haya que variarlo un poco y ya dicen que el tute que habia es malo, no es malo, es de una version anterior, o ciertos detalles fueron cambiados por el programador, para que lo que leyo en el tute no se pueda hacer, entonces hay que buscarle un poco la vuelta nunca sera muy diferente solo un poco.

Ricardo Narvaja
azuka
06-28-2005, 07:15 PM
a bueno gracias por lo dicho y creo que no te molestare hasta tener otro problema como esto pero no creo que sea la ultima ves qu ete fastidie de este modo sino oriras hablar de mi mas bueno desearia hablar y charlar con vos por el msn pero creo que seria joder mucho ok

y gracias por la larga lista de tutos q estoy viendo en su web y me estan gustando la mayoria

=]
TBD
06-28-2005, 08:10 PM
1. this is an english forum
2. I will delete also unpacker posts as it seems that are only cracking related


How to manual unpack UltraEdit with OllyDbg

RCE Messageboard's Regroupment > General > How to manual unpack UltraEdit with OllyDbg
paf
01-23-2005, 03:08 PM
This isn't CRACK request.
I wanna translate English into Chinese.
But I don't want to use Unpacker, I want to MANUAL unpack.

version of UltraEdit is 10.20d

Could someone give me tutorial~~~~

Thank YOU!!!!!!
ExE_SyS
01-24-2005, 07:11 AM
Hi,
I think that you may use some software like Restorator or ResourceHacker. It can recompile executable file and you can change texts or graphics, delete forms (include nag screen too ;)). It's very good to doing trasnlations or doing skins for applications. Try it, use Google.com or write to me. I hope I was helpful!
hosiminh
01-24-2005, 09:48 AM
You cannot use such programs ( Restorator or ResourceHacker) on packed file . UltraEdit v10 is packed with armadillo as i know .
paf
01-24-2005, 10:08 AM
yep~~~
UltraEdit 10.20d is packed with Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks (use PEiD to detect)
hosiminh
01-25-2005, 05:43 AM
Find previous version v9 that is not packed.

Search for "uedit32.zip" in your favourite search engine or go here:

_http://www.filemirrors.com/search.src?type=begins&file=uedit32.zip&ac tion=Find
paf
01-25-2005, 11:46 AM
hi hosiminh

I want to tranlate version 10.20d, not version 9
so I want to know how to MANUAL unpack this version

thanks~~
hosiminh
01-25-2005, 12:35 PM
Then go here:

_http://tothesky.us/

(warning : if program use copymem 2 and nanomites it is not easy not unpack)


OLLYSCRYPT COMMAND SUGGESTIONS

RCE Messageboard's Regroupment > Plugins > OLLYSCRYPT COMMAND SUGGESTIONS
Ricardo Narvaja
01-26-2005, 02:59 AM
I don´t know if ollyscript continue or not, but is the more important plugin of ollydbg for me, and for this reason i suggest to the author this very useful commands.

examples

004013A9 E8 EA9F0600 CALL dump2.0046B398
004013AE 5A POP EDX

COMMANDS

1)NEXT

NEXT 4013A9

$RESULT=4013AE

return the adress of the next instruction

2)DIS

DIS 4013AE

$RESULT="POP EDX"

return the text of the assembly line

3)change of view from olyscript

GEXPL 401000

similar to GOTO EXPRESSION IN CPU LIST = 401000

GEXPD 401000

similar to GOTO EXPRESSION IN THE DUMP=401000

VIEWLOG

similar to VIEW LOG

VIEW MEMORY (EXECUTABLES-TRACE INTO etc)

change the view in OLLYDBG this are useful when the program ask you with a MSGYN, for make a desicion and you need view some value in the dump or in the cpu list, or in a different view and if you can change from the script is perfect.

FINDTO 401000 500000 #FF#

other find but limited from 401000 to 500000 for example, there are tasks with the FIND searching in all memory, the script crash for look in not necesary memory sections.

The posibility of mov, compare and work with bytes and words, not only dwords are very useful.

If the author read and think is possible add any command of this to ollyscript, will be a great help for us.

Ricardo Narvaja
Ricardo Narvaja
01-26-2005, 03:01 AM
ah i remember

the possibility of use [ ] in all commands

mov [ebp-4],eax

cmp [ebp-4],eax

there are commands than accept but others not.

Ricardo Narvaja
psyCK0
03-08-2005, 03:30 PM
If any of you wonder... I haven't died yet. =)
There WILL be a new version of OSC ... eventually. Then the requested feature will be added.
Ricardo Narvaja
03-09-2005, 08:04 AM
jeje thanks, vey good you not die.

Regards
Ricardo Narvaja


Morphine 2.7 Unpacker?

RCE Messageboard's Regroupment > OllyScript > Morphine 2.7 Unpacker?
y2k3
01-27-2005, 03:28 AM
Hi Are There Any ollyscript or any tutorial, any unpacker for morphine 2.7 and other versions?

Thanks...
hosiminh
01-27-2005, 06:02 AM
PeID plugin:

_http://go.to/Hairy_Bits
y2k3
01-27-2005, 08:32 PM
There is Morphine 2.7 gui but it is not working on my computer. How can i unpack :\

hosiminh, for your message, thanks...

But i want packer(s) for morphine 2.x versions.

Note : i wouldn't find any morphine unpacker another from 1.2 / 1.3 and they are on ollyscript site. Please Help Me. i am waiting You.

Thanks..
TBD
01-28-2005, 03:26 AM
[warning] walking on thin ice

translation: keep only OD related topics - unpacking is not!
y2k3
02-04-2005, 11:06 AM
OllyScript is an unpacker program or not? Why Everybody send unpacking script. Did You See Only Me? Okay. Thanks.!
TBD
02-04-2005, 12:01 PM
OllyScript is not an unpacker, it is more like a macro recorder.

yes, it seems that OllyScript is used lately only as a tool for unpacking. from now on, all unpacking scripts will be deleted - use OllyScript site for unpacking script repository.
KaGra
02-04-2005, 04:09 PM
http://biw.rult.at/vbb/upload/showthread.php?s=&threadid=1130

Morphine 2.7 unpacking tutor

;)
KaGra
02-05-2005, 07:48 AM
Morphine 2.7 unpacking tutor also in http://www.angelfire.com/indie/zong
haggar
03-29-2005, 05:39 PM
Ignore all exceptions in Olly, then (you must have win XP) put "bp IsBadReadPtr" in cmdline, and run it. You will get message "Bad format..." click OK, you are now in kernel, return in user code, press Ctrl+F9 to rach RETN 0C (I think), execute it. You will land somewhere. Below is JMP EAX go to it , execute it and you are on OEP. The shortest tutorial on the world ;-)

Or paste this in your text:

// ExeStealth v3.04 and Morphine v2.7 - OEP finder script
//
// Works only on Windows XP (because of breakpoint on dll).
//
// ExeStealth first pack file with UPX (but that's optional)
// and then crypt it with Morphine wich uses IsBadReadPtr
// API to clear any breakpoints (that's the reason for that
// "Bad or unknown 32-bit ...").
//
// If there is something wrong with script please mail me
// at "dalmatinac_ipo@yahoo.com".
//
// written by haggar 29.03.2005
//

msg "Ignore all exceptions. If you get 'Bad or unknown format...' message just click OK. "
gpa "IsBadReadPtr","kernel32.dll"
bp $RESULT
run
bc eip
rtu
rtr
sti
findop eip,#FFE0# // Find JMP EAX that leads to OEP
bp $RESULT
run
bc eip
sti
find eip,#60BE????????8DBE????????# //Is it packed with UPX too?
cmp $RESULT,eip
jne OEP_found
sti
var x
mov x,esp
bphws x,"r"
run
bphwc x
sti
OEP_found:
an eip
cmt eip,"This is the OEP. Just dump and fix IAT!"
ret


Armadillo 4.01a unpack tutorial by KaGra

RCE Messageboard's Regroupment > General > Armadillo 4.01a unpack tutorial by KaGra
KaGra
01-27-2005, 09:56 AM
Armadillo 4.01a unpacking tutor by KaGra

http://biw.rult.at/vbb/upload/showthread.php?s=&threadid=1113

and here:

http://www.angelfire.com/indie/zong

EnJoY ;)
paf
01-27-2005, 10:19 AM
This is great!!!!
Thank you very much!!!!
KaGra
01-27-2005, 10:25 AM
a small note:unpacked may not run in your ver of Win.Whis is becasue it contains the ABSOLUTE API addresses.Follow the tutor and the unpacked will run just fine in your system.
Mine is WinXP SP1 English

;)
linhanshi
01-30-2005, 03:13 PM
Thank you very much!!!
Eggi
01-30-2005, 05:27 PM
use Imprec... it will say that the imports are not valid... then select all the invalid ones (by hand! or you can use the filter...(right click -> advanced commands -> imports filer)) imprec will say that iat is still invalid but you can fix your file with it and it will work...
Snowski
04-15-2005, 08:11 PM
Thanks alot...might just help me.

If anyone is familiar with the COPYMEM-II, and how to get around it, let me know! :D
Kufnor
05-07-2005, 07:43 AM
Hi, KaGra

I want to try your "CopyMEM2+DebugBlocker Armadillo 4.xx unpacking tutorial" which you uploaded in Exetool forums.

I can't download it because I am not a member of that forum.

Will you upload anywhere?
Kufnor
05-07-2005, 01:10 PM
Sorry

I got the above tut.

Thank you
teidkram
05-14-2005, 08:41 PM
i will pay someone to unpack/unprotect an armadillo protected file
post reply here and i will give you my msn/email addy

yes i am dead serious!!!!!!!!
Ricardo Narvaja
05-15-2005, 11:28 PM
This is nonsense to me, if you pay, is logical, you pay for the original, not spend the money in pirated version.

And there are many tuts and is not so difficult, you can unpack by yourself with a little effort.

Ricardo Narvaja
teidkram
05-16-2005, 12:33 AM
if there was an original i could buy i would...........
it is a game server that is in chinese, and i need it unpacked
i have tried to unpack it myself and have failed many times so i thought i would ask the experts for help and offer to pay them......

still nonsense?
Ricardo Narvaja
05-16-2005, 11:02 AM
it´s your money, not mine

Ricardo Narvaja


Visual Basic 6

RCE Messageboard's Regroupment > General > Visual Basic 6
tobibot
01-28-2005, 01:10 PM
Hello.

I'm trying to find a serial for a visual basic 6 app. I know that it is being calculated from the computer name. I don't want a ready made solution, I'm looking for tips and hints on how to deal with visual basic in this case.

I've tried SmartChecker already but it doesn't help me very much.

Any hints, tips, tutorials on this topic would be appreciated.

Thank you very much

TobiBot
tobibot
01-29-2005, 10:59 AM
What I've found out so far is that the app uses long data type to compare the entered string (converted to long first) and the calculated? serial. Therefore it's not possible to break on __vbastrcomp or __vbastrcmp.

TobiBot

PS: If I load the VB6 symbols in softice and set a breakpoint on e.g. __vbastrcmp, bl shows something like

BPX #00ee:00345720

instead of

BPX msvbvm60!__vbastrcmp

Can anybody please explain?

regards
TobiBot


Howto put advanced breakpoint

RCE Messageboard's Regroupment > General > Howto put advanced breakpoint
hosiminh
01-30-2005, 11:59 AM
I want to put bp something like this :

Bpx RegQueryValueExA if (**(esp+8)=='blah') || (**(esp+8)=='jeje')

Is this possible in Ollydbg ?
MaRKuS TH DJM
01-30-2005, 12:44 PM
why not use a conditional breakpoint? i think you can do these things with it
garryw
01-30-2005, 02:33 PM
bp RegQueryValueExA STRING [[esp+8]]=="blah" || STRING [[esp+8]]=="jeje"
at least I think that's what you're asking
oh me anon
01-31-2005, 10:52 AM
alt+e (executable modules)
navigate to advapi32.dll
press ctrl+n find names
type RegQueryValueExa
right click follow in disassembler
press shift+f4
use the following

condition
[string [esp+08]] == "bluh" || [string [esp+08]] == "bleh"

explanation
this is some trial crap

expression
[string [esp+08]]

decode value of expression as : pointer to ascii string

pause program radio button never

log value of expression radio button always

log function argument radio button on condition

press ok

now if you run the exe

you will get an output like this in log window

Log data
Address Message
77DB858E COND: this is some trial crap = vptray
77DB858E COND: this is some trial crap = bluh
77DB858E CALL to RegQueryValueExA from requery.00401058
hKey = 30
ValueName = "bluh"
Reserved = NULL
pValueType = requery.004030B0
Buffer = requery.004030B4
pBufSize = requery.004030A5
77DB858E COND: this is some trial crap = bleh
77DB858E CALL to RegQueryValueExA from requery.00401079
hKey = 30
ValueName = "bleh"
Reserved = NULL
pValueType = requery.004030B0
Buffer = requery.004030B4
pBufSize = requery.004030A5
77DB858E COND: this is some trial crap = tingting
77DB858E COND: this is some trial crap = tongtong
77DB858E COND: this is some trial crap = bluhbluh
77DB858E CALL to RegQueryValueExA from requery.004010DC
hKey = 30
ValueName = "bluhbluh"
Reserved = NULL
pValueType = requery.004030B0
Buffer = requery.004030B4
pBufSize = requery.004030A5
77DB858E COND: this is some trial crap = reaahhh
77DB858E COND: this is some trial crap = huhuhu
77DB858E COND: this is some trial crap = dadada
77DB858E COND: this is some trial crap = gugugu
77DB858E COND: this is some trial crap = hehehe
77DB858E COND: this is some trial crap = Synchronization Manager
77DB858E COND: this is some trial crap = Default
004011CA Breakpoint at requery.004011CA (<ModuleEntryPoint>+1CA)

notice it has logged the function arguments on the condition and has not recorded when the condition was not met notice it also recorded
when the string was bluh as well as bluhbluh also


Source Window

RCE Messageboard's Regroupment > General > Source Window
jmachine
01-31-2005, 12:47 AM
Can you step through the source file with this deguger?
When I bring up the source window it is alwys blank.
How do I see the source file?
Jim
oh me anon
01-31-2005, 08:13 AM
have you compiled it with debug info or do you have the .pdb or .dbg file in the executables directory ??? and is the source file in same directory as the executable if your answer is yes to both of the above question olly should be able to load your source without any problems
use ctrl+f5 to view sourc in olly dbg

you can right click and select view in disassembler from source window
or view source from disassembler window

or use view ---> source files for a list of source files that are availabel
on your project

Source files
Module Source Source path
cout COUT.CPP C:\Borland\testwin\cout.cpp
cout OSTREAM.H c:\Borland\Bcc55\include\ostream.h
jmachine
01-31-2005, 05:30 PM
Thanks. I will check for the files in the directory when I get home. I know I have the .pdb file for sure I use the -Zi option with the assembler-MASM. BTY, I am debugging assembly languaage programs so I'm not sure there is a .dbg file.

Jim


Armadillo Script

RCE Messageboard's Regroupment > OllyScript > Armadillo Script
AvAtAr
02-02-2005, 12:46 AM
/*
.:TEAM RESURRECTiON:.
Armadillo Standard Script by AvAtAr//stephenteh
Tested on WinXP Pro SP2, OllyDbg v1.10, OllyScript v0.92
NOTES:
- Remove all hardware breakpoints before run the script.
- Add the following custom exceptions on OllyDbg:
C0000005(ACCESS VIOLATION), C000001D(ILLEGAL INSTRUCTION)
C000001E(INVALID LOCK SEQUENCE), C0000096(PRIVILEGED INSTRUCTION)
*/

var OpenMutexA
var CreateMutexA
var GetModuleHandleA
var VirtualAlloc
var CreateThread
var JumpLocation
var JumpLength
var OEP

gpa "OpenMutexA", "kernel32.dll"
mov OpenMutexA, $RESULT
gpa "CreateMutexA", "kernel32.dll"
mov CreateMutexA, $RESULT
gpa "GetModuleHandleA", "kernel32.dll"
mov GetModuleHandleA, $RESULT
gpa "VirtualAlloc", "kernel32.dll"
mov VirtualAlloc, $RESULT
gpa "CreateThread", "kernel32.dll"
mov CreateThread, $RESULT

bp OpenMutexA
esto
exec
PUSHAD
PUSHFD
PUSH EDX
XOR EAX,EAX
PUSH EAX
PUSH EAX
CALL CreateMutexA
POPFD
POPAD
JMP OpenMutexA
ende
bc OpenMutexA

bphws GetModuleHandleA, "x"
label1:
esto
cmp eax,VirtualAlloc
jne label1
esto
bphwc GetModuleHandleA
rtu

find eip, #0F84????????#
mov JumpLocation, $RESULT
mov JumpLength, JumpLocation
add JumpLength, 2
mov JumpLength, [JumpLength]
inc JumpLength
mov [JumpLocation], 0E9
inc JumpLocation
mov [JumpLocation], JumpLength

bp CreateThread
run
cob
bc CreateThread
rtu
rtr
sti

find eip, #2BF9FFD7#
mov OEP, $RESULT
add OEP, 2
bp OEP
run
bc OEP
sti
cmt eip, "<- OEP"
msg "You're at the OEP, now dump with LordPE and fix the IAT with ImpRec. =)"
ret
hackerman
02-20-2005, 02:21 PM
armadillo 3.78 successfully unpacked

thanks for the script
JiveAxe
02-27-2005, 06:42 AM
Hi everybody, I'm new in this forum and this is my first post. I have a problem running the script trying to crack the executable of KaGra packed with Armadillo 1.xx - 2.xx and an other exe packed with Armadillo 3.78, and the errors are the same: the first is that an instruction "0x004a74cf" refers to a memory address "0x00000001" that could not be "read", while the second is an unknown software exception (0xc0000027) in the application at the position 0x7c80e0b9. (If useful, the title of the two messages is: [CPU - main thread, module kernel32]:OLLYDBG.EXE - application error) .

My configuration is equal to the test one of AvAtAr: WinXP Pro SP2, OllyDbg v1.10, OllyScript v0.92; added the custom exceptions on OllyDbg.

I have a bad configuration of OllyDbg or of my system?

Thanks for help.

bye, JiveAxe
stanislavdimov
02-28-2005, 05:19 AM
I run with ollydbg - AC3D v5 - with your script -but no nothing
PEiD say that is Armadillo 3.78
If any know - my e-mail stanislavdimov@yahoo.com
Thanks
bugsome
02-28-2005, 10:05 AM
thx AvAtAr it worked gr8 can you give some info about fixing the IAT please.Just cutting thunks wont help .pls..
AvAtAr
03-01-2005, 05:59 AM
I found a problem with the script a few days ago.

find eip, #2BF9FFD7#

This line search for the "CALL EDI" that leads to the OEP, but in some armas i found that it's a "CALL EDX". So replace that line with:

find eip, #2B??FF??8?#

@JiveAxe
try after fix the script like i've explained above.

@stanislavdimov
detach from parent first then use the script on child process.

@bugsome
IAT repair is explained in many tuts, search the web.
wolflone
03-02-2005, 06:31 AM
HI

Armadillo 3.78 ERROR

http://www.mobile-files.com/forum/attachment.php?attachmentid=3251

HELP ME
JiveAxe
03-03-2005, 06:32 AM
Hi AvAtAr, I've tryed to fix your script but with no luck. Propably the problem isn't in the script infact I've used another script, Armadillo Detective by SHaG with the same errors.

thanks
dweeb
03-10-2005, 07:24 PM
You guys are life savers! I'm quite a newbie at this and have spent hours trying to decrypt Arm 3.78.
The above script with AvAtAr corrections worked a treat. Thanks!
Shurik
03-17-2005, 06:26 AM
It is not possible to unpack DLL - OllyDbg terminated with exception.
Thanks.
canaglia
04-08-2005, 08:22 PM
hallo everybody I 'm new inside this forum
I need an help
This script not working with my dear olly i don't know why!
olly give me an error that tell me one breakpoint is deleted
I changed the line find eip, #2B??FF??8?# too
but without any positive response,the prg run

please help me
I haven't success with unpack armadillo 3.78
for any mail
russo58@virgilio.it
eliran
04-25-2005, 10:17 PM
Hi!!
I've fixed it as you said, AvAtAr, and added those 4 custom exceptions. what i get is that olly just run like mad, i can see it stops and auto-running exceptions, until it terminate the debugged application, and nothing.
What do you think?
Snowski
04-26-2005, 08:50 AM
Your version of arma protection might be too much for this script....

I.e. Your packed file might have CopyMemII, DB, nanomites protection, and I think AvAtAr's script can not handle that.
LinuxMan
04-27-2005, 06:45 PM
i'm trying to unpack a exe packed with armadillo 3.78. i found oep. i dump it with lordpe, i import iat but when i try to fix imprec say me that it cannot add a new section in exe. why?


Difference between various Analysis 1 options

RCE Messageboard's Regroupment > General > Difference between various Analysis 1 options
hosiminh
02-04-2005, 09:40 AM
What is the difference between "Strict" , "Heuristical" and "Fuzzy" "Procedure Recognition" (in Debugging options -> Analysis 1) ? Which one should i have ticked ?
oh me anon
02-06-2005, 09:23 AM
noramlly let it at the default heuristics selection it works best

strict is one where the winmain message loop kind of procedure is not recognized

fuzzy recognizes some procedures extra but may not be reliable
100 %

here is a sample analysis with iexplorer.exe with all three options turned on one by one notice fuzzy recognises 9 more procedures than
strict and heuristics

Log data
Address Message
Analysing iexplore
14 strict procedures
58 calls to known, 11 calls to guessed functions
9 loops
Analysing iexplore
14 heuristical procedures
58 calls to known, 11 calls to guessed functions
9 loops
Analysing iexplore
23 fuzzy procedures
58 calls to known, 11 calls to guessed functions
9 loops

it has recognized this as a procedure

0040145B /. 8BC6 MOV EAX, ESI
0040145D |. 5E POP ESI
0040145E |. C9 LEAVE
0040145F \. C3 RETN

if you try to find referances for this procdure you wouldnt find none

neither will call stack (ctrl+k) show who calls it or what this calls :)

you can use ctrl+ + (plus) or ctrl+ - (minus to find the procedures after analysis

it all depends on what you like to do :)


PE Protecting

RCE Messageboard's Regroupment > The Heap > PE Protecting
Marcus Reu
02-07-2005, 06:46 AM
Hola,
I'm a coder and created new and nice PE Protector .I need an important feature to release this proggy for free to the public which is CRC Checking !!
Could any one tell me about masm source for a program that his only jop is CRC Checking ?
Could any give me a masm source of his/her own work ?
I would highly appreciate this .

Thanks Members
1bitshort
02-07-2005, 07:34 AM
mov esi, BuffAddr ;esi = ptr to buffer
mov edi, BuffLen ;edi = length of buffer
mov ecx, -1 ;ecx = -1
mov edx, ecx ;edx = -1
nextbyte: ;next byte from butter
xor eax, eax ;eax = 0
xor ebx, ebx ;ebx = 0
lodsb ;get next byte
xor al, cl ;xor al with cl
mov cl, ch ;cl = ch
mov ch, dl ;ch = dl
mov dl, dh ;dl = dh
mov dh, 8 ;dh = 8
nextbit: ;next bit in the byte
shr bx, 1 ;shift bits in bx right by 1
rcr ax, 1 ;(rotate through carry) bits in ax by 1
jnc nocarry ;jump to nocarry if carry flag not set
xor ax, &h08320 ;xor ax with 33568
xor bx, &h0EDB8 ;xor bx with 60856
nocarry: ;if carry flag wasn't set
dec dh ;dh = dh - 1
jnz nextbit ;if dh isnt zero, jump to nextbit
xor ecx, eax ;xor ecx with eax
xor edx, ebx ;xor edx with ebx
dec edi ;finished with that byte, decrement counter
jnz nextbyte ;if edi counter isnt at 0, jump to nextbyte
not edx ;invert edx bits - 1s complement
not ecx ;invert ecx bits - 1s complement
mov eax, edx ;mov edx into eax
rol eax, 16 ;rotate bits in eax left by 16 places
mov ax, cx ;mov cx into ax

CRC32 is now in EAX.
Bob
08-01-2005, 01:34 AM
You should use custom CRC, not crc32 or known routine.
There is a plugin for PEiD to 'force' a crc32 of a file by replacing the last dword with a fixed value to correct the crc32 of the file.
Obviously the same can be done to block of data protected with crc32.

~BoB~


Problem with conditional message breakpoint

RCE Messageboard's Regroupment > General > Problem with conditional message breakpoint
micmic
02-07-2005, 05:27 PM
I have the following breakpoint:
WINTEXT([ESP+4])=="MCSch" && [ESP+8]==WM_NOTIFY
which breaks ok everytime the window receives a WM_NOTIFY.

Now I want to modify this breakpoint to break when the dword that lParam [ESP+10] points to is 1035A. So I edit the condition like this:
WINTEXT([ESP+4])=="MCSch" && [ESP+8]==WM_NOTIFY && [[ESP+10]]==1035A

But now Olly breaks on every message! What gives ? Funny thing is that if I add a watch like [[ESP+10]], I see that [[ESP+10]] is indeed 1035A, so Olly should break. ???


How to find Point-A

RCE Messageboard's Regroupment > General > How to find Point-A
TechLord
02-08-2005, 05:39 AM
Hi...

Just like point-H, it was mentioned that there is another point called Point-A by Akira for Visual basic Programs.

Can someone who knows about it guide as to what exactly it is and how to find it?


Opening an installer with command line

RCE Messageboard's Regroupment > General > Opening an installer with command line
andresiraola
02-08-2005, 05:34 PM
I wanna open an installer with OllyDbg but i can't find the way to put a command line:
for example
setup1.exe x:\setup.lst x:\st5unst.001 x:\st5unst.exe so.. when i run the olly debugger i could debug my program running with the installer command line because if i do not use the command line i get "No command line available"
oh me anon
02-09-2005, 07:35 AM
:( you could have searched this board before posting and you could have found the answer your self in one of the many threads that deal with the same question or you could have read the help file
:(
anyway
click debug---> arguments --> type your command line
and then restart olly for this to take effect
and it is done
have fun
andresiraola
02-09-2005, 12:07 PM
thanks man sorry for reading older post ;)


finit int 3 bug

RCE Messageboard's Regroupment > Bugs > finit int 3 bug
JimmyClif
02-08-2005, 11:42 PM
I probaly use an old version (v.1.09d) and I'm sorry for not trying this bug on a new version but I won't risk messing up my settings for nothing atm ;)

Anyways, the bug I found is as follows:

DBE3.....finit
CC........int 3

Upon breaking (I use Olly as JIT) I find myself on this line:

00401051 ^E3 CC JECXZ SHORT 0040101F

Hitting F7 for Single Step actually really jumps to 0040101F and that's a big NoNo :(

Hope someone can reproduce this.

Best Regards..
JC
oh me anon
02-09-2005, 07:11 AM
you risk none of nothing by trying out the new version :(
just unzip to a new folder and set it up and run it :( if you prefer you can even copy paste the existing ollydbg.ini to the new folder and olly will inherit all the settings which you have :(
anyway i dont wish to comment on that part it is your prerogative to use
maybe even a older version of ollydbg

but as you say if you use olly as jit and it broke because of int3
then it should stop on the int3 command and not on any other
jecxz

and if you single step then it if you have a handler setup fot int3
it should get into handler
Log data, item 0
Address=00401003
Message=INT3 command at jmach.00401003

if no handler then
it should say
Log data, item 0
Message=Debugged program was unable to process exception

this is the default with behaviour (that means you have options --> debugging option -->exception --->ignore pass to program --> int3 check box checked

if you dont have the above int3 checked then it will simply step into next command wont care for that int3 exception

and jecxz is normally used in finding the version of windows
if you are using w9x as os jecxz will jump and if you are suing nt box it should not jump
if it was executing this code

00409068 MOV CX, CS
0040906A XOR CL, CL
0040906C JECXZ SHORT MISSION_.0040907A

so what you are saying is kinda unclear at the moment
JimmyClif
02-09-2005, 10:54 AM
Sorry for explaining myself unclearly.

The opcodes for finit are DB E3 and for int 3 the opcode is CC. This gives as disassembly the following:

DB E3 finit
CC int 3

Now the opcode for JECXZ SHORT 0040101F is E3 CC.

As you can see when Olly breaks it stops somehow in the middle of my finit and the int 3.

When I scroll up then it magically becomes finit and int 3 again and an F7 behaves as expected, if I don't it jumps to 0040101F and well crashes because at 0040101F there's something completely different going on.

---------------------------------------------------------------------- --------

Update: <u>I upgraded and Olly is well, now it works as it is supposed to. Should have done that in first place. :)</u>
oh me anon
02-09-2005, 11:19 AM
well if some thing is jumping to some other opcodes middle
then you can always check off the
auto start analysis of main module in
options --> debugging options --> analysis1
olly will not auto analyze unless and untill you press ctrl+a

or if you prefer to keep it on you can right click --> analysis-->remove analysis from module
or remove analysis from selection

or better if seemed to look like it has stopped in middle of something
then double click the eip register it will point to the right instruction
that is about to execute

but one thing isnt still clear for me
i cant understand how it can jump to some arbitary location
from arbitrary looking visuals
some thing doesnt still gel with the explanation
i still assume it jumps to the handler and you are confusing yourself that
it is jumping to some arbitrary location

i must be having this 109d some where in some dust ridden cellar
if the code you talk about is small enough reply ill post my mail address
and i would give it a try to reproduce what you are talking
JimmyClif
02-09-2005, 11:34 AM
Hi Anon :)

Here you can Download Ollydbg 1.09d :
http://www.zdnet.com.au/downloads/0,39024478,39067711s,00.htm

Just use any project you got and insert a :

finit
int 3

and then run the thing after making sure that Olly 1.09d is your JIT.

I tried it on two computers, on both boxes the new Ollydbg (1.10) stops at an int 3 and on the old Ollydbg 1.09d it stops at an jecxz.

It's not a big deal, as it's fixed in the new version and that's the one I'll be using from now.
oh me anon
02-09-2005, 12:29 PM
hehe i said i had it in my cellers :) anyway
if thats the only code then sure it will not jump to some arbitrary
place it is only erreneous reporting of Pseudeoopcode size
if you f7 it should pass to the next valid command not jump to
arbitrary location

any way it was bug that was reported
and corrected already

OllyDbg improperly decoded size of pseudooperand CX/ECX in commands like JCXZ/JECXZ, REP MOVSB or LOOPW/LOOPD. Bug reported by Karel.

look here for bug reports of previous versions

http://home.t-online.de/home/ollydbg/whatsnew.htm

and thats official site btw :)


Breaking on execution with installshield

RCE Messageboard's Regroupment > General > Breaking on execution with installshield
kittmaster
02-09-2005, 02:17 AM
I'm trying to learn how to deal with MD5 hashing and installshield is a good place to start. I have an old program with an old version 5, when I use the command line interface bpx getdlgitem olly does not break when I enter the correct serial or any serial for that matter. Using softice it breaks all day long and I can trace the code to follow the hashing process. Is there something I'm doing wrong because olly doesn't break? I've looked through all the options and don't see anything.

I don't think installshield uses ring 0 methods, and because olly is ring 3, am I missing something as to why olly won't break on the identical command?

Any insight would help.........:|

Chris
gabri3l
02-09-2005, 03:52 AM
Try setting "BP GetDlgItem" That will break inside the actual GetDlgItem function. I think in the Olly Commandbar BPX sets a breakpoint on the Call to a certain function. not the execution. This call could be made by ordinal or maybe redirected and Olly will never break because it does not see "CALL user32.getdlgitem"
oh me anon
02-09-2005, 06:44 AM
if you the commandbar plugin and if you are in nt box it will set bp to
the first line in the system
if you use this syntax bp GetDlgItem
Breakpoints
Address Module Active Disassembly Comment
004010EF FILE Always CALL <JMP.&USER32.GetMessageA>
77E1783F USER32 Always MOV ECX, DWORD PTR SS:[ESP+4]

77E1783F USER32.GetDlgItem MOV ECX, DWORD PTR SS:[ESP+4]
77E17843 CALL USER32.ValidateHwnd
77E17848 TEST EAX, EAX
77E1784A JE SHORT USER32.77E17864

if you use bpx and if the call is not avl in the exe then
it will show you all the calls (the output of ctrl+n) in the appropriate exe

if you are not in the context of the exe but you are in some dll
and use the bpx sysntax and if it was available in that dll
it will set the bp there not in the application you wish to set it
Breakpoints
Address Module Active Disassembly Comment
004010EF FILE Always CALL <JMP.&USER32.GetMessageA>
77E1783F USER32 Always MOV ECX, DWORD PTR SS:[ESP+4]
77E1A4E2 USER32 Always PUSH EBP

after setting bpx use alt+b and look at where the bp is set before you jump to any conclusion like it sets blah on blah blah

thanks and regards
kittmaster
02-09-2005, 12:32 PM
that worked perfectly and thanks!

The next question, is there a way to have olly follow a passed argument to an exe load function? The way installshield works is that it is creating a temporary directory for the installation process files and once that is set the setup.exe terminates and I can no longer follow it.

I've saved the decompressed files but all the 3 exes (setup, _insXXX, and ~tempXXX) work in concert with each other, but olly can't seem to follow those newly created installation files.

How do I get olly to follow into the install tempory files? The excecutable modules doesn't list them as valid files because they are labeled as ~blah.exe and the mask assumes they are invalid, yet the data generation is done there as part of the install.

??

Thanks
Chris
oh me anon
02-09-2005, 01:08 PM
well lets hope we are not veering into offtopic here
i would prefer you ask questions related to ollydbg usage
rather than getting into some other thing

but as an answer if it is spawning a process then you can use file attach
on the other process that is spawned

the alt+e executable modules would list the debuggee not debuggees
child

if they are acting in concert then there must be some link to them with
the present debuggee or may be it is shell executing those
newly made files
any way look at file attach option and see if there is a new process
spawned and if it is waiting for some synchronization object
like ZwWaitForMultipleObjects

Maybe ntdll.ZwWaitForMultipleObjects

0012FE34 00000015 \Arg1 = 00000015
0012FE38 00BA04A4 ASCII "/SL4 $1F01B0 "C:\Documents and Settings\Administrator\Desktop\blah.exe" 522577 50688 "
0012FE3C 00BB78BC ASCII "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-569QB.tmp\is-KEJVU.tmp"

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-MONND.tmp\_shfoldr.dll
kittmaster
02-09-2005, 06:38 PM
That info is exactly what I'm encountering, how to tell olly to watch for those files as they spawn, the problem is the executable modules do not show those files during run time. If I could get olly to attach to them as they are running then I'd have my problem solved. Should olly be set to break on the command? I've tried using the command search for all intermodular calls, set breaks on those, and still it doesn't break on the temporary files.

Could that be a dll call during the runtime? That is why I'm confused.

Thanks for the quick responses.....:)

Chris
oh me anon
02-10-2005, 09:15 AM
a process can be spawned only with some of these apis
viz CreateProcess() (and all it variants like as user as blah w etc etc)
or in some cases may be using WinExec () this is backward compatible
api that actually calls CreateProcess some where in its process

or the new process may be using ShellExecute() A or W
ShellExecuteEx () A or W

and other variants of ShellExec

or some may be Directly using NativeApi in ntdll

like ZwCreateProcess()
77F92D2C ntdll.ZwCreateProcess MOV EAX, 29
77F92D31 LEA EDX, DWORD PTR SS:[ESP+4]
77F92D35 INT 2E
77F92D37 RETN 20

watch them and you can find when a new process is spawned
kittmaster
02-10-2005, 06:45 PM
I've seen those as stated, I think that answers my question. Thank you for your help

Chris
zero1
03-03-2005, 03:24 AM
how am i able to trace a program loaded by createprocess? lets say i am tracing program_A then it loads program_B using createprocess, how am i be able to trace program_B?
TechLord
03-03-2005, 02:25 PM
You can attach using another instance of Olly.

It is easier if you break on WriteProcessMemory and then attach with the other instance of Olly to the created Thread.
zero1
03-04-2005, 02:56 AM
i tried using Attach but the program is already finished. i was hoping i could analyze the decryption process but the process is already over when i attached it.

how do i break on WriteProcessMemory? i think this could be the answer. i tried on Debugging Options to enable all Events but it couldnt break on thread loading so i assume createprocess didnt create any threads.


Help for a NOOB :/ can't find hidedebug script for ollydbg

RCE Messageboard's Regroupment > General > Help for a NOOB :/ can't find hidedebug script for ollydbg
Ronst3r
02-09-2005, 08:13 PM
Hey really lame question (<u>I'm soory</u>) but i've just started using ollydbg and i'm doing some tutorials which require Hidedebug script for ollydbg which i can't find anywhere please help
Ricardo Narvaja
02-09-2005, 08:45 PM
hidedebug is not a script, is a plugin if you mail me i send to you

ricnar456@yahoo.com.ar

Ricardo Narvaja
hosiminh
02-10-2005, 08:11 AM
You can find plugin here:

hxxp://cracklab.ru/f/index.php?action=vthread&forum=1&topic=317
Ronst3r
02-10-2005, 11:53 AM
Thanks guys, i've just been having real trouble scouring the web with google to find this and import reconstructer v1.6 which always links me to Mackt.cjb.net (http://mackt.cjb.net/) but when i get there i can't actually find any link to download it??? just this
"* NOTE : You will have to click a second time on the link of prohosting to download a file." which i've done and nothing happens, i'm probably looking over something something that is plainly obvious. If so i must just be a fool and may as well give up now :S
If you feel sorry 4 me and can save me the trouble of getting it then please email me (rocketman_rob@hotmail.com)
thankyou
hosiminh
02-10-2005, 12:56 PM
LOL

Import REConstructor v1.6 FINAL
hxxp://wave.prohosting.com/mackt/projects/imprec/ucfir16f.zip


Softice vs Ollydbg

RCE Messageboard's Regroupment > General > Softice vs Ollydbg
warf
02-10-2005, 01:56 AM
Hello im new to this forum and im a new guy to ollydbg and asm to.. for my first topic i was wondering what is equivelent to softices F11 key that ollydbg has is there anything that does the same thing ?

warf
Ricardo Narvaja
02-10-2005, 06:03 AM
DEBUG-EXECUTE TILL RETURN? This is similar to F12 of softice, but F11 is the same i think,

Ricardo Narvaja
warf
02-10-2005, 12:11 PM
Thanks a lot man.. i want to use softice but im on xp and point.h owns all =P thanks Ricardo Narvaja ur the man..

Another question Ricardo Narvaja off the topic.. all your tutorials are based on unpacking etc.. do you have anything else ? that can help new guys out with ollydbg ? like why do you always put a breakpoint/memrory access on esi what is a qucker way to get the ascii from esi instead of pressing f8 f7 or f9 a lot of time =P thanks

warf
Ricardo Narvaja
02-11-2005, 07:10 AM
in my FTP there are 380 theories (unpacking the most), but in the folder CONCURSOS there are crackmes solutionated, programs, and in COLABORATIONS there are crack of programs, crackmes, etc, look my ftp have already 1000 tutorials, not only the 380 tuts on TEORIAS.

Ricardo Narvaja
warf
02-11-2005, 07:55 AM
whats ur ftp site ?


bad assembly analysis

RCE Messageboard's Regroupment > Bugs > bad assembly analysis
Necr0Potenc3
02-10-2005, 08:16 AM
this is the code:
http://necrotoolz.sourceforge.net/IRW/Main.c
the executable:
http://necrotoolz.sourceforge.net/IRW/IRWLauncher.exe
and the error:
http://necrotoolz.sourceforge.net/IRW/badanalysis.jpg

the display starts at line 527. the executable was compiled with vs.net 2003 and I'm using olly 1.10 in winxp pro (sp2)
Necr0Potenc3
02-10-2005, 08:22 AM
btw, I know it says (int)(INT_PTR)WriteProcessMemory... but disregard that since no cast is necessary.

and even though I remove the cast, the bad assembly analysis remains
oh me anon
02-10-2005, 09:02 AM
i see it correctly with 0llydbg v 1.10 :(
what version you are using
did you try analysing it once more ??
probably you have some messed up .udd file in there which puts it
try finding irwblah.udd and delete it and re load the exe

here is the same snippet in my copy of ollydbg

0040204D |.>MOV EDX, DWORD PTR SS:[ESP+110]
00402054 |.>MOV ECX, DWORD PTR SS:[ESP+32C]
0040205B |.>SUB EDX, EBP
0040205D |.>SUB EDX, ESI
0040205F |.>SUB EDX, 7
00402062 |.>PUSH 0 ; /pBytesWritten = NULL
00402064 |.>MOV DWORD PTR DS:[EAX+3], EDX ; |
00402067 |.>MOV EAX, DWORD PTR SS:[ESP+34] ; |IRWLaunc.<ModuleEntryPoint>
0040206B |.>PUSH EAX ; |BytesToWrite = 0
0040206C |.>PUSH EBX ; |Buffer = 7FFDF000
0040206D |.>PUSH ESI ; |Address = 0
0040206E |.>PUSH ECX ; |hProcess = 01010101
0040206F |.>CALL NEAR DWORD PTR DS:[<&KERNEL32.WriteProcessMemory>] ; \WriteProcessMemory

also try compiling with debugging info and see the source using ctrl+f5
along side :)
Necr0Potenc3
02-10-2005, 09:06 AM
yeap... I deleted the udd files and now it displays the assembly correctly. stupid of me not to have thought of that before

crap.. I thought I accidently had written code that messes up disassemblies lol

thanks anon :)


Ollydbg

RCE Messageboard's Regroupment > General > Ollydbg
warf
02-10-2005, 03:40 PM
Why dosen't every app that i load into ollydbg break at point.h ? if im correct f9 then do whatever then u bp point.h and it should break

warf
TechLord
02-12-2005, 05:36 PM
The Point-H is used to BP on TranslateMessageA or some such API in the user.dll library of Windows xp or 2000.

So if the application uses some other API like GetDlgItemTextA or something then it won't break on the Point H.

The ACTUAL point-H is the point at which the Reps Mov occurs to repeatedly transfer something like all the items in a string etc into the Memory (RAM).

Therefore this function need NOT always be used by applications.


DebugActiveProcessStop problem...

RCE Messageboard's Regroupment > General > DebugActiveProcessStop problem...
KaGra
02-10-2005, 03:56 PM
Well,i used this API like thin in .asm file:

.586p

locals
jumps

.Model Flat ,StdCall

o equ offset

extern DebugActiveProcessStop :PROC

bla...bla...bla...

no linking problems,nothing.I debugged the exe in Olly (v1.10) but i cannot see anywhere this API i declared.If i also make a call in the code of the exe,then an error during linkig appearz.I used tasm32.

Can anyone plz help?This happens also with other debugging APIs I may declare...
thankz


Softice

RCE Messageboard's Regroupment > General > Softice
warf
02-10-2005, 04:33 PM
olly is great i love it but i want to try softice i installed it and when i run start softice i get this in the dos prompt

net start ntice

System error 127 has occurred.

The specified procedure could not be found.

why is that when it just got installed ?

please help

warf


Ollydbg F7

RCE Messageboard's Regroupment > General > Ollydbg F7
warf
02-10-2005, 10:03 PM
Man there has to be something easier then having to press F7 3 billion times lol if there is a way can somone plz help thanks

warf
Ricardo Narvaja
02-11-2005, 07:06 AM
press TRACE INTO one only time and the list of lines qill be write in RUN TRCE window or a log file, and if you put a bp the program stop

Ricardo Narvaja
warf
02-11-2005, 05:40 PM
when im in the run trace menu what am i looking for.. i have never did the run trace and when i see it its to much for the eye

warf
Ricardo Narvaja
02-12-2005, 08:03 AM
in the RUN TRACE right click- LOG TO FILE and read in the txt file, is the code is long will be so much for the eye, but is better than press f7 by hours.
You can put conditions in SET CONDITIONS, for the trace stop.

By the way if you are tracing in a section by example 401000-500000 in SET CONDITIONS you can put a condition for the trace stop if EIP go out of this values (in an api by example) and you have stop the trace in each access of an api.

Ricardo


EXECryptor v 2.1.15

RCE Messageboard's Regroupment > OllyScript > EXECryptor v 2.1.15
zel
02-11-2005, 03:30 AM
i can't debug execryptor-protected files in ollydbg ... tricks in debugging this ... anyone?

tnx :)
kao
02-11-2005, 05:07 AM
I played with Execryptor long time ago.. If I remember correctly, Olly 1.10 is buggy. It can't correctly handle certain opcode combinations, like LOCK:INT3, LOCK:INT1. There is no self-check routines in Execryptor, you can remove LOCK prefixes. ;)

Greets,
kao.
zel
02-11-2005, 09:29 AM
tnx ... :)

execryptor really have good anti-debugging techniques ... can't seem to bypass these tricks...even in softice ... :(
blehbeb
02-13-2005, 10:49 PM
Hey kao, ive been looking into unpacking/rebuilding the IAT of exe's protected with EXECryptor. Ive got the exe unpacked but for the life of me cant get a working IAT. Any tips or tricks you know of?
KaGra
02-13-2005, 11:34 PM
I've unpacked succesfully 2.1.15 version,but trial unregistered.Is that ok?

Well,if anyone has a registered packed version,url...
zel
02-14-2005, 12:38 AM
KaGra ... care to share? :) i badly want to unpack it ... :D im using the unregistered version also ...
TBD
02-14-2005, 02:54 AM
topic locked: unpacking for cracking


Ricardo Narvaja

RCE Messageboard's Regroupment > General > Ricardo Narvaja
warf
02-11-2005, 12:46 PM
how to i translate the site to english. babelfish is f@#$@#ing up
and i was wondering if you have any of ur tutorials or your programs, and in COLABORATIONS

warf
Ricardo Narvaja
02-12-2005, 07:59 AM
i´m spanish and don´t speak english and use translators all day for browsing (internet in 90 % in english) and is the unique solution in this moment.

Ricardo Narvaja
TechLord
02-12-2005, 05:32 PM
Ricardo,
can you please tell us which translator YOU use - We can probably use the same one to translate your tutorials back to English !

I know of the ones like Babelfish etc but they are not very good...
Ricardo Narvaja
02-13-2005, 08:33 AM
all translators are not good, mines too

snif

Ricardo Narvaja
Cylox
02-14-2005, 11:50 AM
Are any of Ricardo's tutorials translated to english? If so, where might they be found?
Ricardo Narvaja
02-14-2005, 01:40 PM
there are few tutorials translated to english, but very few we have 380 (not all are mine) but there are much good tutorials in crackslatinos web and ftps in spanish .

In english no more of 10 tutorials there are translated.

Ricardo
helper
02-16-2005, 08:01 AM
Hello Ricardo , Ihave tray to find tut about SVKP but can not find , can you send me, or can you give me link.

Best regards
Ricardo Narvaja
02-16-2005, 09:19 AM
look in crackslatinos page

http://www.crackslatinos.hispadominio.net/

344-AlcaTool_v5.51 UN SVKP por SACCOPHARINX.rar

or more olds tuts

103-Desempacado de Crackme de Blasito packer SVKP.rar
164-Desempacando SVKP por SHOULCK.rar

Ricardo Narvaja
kickidiot
02-16-2005, 03:33 PM
Hi,
Ricardo Narvaja

i had read your tutorials and found it yery good ones. But i have problem in getting for some of your tutorials

Can you help me to get crackmes used in your following tutorials as listed below :

TEORIA DEL CONCURSO 12:Iniciándonos en DELPHI
PRIMEROS PASOS EN EL IDA
TUTES CON IDA MAS DEBUGGER
SEGUIMOS MOLESTANDO CON IDA
UN MUNDO NUEVO EL P-CODE
MESSAGESPY en OLLY
TEORIA DEL CONCURSO 10
CRACKEANDO CON OLLYDBG
kickidiot
02-16-2005, 03:35 PM
Hi members

i need your help in getting some of these crackmes as listed below:

Crackme v 1.0 Blasito
VBcrackme 10
VBcrackme 1.0
Multithread crackme v2.0
Crackme 11 of Shoulck
Crackme 13 of Shoulck
Ricardo Narvaja
02-17-2005, 07:54 AM
the crackmes used are in my FTP in the folder NUEVO CURSO-PROGRAMAS DE LAS TEORIAS DE NUEVO CURSO with the number of theory, do you see in this folder?

The crackme the blasito are in this folder look there are two tuts of crackme de blasito, look for the two number of tuts.

Ricardo
kickidiot
02-17-2005, 04:32 PM
I don't have your ftp address and "user name, password"

can u help me out or mail me

koolninja@gmail.com
Ricardo Narvaja
02-17-2005, 08:34 PM
ricnar456@yahoo.com.ar

mailme and i send the ftp and user-pass

Ricardo Narvaja
bestobest
10-27-2005, 02:27 AM
I've found a good translator at http://www.e-promt.com check it out it is great I think

regard......bestobest


RinG-3 DebuggerZ BloCkEr FeaTuRe

RCE Messageboard's Regroupment > General > RinG-3 DebuggerZ BloCkEr FeaTuRe
KaGra
02-11-2005, 01:05 PM
The ThinG => RinG-3 DebuggerZ BloCkEr FeaTuRe by KaGra at

hxxp://www.angelfire.com/indie/zong

EnJoy ;)
kittmaster
02-11-2005, 09:00 PM
what exactly does this little 4.41KB file do?
KaGra
02-11-2005, 09:07 PM
just try to set a breakpoint at the messagebox...
1bitshort
02-12-2005, 01:02 AM
Kagra,
IsDebuggerPresent also works 8)

Thanks for putting a txt/tutorial file in with the package - i hate crack-me's that don't come with an answer, nobody has time for that stuff anymore these days. Much better to just read the tutorial first, then look at how it has been implemented - you learn just as much but it saves a lot more time


Debugging only one DLL

RCE Messageboard's Regroupment > General > Debugging only one DLL
MasTool
02-12-2005, 01:57 PM
Hello.
I'm trying debug a DLL which is loaded inside an exe i made.
but i'de like step ONLY on my.dll but not my.exe or ntdll.dll ...
i tried setting breakpoints by selecting all the lines of the dll and pressing F2 but it was not possible :(

Thanks in advance,
MasTool
TechLord
02-12-2005, 05:28 PM
You can try putting bp on LoadLibraryA api which is used to load the dll file.
Then onwards you can step through the code which will be that of your dll.

If you enter into ntdll or other dll which you don't want then you can use Alt-F9 to come back into the user program.
1bitshort
02-13-2005, 01:35 AM
Options menu, Debugging Options submenu, Events tab. Select "Break on new module (DLL) loading"


Break/pause on "unhit" instruction?

RCE Messageboard's Regroupment > General > Break/pause on "unhit" instruction?
yeryry
02-13-2005, 07:54 AM
Hi

Is there a way to break or pause execution on an "unhit" instruction?
What I mean is this...
I mark some routine for hit trace.. Execute the program with some options set..
I get nice red marks on all executed lines.
Now, I change something in debugged program so the routine is called again...
I would like animation or execution to pause/stop when an "unhit" instruction is executed.. ie, a line that doesn't already have a red mark.
This would be wherever the flow of the program starts to differ from last time.. Would be very useful to be able to find this easily.
Is there a way to do this?
Or can this be done somehow using run trace instead of hit trace?

Thanks
oh me anon
02-13-2005, 10:59 AM
well when you run hit trace and after all the markers are made
if you right click you will see a context menu trace hit

right click search for --->trace hit
now when you are there you select all those that have markers and
remove them out of selection
to find the next trace hit use ctrl+L :) remove them from trace
if you are bored write a script to automate it with olly script :)

and now you run trace again
and what ever new markers are set are those which werent hit the first time its simple annd elegant isnt it

now if there are new markers you can analyse and set new break points
with f2 i would presume :)
have fun :)


SetUnhandledExceptionFilter

RCE Messageboard's Regroupment > General > SetUnhandledExceptionFilter
BeatriX
02-13-2005, 01:31 PM
Hi,

I looked for some information on this forum about the problematic api SetUnhandledExceptionFilter but I didn't find anything. I have this problem since a while and I can't resolve it. Example :

If a prog uses SetUnhandledExceptionFilter and just after put a Int 3. OllyDbg can't handle this exception and even if I put a BP on the handler, OllyDbg stop ! Why ? What can I do to pass this exception ?

That is not the same thing if the prog install a SEH by filling FS:[0] with the right handler. There is no problem in that case :)

Thanks for your answer

Regards,
oh me anon
02-13-2005, 02:17 PM
SetUnhandledException is used to set the top most handler

get jeremy gordons seh tut and execute the except.exe in it
under olly and out of olly you will see the results are different

with both of them

here is an excerpt from his asm comments

if you run the exe from within olly youwould notice how ever you try you cannot make it put out one of the message box :)
now find why that happens and you have answer to your question :)
also i think there is a plugin SetUnhandled Exception filter
some where around

which lets you patch it :)

;This program only uses Windows message boxes, which is why there is no
;message loop.
;The program has two exception handlers. The final exception handler
;is created first, then a procedure is called which has its own
;per-thread exception handler, capable of swallowing an exception.
;This it does at the option of the user.
;If the user decides to swallow the exception, the program would be able
;to continue to run, but actually in this case it terminates normally.
;If the user decides that the exception should not be swallowed by the
;handler, then the final exception handler is called (on the way to
;program closure). In real life, this handler would be responsible for
;completing logs and records, closing file handles, releasing memory etc.
;But before the program finally finishes, the system calls the per-thread
;exception handler in case there is more clearing up to do in that
;particular stack frame using local data. This is the system unwind.
;
;Written for GoAsm (Jeremy Gordon). Assemble using:-
BeatriX
02-13-2005, 02:55 PM
Wonderful :) Thanks a lot !!! This Plugin is really Great ! Here it is :

hxxp://community.reverse-engineering.net/viewtopic.php?t=3440

Thanks again. I just have to know now what this plugin is doing exactly

Regards,


About hardware breakpoints

RCE Messageboard's Regroupment > Bugs > About hardware breakpoints
thomasantony
02-14-2005, 09:48 AM
Hi,
I can't set hardware breakpoints. There is no such option. The menuitem is disabled. Whats wrong. I have version 1.10

Thomas Antony
hosiminh
02-14-2005, 09:58 AM
Hardware breakpoints works only on Win nt/2000/xp .
thomasantony
02-15-2005, 05:44 AM
Oh,
Then is it ok to use Memory breakpoints while unpacking. You know they put hardware break point on the edi value in stack so that we know when a popad is executed.

Thomas Antony
Ricardo Narvaja
02-15-2005, 08:04 AM
if you think use ollydbg change to NT/2000 and XP in 98 OLLYDBG have serious limitations, you cannot trace system dlls,puy bpx in the apis directly, put bpx in the stack.

change to nt/2000 or XP and if you continue using 98 use softice or trw2000 not ollydbg.

Ricardo Narvaja
thomasantony
02-16-2005, 01:43 AM
All right,
I have XP but I hate it. It runs slow on my poor PIII 850 MHz with 128 mB. I guess I will have to get 2k.

Thomas Antony
TechLord
02-16-2005, 06:04 AM
No Thomasantony...We use the same type of PIII in our institute. Recently I loaded XP on them and they run fine without being slow etc.

You can go to control panel>Advanced and disable all the bells and whistles of XP by choosing "Optimize for Best Performance" or some such option.

You may please note that we DIDN'T have to do that.

Try and experiment as some settings may be wrong on your machine leading to the slowness as otherwise XP itself was not making our systems slow with a similar configuration.

Also Norton Antivirus hogged the resources on such a machine. So we use McAfee v7 and are quite happy with it.
TechLord
02-16-2005, 08:12 AM
One more thing I want to add is that sometimes the UPGRADE option to upgrade from Win 98 to Win XP or Win 2000 give some strange problems.These probs may manifest in the form of your comp running slow.

To avoid this please do a FRES install of the XP.

I have further personally confirmed from friend who is using XP on a P3 (600 MHz) system with 128MB SD RAM (266 MHz RAM Freq) that his comp runs pretty fast.

Therefore you may like to investigate in more detail what you are doing wrong.

The way we procced in the institute for the 90 odd computers we have of the config stated above is to backup all the data, then do a full format of the hard disk and then install win XP SP1 from the bootable CD.

This helps avoid a lot of probs...
Ricardo Narvaja
02-16-2005, 09:16 AM
upgrade to windows 2000 fresh install ,or i tell you i have a P2 300 Mhz 128 M RAM and have WXP sp1 and run fine.(fresh install)
If you stay in 98 use softice or trw2000 not OLLYDBG.

Ricardo Narvaja
TechLord
02-16-2005, 02:35 PM
I agree with Ricardo... Even PII runs fine if all your settings are right and it is a fresh install.

By the way, you'll not notice better results much in terms of speed if you use Win 2000 instead of Win XP since WinXP mainly has more bells and whistles than Win 2000 and these can be disabled if necessary...
Ricardo Narvaja
02-17-2005, 07:59 AM
and for norton antivirus slowing machines:
This is real, but the new version 2005 was improved and i´m using in my old machine fine and fast, when the version 2004,2003 freeze this computer completely.
Other antivirus also freeze olds machines kaspersky, panda, etc aonly nod32 is falst in all versions in all machines.
Ricardo
TechLord
02-17-2005, 03:50 PM
I do agree with ricardo that Norton 2005 is improved, but we have practically found out that there are still a LOT of internal conflicts which can be improved by using some antivirus less taxing on the machine like McAfee 7.03 which has EQUAL efficacy to that of Norton with MUCH LESS problems.
Ricardo Narvaja
02-17-2005, 08:36 PM
is possible, only i comment the point of norton and slow machines and the 2005 was improved in speed.
I don´t try mc afee maybe i try in a moment thanks
Ricardo
thomasantony
02-18-2005, 03:34 AM
Hi,
I have tried Norton and dumped it long ago. I went without an AV for about 2 years. Now I use AVG Free edition. It has never let me down.

Thomas Antony
thomasantony
02-18-2005, 03:35 AM
Hi,
I have tried Norton and dumped it long ago. I went without an AV for about 2 years. Now I use AVG Free edition. It has never let me down.

Thomas Antony
TechLord
02-18-2005, 09:07 AM
No Thomas Antony... Unfortunately, we had tried to use the AVG free edition a few months ago and found out ONLY WHEN COMPARED with Norton or McAfee that it couldn't find out most of the worms. If it finds them, it is not reliable all the time, even for the same worm...

Also it is seriously lacking in the area of Heuristic search for viruses. You probably were lucky or maybe even got infected already !!!!

There are several known worms and trojans which the Free Version does not even RECOGNISE let alone clean them. Unfortunately, the examples are far too many for me to doubt, and this made us to take the decision of shifting to McAfee though we had to pay for it.
Ricardo Narvaja
02-18-2005, 10:50 AM
i agrre with TechLord i quit the avg free version when i infect with all types of virus trojans, worms, and AVG don´t detect at all.

Ricardo Narvaja
littlecode
02-18-2005, 04:16 PM
That's true indeed.

since norton do improve their AV and keep the bells as much as they can.

but in real state, pay more attention is a good practice ~

Littlecode


PEspin v1.1 under Olly

RCE Messageboard's Regroupment > General > PEspin v1.1 under Olly
KaGra
02-14-2005, 01:44 PM
Has anyone find a way to see the stolen bytes under Olly?If so,plz post some info...

thankz a lot

;)
KaGra
02-14-2005, 02:25 PM
ok,i found them...
BeatriX
02-15-2005, 09:10 AM
For information, Stolen Bytes are always located at EP + 1875h


stepping thrugh code!

RCE Messageboard's Regroupment > General > stepping thrugh code!
miltantof
02-15-2005, 01:03 PM
Hi all!
is there any way I can syncro the ascii dump while stepping through code?
Appreciate any help.

miltantof
oh me anon
02-16-2005, 01:55 PM
well it will be meaning less in many commands unless the command
referances memory
either as source or destination and i dont believe such a functionality exists inside olly which auto synchronises as you step
but you can very well right click and follow in dump to any specific
place also
i dont understand why you would need such a functionality
if it some strings olly shuld put them in the comments section automatically
miltantof
02-16-2005, 02:48 PM
Yep you're right! Obviously I can click and follow in dump to any specific
place, but still it would have been nice to be able to follow in real time the ascii dump if needed.
Thanks for you're quick answer.
kittmaster
02-16-2005, 06:07 PM
I have to agree, a real time dump as the code is stepped would be quite useful instead of having to issue the follow command every time


What am I doing wrong? Concerning Run trace.

RCE Messageboard's Regroupment > General > What am I doing wrong? Concerning Run trace.
Mind
02-16-2005, 11:27 AM
I am trying to stop execution at a certain address. The problem is that the address does not contain any code yet, but by the time the execution reach that point it will.

After execution has passed that address it will be to late, then my address will be cleaned of any code.

I can´t put a breakpoint directly at that address so I thought I´d give Run trace a try.

Well, so far so good, I think I set all the conditions right and so on but I can´t seem to get the actual trace started, when I press Trace into (Ctrl+F11) it takes one step and one step only.
I have tried having the Run trace window log to a file and all sorts of stuff but to no avail, I still need to sit and press Ctrl+11 a couple of billion times... and it simply is not possible to get to my address within reasonable time, I really need it to run until that point and brake there.

The condition I have set is EIP=1001F1A5
That being my address.

So, to recap, I open my executable, it gets paused.
I press CTRL+T and type in EIP=1001F1A5 next to "Condition is TRUE" and check the box.

I choose Open or clear runtrace (nothing happens)
I press CTRL+11, it takes one step.

I read somewhere that I should press CTRL+11 only once so I tried waiting for a while after the first ctrl+11... nothing happened. And the process is still paused, no logfile or run trace window is updated.

I have tried all sorts of combinations and whatnot in the above procedure... simply is not working.

Am I doing something wrong?
In case Im doing it right and there seems to be a bug I´m sitting on a Windows XP second edition and a P4 processor with hyperthreading.

[Edit]

Ah, I forgot to say, I have also tried just starting the execution again with F9, but then I dont get any Runtrace data logged, and it also does not brake when EIP=1001F1A5 when I do that.

[Edit nr2]

Hmm, ok, well I found out that the trace is actually working out fine if I set some other condition than EIP=....
For instance when I use command count only it does trace.. hmmz.. guess I cant have it stop at eip like that no?
Have to use the EIP range option?
oh me anon
02-16-2005, 01:39 PM
well when you are dealing with eip range why not use
the provided functionality
rather than using a boolean expression

use the first eip is in range
set the first box and second box with respective values
and press ctrl+f11 it should stop when your eip is executed

like this

Log data, item 0
Address=00401023
Message=Conditional pause: EIP in range 00401023..00401028

and it should stop only once if it is not a part of loop
TechLord
02-16-2005, 02:32 PM
Just a thought...
Sometimes it works if i put EIP==some value intead of a single "=" sign... in the condition box...

Give it a try...
warf
03-11-2005, 09:30 PM
i have played with runtrace but i really don't know how to use it.. can somone please explain what it does ? and how can i use it ? if it helps me with program and getting a serial or something faster then by all mean stell me :)

warf
Ricardo Narvaja
03-12-2005, 03:56 PM
use ollyscript with a little script than put a hardware bpx in your location and each time reach the address, look if EIP point to the code you expect, compare and if is the code stop the script and the program wiil be stopped in your address, in the moment you want.

Ricardo Narvaja


Ultra String Reference

RCE Messageboard's Regroupment > Plugins > Ultra String Reference
miltantof
02-16-2005, 03:35 PM
Back again. I found a plugin called Ultra String Reference . The doc in the download is in chinese. Is there a translation anywhere or can some1 explain how to use it? thanks guys.
miltantof
02-16-2005, 03:36 PM
BTW I tried online translation engines but none work for me
oh me anon
02-17-2005, 04:19 AM
i think you are talking about luocongs plugin
if that is it then it is supposed to find simplified chinese
strings in application
there is a post in this forum about it by the author iirc
also try worldlingo online translator it hits chines translation pretty accurate
but generally online translators suck :) so good luck :)
miltantof
02-17-2005, 12:38 PM
Could not find the post. I'll try with wordlingo.
thanks bro!
oh me anon
02-17-2005, 01:57 PM
what do you mean by you cant find the post
as far as i know this is the only board software which has a very good search function implemeted it hits on the nail damn sure for any and every search term i put upon it :)

5. Posted: 2004-07-27 13:04:20 - Plugins —› [NEW]Ultra String Reference v0.11 for Chinese
Great plugin !! Thank you...

6. Posted: 2004-07-27 04:15:11 - Plugins —› [NEW]Ultra String Reference v0.11 for Chinese
Ultra String Reference lets you to find Simplified Chinese string reference in a ...

did you try searching ?? :) did you try altering the number of days to search ??? :(
miltantof
02-18-2005, 03:20 PM
You're right! I'm sorry... didn't go back far enough in my search.
thanks


.arg file and logging function arguments

RCE Messageboard's Regroupment > General > .arg file and logging function arguments
JDog45
02-16-2005, 05:52 PM
Does Olly still support the use of a .arg file? I've been trying to use my old trusty one lately, but it won't let me turn on the option to log function arguments.


Never break on EOP

RCE Messageboard's Regroupment > Bugs > Never break on EOP
Newbie_Cracker
02-16-2005, 06:06 PM
Hi.
Please see the article in the follwing address.
Olly could not break on OEP and directly runs the proggy.

hxxp://www.angelfire.com/indie/zong/DieRing-3.zip

Here is another trick for killing Ring-3 debuggers !!
oh me anon
02-17-2005, 03:50 AM
hehe it has been documented already some where i even have a post about about this phenomena in this forum on some queer post
i think i replied it in regard to 1bitshort's query
and lately this was again pointed out by
nicolez brulez of armadillo (in his paper to honeynet scan of the month 33
results ) he actually thought it will stop olly somehow loading the app
but ollydbg loads the application and executes it without stopping
on ep (the reason he states for his thinking is
about modifiaction to LoaderFlags and Rva Entries in the pe-header

but i beleieve they are not the only problems i have seen apps
which dont have this modification but still execute the said application
:( probably there are more issues out there apart from these modification :(

anyway to counter the above problem one can physically modify the

entry point bytes 0xeb 0xfe (infinte jump)
and load the exe when it has completely loaded (ignore the warning about not valid blah blah )
press f12 and pause the application
it will stop in the infinite jumps :) modify the bytes back to original values
and then you can find all of the string referances and import names all such s***

have fun
Bob
06-07-2005, 04:46 PM
what is the trick? the url has gone..


Debug Visual Basic

RCE Messageboard's Regroupment > General > Debug Visual Basic
imashane
02-17-2005, 02:22 AM
Is there a way to debug code compiled with Visual Basic and be able to see the function calls (imported from msvbvm60.dll)?

Shane Blazek
oh me anon
02-17-2005, 04:00 AM
why not give it a try and have a look at it your self rather than asking
question which have just irritation value and nothing else
this kind of question only would get flames as an answer nothing else
and both you and the answerer will drag the thread into some useless
flame war

yes ollydbg can load visual basic apps
yes it can find referances from msvbvm## dlls
there is a file in the ollydbg folder called ollydbg.hlp
it is meant for reading through not just idle there
and when you have downlaoded ollydbg you are supposed
to find how it works and experiment with it and read the help files
and ask some what advanced questions questions which are
joyfull to answer


Help please OllyDump

RCE Messageboard's Regroupment > Plugins > Help please OllyDump
Nspire
02-18-2005, 04:33 AM
Im new at this.. but I used OllyDbg to unpack a scarmbled UPX file.. after its unpacked i dumped it first used PE Tools... then when I tried running the prog with the fixed .DLL it said it wasnt a valid windows image. Then, I search a bit and found OllyDump. So I go through the steps and unpack it then i go to ollybump-find OEP then i go to dump and dump the file. Now when I try to run it I get the message: "The procedure entry point RitRestoreLastWin32Error could not be located in the dynamic link library kernel32.dll".. help please? Thanks in advance
BeatriX
02-18-2005, 07:03 AM
OllyDump can't resolve all the imports. When you dump the file with OllyDump, then you must rebuild imports with a tool like ImpRec. I am sure you did not yet rebuild IAT.
Ricardo Narvaja
02-18-2005, 09:30 AM
old ollydmps (2 or less versions) make dumps with table reconstructed well in easy packers (upx etc), but in new versions, not work well in all SO languajes, the new versions of ollydmp in my spanish SO, only repair 20 or 30 % or the dumpings of easy packers and with the mark in METHOD 2 of rebuild options enabled in METHOD 1 make a mess.

Ricardo Narvaja
Ricardo Narvaja
02-18-2005, 09:32 AM
for instance is better work with IMPORT RECONSTRUCTOR for more general solution.

Learn to work with IMP REC is better.

Ricardo Narvaja


Private Messaging?

RCE Messageboard's Regroupment > The Heap > Private Messaging?
thomasantony
02-18-2005, 05:38 AM
Hi,
Is it not supported by this forum software?

Thomas Antony
TBD
02-18-2005, 07:19 AM
no.
the ideea for this forum is to share with everyone ;)


Using OllyDbg with games...

RCE Messageboard's Regroupment > General > Using OllyDbg with games...
Tha Killa
02-19-2005, 06:58 PM
In the game I'm stop something from running. And I've got the address of the thing I want to stop, but I don't really know how to do it. I tried setting a breakpoint-memory, on write, then I toggled it. But it just says unable to set breakpoint. Any tips? What am I doing wrong?
1bitshort
02-20-2005, 02:15 AM
What am I doing wrong?
Other than cracking?
Tha Killa
02-20-2005, 05:54 AM
Oh I can't post stuff here about that? Sorry. Nevermind then.


is this a bug?

RCE Messageboard's Regroupment > Bugs > is this a bug?
hackerman
02-20-2005, 04:02 AM
hi all

load a target in olly then hold on ctrl and move up or down couple of times
0051EB7B |. E8 31230000 CALL UEDIT32.00520EB1 ; \UEDIT32.00520EB1
0051EB80 |. 59 POP ECX
0051EB81 |. EB 03 JMP SHORT UEDIT32.0051EB86
0051EB83 |> 56 PUSH ESI
0051EB84 |. FFD7 CALL EDI
0051EB86 |> 8D43 FE LEA EAX,DWORD PTR DS:[EBX-2]
thats was happened:

0051EB7A |? 13E8 ADC EBP,EAX
0051EB7C |? 3123 XOR DWORD PTR DS:[EBX],ESP
0051EB7E |? 0000 ADD BYTE PTR DS:[EAX],AL
0051EB80 |. 59 POP ECX
0051EB81 |. EB 03 JMP SHORT UEDIT32.0051EB86
0051EB83 |> 56 PUSH ESI
0051EB84 |. FFD7 CALL EDI
0051EB86 |> 8D43 FE LEA EAX,DWORD PTR DS:[EBX-2]
zero1
02-24-2005, 12:25 AM
nope that's not a bug. it's not just aligned (not viewing the correct offset). If your code is full of JUMP instructions and after those command you put a garbage byte, your code would look meaningless at first glance.

analyze this code:
jump code.hello
db 'EB'
hello:
pop eax

which when transferred to machine code will look:
eb01
eb ;garbage byte
58

but olly will not fix the view (same with HIEW) except if you follow the jump instruction:
00000000 eb01 ;jmp code.00000003
00000002 eb58 ;jmp code.00000059


Question about olly.

RCE Messageboard's Regroupment > General > Question about olly.
genlock
02-20-2005, 10:47 AM
Is it possible to have olly to display the content of the stack and the AL,BL,CL... at all time?

any pages/tutorials to learn the very basics on olly and asm?
Really new at this.. thanks for helping!

-Genlock
TechLord
02-20-2005, 12:06 PM
The Art of Assembly is a good book - Search on the net for it. It explains things in an easy to understand way...There are several other resources also.
This is an excellent resources for win32 asm programming : http://win32asm.cjb.net/

For Olly, one should not forget the help manual and the help item that appears in the Olly Menu... :-)
It goes a long way in familiarising you with Olly. Also there are a few useful resources on the Olly home site itself to get you started, as it did for me...

Then, Google is your friend as far as searching for tutorials etc is concerned on the net. You can never have enough and everyday I find something new...

I have given you enough to get you started...People will feel like helping when you can show that you are trying to help yourself without expecting someone to do your work for you... :-)

That said...A very warm welcome to you and hope you enjoy your stay here... :-)
Ricardo Narvaja
02-21-2005, 08:16 AM
In ollydbg you have all the time displaying the stack, and registers,

if you view EAX, you view AL by example.

Ricardo Narvaja


Question on how to unattach processes without them crashing

RCE Messageboard's Regroupment > General > Question on how to unattach processes without them crashing
Darkdeath
02-21-2005, 06:13 AM
Is there any way to do this? I'm trying to debug an application while it's running and when I quit ollydbg, it instantly closes. It would be great if I was able to do this. Any help would be greatly appreciated.
Ricardo Narvaja
02-21-2005, 08:13 AM
yes is possible, use the plugin Hidebug 1.2, make a infinite loop EB FE, put the program running,(quit all BPs) and next detach, with the option DETACH of the plugin.

The program is looping now out of ollydbg, with pupe quit the infinite loop, and replace for the original bytes and continue running.

Ricardo Narvaja
Darkdeath
02-21-2005, 02:47 PM
Alright. Sounds great. Is everything I debugged saved?
Darkdeath
02-21-2005, 03:21 PM
Oh and also, I'm pretty noob to ollydbg. I managed to get the plugin however I don't know how to load plugins.
Darkdeath
02-21-2005, 03:28 PM
Nevermind, I just figured that out and it was already loaded. Now to just follow up on your steps...mind telling me where the detach option is located?
Ricardo Narvaja
02-21-2005, 08:43 PM
the dll of the plugin you can put in the same folder of ollydbg.exe, and in appearende -directories change the path to the olly folder with this the plugin will be loaded.

in the menu plugins of ollydbg, yo se hidedebug, and in the menu of hide debug is the option detach, if you donñt have this option, don´t have the version 1.22 of hide debugger your version is old.

And the method work i detach hundred of times with this method.

Ricardo Narvaja
Darkdeath
02-22-2005, 01:06 AM
Damn...then I don't have version 1.22..I think I got v1.2. Anyway you could possibly send me it or tell me a link to d/l? I hate to beg, but I tried google...and couldn't find a whole lot. Anyways, my e-mail is masterofnightmares@gmail.com. I can also e-mail you if you prefer as long as I have your e-mail address. Thanks for the help so far though, you've been helpful.
Ricardo Narvaja
02-22-2005, 07:47 AM
ricnar456@yahoo.com.ar

write me

Ricardo
Darkdeath
02-22-2005, 06:32 PM
Alright. I just wrote you about it. Would be great to get that Hide debug v1.22 off you.


OllyDbg v1.10 - Virtual PC - Win2000

RCE Messageboard's Regroupment > General > OllyDbg v1.10 - Virtual PC - Win2000
tDJ
02-21-2005, 03:52 PM
I use Olly already some years w/o probs with
Win98SE/Win2k/WinXP. But because OllyDbg doesn't always break on point-h in
WinXP while it does in Win2k, I installed Win2K on Microsoft Virtual PC 2004
v5.3.582. After that I copied my working Olly dir from XP to the virtual pc,
but I can't get it started. I also tried the original version, but the same
prob. I only get an message that "Ollydbg.exe has generated errors and will
be closed by Windows". (look at the attached image)
A
It tells also that a log file is created, but it isn't in the Win2k log
files. So I still don't know what's wrong, but maybe somebody knows it?
oh me anon
02-22-2005, 07:00 AM
well that error dialog doesnt show anything meaningfull
there are some option

1)unzip the ollydbg zip to a new folder and see if it works
2)if it said it logged something i think ( iam not versed with virt pc so i may be wrong :) the just in time debugger which is
drwatson logged the crash probably
if that is the case them you can search for minidump.dmp
drwatson.log or memory.dmp (those are the files that are created by
drwatson
3)or if you have windbg you can set up it as justintime debugger
instead of dr watson and let it catch the exception
4)last this may not work since the crashing app is ollydbg
still you can try to give it a spin
make ollydbg the just in time debugger and let it catch itself :)

mostprobaly inzipping it to a new folder should solve the problem

3)
tDJ
02-22-2005, 02:43 PM
Thanks for the reply, oh me anon.

But unpacked original v.1.10 Olly.zip crashed too, also the beta 1, 2 and 3. Version 1.09d has no prob, so now I'm tracing Olly v1.10 with v1.09. But it's very, very slow...
tDJ
02-22-2005, 03:30 PM
OK. Finally found it. Original Olly.zip was right, but I used my own .ini which reffers to my plugin dir, and there was the prob. I traced it with v1.09d and found that it crashed at 04501082:
04501082 8A1401 MOV DL,BYTE PTR DS:[ECX+EAX]
DS:[77E75000]=???
DL=00

So I traced to there and found that this error was called within this call:
004969C7 |. FFD7 |CALL EDI ; PuntosMa._ODBG_Plugininit

I stepped into this call till I came here:
045018AD E8 4EF7FFFF CALL PuntosMa.04501000

Then it goes wrong.

So the prob is in PuntosMagicos.dll, the Point H and Point A for VB 5-6 plugin by TheKluger. Maybe he can fix it....
tDJ
02-22-2005, 03:57 PM
Renaming PuntosMagicos.dll wasn't enough to get rid of this error. I had to delete/remove it...
oh me anon
02-23-2005, 03:03 PM
well there is a thread here about it crashing in w2k and a reply by ricardo stating that this plugin is meant only for xp not for w2k :) so that closes the issue :) hope you had some fun and learnt some thing in the process


Map Files generated by IDA

RCE Messageboard's Regroupment > General > Map Files generated by IDA
Cthulhu
02-21-2005, 04:43 PM
Hello Folks!
Is there a way to load MAP files generated by IDA Disassembler into Olly as we can do in SoftIce?
I tried to do it reading olly's help but I didn't find it.

Thanks in advance!
Cthulhu
02-21-2005, 05:06 PM
Ooops I found the answer here http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=841 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=841)

No need to answer my question anymore...


HideDebugger \ IsDebugPresent

RCE Messageboard's Regroupment > Plugins > HideDebugger \ IsDebugPresent
HLL
02-21-2005, 11:30 PM
I'm trying 2 find a plugin that will do the job
but IsDebugPresent seems to corrupt my file
and i can't find HideDebugger, all links are broken (if some1 will mail me, i will be thankfull hllhll@gmail.com)
KSA
02-22-2005, 01:43 AM
You can find the latest version of these tools in exetools forum.
Darkdeath
02-22-2005, 02:29 AM
The only bad thing about the exetools forum is for new users they cannot register. =/
Lord_Looser
02-22-2005, 06:25 AM
http://www.wasm.ru/forum/files/_1368105966__HideDebugger12.rar
google: "hide debugger" isdebuggerpresent findwindow
HLL
02-22-2005, 12:46 PM
Thanks both ;)


Problem with Debug>Call Dll Export

RCE Messageboard's Regroupment > General > Problem with Debug>Call Dll Export
bohlinger
02-22-2005, 06:55 AM
Hello all,
I'm a new OllyDbg user and I want first to thank the author of this application for his contribution.
My goal is to have a better understanding of assembler language.
However, difficulties soon arise when I use Ollydbg to analyse a dll I'm interested in.
Loading this dll makes the expected prompt "Windows can't execute...." to pop up.
I push the yes button.
Then selecting: Debug>Call Dll Export fails to make the dialog pop up to appear.
I'm then unable to give either an entry point or arguments values.

Before mailing to this forum, I tried the short tutorial with user32.dll given as an example. In this case, all seems to work fine.

I use OllyDbg v1.10 under Windows Xp Pro (SP1)

Thank you for your help.
Best regards,
C Bohlinger
oh me anon
02-22-2005, 07:05 AM
after pushing the yes button
olly stops at the dllEntryPoint
it does not run automatically you will see a paused in the status bar
that is to give you a chance to examine the dll entry function which
normally gets executed whenever you load a dll
at that time the debug-->call dll export wont be working

you have to either single step and examine the DllEntryPoint() and then run the dll or directly press f9 and run the dll ( the yellow pause will change to running) only after that you should look for dll export
bohlinger
02-22-2005, 10:24 AM
You could'nt be more precise.
It works as expected.
Thank you for your help.


How trace multithreaded programs?

RCE Messageboard's Regroupment > General > How trace multithreaded programs?
Adrian
02-22-2005, 08:25 AM
Good day to all!

I'm having problems tracing multithreaded apps. When the application created a new thread, olly just stops.

How am I going to trace the execution of different threads?

Thanks,
Adrian
haha20001
04-19-2005, 10:25 AM
I have met the same question
Ricardo Narvaja
04-19-2005, 11:45 AM
i have no problem with vprotector (is a multithread and multiprocess jeje) what is your problem?

Ricardo Narvaja
haha20001
04-25-2005, 12:50 AM
I want to run trace another thread,instead of main thread,but i can't switch to the thread in olly.
haha20001
04-25-2005, 12:52 AM
when i run trace a program,olly tell me the thread exited,but the program is always runing,and now how can trace another thread.
Ricardo Narvaja
04-25-2005, 06:47 PM
When the program stop in CreateThread look the starting adress of the trhead, and put a BP in this adress, continue tracing the main thread, and the program will switch automatically and stop in the new thread in the BP.

In this moment go to VIEW-THREAD and change to the main thread and doble click in it.

The cpu change showing the main thread sttoped, but if you look the stack, looking down you can look the adress (RETURN TO XXXXX) put a BP in the point of return (always in the exe image)

and continue tracing the new tread when the program change to the old thread, will stop in the bp, and in this moment go and put in the return point of the new thread a BP and continue working without problem.

Ricardo Narvaja


Dumping exe window

RCE Messageboard's Regroupment > General > Dumping exe window
kittmaster
02-22-2005, 04:07 PM
None of the pluggins seem to do what I'm looking for. I have the entire executable loaded in olly, it works no problem. Is there a way to select the entire contents of the debugging window, line numbers, asm codes and comments and dump them as one giant text file for anaylysis outside the olly environment?

I don't need the line by line real time data, I just want to be able to search for things indirectly and text file would be easier to deal with. I've tried extracopy, ollydump (which creates and exe).

Any suggestions?

Chris
sgdt
02-22-2005, 05:50 PM
Right click, Select All, right click, save to file (or clipboard).
kittmaster
02-22-2005, 08:40 PM
I am a dumbazz..............thank you for that.........so many options and the simpliest ones overlooked.

Chris
oh me anon
02-23-2005, 09:24 AM
if it was self modifying code and you want the memory after it decrypted
right click and create backup and save backup to file
it will be saved as section.mem viz
if a memory section spanned from 50d100 to 50f1oo
it will be saved as 50d100.mem

also you can reload those memory at a later time
to compare polymorphic codes :)

lots of endless possibilities exist for user who can use olly to its fullest capability
it will amaze you with its capabilities if you dig deeper and deeper into it

have fun :)


reading arguments before a function call

RCE Messageboard's Regroupment > Plugins > reading arguments before a function call
wirepair
02-23-2005, 08:47 AM
lo all,
I would like to be able to read the arguments to a function call much like a run trace and save them to my own variables. I found the address of the import and I would like to set a break point on each reference. I'm pretty sure that part is easy to do, but i have no idea on how to trap these arguments to the function call. Is this something that is possible with the api?
Thanks,
-wire

I want this stuff below after i set my breakpoint on:
01001CC5 |. FF35 C8900001 PUSH DWORD PTR DS:[10090C8] ; |format = " Ln %d, Col %d "
01001CCB |. 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] ; |
01001CD1 |. 6A 7F PUSH 7F ; |count = 7F (127.)
01001CD3 |. 50 PUSH EAX ; |wstr
01001CD4 |. FF15 14130001 CALL DWORD PTR DS:[<&msvcrt._snwprintf>] ; \_snwprintf

here:
0007FD28 0007FD50 |wstr = 0007FD50
0007FD2C 0000007F |count = 7F (127.)
0007FD30 000A89C4 |format = " Ln %d, Col %d "
0007FD34 00000001 |<%d> = 1
0007FD38 00000005 \<%d> = 5
0007FD3C 77D491A3 USER32.GetMessageW
oh me anon
02-23-2005, 09:18 AM
use shift+f4 and make
check the log function arguments radio button to always
and in log window enable saving the log automatically to a file that you name

this is detailed in conditional log breakpoint part in help files
and there are various examples of them in this forum
use search to find them and read through them
wirepair
02-23-2005, 10:34 AM
Uhm, do you realize this forum is for programming, not 'how to use olly?.' I'm asking for a programming solution not a clickity mouse click solution. Thanks anyways...
-wire


Anti Bpx

RCE Messageboard's Regroupment > General > Anti Bpx
zero1
02-24-2005, 12:41 AM
Are there known issues regarding Anti Bpx on Olly? Does OllyDbg have tricks on its own to counter this?
BeatriX
02-28-2005, 02:04 PM
No, it is not really possible ! You can test the existence of BPX in many many many ways. test if there is a CCh , calculate a checksum on the dump ... If you believe that the file you are analysing is able to detect such a BP , so, use Hardware BreakPoints :)


Using "Log window" in Olly to crack a time trial progam

RCE Messageboard's Regroupment > OllyScript > Using "Log window" in Olly to crack a time trial progam
benina
02-27-2005, 05:12 AM
Download TUT :
http://upload4free.com/files/17260.zip
BurnOmania
03-12-2005, 09:50 PM
can someone post a working link for that ?
thanx :)


How to debug a Win32 callback function?

RCE Messageboard's Regroupment > General > How to debug a Win32 callback function?
Wilmar
02-27-2005, 09:14 AM
I set up some int 3 breakpoint in a couple of function in my code for debugging purpose, btw this works on almost all functions except on win32 callback ones....the breakpoints seem to be ignored and i can't debug them....
What's the reason?

TIA

http://www.loadercranes.com/Bilder/Hersteller/ferrari.gif


SVK-Protector

RCE Messageboard's Regroupment > General > SVK-Protector
bff70000
02-28-2005, 10:19 PM
hi
how to hide olly from SVK-Protector?
hosiminh
03-01-2005, 06:44 AM
Load SVKP packed program into Ollydbg. Press F7 9 times:

00504026 /75 67 JNZ SHORT Tech2.0050408F

Make sure this jump is NOt taken 'coz otherwise it will bring up NastyNagScreen: Debugger_detected and API kernel32.ExitProcess .
BeatriX
03-01-2005, 08:24 AM
"press F7 9 times" !! hmm, sorry hosiminh, but it is much more interesting if you explain what happen in fact... is it IsDebuggerPresent ?
hosiminh
03-01-2005, 09:25 AM
Take a look on .svkp Section in Memory map while program is running in memory and you will see what i mean.

Of course it use IsDebuggerPresent.


Debugging a program which uses its internal resource

RCE Messageboard's Regroupment > General > Debugging a program which uses its internal resource
Alireza
03-01-2005, 11:40 AM
Have you ever debugged a program that wants to access its resource?
When windows APIs for resource handling are used in the debuggee, they assume that the active program, ie the debugger, is accessing its resource. This means that debuggee does not stand a chance of accessing its own resources and always receive error messages. There must be a way to get around this problem. I'd always experience the same problem with Visual Basic programs at run-time. If a VB program wants to use its resource it must be running outside VB IDE to be able to access its resource.
If a debugger wants to let debuggee to access its resources, it must hook all resource functions in kernel32. If the debuggee is accessing its resource indirectly, there is no way other than not debugging it!
If there is anybody out there who had overcome this problem please comment or mail me directly.
Thanks


zylom.com what softwrap is it?

RCE Messageboard's Regroupment > General > zylom.com what softwrap is it?
denubis
03-02-2005, 05:53 PM
Hi! I'm new to dissembling and want to become better. Was planning to work on softwrap stuff since i allready bought some of these <from zylom> And I was wondering does anyone know what type of softwrap this is / what steps should I do to correctly remove it. I saw a post here

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=966
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=966
)

and MaRKuS TH DJM said

MaRKuS TH DJM
Member

Posted: 24*Oct*2004*09:20:59
i unpacked several apps from different versions. i don't know if there are different protection options for these apps, but i did the following:
Tools:
Olly
Process Explorer by Sysinternals
Make Olly as your JIT (just-in-time) debugger
Load your target in olly, set a BP on ResumeThread. Press F9. maybe your target is showing up trial-screens and so on, skip it. when the ResumeThread breakpoint breaks, go into Process Explorer and search for your exe. there should be now a second process which was started by the other process. right click this, select debug. maybe you get a error-message now, just click ok. go to view > executable modules and double-click the attached exe-file. select the whole code-section, right-click, copy to executable > selection, and in the new window save file. save it under a different name. target should be unpacked now (if all softwrap-types are the same).

which i tryed and on my first shot got it working <yep got a dll to exe or at least i think that is what i did since they are the same size and work>

ok so tell me what i am doing wrong cause i tryed and tryed and tryed and am getting no where fast.

thanks for reading my post and any help is good


script not work ASProtect 1.2x - 1.3x [Registered]

RCE Messageboard's Regroupment > OllyScript > script not work ASProtect 1.2x - 1.3x [Registered]
sploid
03-03-2005, 12:29 AM
PEiD v0.92 shown that program is packed by ASProtect 1.2x - 1.3x [Registered] -> Alexey Solodovnikov
when I run script, it stopped on error and didn?t want find OEP.
I can?t unpack this program other automatic unpackers like stripper.


debug running processes

RCE Messageboard's Regroupment > General > debug running processes
Rider
03-03-2005, 10:32 AM
hi!
i have a problem with an ftp i want to debug. it doesnt start when i doubleclick it - it has to be startet as a service via net start "ftp server".
so when i start olly and open the ftp server.exe and go on run the program doesnt really start and ends shortly afterwards again. so i thought - ok - maybe u can only debug it when u attach to it. i tried but as soon as i attached the port 21 where my ftp was running closed! the program crashes.
so how can i debug that program?
i cant run it and i cant attach to it :S

seems quite strange...

greetz


Example of Plugin that compiles with Visual Studio 6 or later?

RCE Messageboard's Regroupment > Plugins > Example of Plugin that compiles with Visual Studio 6 or later?
duhru
03-06-2005, 12:45 AM
Does anyone have an example of a plugin that compiles with Visual Studio 6 or later?

I can't get the examples in plug110.zip to compile with VS6 or later. I get errors such as this:
Bookmark.obj : error LNK2019: unresolved external symbol _Pluginreadintfromini referenced in function __ODBG_Plugininit
Perhaps that means I need to turn off name mangling, but I can't find the option in VS.

Thanks in advance.
duhru
03-09-2005, 03:09 PM
Using the "Modified PDK from Alex Clarke" fixed my issues with Visual Studio 6:
http://home.t-online.de/home/Ollydbg/sdkupdat.zip


Saving "unpacked" executable?

RCE Messageboard's Regroupment > OllyScript > Saving "unpacked" executable?
Segosa
03-06-2005, 02:42 PM
I couldn't see anything about this, and I'd like to know whether it is possible.

If I have a packed executable and I use an OllyScript to find the entry point and analyse it, is there a way to save that to disk as the unpacked executable so that in future when I reanalyse it I don't need to go through the hassle of running the OllyScript again? I've tried saving the contents of the CPU window, or dumping them, or saving memory, etc etc but I couldn't find anything that worked..

Thanks in advance,
Segosa.
KSA
03-06-2005, 06:09 PM
Hi,

Use OllyDump plugin to do this for you.
Segosa
03-07-2005, 03:39 AM
Thanks very much- it works like a charm :)


Scan upper 2GB of process space?

RCE Messageboard's Regroupment > General > Scan upper 2GB of process space?
DulacLancelot
03-08-2005, 05:45 PM
so in windows xp we have 4GB of memory per process, right? the first 2GB (00000000-7fffffff) is for the process to use, and the other 2GB (80000000-ffffffff) is part of system/os memory.

so i see that in the Memory Map window, you get to see/search whatever memory has been used/allocated by your process. in that window, you can usually see addresses up to about 7fffffff. is there a way to search the next 2GB of memory, from 80000000 to ffffffff?

thanks!
1bitshort
03-09-2005, 06:37 AM
That area is restricted to kernel mode, you can only scan there using a driver or other ring-0 trick
rocket_lei
03-23-2005, 01:24 AM
I think it's not necessary to scan the upper 2G, in most situation, isn't it?
Necr0Potenc3
03-25-2005, 05:28 PM
I remember there was a trick involving ReadProcessMemory or some other api... but I cant remember which flag was used


ollydbg /dbghelp.dll/ and .tds files

RCE Messageboard's Regroupment > General > ollydbg /dbghelp.dll/ and .tds files
deli
03-10-2005, 11:52 AM
hi does anybody know how olly can read the borland .tds debug file?
because there is a debug library from borland, called bordebug.dll
but olly uses the windows debug api dbghelp.dll, which cannot interpret .tds files.
has anybody a answer for me ??

thanks a lot .......


New Olly PE Dumper plugin

RCE Messageboard's Regroupment > Plugins > New Olly PE Dumper plugin
FKMA
03-11-2005, 05:12 PM
This is new PE Dumper plugin for best user mode debugger OlluDbg.
The PE Dumper is similar to OllyDump by Gigapede but fully rewritten and have
some features:

- you can dump any *.exe and *.dll from debugged process address space;
- you can add/remove sections to/from resulting dump. If you are add new section,
you specify VA and size of memory region to add as section, attributes, File Offset,
RAW size and section name. So, now you can add to dump any memory regions created
by protectors during debug session;
- antidump antiprotection and most correct save dump technics: during dumping,
against other dumpers, PE Dumper save only present memory pages (basing on VA & Virtual size).
So, if between memory regions present non-allocated space, most other dumpers
(and OllyDump too) will not save dump correctly, but PE Dumper will save all
correctly.
- fix raw sizes correct only RAW size of image according to Virtual Sizes;
- paste header from disk - use header from disk, it's clear;

This plugin not fully tested yet. If you find bug, please e-mail me.

http://mmtools.nm.ru/OllyDbgPEDumper.rar

e-mail:
fkma@mmtools.ru
Ricardo Narvaja
03-11-2005, 08:28 PM
the link don´t work

When i can download?

Ricardo Narvaja
Ricardo Narvaja
03-11-2005, 08:33 PM
i can download now sorry
thanks
Ricardo
Ricardo Narvaja
03-11-2005, 08:35 PM
i can download now sorry
thanks
Ricardo
pzalps
03-12-2005, 01:46 AM
Nice Work
Thank you
linhanshi
03-12-2005, 11:10 AM
you good!

this job is very nice.
FKMA
03-12-2005, 06:02 PM
Please test it. I can't have many time in this time for trying to deep test
of this plugin. It may contain some bugs.
Thanks.

fkma@mmtools.ru
FKMA
03-16-2005, 05:56 PM
Hi.

Version 3.01 released.

changes:
+ Added autoselect main exe module in pick module list
* some GUI minor changes
- remove some unused code

http://mmtools.nm.ru/ollydbgpedumper301.zip
TBD
03-17-2005, 04:04 AM
FKMA: there are some problems in downloading your plugin. please send it to me via mail so I can add it to the stuph page. thanks
sgdt
03-17-2005, 02:07 PM
I agree, took many retries. Thank you for the work you put into this, anything to make life easier is great!
rocket_lei
03-23-2005, 12:46 AM
Great tool, wish you could make it perfect!
cubituz
03-30-2005, 03:10 PM
i identify olly crash on startup with "many plugins" and pedumper.dll (v3.01)

OS: win2k

Application popup : OLLYDBG.EXE

The Instruction at "0x0010db9b" referenced memory at "0x0010db9b"
The memory could not be read.

please FIX

thanks :)
FKMA
03-31-2005, 01:08 PM
cubituz
I also have many plugins that Olly loaded (about 29 ) but don't
face with such problem.
At this point can't say anything about reason.
Say version of W2K, what module belongs address 0x0010db9b, base address of owner module and enum plugins that you use.

see later.
sorry for my english.
kaos_xlro
04-01-2005, 08:46 PM
Well, I don´t know if it´s for the SP2 but I can´t add any section to the dumped file, even if I mark the option to make sections writable.

The Import Reconstructor jump me with "Can't add any section to this file".

Have you test it on SP2 or may be just a problem on my machine
smarco
04-02-2005, 08:50 AM
Hi FKMA !

Very very good plugins! :)

Can you help me for find OEP for dump?

Is there a solutions for find this value for some program?

When I can use GET EIP as OEP?

THANKS!
cubituz
04-03-2005, 11:17 AM
Hi FKMA,

I send email with my olly config for you.

thankx for your help.

Good luck
FKMA
04-03-2005, 12:30 PM
cubituz
Hi !
I have received yours e-mail.
It not glitch PEDumper-a.
It has turned out here that: at deleting ANY plug-in (you have them 34), olly it is started normal. Similar, it is bug Olly. Somewhere there is a stack overflow.
It is necessary to reduce amount of loaded plug-ins.
Success.
FKMA
04-03-2005, 12:33 PM
kaos_xlro
Hi.
I shall deal with this problem in the near future.

Thanks to all.
FKMA
04-03-2005, 12:39 PM
smarco
Hi smarco!
How to find OEP write in crackers manual.
Look, it is a lot of them in INET.

Get EIP as OEP means, that in header of PE file as an entry point current value EIP will register.

Success!
cubituz
04-04-2005, 06:00 AM
Hi FKMA,

thanks for all.

sorry for the trouble.

thanks again,
FKMA
04-04-2005, 01:39 PM
kaos_xlro

Hi !
About problem you are say earlyer.
At attempt to add a new section in dump at restoring IAT by ImpRec, made from a file protected by some protectors, for example ASProtect, we receive the message that it is impossible to add a section.
If to look on Header of such file it is possible to see that measures against addition new sections are taken.
For example, ASProtect 2.0 beta:

RAW offset of first section is 0x400
IMAGE_DOS_HEADER.e_lfanew is 0x100 (general 0xf0)
12 (0x0c (!)) sections in PE.
so, we have:

offset
0x0000 IMAGE_DOS_HEADER
0x0100 IMAGE_NT_HEADERS
0x01F8 (0x100+4+sizeof (IMAGE_FILE_HEADER) +
sizeof (IMAGE_OPTIONAL_HEADER) -
begin of array of IMAGE_SECTION_HEADER
0x03D4 IMAGE_SECTION_HEADER.Characteristics of last structure
0x03D8 sizeof (IMAGE_SECTION_HEADER) bytes of 0x00 -
(the indicator of the end of array IMAGE_SECTION_HEADER)
0x3D8 + 0x28 = 0x400
0x0400 begin of image of first section
...

so, we see, that there is no place for add new section.
To solve the problem it is possible or to delete the unused sections which have remained after a protector before resolving import, or having made re-structuring PE of a file and to shift the beginning of the first section from 0x400 to 0x1000, for example.
The second method and some checks and bugfixes will be realized in next version of pedumer. cooming soon...
Thanks to all, and, please, send me a bugreport, if any.
FKMA
04-23-2005, 07:12 AM
Hi all !
version 3.02 released.
changes:
+ Now you can add section by selecting it from Memory Map window.
Simple push "Get MAP" button in main window.
+ added check for needed free space in header when adding new section.
- fixed bug of setting raw size to zero for newly added sections when
check/uncheck "Fix RAW sizes"

http://rapidshare.de/files/1393348/olly.pe.dumper.3.02.rar.html

as usual, please test.
FKMA
04-27-2005, 08:13 AM
Hi.
version 3.03
changelog:
3.03 27.04.2005
----
- display "Saved with ERRORs" message when Raw Size of section == 0 - fixed
- fixed bug with setting OEP

thanks MaRKuS-DJM for testing.
hxxp://rapidshare.de/files/1454959/peDumper303.rar.html
flinflon
04-29-2005, 08:22 AM
I can't download peDumper303 from rapidshare because I use download managers. Is there another site from which I can download. Removing the download managers from my pc seems to cause a lot of grief!

Thanks
aunlead
05-06-2005, 06:27 PM
just disable ur download manager........u dont have to uninstall it or use firefox ;)

its just 85kb file!!!
kaos_xlro
05-06-2005, 08:50 PM
Hi FKMA again me testing at your plugin:

1.Good option the one of reading the header from disk, because there could be diferences, but particullary Im looking the thinstall (packer) that change the header on memory... well what Im try to tell you is about unchecking this option of the plugin if I amnt wrong the plugin then copy the header from memory.

I got a problem when unchecking this option, it doesnt dump the other sections just the header.

2.It had some problems on reading correctly the sections on header. If I try to add a new section (the GETMAP option) the plugin overwrite some of the others sections and had some problem reading some bytes.

dont know if its a problem of the packer but I compare the dump of your plugin and the one of the Ollydump and had no diferences on other sections but in the header.

I tested 3.03 version
Sorry Im telling you this but I really apreciate your job and I want looking it working fine (could be a better tool that Ollydump in my opinion) (If you want to send me a betta version Ill be glad to help you kaos_xlro""@yahoo.com (whitout cuotes))
flinflon
05-09-2005, 10:47 AM
OK aunlead point taken
FKMA
05-28-2005, 11:23 PM
Hi kaos_xlro !
Thanks for you testing !

I was very busy last time and don't visit this forum.

About first problem: i download thinstall and look for this in near time. But, can you send me the app that you try dump and small tutorial to get point in that you dump the app ? It may help to solve bug. My mail: fkma[at]mmtools[dot]ru

Second problem: are you get this on thinstall packed program or in some else cases ? Some words about GetMap: it's dont retrieve any data from memory of debugging process. It simple fill with data additional rows in section table in main plugin window. If sections crosslinked in this table, it will be write on dump incorrectly. Plugin dont check the areas and bounds of sections that fill in table. After you press Dump, its simple dump sections row by row according it order in table and take the parameters of sections from table too. If, for example, third section begin sooner than second ends, the second section will be partially overwritten. I add some checks about crosslinked entries in table and offsets auto-recalculation option in v 3.04. (it lied on my HDD about month already with some bug fixed (i already dont remember about what fixes :( ) and small help about how dumper works.)
Thanks a lot for testing. I send you 3.04 and publish 3.05 after bugs will be fixed.


Ricardo Narvaja

RCE Messageboard's Regroupment > General > Ricardo Narvaja
warf
03-11-2005, 07:08 PM
hey man. 2 questions ok.. what is a good setup for ollydbg i use the default cause i really dont understand all of the stuff in debbug options of ollydbg. another thing is when a program dosen't respoind to a name or number you put into it how do you trace it ? or why isn't it breaking

warf
Ricardo Narvaja
03-11-2005, 08:24 PM
the beter setup is not unique, the setup is adapted to each case, in any packers i use certain configuration, in other different, is very good you learn the effect of each configuration for adapt better to the case.

I don´t know explain better, what do you put (BP, HE, BPM) and what packer, and when don´stop.

Ricardo
warf
03-11-2005, 09:20 PM
what i mean is that when i click on ok or check for a fake serial/name algo
and it dosen't respond what do i need to look for to breakpoint on.. usually when you click check or ok you bp on getdlgitemtexta messageboxa or getwindowtexta ? if those api's aren't there would do i break on ?

warf

the beter setup is not unique, the setup is adapted to each case, in any packers i use certain configuration, in other different, is very good you learn the effect of each configuration for adapt better to the case.

I don´t know explain better, what do you put (BP, HE, BPM) and what packer, and when don´stop.

Ricardo
Ricardo Narvaja
03-12-2005, 03:49 PM
well you have the point H, work in XP in 80% of the programs (NOT VC++), the plugin of kluger for automatic found the point h was not published in the plugins list of ths forum, arguin only english plugins are published.

Well a plugin with 3 words in spanish and 2 buttons was not published and is very practical, but this are the rules man jeje.

The tut of point H was translated to english and is in my ftp.
(ftp://ftp.
)

you have the chance of stop in ollydbg with message breakpoints (BMSG in SOFTICE), with this and the point H, you can not tell me the program dont stop jeje.

Ricardo Narvaja


armadillo 3.61

RCE Messageboard's Regroupment > General > armadillo 3.61
claudemx
03-13-2005, 04:11 PM
hello, sorry for the translation, I seek one concealed for unpacker armadillo 3.61. I have of them one of ricardo narvaja, but in Russian... thank you for any answer .
my English is really very bad...
Ricardo Narvaja
03-14-2005, 09:29 AM
all my tuts are in spanish, there are some few in english.

Ricardo Narvaja
claudemx
03-14-2005, 10:51 AM
hello ricardo, if I can have all your tut, especially on armadillo, I takes... of English or Spanish in data processing it's ok, but Russian............
good day
Ricardo Narvaja
03-14-2005, 01:52 PM
well i don´t translate to russian, maybe any russian cracker translate by himself, there are no problem

Ricardo Narvaja
claudemx
03-15-2005, 12:22 PM
ok ricardo, but you,which tut you have on armadillo to help me?

thank's
Ricardo Narvaja
03-15-2005, 07:30 PM
in my ftp there are 30 tuts of armadillo at least

Ricardo
Snowski
04-15-2005, 07:40 AM
Hi Ricardo,

Nice...how can I get access to your tuts...?

Thanks in advance,

Snow :)
Ricardo Narvaja
04-15-2005, 09:07 AM
mail me and i send the user and pass for my ftp

ricnar456@yahoo.com.ar

Ricardo
Snowski
04-15-2005, 12:41 PM
You've got mail! :)
Seed
05-06-2005, 09:28 PM
Can i get acces too?

Check your mails please.
Ricardo Narvaja
05-06-2005, 09:34 PM
i give acess to all write me

ricnar456@yahoo.com.ar

Ricardo Narvaja
Asad Rehman
05-18-2005, 07:44 AM
is there a tutorial for unpacking Armadillo 3.78 ?
LandoX
06-20-2005, 04:28 PM
Hi Ricardo.. i gonna send u a email.. im from venezuela.. ty and c-ya i need a tutorial for 3.61... see and ty..
Jellard23
07-02-2005, 04:51 PM
hey, i want to check out the tutorials as well
i've emailed ricnar456 (at) yahoo (dot) com (dot) ar

btw, if anyone else has a tutorial on unpacking Armadillo 3.78 please tell me :)
Ricardo Narvaja
07-02-2005, 05:17 PM
if peid say armadillo 3.78 search for armadillo 4, peid fail in detect the right version

Ricardo Narvaja
bud_gd
07-12-2005, 01:33 AM
Hi Ricardo if asked nicely might you post a english tut on armadillo 4.x ? I know alot of us would be most greatfull, & thanx for clue on PEiD saying a lessor version! & Jellard23 there are a few fine tuts as well at:
h**p://intechhosting.com/~access/ARTeam/tutorials/index.php?page=1
sakis
07-12-2005, 02:30 AM
Ricardo Narvaja
Ricardo Narvaja
Ricardo Narvaja
ok ricardo, but you,which tut you have on armadillo to help me?

thank's
ok ricardo, but you,which tut you have on armadillo to help me?

thank's
ok ricardo, but you,which tut you have on armadillo to help me?

thank's
Ricardo Narvaja
07-12-2005, 10:57 AM
enter in my http and download the 4 parts of this tut

421-ArmadilloTomoI TlatoaniMT001.zip

this are a 4 part tut

and this tut too

368-Armadillo 4.x Tute..or TlatoaniMT001 .rar

This are not mine but work perfect
i don´t write tutorials of armadillo 4, when i write a tut, armadillo programmers read and change the program for my method don´t work, i have my method, i can unpack but i don´t write a tut for teach armadillo programmers how i can unpack, but there are other members of crackslatinos, here is the tuts.

Ricardo Narvaja
amras
07-25-2005, 07:00 AM
Could u guys pls send me any info how to deprotect armadillo 4 my e-mail is amras <at> o2.pl if anybody succeed with breaking this protection, pls tell for me to now if it's worthy to try it!


disasm engine

RCE Messageboard's Regroupment > General > disasm engine
deli
03-14-2005, 11:30 AM
is there any disasm engine out there, which i can use in closed source and comercial tools?

thanks a lot


STEPING OUT

RCE Messageboard's Regroupment > General > STEPING OUT
warf
03-14-2005, 06:08 PM
like softice when you do your breakpoint you step out of it by pressing F11 or F12. what is the equivelent for ollydbg. if i go to user32.dll then set a breakpoint on getwindowtexta or any other api in user32.dll how do i get out of it and back to the real code ?
kao
03-15-2005, 04:48 AM
Execute Till Return (Ctrl-F9) or Execute Till User Code (Alt-F9)
warf
03-15-2005, 06:14 PM
what exactly does execute till return mean. or executre till user code.. i do all this stuff and get the serial lol. but i really don't know what it means :)
Ricardo Narvaja
03-15-2005, 07:27 PM
EXECUTE TILL RETURN is the same in softice f2, RUN till next RET, and execute till USER CODE, RUN till the section defined CODE in the header.

Ricardo Narvaja
Ricardo Narvaja
03-15-2005, 07:28 PM
Sorry is f12 not f2 type error

EXECUTE TILL RETURN is the same in softice f12, RUN till next RET, and execute till USER CODE, RUN till the section defined CODE in the header.

Ricardo Narvaja


EIP

RCE Messageboard's Regroupment > General > EIP
warf
03-15-2005, 06:12 PM
what is exactly is the eip. how does it help me if i don't have a packed program. will it help me find the serial faster ?
Ricardo Narvaja
03-15-2005, 07:29 PM
eip point to the address of the command executed in each moment.

Ricardo Narvaja
warf
03-15-2005, 07:58 PM
is eip and PE the same thing ? im looking for something that can help me faster then what i have been doing ? and does teh program have to be packed for me to use eip or pe ?

warf

eip point to the address of the command executed in each moment.

Ricardo Narvaja
Ricardo Narvaja
03-15-2005, 08:55 PM
no EIP is a register,(how EAX,EBX etc) and PE is a type of file (i don´t now how explain in english)

Ricardo Narvaja
warf
03-15-2005, 09:52 PM
hey Ricardo Narvaja write it in spanish. and i will transulate it in babelfish :)

warf

no EIP is a register,(how EAX,EBX etc) and PE is a type of file (i don´t now how explain in english)

Ricardo Narvaja
Ricardo Narvaja
03-16-2005, 08:35 AM
EIP es un registro mas que apunta a la direccion donde se encuentra el comando que se esta ejecutando en cada momento.
Tienes que leer tutes con imagenes esto no puede ser explicado tan facil en un foro en tres palabras
Ricardo Narvaja


OEP, PE

RCE Messageboard's Regroupment > General > OEP, PE
warf
03-15-2005, 08:39 PM
sorry for all these post guys but i really need to learn this stuff can i get a link or something for OEP and PE how does this help me get what i want ? serial etc.. or does it only have to be a packed program for me to get the PE or OEP

warf
Ricardo Narvaja
03-15-2005, 09:00 PM
you have to read tutorials jeje

OEP, is original entry point

Is the ENTRY POINT of the unpacked (original) file, when you pack the file this point is named OEP (original entry point)

I think you need read more tutorials is difficult explian in a forum, and i don´t speak in english well, maybe i confuse you, but i have clear in my mind jeje.

Ricardo Narvaja
warf
03-15-2005, 09:53 PM
hey Ricardo Narvaja explain it in spanish and i will transulate it in babelfish to english :)

warf

you have to read tutorials jeje

OEP, is original entry point

Is the ENTRY POINT of the unpacked (original) file, when you pack the file this point is named OEP (original entry point)

I think you need read more tutorials is difficult explian in a forum, and i don´t speak in english well, maybe i confuse you, but i have clear in my mind jeje.

Ricardo Narvaja
Ricardo Narvaja
03-16-2005, 08:32 AM
Bueno pero quizas el traductor lo confunda mas

Cuando tu tienes un programa sin empacar, este tiene un punto de entrada que es la primera linra que se va a ejecutar seria al estar sin empacar aun el EP o ENTRY POINT.
Si tu lo empacas por ejemplo con asprotect o otro packer, obviamente el programa ahora empacado no comenzara a ejecutarse en la misma linea que antes, pues esta empacado y tiene que correr el packer antes para desempacarlo.

Entones el packer tendra su propio punto de entrada pero el antiguo punto de entrada que el programa tenia antes de empacar se lo llama OEP porque era el punto de entrada original antes de empacar el programa.

Como el packer desempacara el programa en la memoria casi todos saltan luego de haberlo desempacado al oep y comienzan a ejecutar el codigo original, por eso se trata de hallar el oep pues es la primera linea del codigo original del programa y un buen punto para dumpear.

Ricardo Narvaja
Ricardo Narvaja
03-16-2005, 08:33 AM
Bueno pero quizas el traductor lo confunda mas

Cuando tu tienes un programa sin empacar, este tiene un punto de entrada que es la primera linea que se va a ejecutar, seria al estar sin empacar aun, el EP o ENTRY POINT.
Si tu lo empacas por ejemplo con asprotect o otro packer, obviamente el programa ahora empacado no comenzara a ejecutarse en la misma linea que antes, pues esta empacado y tiene que correr el packer antes para desempacarlo.

Entones el packer tendra su propio punto de entrada pero el antiguo punto de entrada que el programa tenia antes de empacar se lo llama OEP porque era el punto de entrada original antes de empacar el programa.

Como el packer desempacara el programa en la memoria casi todos saltan luego de haberlo desempacado al oep y comienzan a ejecutar el codigo original, por eso se trata de hallar el oep pues es la primera linea del codigo original del programa y un buen punto para dumpear.

Ricardo Narvaja
warf
03-17-2005, 07:13 PM
Ricardo Narvaja

since eip ep etc.. is helping you guys find the entry point for packed programs. what can i use for none packed programs ? and how will it get me to my serial faster ?

warf

Ricardo Narvaja
Bueno pero quizas el traductor lo confunda mas

Cuando tu tienes un programa sin empacar, este tiene un punto de entrada que es la primera linra que se va a ejecutar seria al estar sin empacar aun el EP o ENTRY POINT.
Si tu lo empacas por ejemplo con asprotect o otro packer, obviamente el programa ahora empacado no comenzara a ejecutarse en la misma linea que antes, pues esta empacado y tiene que correr el packer antes para desempacarlo.

Entones el packer tendra su propio punto de entrada pero el antiguo punto de entrada que el programa tenia antes de empacar se lo llama OEP porque era el punto de entrada original antes de empacar el programa.

Como el packer desempacara el programa en la memoria casi todos saltan luego de haberlo desempacado al oep y comienzan a ejecutar el codigo original, por eso se trata de hallar el oep pues es la primera linea del codigo original del programa y un buen punto para dumpear.

Ricardo Narvaja
Ricardo Narvaja
03-18-2005, 09:10 AM
there are excellent tuts i internet is impossible explain all the variants of this topics.

I don´t recommend my tuts for the reason are writed in spanish, but there are very good tutorials in english.

Ricardo Narvaja


HELP!!!

RCE Messageboard's Regroupment > General > HELP!!!
Wilmar
03-18-2005, 04:04 PM
I've attached Ollydbg to debug a service, but when I start Run, the program runs briefly, then OllyDbg freezes!!!

I can't do nothing because the OllyDbg window does not respond, so I must kill the process I'm debugging and restart the debugger!!

What can I do??

Please help...
Ricardo Narvaja
03-18-2005, 07:21 PM
ollydbg is a ring3 debugger, look for softice or other ring0 debugger.

Ricardo


How to edit the Unicode text in the Application using Olly.

RCE Messageboard's Regroupment > General > How to edit the Unicode text in the Application using Olly.
electromagneticrays
03-20-2005, 01:40 PM
hi all,
Firstof all thank you so much for such a great debugger which takes almost NO system resources and works perfect. Thanks for making it free too & feature rich. This is my first post I am sorry if i ask something irritating or a idiot question.
i have a program made in vb that connects to a website to check security code based on HDD .I want to change the URL it connects to . I have successfully unpacked it and i want to change the website address it connects to. Its in Unicode i think. but i dont know how to change it using Olly.
can someone please help me? thanks


OllyDbg Getting Confused?

RCE Messageboard's Regroupment > General > OllyDbg Getting Confused?
some_spare_id
03-21-2005, 02:28 PM
I'm processing a small executable in Olly, and it seems to be getting confused at the end.

There's some code at the end of this executable that shows up in W32Dasm as code, but Olly thinks it's data. Anyone observed any such behaviour before with Olly?
Ricardo Narvaja
03-21-2005, 07:02 PM
right click-remove analisis or right click analise code

Ricardo Narvaja


Log every jump?

RCE Messageboard's Regroupment > OllyScript > Log every jump?
noobzilla
03-23-2005, 02:36 AM
Hi,

Is it possible to write a script to log every jump that a program executes (its location at least). It would make things a lot quicker than stepping through each command manually. The best I could do was make a script to record the eip of each instruction, which is slow.

Thanks.


displaying things in the Registers box

RCE Messageboard's Regroupment > General > displaying things in the Registers box
FireRaven
03-23-2005, 09:39 AM
greetings all!
here's a picture of what i'm talking about with a green circle around the Registers box in olly:
http://www.heroraven.com/pub/registers.JPG

i question is how can i get the 16-bit and 8-bit registers here.
i see EAX, ECX and so on but no AX, AL or CX, CH or anything.

is this possible? if not is there a way of displaying the values of these registers when debugging?
Ricardo Narvaja
03-23-2005, 10:07 AM
if you have EAX you have AX and AL

in your example AX is 0001 and AL 01

the last 4 numbers is AX and the las two numbers is AL

the same CH and CL

Ricardo Narvaja
FireRaven
03-25-2005, 08:12 AM
i see.
i probably should have learnt more about assembly before using olly ;)

i understand now AX and AL are part of EAX.
same with ECX CX and CH.
good :)

cheers mate.
Ricardo Narvaja
03-25-2005, 08:24 AM
yes ax and al are part of eax.

yes you need read more assembly jeje

Regards
Ricardo Narvaja
thomasantony
03-30-2005, 05:22 AM
Same for dh,dl,dx and bh,bl,bx and si and di

Thomas Antony


UPX Modified Stub -> Farb-rausch Consumer Consulting

RCE Messageboard's Regroupment > OllyScript > UPX Modified Stub -> Farb-rausch Consumer Consulting
Palles
03-24-2005, 04:42 AM
UPX Modified Stub -> Farb-rausch Consumer Consulting [Overlay]

How do I unpack it?
Possible do to with or maybe without ollyscript?
Ricardo Narvaja
03-24-2005, 08:22 AM
the manual unpacking of a modified upx is the same methoid of the normal UPX, any tut of UPX is useful.

If You have NT/2000 or XP for found the OEP you can use the METHOD OF PUSHAD is functional for any UPX.

trace F7 till you pass the first pushad, mark ESP and right click FOLLOW IN DUMP

In the DUMP WINDOW, mark the 4 bytes and right click BREAKPOINT, HARDWARE BREAKPOINT ON ACCESS and RUN

you stop before a POPAD and press f7 and you found the JUMP to the OEP.

when you reach the OEP dump and reconstruct the IAT with IMPORT RECONSTRUCTOR if the OLLYDUMP dumped archivo don´t RUN.

Ricardo Narvaja
Palles
03-24-2005, 10:56 AM
I tried what you said and even tested some upx script. But when I tries do dump (ollydump) I get the error "Unable to read memory of debugged process (00400000..004CFFFF)."
And after that error I get "Bad DOS Signature!!"
Ricardo Narvaja
03-24-2005, 01:43 PM
go to view-memory and change the permission of this section to FULL ACCESS and dump next.

Some programs corrupt the header you can compare with the original header (when the program start) and look for the differences and correct

Ricardo Narvaja


OllyScript V0.92

RCE Messageboard's Regroupment > OllyScript > OllyScript V0.92
Terror
03-24-2005, 02:25 PM
Hi All,

I need OllyScript v0.92 download link.
Thank You.
TBD
03-25-2005, 04:08 AM
http://ollyscript.apsvans.com/
salma
08-15-2005, 11:05 AM
http://www.openrce.org/downloads/download_file/106

if it not worke type your mail and i sent it for you.
oh me anon
08-15-2005, 12:26 PM
hehe thats a 5 months old thread and there are lot of posts describing many other location of the said plugin in this forum after that post
so may be you should trylooking atthread dates before
posting :)
ftts
09-01-2005, 12:01 PM
???? link is not available.


bmsg hwnd wm_CLOSE in Olly

RCE Messageboard's Regroupment > General > bmsg hwnd wm_CLOSE in Olly
santa
03-26-2005, 10:36 AM
I work on SI and I would like to know how to addopt bmsg hwnd wm_CLOSE in Olly to Olly. Thanks
Ricardo Narvaja
03-27-2005, 07:49 AM
go to view-windows and in the list of windows, mark yours and right click, messege breakpoint and select the type of bmsg you want.

Ricardo
santa
03-27-2005, 08:42 AM
Ricardo Narvaja wrote:
"go to view-windows and in the list of windows, mark yours and right click, messege breakpoint and select the type of bmsg you want"

I know, I did it but when I want the intresting window to pops up after setting the breakpoint, it dont want to.
Ricardo Narvaja
03-27-2005, 06:11 PM
you can put conditional bp in apis (translatemessage and others apis of messages) wth the condition msg==XXX being XXX the value for WM_CLOSE look in the list for the number.

Ricardo


how to log buffer more than 8 length?

RCE Messageboard's Regroupment > General > how to log buffer more than 8 length?
Teerayoot
03-29-2005, 11:07 AM
I need to log buffer at send winsock api with length of data 12 and i need to log whole buffer how to do ?

ok give a example that olly only show 8 first digit

i set in [eax] expression condition log

i got this out put

00704185 | COND : 204C4143 in log window.
it show only partial output.
oh me anon
03-30-2005, 08:02 AM
20404143 == " LAC" so it is a string [eax] is dword by default so it
shows only 4 bytes
set decode value of expression as to ---> pointer to ascii string or

or use [string [eax]] as expression to log
Teerayoot
04-10-2005, 05:00 PM
u miss understand me!

ok this is buffer in c

unsigned char my_buffer[16] = {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00
};

i need to log whole buffer written to log window as this format

00704185 | COND : 4D5A90000300000004000000FFFF0000

it not ascii.
oh me anon
04-12-2005, 06:53 AM
well there is only one way you can use STRING [[ESP+CONST]] or use pointer to unicode string both have thier limitations they will stop at first null terminator ie either 0 or 00 :)

here is how some logs will look like

the break point i place here is like this

0040107A STRING [[esp-10h]] |. FF35 24304000 PUSH DWORD PTR DS:[403024] ; /hObject = 0000002C (window)

i set it on one line below ReadFile
note [esp-10] will hold the buffer pointer to which the file was read :)

00401069 |. FF35 30304000 PUSH DWORD PTR DS:[403030] ; |Buffer = 00132BE0
0040106F |. FF35 24304000 PUSH DWORD PTR DS:[403024] ; |hFile = 0000002C (window)
00401075 |. E8 40010000 CALL <JMP.&KERNEL32.ReadFile> ; \ReadFile

and i set the same expression to be logged :)

COND: ReadFileOutput = Œ½œ’rd9#*4rurdt:r<drœŒrt0ES1 E3:(3¾c0rktcsu`kubszlkxi`~i hy imavlfxnl{~hyhSõMUEV_FnMCZISCQ@GzDKXLAYMAQFŒ¾t1d} zloyil~h{@DhRWQ@WFAW Q@WFAWQ@WFAWQ@WFAWQ@WFAWQ@WFAWQ@WFAWQ@WFAWQ¥cbmt« f®pdAegerfrsš°dytedp pdtercdrtercdr`wcsrgg


Problem with puting bp on code section(s) - AntiCrack example

RCE Messageboard's Regroupment > OllyScript > Problem with puting bp on code section(s) - AntiCrack example
haggar
03-29-2005, 05:51 PM
Hi, I'm trying to write script for fiding OEP in UltraProtect and AntiCrack packed programs and I have problems with memory bp on CODE section.

Example look like this:

Memory map
00400000 00001000 ACProtec PE header
00401000 00108000 ACProtec CODE code
00509000 0002B000 ACProtec DATA code,data
00534000 0021E000 ACProtec BSS code
00752000 00003000 ACProtec .idata code
00755000 00001000 ACProtec .tls code
00756000 00001000 ACProtec .rdata code
00757000 0000C000 ACProtec .reloc code
00763000 0002E000 ACProtec .rsrc code,resourc
00791000 00024000 ACProtec .perplex code,imports

Now, I wan't to put mem bp on access on first code section. If I do it manualy (on a first line which base and size is 00401000 001080009 it works OK and program then breaks on OEP, but if I write that in script, OllyScript is placing mem bp on all that code sections. Result is that Olly breaks earlier and not on OEP. Is it posible to write script that will give corect size of first part? Am I doing something wrong, or plugin isn't capable to detect real size/don support this ?

Thanks.


New scripts available!

RCE Messageboard's Regroupment > OllyScript > New scripts available!
psyCK0
03-30-2005, 09:12 AM
Hey,
Sorry for being idle, been busy lately... I've taken some time to check the uploaded scripts and they are now available at the OllyScript site...


I need help for some stdio.h routines

RCE Messageboard's Regroupment > General > I need help for some stdio.h routines
hero
03-30-2005, 04:01 PM
Hi all
I need some help for stdio.h routines.
for example I never can use sprintf() in my programs because ollyDbg always crashs.
or if I use char* to declare an string olly crashs and I should set a length for it by declaring like this: char tmp[20];

do you know what is the problem?How I can use sprintf()?

sincerely yours


How to rebuild IAT/IT (UPX)

RCE Messageboard's Regroupment > General > How to rebuild IAT/IT (UPX)
paf
03-31-2005, 01:54 AM
I found OEP with SoftICE
OEP is 1000, Image base is 00400000
After rebuild with ImportREC, it show "success" message

But I run this unpack file error!!
I run it error if this file have section .RDATA, .IDATA or .BSS
(I run OK if this file have only section .TEXT, .DATA and .RSRC)

Could someone help me, plz
Thanks!!!!
thomasantony
03-31-2005, 07:43 AM
Hi,
did you dump the file using procdump or lordpe? properly after sending the prog into an infinite loop?

Thomas
paf
03-31-2005, 10:12 AM
did you dump the file using procdump or lordpe? properly after sending the prog into an infinite loop?

First, I used ProcDump to dump memory to file(dump.exe)
then I used ImportREC to rebuild IAT/IT of dump.exe
After finish, then filename is dump_.exe

I run dump_.exe, SoftICE will pop
I press F5, then OS show error message


Unexpected error 000000002?

RCE Messageboard's Regroupment > General > Unexpected error 000000002?
kittmaster
03-31-2005, 07:00 PM
I'm debugging a target that allows debugging all the way up to the splash screen before I get an error:

Unexpected event 00000002 in inejected code =>debugged program may get unstable and then I get the code is waiting 5 secs etc and I'm stuck. The EDX is displaying "CLIPBRDWNDCLSS", not sure if this helps or not but either way it locks up right there.

The target is using SHA1 and TEAN32 hashing functions as part of the release validation routine. Not sure if this is the root problem or not.

Is there a setting that I may not have set correctly to get around this. I think that if I can find out what is choking olly the injected code issue would not occur.

thanks

Chris
oh me anon
04-01-2005, 02:29 AM
if you have enabled this in olly
try disenabling
debugging options --> security-->allow code injection blah to find wnd proc
also disable registers -->enumerate some thing sse blah
the above mentioned location is from my memory (if you didnt find it there search in debugging options the key word is sse mmx register

both these functionalities use code injection in ollydbg and if all threads
in your app are suspended they dont succeed so olly waits for ever

there is a big thread in this forum named code injection erros
look through it
kittmaster
04-04-2005, 01:17 AM
Yes, you were absolutely correct, I had to disable to the option decode SSE registers. Problem totally solved........code injection errors gone.........I wonder if there will be an automatic option in version two to combat this issue

Thanks for the help

Chris


how to use ollydbg for w3wp process (IIS)

RCE Messageboard's Regroupment > General > how to use ollydbg for w3wp process (IIS)
dwarkeeper
03-31-2005, 10:59 PM
As you probably know with IIS 6.0 has a worker process (w3wp.exe), My ISAPI DLL is loaded from this worker process. I want to attach Olly to the w3wp.exe process however, I get the following error: "Unable to attach to process w3wp".

So I decided to change the registry key:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w3wp.exe
Debugger REG_SZ c:\odbg110\OLLYDBG.EXE

I Rebooted the box and now when ever I try to connect to IIS, ollydbg starts however it keeps giving me another Error "CPU Error" and dies and keeps through that loop.

I also tried to replace the HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
Debugger REG_SZ c:\odbg110\OLLYDBG.EXE

But that also gives me an error.

So My question is how do i successfully attach ollydbg with w3wp process.

May be i am missing something really basic.

thanks

dk


Two scripts: Stone's PE-Encrypter & WinKript

RCE Messageboard's Regroupment > OllyScript > Two scripts: Stone's PE-Encrypter & WinKript
DeAtH HaS cOMe
04-01-2005, 07:05 AM
Here you are!
--

/*
Find target's OEP [ Stone's PE-ExeEncrypter v1.13 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death@ech2004.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
Date : 04.01.2005
Config: -
Note : Any bug or comments, please report at death@ech2004.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

findop eip, #FFE0#
go $RESULT

sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death@ech2004.net WWW: http://www.ech2004.net"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret

--

/*
Find target's OEP [ WinKripT v1.0 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death@ech2004.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
Date : 04.01.2005
Config: -
Note : Any bug or comments, please report at death@ech2004.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

findop eip, #61#
inc $RESULT
go $RESULT

sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death@ech2004.net WWW: http://www.ech2004.net"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret


Other more: VGCrypt v0.75

RCE Messageboard's Regroupment > OllyScript > Other more: VGCrypt v0.75
DeAtH HaS cOMe
04-01-2005, 07:57 AM
/*
Find target's OEP [ VGCrypt PE Encryptor v0.75 Beta] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death@ech2004.net
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
Date : 04.01.2005
Config: -
Note : Any bug or comments, please report at death@ech2004.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aurënya :P
*/

findop eip, #E9E4#
bp $RESULT
run
bc $RESULT

findop eip, #E2F2#
add $RESULT,2
bp $RESULT
run
bc $RESULT
sto

findop eip, #FFE3#
go $RESULT

sto
log "El OEP del programa es:"
log eip
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
log "Script CracksLatinos by DeAtH #eCh!2004"
log "@: death@ech2004.net WWW: http://www.ech2004.net"
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"

ret


howto BPX with ollyscript ??

RCE Messageboard's Regroupment > OllyScript > howto BPX with ollyscript ??
nick_name
04-01-2005, 09:53 AM
is there anyway to automate

bpx CreateThread

like command, which we used to put inside the commandbar ??
haggar
04-02-2005, 06:56 PM
You have Readme.txt file that comes with OllyScript plugin. In it you have whole reference. In your case (I think that only works on XP):

gpa "CreateThread", "kernel32.dll"
bp $RESULT


Any interactive cmd to modify register and/or memory contents like sice ?

RCE Messageboard's Regroupment > General > Any interactive cmd to modify register and/or memory contents like sice ?
yalcm
04-02-2005, 02:32 AM
Hi,
I am newbie here and start to learn using ollydbg. I have had some expericence of sice before. Usually when I debug something when breakpoint reached, I need to change register(s) and/or memory contents. In sice I can use, for example, "REG EAX=00112233h or REG EIP=EIP-1 or E DS:EBX 12345678" etc to modify register/memory contents interactively. So my question is that "is there a counterpart like this in ollydbg" ? I have tried to input something in the cmdbar of ollydbg interactively, but I just couldn't find out any solution for my needs.
And I have spent a lot of time to read/search here in this forum to find out a solution/info for myself, but with NO such luck about this. So please help me out and thanks a lot for your attention.

A truely ollydbg newbie -- yalcm
oh me anon
04-02-2005, 01:34 PM
i dont know if a commandline command exist or not (never used it much)
but to modify a register it takes two mouse click

select register and hit enter olly will pop up a modify eax,ebx,ecx dialog
or select register and right click and select modify

to write to the place in ebx viz ds:ebx
select register >>>right click >>> follow in dump >>>> use ctrl+e (edit data dialog to modify data in dump )
yalcm
04-02-2005, 04:49 PM
Thanks for the quick reply. Modifying registers' content and/or memory's content with your method is no problem. But I'm coming from sice side, so I'm trying to find if there is an interactive way for olly like sice. Besides this, with your registers' content modifying method, it does NOT work for EIP register. I dunn know why ? So in olly is there a way to change the program execution flow(for example EIP=EIP-1) ?
Ricardo Narvaja
04-02-2005, 05:24 PM
yes mark the line you want, right click NEW ORIGIN HERE and EIP change pointing to this line.

Ricardo Narvaja
bigglass
04-03-2005, 03:28 AM
read Cmdline.rtf from plug110.zip (or view source).
use SET command from Command Line plugin (ALT+F1).
//clear debug bit
ex: set [BYTE [(FS:[18])+30]+2]=0
P.S. CommandBar not support SET command
yalcm
04-03-2005, 05:10 AM
wow, olly is really a great great great tool!!!
Thanks for all of these quick reply. Greeting fly out to all of good guys here, especially to this great tool's developer.

Have a good day, all
-yalcm
oh me anon
04-03-2005, 06:01 AM
ctrl+g ---> type eip-1 hit ok
ctrl+* eip will be modified

get the .hlp out and give it a read all these questions are answered there


how to find a address

RCE Messageboard's Regroupment > OllyScript > how to find a address
terb
04-02-2005, 08:52 AM
Hi guys ...

Been searching the forum for an answer but with no luck !!!

I wanna find a value somewhere in memory. As a logic thought I wanted to use FIND

ex:
Find esi, mydatavalue <-- this value is of course different from time to time

however it wont run...

So instead I create a stupid loop kind of like this:

ex:

mov eax, mydatavalue
loop:
cmp [esi], eax
je goodboy
add esi, 4
jmp loop
goodboy:
msg "found"

But doing this is very time consuming. My question is if there another way of doing this using a OllyScript command ?? I cant seem to find one !!!

All help is appreciated... Thx in advance

Terb
Epsylon3
11-02-2005, 10:41 AM
findop eip,#FFD2# //find command 'call edx'


Need new method of reading/writting memory of OllyDbg.

RCE Messageboard's Regroupment > Plugins > Need new method of reading/writting memory of OllyDbg.
Teerayoot
04-02-2005, 05:05 PM
i found game online protection using hightest tecnology to stop disassembly

i can't even read /write to that process
dunno that hook NtWriteVirtualMemory/NtReadVirtualMemory
or hook normal api

so hardest i have been face on my life!(tell me if u interest in this protection)

so any1 can help write some plugin using NtWriteVirtualMemory/NtReadVirtualMemory

hook normal api call to that ntxxx func :)


new, where should i start

RCE Messageboard's Regroupment > General > new, where should i start
Soldier
04-03-2005, 05:34 AM
hi, im new in this forum and ive been using ollydbg for some things but i still have trouble understanding most things.. i want to learn how to unpack exe files that are packed with armadillo, but since i dont know much about where to start i want to begin with some easy stuff so i can get used to it.. are there any tutorials/beginers guide to unpacking here? any good guide that explains commands, how to unpack something, what programs to use, etc. please reply with a link to any place thats good for starters, thank you.
Teerayoot
04-10-2005, 04:52 PM
a lot of good guide can be found on www.google.com
reverser41
04-11-2005, 02:16 PM
Try... this may help you alot.
http://tutorials.accessroot.com/
:-)


Function Cross reference

RCE Messageboard's Regroupment > General > Function Cross reference
fxd0h
04-03-2005, 01:12 PM
Hi all, is there any way to dump to a file or similar all the cross references for a function?

Thanks in advance.
oh me anon
04-04-2005, 08:46 AM
wht do you mean ?? all windows that ollydbg popup have copying abilities

you can copy a single line or whole table or message or comment or whatever

just right click and select the option you prefer

by function referance do you mean call tree ?? if yes select the functions first command press ctrl+k and then copy the whole table to note pad
from the window that pops up

is that what you are looking for ??
1bitshort
04-04-2005, 02:59 PM
Also try right-clicking on the disassembly, then Search For | All Intermodular Calls
i guess you could call that a function cross reference of sorts
fxd0h
04-07-2005, 12:31 PM
yeah , got it

Thx

---
fxd0h
http://fx.net.ar


Any ideas for plugins?

RCE Messageboard's Regroupment > Plugins > Any ideas for plugins?
1bitshort
04-03-2005, 04:37 PM
Ok great, i've made a simple working skeleton plugin (basically just a Hello World plugin so as to base future plugins off), but I can't think of any plugins to write ...
Any ideas anyone?
cubituz
04-04-2005, 06:06 AM
hi 1bitshort.

i like trace compare plugins (if possible)

thanks
1bitshort
04-04-2005, 07:15 AM
i think i know what you mean, but can you give me more information/an example? thanks
FKMA
04-04-2005, 01:44 PM
hi 1bitshort.

Let's write plugin to show in title of disasm windows offset from
current low-nearest exported function.
Like kernel32.GetProcAddress+0x22
It can be useful, if you are traicing in dll, and want to know where you are.

thanks.
1bitshort
04-04-2005, 02:01 PM
FKMA interesting idea, but the problem with that is that there's no way for the plugin to know when an exported function ends, so it may say "kernel32.GetProcAddress+0x456" when it's no longer in GetProcAddress. (And if youre debugging just an exe then there probably wont be any exported functions anyway)
Hmmm :)
FKMA
04-04-2005, 06:29 PM
1bitshort
There is , IMHO, two ways to resolve problem,
and both not ideal:
1) consider the begin of next exported function as end of previous
2) find the end of function by signature pop xx; pop xx ; ret(n);

The begins and ends of funcs for particulary dll find once a user
popup the disasm window in that dll and stored internally in linked list or array for speed search reason.

And in exe auto switch off this possibility.

Some week ago i want to write such plugin. That like softice show offset.
But in this period i too busy on work and don't have many time.
Sorry for my english :(

Thanks.
xtreem
04-04-2005, 11:47 PM
I think option 1) would work fine. You just look at the current offset and see which function address is closest to it, without being more than it. ie,

GetWindowLong 0x100
DrawRect 0x200
OtherFunc 0x300

If the offset is 0x259, you can deduce that you are in function DrawRect, or at least can show the address as an offset from this function. This is basically what FKMA has just said :P
FKMA
04-05-2005, 01:08 PM
Oh, yes . :)
kittmaster
04-05-2005, 02:40 PM
Is there a plug in that can log the steps like smartcheck by numega does? If not that would be a cool plugin so you could trace the program especially if it is encrypted like an SHA1 hash.

What do you think?
sabq1
08-26-2005, 04:28 PM
cubituz - Member says:

hi 1bitshort.

i like trace compare plugins (if possible)

thanks

...........................

1. save memory (press button)
2a. ... now you do somethink in program ...
2b. save memory (press button)
2c. now you compare 1 & 2b (search changes (you type what changes))
3a. ... now you do somethink in program ...
3b. save memory (press button)
2c. now you compare 2b & 3b (search changes (you type what changes))
4a...
4b...
4c...
...
Wille
02-09-2006, 06:47 PM
write a plugin which makes tutorials for olly...
like if u set breakpoint to somewhere it'll write text "Now set breakpoint to <address>" into html document and in future releases it could take screenshots for tutorial by pressing some key combo like ctrl+home.
HolyView
02-12-2006, 04:11 PM
mhhh ... i wrote a plugin which permits to converts asm code to it's html view with colors ... useful for tutorials writing :) (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2 &topic=1588)
it's not exactly what you want but there's source code (delphi) if you (or someone) want to take a look.
maybe it can help you ....
Wille
02-13-2006, 03:03 PM
how u can write plugins with delphi for olly? is it possible with vb too?
HolyView
02-13-2006, 08:56 PM
actually there is no SDK for VB.
you can view sdk here : http://ollydbg.win32asmcommunity.net/stuph/


disasm error in ollydbg

RCE Messageboard's Regroupment > Bugs > disasm error in ollydbg
kotzeesser
04-04-2005, 06:18 AM
this is what olly displays
F724B3 mul dword ptr ds:[ebx+esi*4]

and this is the correct disasm
F7 24 B3 mul eax,dword ptr [ebx+esi*4]
oh me anon
04-04-2005, 12:24 PM
what do you mean sir ??
afaik mul is always mul source :( never heard of two operators on mul

it always multiplies what is on al,ax,or eax by the source and leaves the result in ax,eax, and eax:edx

MUL source

Logic AX . AL * source ; Source is a byte
or
DX:AX . AX * source ; Source is a word
or
EDX:EAX . EAX * source ; Source is a dword (386+)

MUL performs unsigned multiplication.

The carry and overflow flags (CF and OF) are set to 1 if the
high-order of the result (AH,DX, or EDX, respectively) contains
any significant digits; otherwise, CF and OF are reset to 0.

Opcode Format
F6 /4 MUL r/m8
F7 /4 MUL r/m16
F7 /4 MUL r/m32
kotzeesser
04-05-2005, 03:17 PM
you are right, this isnt a error

i was just wondering because visual studio disasm displays it as
mul eax, ...

but the use of ax, eax, .. as dest is implicit for mul


how do you breakpoint on memory access?

RCE Messageboard's Regroupment > General > how do you breakpoint on memory access?
FireRaven
04-04-2005, 08:37 AM
greetings all!

i want ollydbg to break when the program accesses the address circled in the picture (0003042E)...
http://www.heroraven.com/pub/screenshot1.JPG
i noticed the address is not part of the image base.
the picture shows one place in the code where it is accessed, but there are more in the program but don't know how to ask olly to break when it comes across each one.
oh me anon
04-04-2005, 08:50 AM
that is the handle to the window the value is per seesin only they change if you change session it is not an address :(

you can use conditional break point and specify the handle

or use window menu and set a message break point
FireRaven
04-04-2005, 10:15 AM
what's the window menu? and how do i set message breakpoints?
oh me anon
04-04-2005, 12:09 PM
i dont know why you ppl need to be spoon fed shit :(
cant rtfm ?? never look into the folder where ollydbg is situated ??
dont open .hlp file ?? doesnt know the .hlp file is there for help ??
the question is the most useless one to answer :(

instead of wasting time waiting for reply form some one you could have opened the fscking .hlp file and could have found out for yourself what windows menu is and how do you set message breakpoints and could have posted a meaningful question which when answering bring joy rathere than anger :(

This window displays list of all windows owned by debugged application and their most important parameters.

NT-based systems hide address of window procedure (function that processes all messages to the window). This effectively disables subclassing of windows belonging to different process but creates problems for debugger. OllyDbg can read address of window procedure by executing GetWindowLong in the context of debugged application using code injection. This method is time-consuming and sometimes (especially for multithreaded applications) unsafe. I use it only when debugged application is paused and injection is enabled by option Allow code injection to get address of WinProc.

Due to the lack of place, many columns in this window contain additional information that is normally hidden in the columns. For example, column WinProc marks subclassed windows (window procedure is not the same as class procedure), column ID displays ID of the control in decimal form and Style decodes window's style as a set of WM_xxx flags. To view additional information, change width of corresponding column.

You can set breakpoint on window message, for example WM_PAINT, or group, like mouse messages.

To set breakpoint on message, OllyDbg creates specially prepared conditional logging breakpoint with explanation "<WinProc>". To see how it works, assume that we have button with handle 00001234 and request pause on all button messages. After breakpoint is set, open it as a conditional logging breakpoint. You will see the following options set:

Condition: [ESP+4]==00001234 && [ESP+8] IN (0F0..0F7,135)
Explanation: <WinProc>
Pause program: On condition

At entry to window procedure, stack contains:

[ESP+00] Return address
[ESP+04] Window's handle
[ESP+08] Message
[ESP+0C] wParam
[ESP+10] lParam
Now it's clear that first part of condition means: "Window's handle must be 00001234" and second: "Message is one of (BM_GETCHECK...BM_SETIMAGE, WM_CTLCOLORBTN)".

Important note: Window's handle is different each time window is created, so if you set breakpoint on actual window only, this breakpoint is valid only for the life of this window.

now i have pasted the full content form help file go read through and experiment and ask some question which is really enajoyable to read and answer :(
allenmif
04-11-2005, 03:05 PM
thanks oh me anon!


Automated step in step out

RCE Messageboard's Regroupment > General > Automated step in step out
kittmaster
04-05-2005, 02:06 AM
Is there a function in the ini to slow the automation stepping down to something a bit more readable. I've check the help file and it only shows how you can stop it or how it breaks when encountered. Is there a way to vary the speed in real time or can it be set statically in the ini?

thanks

Chris
Teerayoot
04-10-2005, 04:49 PM
I think can't set it in anyway.
but tool name speedgear will get the rescue.


OllyDbg Breakpoint Manager Plug-in Released

RCE Messageboard's Regroupment > Plugins > OllyDbg Breakpoint Manager Plug-in Released
pedram
04-05-2005, 02:11 PM
OllyDBG has excellent breakpoint manipulation capabilities and can store breakpoint information across debugging sessions for the main module being debugged. However, there are some limitations to the available functionality which this plug-in attempts to address. The OllyDbg Breakpoint (BP) Manager plug-in was written to provide three main functions- breakpoint exporting, breakpoint importing and automatic breakpoint loading. Offsets are used in place of absolute addresses to support setting and restoring breakpoints on modules that move around in memory. More information, examples and source code are available on the software page of the iDEFENSE Labs web site:

http://labs.idefense.com

I encourage users to submit useful breakpoint sets they have created with OllyDbg Breakpoint Manager to me for credit and inclusion in future releases and on the release web site.

-pedram
TBD
04-06-2005, 03:32 AM
also added to Stuph page. nice work!
psyCK0
04-11-2005, 11:00 AM
Nice one!!!
Gerrye
04-11-2005, 01:22 PM
As always, nice work.

/gerry
pedram
04-11-2005, 08:16 PM
Thanks for the kind words all. If anyone constructs an interesting breakpoint list, please share ;-)
oh me anon
04-12-2005, 06:17 AM
nice plugin :) i normally break on seh handler here in ntdll :) w2ksp4

77F9250D ntdll.RtlpExecuteHandlerForException MOV EDX, ntdll.77F8A896 ; default handler for any exception that gets raised in seh handler
77F92512 ntdll.ExecuteHandler PUSH EBP ; stack setup
77F92513 MOV EBP, ESP ; stack setup
77F92515 PUSH DWORD PTR SS:[EBP+C]
77F92518 PUSH EDX
77F92519 PUSH DWORD PTR FS:[0]
77F92520 MOV DWORD PTR FS:[0], ESP ; seh handler setup here
77F92527 PUSH DWORD PTR SS:[EBP+14]
77F9252A PUSH DWORD PTR SS:[EBP+10]
77F9252D PUSH DWORD PTR SS:[EBP+C]
77F92530 PUSH DWORD PTR SS:[EBP+8]
77F92533 MOV ECX, DWORD PTR SS:[EBP+18]
77F92536 CALL NEAR ECX ; this calls your handler look at what gets to ecx one line above

and i put a break there and exported it with the plugin
it puts a nice .obp into th dir :)
ntdll:00012536:#:#

how about conditionals like stopping on CreateFile when hFile == String blah kind of breaks are they implemented too ?? or stopping on TranslateMessage when Handle == #### and msg == WM_BLAH
anyway nice plugin :)
pedram
04-12-2005, 10:57 AM
Thanks. Conditional breakpoints have not yet been implemented. Only regular/log with expression/explanation. I'll look into adding conditionals for another release when I find the time. If someone feels like beating me to it that would be great- I'll update the distribution with all the proper credits.

-pedram
URDust
07-01-2005, 06:19 AM
I am new in here!
How can i do some plugings for Olly?

Thx
oh me anon
07-01-2005, 07:41 AM
do you mean you want to write plugins ?? its plugins not plugings btw :)
if yes then you should take a look a pdk which is available from ollydbg site it comes with two sample source codes for the default bookmark plugin and commandline plugin along with a pre made make files
for bcb5.5 and vc

you should have an idea of what you want to write for
you should have your preferred compilers set up

then as a trial you could try compiling the sample source that comes along
and see how it works out

if you prefer to write plugins in assembly
eviloid has put together a pdk for masm (its not updated yet for v 1.10)
but was for 1.08 version

if you are using vs then alex clark has put together a pdk for
vs you can get it from ollydbg main site
Bob
07-04-2005, 04:52 PM
..and theres a delphi version of SDK too..

Thanks for the plugin, Pedram :)

~BoB~


Unusual exception issues between full run and stepping

RCE Messageboard's Regroupment > General > Unusual exception issues between full run and stepping
kittmaster
04-06-2005, 01:48 PM
I'm debugging a program that if any of the typical breakpoints are set the program breaks normally and if the run command (F9) is issued will go all the way to termination as it should. Without changing a thing, I then take the same breakpoints and target and automate stepping for some 50000 line code passing and about 2/3 of the way, some type of exception gets raised and it chokes olly.

Why would a full run not cause the expection and an automated step raise it? The only protection involved is crypto which is SHA1 and TEAN32.

I have the DECODE SSE REGISTERS disabled but all the rest in tact.

Any ideas why this error would happen?

thanks

Chris
oh me anon
04-06-2005, 03:26 PM
probably some other single step preventing anti debugging trick that you have over looked

like pushf or [esp],100 popf or checking for 0x cc on esit points of loops
when you automate olly sets one time break points called hit points (Not just olly all debuggers for that fact set a single hit bps for traversing loops
may be it is being checked
there are lot of possibilites
can you say what is the ezception that is getting raised ???
did you try passing it to program ??
did you view seh chain and locate the handler ???
did you break before there using runtrace condition and single step ??
i dont think the above mentioned info is sufficient enough to give a
reasonable answer
Ricardo Narvaja
04-06-2005, 05:14 PM
maybe a RDSTC protection, when stepping more time pass and this is detected

Ricardo Narvaja
Ricardo Narvaja
04-06-2005, 05:15 PM
RDTSC sorry write error

Ricardo
kittmaster
04-06-2005, 05:17 PM
The process does not allow for a pass exception like control f7 f8 or f9, the process from what I've seen a few times is Zw.raiseexception which I think is an int 3 exception. I've tried the plugin that unhandleexpectionfilter .22p, it says it can't find the signature. I don't think the two are the same.

When the exception occurs the total process terminates. I've done PEID on it and there is nothing else.........Its just a C++ [debug] overlay which shouldn't pose a problem.

I've look under the seh chain but the exception terminates and doesn't list the caller of the exception

The break occur before the run trace sucessfully, its after the automation step is sequence that it parses 2/3 after the break and then fails. Under full run mode, it finishs sucessfully with no exception. I can run it again and give a screen shot if needed.

Thanks for the response, hope to hear from you soon

Chris
oh me anon
04-07-2005, 10:03 AM
:( still it is not clear enough to warrant a reply well olly cant magically terminate any application
zwRaiseException is the native api call which raises the Exception it is exported by ntdll.dll
probably you have already checked pass the following exceptions to the program and it is passing it automatically and gets terminated
what are you trying to achieve by auto stepping ?? why not use conditional break points effectively and stop at the required places instead of vague tracing ?? or use the log function of runtrace and log the whole crap and try looking through the logged commands then set a break point f9 and then auto single step to isolate the offending instruction

as ricardo posted it may be timing the sequence and verifying whether it is single stepped or not

UnHandledExceptionFilter is set by the calling process which handles any exceptions that are not handled and its functionality is almost same as
ntdlls final handler get jeremy gordons Except32 seh tutorial and give it a read through

may be look into debugging options -- exceptions and find what options are checked in there may be uncheck them all and add them one by one
as they arise
good luck :)


program text displayed as multiple question marks

RCE Messageboard's Regroupment > General > program text displayed as multiple question marks
steve
04-06-2005, 07:50 PM
can any one help me please, when i run a particular program through olly i get corrupt strings on title bars, menus etc.
the window title appears as ????????????????, as do menu titles and items.

the program is fine when run normally, and other programs display fine through olly.

i've tried searching the forum, and google, but have been unable to find anything.

thanks.
nick_name
04-07-2005, 11:37 AM
may be the UNICODE string got disturbed somehow.
could be a language issue too for which u dont have the font installed


Attaching a process??? How???

RCE Messageboard's Regroupment > General > Attaching a process??? How???
yaa
04-07-2005, 10:19 AM
Hello,

I've been wondering, how should the attach process be done ... whenever I attach *any* process, that process simply freezes. All threads in the attached process are shown as suspended and trying to resume them simply does not work.
Has anyone ever been able to use this functionality??? How???
Thanks.

yaa
Ricardo Narvaja
04-07-2005, 08:09 PM
i use and always work perfect in xp sp1 and sp2 work perfect.

you open a NEW ollydbg (not an used where you work and close the debugee) a open a NEW and FRESH OLLYDBG, go to atach, and select your process, when stop in debug break, you can look the first section, (generally starting in 401000 in WIEW-WINDOWS and select this section or the section you think the program are executing and right click MEMORY BREAKPOINT ON ACCESS and RUN) the program stop.

Quit the BPM and continue tracing running, debugging, if the program freeze I think OLLYDBG is detected, use HIDE DEBUG 1.22 plugin for avoid detection)

But attach is the MOST useful and work perfect.

Ricardo Narvaja
yaa
04-07-2005, 09:05 PM
Hello Ricardo,

Ias I said with a high enough frequency "attaching" an already running process leads to what I described in my original post: the threads in the "attached" process are displayed as "suspended" and there is no way of resuming them (clicking the resume menu item leaves them in their state). Fortunately, this behavior does not seem to be deterministic ... repeating the process enough times you eventually succeed in attaching the target process without it being freeezed.

This behavior is the same on the 2 different machines both running Windows 2000 Server ... and happens even with notepad.exe, so it is not a matter of being *detected*.

Does anyone else experience this same problem???

yaa
Ricardo Narvaja
04-08-2005, 07:50 AM
I have win xp and no experience with 2000, but in XP you need use a new open OLLYDBG for atach, not a used OLLYDBG when you close a debugged program a use for second time.

Do you try this?

Ricardo Narvaja
yaa
04-09-2005, 10:21 AM
Hello Ricardo,

ok, it seems that following your advice of always using a *freshly opened* instance of olly the issue disappears. It would seem that somehow olly remains "dirty" when already used previously for other tasks. Thanks for the advice.

yaa
Teerayoot
04-10-2005, 04:33 PM
I also created my own tool that will launch OllyDbg when target process start to execute, olly will attach to and all thread still running as notthing heppen!

no need to run Olly wait for target and then back to olly go to attach command usefull when need to debug hard target :) hehe

mail me if some1 need.
Teerayoot
04-11-2005, 01:44 PM
I also created my own tool that will launch OllyDbg when target process start to execute, olly will attach to and all thread still running as notthing heppen!

no need to run Olly wait for target and then back to olly go to attach command usefull when need to debug hard target :) hehe

mail me if some1 need.
Teerayoot
04-12-2005, 06:05 AM
I also created my own tool that will launch OllyDbg when target process start to execute, olly will attach to and all thread still running as notthing heppen!

no need to run Olly wait for target and then back to olly go to attach command usefull when need to debug hard target :) hehe

mail me if some1 need.
Teerayoot
04-12-2005, 07:45 AM
:( seem "Edit " function not work correctly
i edit but intead it add new reply!

plese fix it ,Admin.
Ricardo Narvaja
04-12-2005, 09:11 AM
can you send me your tool to my mail?

ricnar456@yahoo.com.ar

and i can put in my FTP for all want download?

Ricardo Narvaja


2 strange things

RCE Messageboard's Regroupment > Bugs > 2 strange things
FarSeeing
04-07-2005, 12:57 PM
Sorry if these problems were already mentioned? but I've got 2 of them:

1) when PUSHing register as an argument for some function you can follow it in dump by right-clicking on it in code window. Another way is to 'follow in dump' the register itself by right-clicking it in registers window. So, the problem is that addresses differ -> reg window goes to address in register (the right one) and code window goes to REG+4 bytes (??)

2) a small problem: when doing some actions with windows (i.e. resizing code window) the header of registers windows is corrupted (the names of registers are hidden by code window), but clicking on header restores it


findprocbegin always returns 0

RCE Messageboard's Regroupment > Plugins > findprocbegin always returns 0
matlix
04-07-2005, 08:13 PM
findprocbegin always returns 0...
It seems that Finddecode can't find valid codedec.
When I see the codedec member of t_module, it' 0...
What's the problem?
Do I need to initialize something?
matlix
04-08-2005, 06:28 AM
and more, how can I access stack information, like the stack comments?


Using Ollydbg with GCC compiled c++/asm

RCE Messageboard's Regroupment > General > Using Ollydbg with GCC compiled c++/asm
Zinho
04-08-2005, 10:34 AM
Greetings,
I'm a completely newbie with ollydbg. I use to code in C++ and ASM using windows gcc (djgpp). I noticed that gcc doesn't produce a standard PE executable as Ollydbg would expect. Is there anything I can do to work both with gcc and Ollydbg? Has anyone experienced such problems before?
Thanks in advance


crackme using vbaVarTstEq

RCE Messageboard's Regroupment > General > crackme using vbaVarTstEq
apfelsaft
04-08-2005, 11:56 AM
Hello, i have a little crackme here, where i have to find the correct password. the programm is using the function "vbaVarTstEq". does anybody how to find out the password, when i have code like this here:

...
00401DF1 . 50 PUSH EAX
00401DF2 . 56 PUSH ESI
00401DF3 . 897D E8 MOV DWORD PTR SS:[EBP-18],EDI
00401DF6 . C745 D4 088000>MOV DWORD PTR SS:[EBP-2C],8008
00401DFD . FF15 50104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarTs>; MSVBVM60.__vbaVarTstEq
00401E03 . 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]
00401E06 . 8BF0 MOV ESI,EAX
00401E08 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00401E0E . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00401E11 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar
00401E17 . B9 04000280 MOV ECX,80020004
00401E1C . B8 0A000000 MOV EAX,0A
00401E21 . 66:3BF7 CMP SI,DI
00401E24 . 894D AC MOV DWORD PTR SS:[EBP-54],ECX
00401E27 . 8945 A4 MOV DWORD PTR SS:[EBP-5C],EAX
00401E2A . 894D BC MOV DWORD PTR SS:[EBP-44],ECX
00401E2D . 8945 B4 MOV DWORD PTR SS:[EBP-4C],EAX
00401E30 . 894D CC MOV DWORD PTR SS:[EBP-34],ECX
00401E33 . 8945 C4 MOV DWORD PTR SS:[EBP-3C],EAX
00401E36 . 74 43 JE SHORT crackme.00401E7B
Ricardo Narvaja
04-08-2005, 06:55 PM
First you are correct this is a point of the comparation of good pass with the fake?

Well can be compare, other things.

Look in the stack, [esp+4] and [esp+8] , right click ih the in this values and FOLLOW IN DUMP in each value, and you see the values compared.
If i´m wrong (memory fail) make follow in dump from [esp], and the [esp+X] values and you found.

Ricardo Narvaja
kittmaster
04-09-2005, 12:24 AM
Ricardo.........can you contact me chris@kittmaster.com. I have a question I need to ask

Thanks
Chris
Ricardo Narvaja
04-09-2005, 09:23 AM
write me to my mail ricnar456@yahoo.com.ar

Ricardo Narvaja
apfelsaft
04-11-2005, 02:44 PM
Hi and thx so far.

i followed in dump and get this 2 lines for the 2 arguments of the vbaVarTstEq function.

0012F59C 08 80 00 00 01 00 00 00 3C AB 13 00 01 00 00 00
0012F5AC 02 00 00 00 38 9E 13 00 B4 00 F7 77 00 00 00 00

from this tutorial (http://www.caesum.com/handbook/rev.htm) i know for the first line that the first byte "08" means that it is a string variable type and byte 12 to 8 is the address where it is stored (0013AB3C). there i found the (wrong) string i entered.

so the second line points to the right value. but how can i find out the value?
Ricardo Narvaja
04-12-2005, 09:14 AM
no you can make the same in the next value of the stack not in the dump.

Ricardo


IN DUMP

RCE Messageboard's Regroupment > General > IN DUMP
warf
04-08-2005, 09:20 PM
i know when you use point.h you do a follow in dump edi because the command is repz esi edi. so that means it will wind up in edi. what other things can i follow in dump that can point me to the serial. like [esp+c] or something? i would like to know so it can help me get a better concept of how things are working when im tracing etc..

warf


PLUGIN - PLEASE HELP - this is a tiny easy annoyance...

RCE Messageboard's Regroupment > General > PLUGIN - PLEASE HELP - this is a tiny easy annoyance...
Josh
04-09-2005, 02:42 AM
I am a seasoned ASM, visual basic, php, hmtl.....etc. developer. C++ is not a langauge ive picked up. Two things:
I NEED a plugin that acts like a notepad in OllyDbg, something that i can quickly copy to and paste from or better yet just double click a copied entry and it gets pasted in the field, anythin like this out? I want it WITHIN olly.

Also is theria plugin deveolpment kit for Visual basic 6? I got olly 1.10.
nick_name
04-09-2005, 02:53 AM
there's a notepad in GODUP plugin ... checkout the plugin section
nick_name
04-09-2005, 03:00 AM
all plugins available in this page :

http://ollydbg.win32asmcommunity.net/stuph/
1bitshort
04-10-2005, 09:46 AM
Windows Notepad does the job just as easily


About the buffer overflow bug

RCE Messageboard's Regroupment > Bugs > About the buffer overflow bug
thomasantony
04-09-2005, 02:56 AM
Hi,
Is there any way arond the OutputDebugString bug in ollydebug?

Thomas
Ricardo Narvaja
04-09-2005, 09:26 AM
there are patchers for this problem.

the tool re-pair fix the bug there are other tools or patchers for this bug look in woodman or exetools.

Ricardo Narvaja
thomasantony
04-09-2005, 02:11 PM
Hi,
I made a patch myself. It is available at the Accessroot forums in the Tools of the trade section

Thomas
nick_name
04-09-2005, 03:15 PM
mentioning anything about EXETOOLS is almost meaningless, no doubt it's a great place but for the registration restriction, it means nothing to whom r not member there ...

anywayz, any working link to OUTPUTDEBUGSTRING solution ??
Ricardo Narvaja
04-09-2005, 07:26 PM
i say to you woodmann, and this is not restricted, is not necesary register at all.

If you go to woodman and in the serach wrire re-pair you found the link of de download

if you don´t find can be here

http://www.woodmann.net/forum/showthread.php?t=6800&highlight=re-pair
nick_name
04-10-2005, 12:36 PM
thanks Ricardo ... i wrote a script for OutputDebugStringA and had to use that on each run of Olly ... but after patching it works just fine ...
thomasantony
04-16-2005, 02:18 AM
Hi,
Find the patch in the Tools of the Trade section of the Accessroot forums http://intechhosting.com/~access/forums/index.php?

You have to register though. It seems that all the filehosting servers are down. myfilebucket.com, upload4free all r down :(

Thomas
Snowski
04-16-2005, 10:34 AM
Great, thanks alot, that patch for OllyDbg works just fine!

Tested it on an Armadillo packed target, that uses the old vulnerability to crash Olly...not anymore! :)


Debugged program unable to process exception

RCE Messageboard's Regroupment > General > Debugged program unable to process exception
abitofboth_
04-10-2005, 07:50 PM
"Debugged program unable to process exception"

Thats what I get when i try to debug this application (game)..

Yes i've googled it, however im coming up short (yes im a noob)...

why would it do this ? Process terminates just after this wich exit code C0000005 ... like wtf ?
Ricardo Narvaja
04-11-2005, 02:52 AM
wel, the debugee probably detect ollydbg.

Use HideDebug 1.22 with all alternatives of hide enabled, and copy ollydbg.exe to other folder rename to by example pirulo.exe, and copy pirulo.exe to the olly folder again.

You will have two executables, ollydbg.exe and pirulo.exe, use this for debugging.

Combine the use of pirulo.exe with hidedebug 1.22

other debuggers detects BP, erase all BP, and RUN again, others detect hardware bpx look in DEBUG-HARDWARE BPX if there are one and delete.

If with all this the program don´t RUN, well maybe the the program use a ILLEGAL EXCEPTION and use a bug of ollydbg for crash.

This bug can be easily patched.

There are more possibilities try this and tell me.

Ricardo Narvaja
abitofboth_
04-11-2005, 08:48 PM
I did what you suggested (allthough i could only find hidedebug 1.2 not 1.22)
and its still the same :o( ...

however LastErr shows ERROR_USCCESS ?

I appreciate you taking your time and all :o)
Ricardo Narvaja
04-12-2005, 09:12 AM
mail me to rivnar456@yahoo.com.ar and i send to you hidedebug 1.22 for try.

Ricardo Narvaja
abitofboth_
04-12-2005, 09:35 AM
Thanksalot ... mail is in the ether ..

More specifically its a CMP that it breaks on .. nop'ing that (and followin JNE) takes me further!!! albeit the same type of error keeps occuring later on as well :o/
abitofboth_
04-12-2005, 09:36 AM
mail is bouncing :o(
Ricardo Narvaja
04-13-2005, 10:28 AM
sorry i wrote bad is ricnar456@yahoo.com.ar

Ricardo


problem with trace with condition

RCE Messageboard's Regroupment > Bugs > problem with trace with condition
RE_LOAD
04-12-2005, 07:19 PM
When setting a condition for the run trace, the trace doesn't always stop, even if the condition is reached. It happens either wit the "EIP is in range" and "Condition is true" commands.
I don't know whether there's a way to solve this bug only setting something in Olly, but I think there's something wrong...
Ricardo Narvaja
04-13-2005, 10:21 AM
write here how do you write the condition (for check is well write) and next in the run trace window, right click and LOG TO FILE to see if the trace pass for this line.
Don´t forget olly configuration can skip trace for system dlls, etc the configuration is very important.

Ricardo Narvaja


New cpu modules,Is it possible?

RCE Messageboard's Regroupment > General > New cpu modules,Is it possible?
hero
04-13-2005, 01:07 PM
Hi all
I want to ask is it possible to make a support for other processor in OllyBDG?
for example by using a plugin?for example make an ARM processor?

sincerely yours
TBD
04-14-2005, 07:11 AM
in 1.x is not possible as it is very linked to x86 architecture
(I know that I talked with Olly about supporting ARM ~ 3 years ago)

maybe in 2.x it will be possible, but I dont know.


com dll unpacking how?

RCE Messageboard's Regroupment > General > com dll unpacking how?
rasel
04-14-2005, 04:55 AM
Hello,

Last day I tried to unpack a DLL protected with
"Armadillo 2.51 - 3.xx DLL Stub" according to PEID with no success. The
target is here:
hxxp://wxw.convertspot.com/convertexceltocsvcom.htm

I searched for a tutorial on unpacking DLLs but all I found is .exe unpacking.

Can someone help me to find my way on this?

Regards.
TBD
04-14-2005, 07:08 AM
this is not an unpacking forum, sorry.


Aspack2.12 IAT HELP PLEASE

RCE Messageboard's Regroupment > General > Aspack2.12 IAT HELP PLEASE
nmanma
04-14-2005, 02:03 PM
I'm trying to unpack this exe, i've tried Aspack2.12 - and i can't rebuild the IAT - I HAVE NO CLUE HOW :P

Can anyone point me to a basic tut on how to rebuild iat's

Oh and another thing, this exe has strange section headers, Like MackT FISH topo0 and lovetzl ?

anyone recognise these?
haggar
04-14-2005, 04:39 PM
Mackt is added import section by Import REConstructor. That is tool for fixing IAT and you can find it on the net. That tool can easy fix IAT at most packers and some protectors. You have good tutorials on old biw reversing forum.
garryw
04-14-2005, 04:40 PM
nmanma, section named MackT suggests it has been unpacked already, maybe repacked?. Try http://www.yates2k.net/peinfo.html for iat related info.
haggar
04-14-2005, 06:52 PM
Btw, ASPack and lot of others packers and protectors have option to change sections name. That is why sections have weird names. Also you can change section name by your self just editing it with hex editor.
nmanma
04-15-2005, 08:20 PM
This exe has been passed around like a penny, its a heavily modified game loader thats used to hook dll's into the process (Not CS/HL related ;) ) its for an rpg im playing with and its chinese, so its been packed, unpacked, modified, repacked.

it was originally packed in PE Encrypt, but they some how decrypted it, and packed it in a less evil packer, i've managed to unpack the dll's its just this being evil.

if i can change the headers in HEX can i then use a compiled unpacker?


load ALL DLLs

RCE Messageboard's Regroupment > General > load ALL DLLs
SGN
04-15-2005, 09:30 AM
Is it possible in OllyDbg to load ALL used DLL at initial start of debugging?

How to set the Breakpoint in app consisting in several theads?

PS
When I set the breakpoint in app consisting in several threads, OllyDbg don't stop +((((

Thanks


[renamed] debugging tips

RCE Messageboard's Regroupment > General > [renamed] debugging tips
Snowski
04-16-2005, 07:30 AM
Greetz to all,

I have a question about Armadillo and COPYMEM-II: How can I determine that my target is packed using the COPYMEM-II feature?

What are the signals I should look for, if any?

I have noticed that if I run my target, it opens twice (I can see that in TaskManager)...does that mean the target is packed using COPYMEM-II?

Thanks in advanced for your reply.
Snowski
04-16-2005, 08:16 AM
Hmmm, just discovered that a file packed with Amradillo 4.XX without COPYMEM-II also appears twice in the Task Manager...so forget my last statement in the previous post... ;)

First question still stands...how to determine if file was packed using COPYMEM-II?
Ricardo Narvaja
04-16-2005, 09:28 AM
yes if there are two process with same name is COPYMEM2

Ricardo Narvaja
Snowski
04-16-2005, 09:31 AM
Hi Ricardo,

I am truly enjoying your tutorials by the way, thanks alot, great work!

That is indeed what I thought...however, in the tutorial called "82-ARMADILLO sin copymem2 FOR DUMMIES ENGLISH PROGRAMA BACKUP por TENSHIN.rar ", I read the following:

"Once you load BKFD.exe in OllyDbg, run it an go to file Attach. You will see only one process with that name, and it is red colored. This is the proof that show us that it’s neither Copymem II protected nor Namite."

I did this to my target, and I see only 1 process running...

But in Task Manager, when I run the target, I see two programs running...so is it COPYMEM II or not...?

Thanks again for all your help, Ricardo!
Snowski
04-16-2005, 09:44 AM
Just to clarify, here are the first lines in Olly before hitting start:

0043D000 > 60 PUSHAD
0043D001 E8 00000000 CALL HTC_new.0043D006
0043D006 5D POP EBP
0043D007 50 PUSH EAX
0043D008 51 PUSH ECX
0043D009 0FCA BSWAP EDX
0043D00B F7D2 NOT EDX
0043D00D 9C PUSHFD
0043D00E F7D2 NOT EDX
0043D010 0FCA BSWAP EDX
0043D012 EB 0F JMP SHORT HTC_new.0043D023
0043D014 B9 EB0FB8EB MOV ECX,EBB80FEB
0043D019 07 POP ES ; Modification of segment register
0043D01A B9 EB0F90EB MOV ECX,EB900FEB
0043D01F 08FD OR CH,BH
0043D021 EB 0B JMP SHORT HTC_new.0043D02E
0043D023 F2: PREFIX REPNE: ; Superfluous prefix
0043D024 ^EB F5 JMP SHORT HTC_new.0043D01B

If I run the program (F9), I get:

Don't know how to bypass command at address 004465C5. Try to change EIP or pass exception to program.
(I do know how to get around this.)

If I push Shift+F9, OllyDbg closes. Armadillo uses a bug (overflow) in Olly to crash Olly.
(I do know how to get around this.)

The strange thing is that I have these extra lines in the START my code:

0043D009 0FCA BSWAP EDX
0043D00B F7D2 NOT EDX
0043D00D 9C PUSHFD
0043D00E F7D2 NOT EDX
0043D010 0FCA BSWAP EDX

I do not see these in any of the tutorials...looks like a new version of Armadillo was used here, possibly version 4.10...
Snowski
04-16-2005, 11:53 AM
Alright...bypassed the ARMADILLO triggers:

"Don't know how to bypass command at address 004465C5. Try to change EIP or pass exception to program. "

No problem there...Shift+F9 does the trick just fine, and thanks to the bugfix in Olly, OllyDbg does not crash... :)

On to the next step: How to find the "son" and dump it...The current methods posted in manuals do not appear to work.

Adding the "BP WriteProcessMemory" before the first run (F9) results in that bypass exception error...HELP!
Ricardo Narvaja
04-16-2005, 04:38 PM
use he not BP (hardware breakpoint on execution) the manual work perfect there are only minor changes.

Ricardo
Snowski
04-16-2005, 07:24 PM
Alright, I have tried the HE method as well (HE CreateThread)...as shown in your tutorials, but F9 will give me the "Dont know how to bypass....." dialogbox.

SHIFT+F9 will run nicely, but NOT break...

Also did a search for all referenced text strings, looking for "Don't know how to...", but no strings found.

Am I using the wrong HE?

--------------

Another interesting thing is that when I look in Memory (M), ther is no CODE section. So I set "memory breakpoint on access" on .data (this is the first after the PE).

Again, no breaking...grrr.

My main quest: How can I find the OEP....?
Ricardo Narvaja
04-16-2005, 07:48 PM
CreateThread is only for one process (not copymem2) armadillos, and in the more new armadillos don´t work.

The string don´t know how bypass is a message of olly.

If you read all my tutorial in the last armadillo with destruction of table, are the instruction for reapair the bug of illegal instruction of olly.

data or code is the same, is the first section next to header.

the goal is you learn different methods and try for yourself not make a point to point read of the tut, the versions change and all programs are not the same. only learn different possibilities and try, the good unpacker always adapt to the situation.

Ricardo
Snowski
04-16-2005, 09:01 PM
Very true Ricardo...thanks.

I try and combine different options and solutions...your tuts are very handy for this (although I do not speak Spanish).

Repairing the bug in Olly is not the problem. You can do that manually or just use RE-Pair that fixes the buffer overflow vulnerability in OllyDbg.

Finding the OEP is my big challenge...but I hope I get there...I will keep digging, and learning!

:)
Ricardo Narvaja
04-16-2005, 09:27 PM
but this is OTHER bug a ILLEGAL EXCEPTION bug is different

Ricardo
Snowski
04-16-2005, 09:53 PM
Hmmm, indeed, ofcourse...! I must be tired. Been at this all day now.

How can I not see that...thanks!

There is hope... :)
Snowski
04-20-2005, 05:39 PM
Hi Ricardo,

Great news...have been able (finally!) to get the program to break on the point where it starts to write 1000 bytes to the child...!

So it is a COPYMEM-II problem with 1000 bytes method! :)

Thanks for all your help.

When I am done with the unpacking (fixing tables etc), I will post a complete tutorial.
1bitshort
04-21-2005, 02:04 PM
> have been able (finally!) to get the program to break on
> the point where it starts to write 1000 bytes to the child...!

Is that just a breakpoint on WriteProcessMemory?
Snowski
04-21-2005, 02:15 PM
Actually, if you BP first on WaitForDebugEvent, you will land there in BP WriteProcessMemory.

I managed to circumvent the BP WaitForDebugEvent, and now it lands on BP WriteProcessMemory, writing two bytes: EB FE (LOOP!)

If you then hit F9 again, it stops at 60 E8 (again two bytes). I have changed those to EB FE as well...to make the parent looping infinitely.


Bug fix for OllyDump 2.21b

RCE Messageboard's Regroupment > Plugins > Bug fix for OllyDump 2.21b
Parasyte
04-16-2005, 10:10 AM
Hello!
I recently used OllyDump 2.21b to unpack a program, and noticed the Import Rebuild feature contains a bug: When OllyDump calculates the new file size, it will not add the size of the import ordinals in the IID. In some cases (such as mine) the bug will cause the dumped executable to report errors such as "Cannot find <strange filename>.dll" That's because the IID is cut short! I guess the bug is rare enough that it was just never caught during development.

To fix the bug, insert the following into line 1261 of RebuildImport.c:

dwNewSectSize += sizeof(WORD);

Here's what the patched code should look like:

if(strlen(pApi->ApiName) != 0) {
dwNewSectSize += sizeof(WORD);
dwNewSectSize += (strlen(pApi->ApiName) + 1);
}

If you want to quickly patch OllyDump.dll without recompiling the source, you can make a few changes in a hex editor. Go to address 0x00005034, and REPLACE the data with the following:
90 90 90 90 90 90 05 03 00 00 00

Don't forget to backup your copy of OllyDump.dll before trying this.

There it is! Sorry if this has been mentioned before. But I figured I would point it out, in any case.
Ricardo Narvaja
04-16-2005, 04:53 PM
i always say new ollydmps have a problem but i don´t know waht the problem is, thanks.

Ricardo
Ricardo Narvaja
04-16-2005, 06:49 PM
i have the version 2.21.108 the fix is for this version?

Ricardo Narvaja
Parasyte
04-17-2005, 07:32 AM
Yes, that appears to be correct. I downloaded it (OllyDump) from the "Stuph" link at the top of this page.
Ricardo Narvaja
04-17-2005, 09:47 AM
thanks

Ricardo Narvaja
c_a2
04-27-2005, 03:15 PM
@Parasyte

I do that you said and don't work.
Can you tell me please the exatly bytes that I must change ?
sorry my english.
c_a2
04-28-2005, 06:21 PM
@Ricardo Narvaja

Tell me please if you get fix the file and if is work well now
Newbie_Cracker
07-27-2005, 08:13 PM
It has another bug.
When dumping Armadillo packed targets, it screws the header. Because it calculates "offset of PE Signature" wrongfully !
But Loadr PE's dump is perfect.
mr haggar
07-28-2005, 07:47 PM
Thanks Parasyte! I had exactly this problem somethimes after dumping Delphi aps packed with PESpin. Gonna check it now.


Any news about OllyDebug v2 ?

RCE Messageboard's Regroupment > General > Any news about OllyDebug v2 ?
ssb
04-17-2005, 05:36 AM
I wonder, is it still under development or abandoned ?


Break on Keypress???

RCE Messageboard's Regroupment > General > Break on Keypress???
GATO_NEGRO
04-19-2005, 12:30 AM
Hi, i have a problem with an app, this have shortkeys, when im press the shortkey..ALT+F this do a funtion(like all shortkeys, jejeje) ok, the problem its that when im press this shortkey DONT DO ANYTHING, this funtion can be maked with an ICON on the menu bar of the app, then yuo can use the MOUSE(clicking the ICON) or using shortkeys(taht not works, its disabled), only works the ICON using mouse, the shortkey its disabled, i need to find wheres call this funtion to crack it but i dont know what BP use, ive tried with ShowWindow,CreateWindowExA,... but never breaks when press the shortkey........
Any idea?????
Thanks
GRACIAS AMIGOS :)
Ricardo Narvaja
04-19-2005, 08:27 AM
put a BMSG with a parameter WM_GETHOTKEY o WM_HOTKEY.

Ricardo Narvaja
GATO_NEGRO
04-19-2005, 03:47 PM
Thanks Ricardo narvaja,
Do you have a tut to learn to put BMSG???

GRACIAS :)
haggar
04-19-2005, 05:10 PM
>Do you have a tut to learn to put BMSG???

Open help in Olly and find under Breakpoints next quote:

- Message breakpoint is same as conditional logging except that OllyDbg automatically generates condition allowing to break on some message (like WM_PAINT) on the entry point to window procedure. You can set it in the Windows window.
GATO_NEGRO
04-19-2005, 05:15 PM
Thanks Haggar im learn how to work with this BP's :)


EXEcryptor problems

RCE Messageboard's Regroupment > General > EXEcryptor problems
Kavuman
04-19-2005, 10:18 AM
Hey folks,

My sister download this .exe called EXEcryptor and put it on my computer. Now, whenever I restart windows, I get a popup that says "This software protected by UNREGISTERED version of EXEcryptor." It doesn't seem to be harmful but I want to get it the hell off my PC. It's not in Add/Remove programs. Nor can I find a related file in Program Files. I tried a windows search for "EXEcryptor" and found nothing. Any ideas as to what I can do to get it out?
Thanks
haggar
04-19-2005, 05:22 PM
When you get that message, open task manager (Ctrl+Alt+Delete) and search for some process that looks weird to you. Kill it and if message is gone, find that exe via search function.

Or, search in registry for startup entry.

Or, download PEiD and scan whole disk for some file protected by that protector (but this is hard way).

Btw, do you know anything about protectors or you just get here by google? EXEcryptor is anti-cracking program and you have it on your computer, or some other program is protected with demo version of EXEcryptor.
Snowski
04-19-2005, 08:43 PM
I am almost sure that the last is indeed the case Haggar....

Kavuman, ask your sister what she installed on your pc. This could be any program, protected by ExEcryptor.

If she does not know, look at your program folder, and select the programs on date. Then you can see which proggie was installed recently. If that does not work, do a systemwide search for all exe files that were installed X days ago or so. And then uninstall the sucker.... ;)


Problem with program packed with "ASProtect 1.2x - 1.3x [Registered]"

RCE Messageboard's Regroupment > General > Problem with program packed with "ASProtect 1.2x - 1.3x [Registered]"
TresPasser
04-22-2005, 04:47 AM
Hi everyone,

I am new to this forum and I have a question about the OEP of a weird program:

Tracing this program with Ollydbg, I found that the first code being run in the code section is:

00407EB4 E8 4781E800 CALL 01290000 ; call to GetModuleHandle

after this, the code returns to the packer code.
Placing a BPM on the code section, I could see that the program stops many more times on various procs in the code section, but they all return to the packer code until the code at: 0043D480. This seems like a valid OEP, but unfortunatly when this code is run, the main window for the program was already created and many initializations were made, so it is impossible to dump from here.

I have found that the decision of which function to call in the user code is made in a loop in a high memory region (the packer code), but emulating this loop is an ugly process as the values are calculated in a long piece of code.

So, my question is: What am I doing wrong? I have unpacked several ASProtect progs before, but never had any trouble like this.

Any help would be appriciated.

Thanks


DirectDraw Hooking

RCE Messageboard's Regroupment > General > DirectDraw Hooking
bahblahblahbah
04-22-2005, 02:51 PM
I'm trying to turn this game that runs in fullscreen into normal screen.
How can I hook directdraw, esp the primary surface & backbuffer?

Many thx...


stack

RCE Messageboard's Regroupment > General > stack
chris
04-22-2005, 05:35 PM
how would i be able to edit a stack address like the way ollydgb does with an external program like c++ or something?
Lord_Looser
04-22-2005, 08:29 PM
how OllyDbg does it - I don't know

char a='a';
char b='b';
_asm {
lea eax, [a];
lea ebx, [b];
mov eax, ebx;
}


Function to detect if exe is open?

RCE Messageboard's Regroupment > Plugins > Function to detect if exe is open?
duhru
04-24-2005, 11:21 PM
Is there a function to determine if an executable is currently open in the disassembly window?

I'd like my plugin to only display relevant options. If the user does not yet have an executable disassembled, I'd like my plugin to not display some menu options.
duhru
04-25-2005, 01:52 PM
Looks like one way to do it is to call Plugingetvalue(VAL_PROCESSNAME) and ensure that the result isn't a null string.


Are Alt+; and Alt+: valid keyboard shortcuts for a plugin?

RCE Messageboard's Regroupment > Plugins > Are Alt+; and Alt+: valid keyboard shortcuts for a plugin?
duhru
04-24-2005, 11:25 PM
My plugin can't seem to recognize Alt+; and Alt+: keyboard shortcuts. Is this a known limitation of ollydbg?

ODBG_Pluginshortcut is working fine for me with Alt+1, Alt+2, etc.
duhru
06-18-2005, 06:19 AM
Apparently you have to use virtual key codes. For example, the ; key is VK_OEM_1 or the value 186.


armadillo app debugging

RCE Messageboard's Regroupment > General > armadillo app debugging
nick_name
04-25-2005, 08:51 AM
armadillo app settings

================================================== =
Project setting : msgbox

protection options : standard protection only
no import table elimination
no strategic code splicing
no mem.patching protection

softice detection : standard softice detection

interceptions options intercept selected dll
================================================== =

now, i loaded it with olly, put a break point on

Memory map, item 16
Address=00401000 ** F2 = break on access
Size=00001000 (4096.)
Owner=msgbox 00400000
Section=CODE
Type=Imag 01001002
Access=R
Initial access=RWE

the program broke accordingly, and show me the following neat codes ....

00401000 > 6A 00 PUSH 0
00401002 6A 00 PUSH 0
00401004 68 00204000 PUSH msgbox.00402000 ; ASCII "Hello"
00401009 6A 00 PUSH 0
0040100B E8 0D000000 CALL msgbox.0040101D
00401010 6A 00 PUSH 0
00401012 E8 00000000 CALL msgbox.00401017
00401017 - FF25 4C304000 JMP DWORD PTR DS:[40304C] **
0040101D - FF25 54304000 JMP DWORD PTR DS:[403054] **

from the last 2 jumps i found the IMPORTS ,

kernel32->Exitprocess[304C]
user32->MessageBoxA[3054]

now the problems are 2folds :

1. i cant dump the process with lordpe when it break on 401000
2. i used dumper of PEditor by yoda, it dumps the file , but if i try to fix it with ImpRec,
imprec says, cant add any more sections

3. i even tried with olly plugin :

olly debug PE dump by FKMA (v3.01)
olly dumper by gigapede (v.3.00.110)

so, guys, could anyone tell me where i'm going wrong ??
is there any trick that i must play with olly ??
oh me anon
04-25-2005, 03:58 PM
well i dont deal with arma and such but from what you
quote
"imprec says, cant add any more sections "
may be arma has filled the whole peheader with stuff and there is no place to define a new section

try deleting one of the section details and make space for new definition

a peheader is mostly 200 bytes physically 0x3c is pe header
if it starts at 0x100 then filled up till 0x200 then the dumper most probably would find space to write a new section details which should have about 0x28 bytes free space :)
hope you understand what i am thinking


Pe_patch file

RCE Messageboard's Regroupment > General > Pe_patch file
r3l4x
04-25-2005, 07:29 PM
Hello!

I've a file packed with Pe_patch and UPX. I know how I could unpack UPX packed files with ollydbg but what is Pe_patch?

Thanks :)

Regards
joe
04-25-2005, 08:19 PM
What's program doe's it use?
yahia
05-05-2005, 10:53 AM
How did u know that it's packed with Pe_Patch ?
If you checked the file's sections and have seen something like:
.Pe_Patch
so i might be another packer !!!
Try FS Program .It's a good one for your situation r2l4x .....


Help: Problem with BreakPoints

RCE Messageboard's Regroupment > General > Help: Problem with BreakPoints
xcracx
04-27-2005, 11:13 PM
CrackMe:
http://biw.rult.at/crackmes/ad_cm2.zip

i've been cracking this crack me by this tut: http://biw.rult.at/tuts/chainie_adcm2.htm
not patching... keygen hack and when im setting the 3break points..
(every refrence) press F9 then click on the check button

ollydbg is not responding how can i soluve this problem it happens to me almost with all break points

OS: xp pro SP2
Ricardo Narvaja
04-28-2005, 11:37 AM
with all breakpoints in any program? or fail the breakpoints in this crackme only?

Ricardo Narvaja
xcracx
04-28-2005, 04:22 PM
well some programs works fine i think (memory and hardware on hex dump window) but normal (on CPU window) breakpoints by F2 making ollydbg not responding

just gave the crackme + tut for you to check if its my olly problem or the crackme's problem
xcracx
joe
04-28-2005, 08:32 PM
Try to delete OllyDbg and unpack Olly from zip archive or if it don't help You, try download some of other version of Olly.
If there are still problem You must control Your OS (are there problem with other program's?).
xcracx
04-29-2005, 06:01 PM
what you mean by controling my os? i've tried re unpack and olly 1.08
same problem... yes normal breakpoints give me that problem

i'll test it with a friend and post here if its only me
Ricardo Narvaja
04-29-2005, 09:55 PM
i don´t hear in all years a OLLY user with BP problem you are the first in many years.
For this reason users recommend you see your OS (maybe a service interfering with OLLYDBG, maybe antivirus is very strange) you have softice instaled?
Ricardo
joe
04-30-2005, 06:53 AM
Yes, Ricardo has a good idea. Try to disable antivirus check and firewalls ... (only when you test Olly). See WindowsTaskManager -> Performance -> CPU Usage (once I had problem with two firewals 100% CPU Usage). Then see Processes CPU. And try step by step switch off applications.
joe
04-30-2005, 06:58 AM
Which OS You are usinig. And some information about Your computer: CPU frequency, memory ?
xcracx
04-30-2005, 08:31 AM
Win Xp Pro...
my CPU is like 7%-18% normaly..

my firewall is only Winxp Firewall (network connection firewall)
my antivirus is norton antivirus 2000
with legal serial installed ...

Ricardo thats why i gave that tut to check if its the exe please check if theres a problem with that crackme meh

a. Ctrl + N
b. BreakPoint on every refrence (GetDlgItemTextA)
c. F9
d. entering an username + serail then click on Check

here is the problem.. olly is not pop up it just stays the same when i try to make olly the active window it is not respoinding
joe
04-30-2005, 10:08 AM
I tested this Crackme too (under WinXP Pro & Win98). Its works fine and don't have any antidebug tricks. Your CPU usage is good, there isn't problem. Turn off norton antivirus (only for testing Olly): still don't responding?
Ricardo Narvaja
04-30-2005, 10:44 AM
you check the same points he make in the post joe?

a b c d points

a. Ctrl + N
b. BreakPoint on every refrence (GetDlgItemTextA)
c. F9
d. entering an username + serail then click on Check

maybe the crackme check the initial value of the apis and crash OLLY.

you use hidedebugger 1.22 for hide olly, maybe olly is detected and crashed by the program.

Ricardo Narvaja
xcracx
04-30-2005, 02:08 PM
i've tried to disable antivirus still no use...

i know there is no debug protect but its not responding even if i use hidedebug plug

man i really don't know what to do now.. it stucking me.. so badly..
if you can upload your olly on zip (options and stuff) i'll be thankful

xcracx
Ricardo Narvaja
04-30-2005, 02:45 PM
you use hidebug 1.22 or old version?

Ricardo Narvaja
joe
04-30-2005, 03:56 PM
I have Olly v. 1.0.10.0 and can send it, but i disbelieve from problem's description, that it can help You. Did You use only one version Olly (from one link)?
I don't understand why only Olly makes You the troubles. I think, that if only Olly is problematic, than this is solution, else...
My address is jancich@centrum.sk
joe
04-30-2005, 04:44 PM
I had seen problem with xp SP2 in the forum. I don't have SP2! There may be problems (some programs don't works correctly with SP2). Try newest version of Olly!!! I don't known, if is running version 1.0.10.0 of Olly under SP2, by try!
sigint33
04-30-2005, 05:13 PM
I'm running SP2 here and have no problem with Olly and the crackme in the initial post - it almost has to be something you recently installed, or some other change made recently.

SiGiNT
xcracx
05-01-2005, 10:14 PM
i think i need to install some C++ runtimes and stuff like that

i've tried anything that you offered here.. im using the newest version of olly from this website
well i really dont know now but i have to find a solution soon.. may one of you come to my house check it out for 20$? ;P
Ricardo Narvaja
05-02-2005, 10:47 AM
i think in a service (securom, hasp etc than corrupt the work of olly) and is running

Ricardo
Ricardo Narvaja
05-02-2005, 11:16 AM
go to control panel -herramientas administrativas-services (in spanish)

and look the services are running in your computer, maybe you install a application with a antidebugging service (hasp securom, etc there are so much services than corrupt the work of the debuggers)

Ricardo Narvaja
xcracx
05-02-2005, 10:20 PM
ok tnx i'll search for an antidebugging services list

cuz im lost with that one tnx for the help (btw im not spanish lol)
xcracx
05-02-2005, 10:25 PM
ohhh

does ProcessGuard 3.100 has any effect on that?
i'll try to remove it then try again tnx for the help so far

xcracx
Ricardo Narvaja
05-03-2005, 11:14 AM
try an look?

Ricardo
xcracx
05-04-2005, 04:48 PM
nothing works i dunno what to do... i can't format it /: to many important things
damiit its realllly important to me i tried disable antivirus and tried to close Process Guard while setting that breakpoint :\

here is a list of my Processes running(hope it will help)

myie.exe > internet explorer
MSGSYS.exe
WMIPRVSE.exe
ALG.exe
SVCHOST.exe
SMAgent.exe
SLEE91.exe
RTVSCAN.exe
DEFWATCH.EXE
DCSUserProt.exe > part of Process guard
ICQ.exe > chatting program
GigAlarm.exe > soft for alams.. like Rest at 2:00
QuickTV > tv watching soft for my computer tv
CFTMON.EXE
MSNMSGR.exe > messenger
Babylon > ver 5
ATIPTAXX.EXE > Ati radon graphic card supporter
pgaccount.exe > Another part Of Proccess Guard
VPTRAY.EXE > Norton AntiVirus 2000
EXPLORER.EXE
Ati2evxx.exe > another thing that connects to My radon
SPOOLSV.EXE
SVCHOST.EXE x5
Ati2evxx.exe > again
LSASS.EXE
SERVICES.EXE
WINLOGON.EXE
CSRSS.EXE
SMSS.EXE
WDFMGR.EXE
System
System Idle Process
haggar
05-04-2005, 08:24 PM
This crackme was one of my first that I solved and I can tell you that there are no tricks in it. Simple small ASM crackme. Problem is either in your system, programs installed or olly.
oh me anon
05-05-2005, 07:06 AM
what is slee91 ( a brief google shows no hits on that name as an exe however there is a a jsr (java specification request )
JAINTM Service Logic Execution Environment API Specification
do you know this slee91 ??

btw if you think you have some problems in your installations (these boards might help resolve your problem though mostly they cater to
malware spyware issues and unwanted popups and such

bleepingcomputer.com --> grinler has some excellent tutorials on his site
forums.spywareinfo.com
tomcoyote.org
subratam.org
castlecops.com
gladiator-antivirus.com

all of them also hosts online chat applets where some of thier board members tend to be present almost in all time zones
you would be asked to run hijack-this (merijns) and post a log
and one of the the members will take over from there
hope you get your problem resolved
hosiminh
05-06-2005, 09:17 AM
You didn't disabled rtvscan.exe

http://www.liutilities.com/products/wintaskspro/processlibrary/rtvscan / (http://www.liutilities.com/products/wintaskspro/processlibrary/rtvscan/)
oh me anon
05-06-2005, 10:53 AM
nope rtvscan is part of norton
realtimevirus scan it doesnt interferE with ollydbg operation i ve been using norton corporate for more than a year now along with ollydbg

i just looked at your link what do you mean disable it HOSIMINH liutil also says it is norton and recommends not to terminate did you read your link contents ??

Description:
rtvscan.exe is an executable of the Symantec Internet Security Suite. It is responsible for the execution of real-time virus-scanning in order to detect virus infected files as they enter your system. This program is important for the stable and secure running of your computer and should not be terminated.
Ricardo Narvaja
05-06-2005, 02:40 PM
but you close process guard GUI but you are sure the service is stopped? I only trust if a service is stopped when go to services list and change to disabled.

This services can let corrupt the IDT and make the olly fail, and you can close the services and the IDT remains corrupt, closing the services the IDT remain bad

UNISTALL this program, disable service and restart and try
Ricardo
MANiAC
05-06-2005, 03:33 PM
Phear my leet keygen:

http://rapidshare.de/files/1607300/k3gen.rar.html
Beta
08-05-2005, 05:24 PM
Had the same problem as you.Turns out there was ghostkeylogger
and i just have to terminate process SyncAgent.i know it isn't in your process list but makbe you have a similar program?try terminating all non system processes one by one


A very newb question about step in and step over

RCE Messageboard's Regroupment > General > A very newb question about step in and step over
ilove2
04-30-2005, 02:29 AM
I just start learn how to use ollydgb, I want to see the serial code at 004010A3 . 807C24 12 77 CMP BYTE PTR SS:[ESP+12],77
but every time I step in or step over to
0040109D . 0F85 12040000 JNZ KGNME-6.004014B5
it jump to somewhere else, but I need to step into 77 and 70 in order to get my complete serials, is there anyway to do that ?

here is the code:

00401085 . 6A 1E PUSH 1E ; /Count = 1E (30.)
00401087 . 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] ; |
0040108B . 52 PUSH EDX ; |Buffer
0040108C . 68 F1030000 PUSH 3F1 ; |ControlID = 3F1 (1009.)
00401091 . 56 PUSH ESI ; |hWnd = 00360278 ('-=( KeyGen Me 6 )=-',class='#32770')
00401092 . FF15 DC704000 CALL DWORD PTR DS:[<&USER32.GetDlgItemTe>; \GetDlgItemTextA
00401098 . 807C24 13 72 CMP BYTE PTR SS:[ESP+13],72
0040109D . 0F85 12040000 JNZ KGNME-6.004014B5
004010A3 . 807C24 12 77 CMP BYTE PTR SS:[ESP+12],77
004010A8 . 0F85 07040000 JNZ KGNME-6.004014B5
004010AE . 807C24 15 70 CMP BYTE PTR SS:[ESP+15],70
004010B3 . 0F85 FC030000 JNZ KGNME-6.004014B5
004010B9 . 68 A4724000 PUSH KGNME-6.004072A4 ; /Text = "Level 1 - d0ne"
Ricardo Narvaja
04-30-2005, 10:49 AM
well 72 is the letter r, maybe is looking if a letter of your fake serial is a r or bad boy.
Look in [esp+13], [esp+12] etc what values are.
Ricardo Narvaja
ilove2
04-30-2005, 06:08 PM
that is a source code from crackme,
I know the other 2 real serials is in [ESP+12] and [ESP+15], but every time I step to 0040109D . 0F85 12040000 JNZ KGNME-6.004014B5 (which is jump if not equal to ) it jumps to other place instead keep going down to 004010A3 . 807C24 12 77 CMP BYTE PTR SS:[ESP+12],77
I try to use step into or step over but they just don't go down
oh me anon
05-01-2005, 06:07 PM
jnz == jne == jump if not equal or not zero will jump

so it checks if the byte ptr at [esp+13] == 72 (r) if it is not equal then it will jump to 4014b5
if it is equal it will go down to the next comparison
checks if the byte there is == 77 (w) if it is not equal it will jump to 4014b5 else it will go down to next comparison and so on and so forth
so as ricardo advised check what bytes are there in [esp+ ###]

btw these bytes are probably not filled by the GetDlgItem coz it pushes
[esp+14] as buffer address
ilove2
05-02-2005, 04:50 AM
so how I check them, I have to step in them right, my question is HOW DO I STEP THERE, every time I step to the first JNZ then I press STEP OVER OR STEP INTO it jumps to somewhere else instead go down to next function
Ricardo Narvaja
05-02-2005, 10:44 AM
first of all

go to debugging options in OLLY and check this marks

in

CPU mark

SHOW DIRECTION OF JUMPS
SHOW JUMP PATH
SHOW GRAYED PATH IF JUMP IS NOT TAKEN
SHOW JUMPS TO SELECTED COMMAND

with this when you reach a conditional jump you see a red arrow if the jump is taken and a gray arrow if the jump is not taken

when you reach the conditional jump of the example and the JUMP will BE TAKEN (RED) go to the registers window and change the flag in this case Z flag

double click in Z flag and the arrow is gray and the JUMP is not taken

continue tracing

Ricardo Narvaja
ilove2
05-03-2005, 02:25 AM
I follow what you told me and it is kind mess up, take a look at the code

00401092 CALL DWORD PTR DS:[<&USER32.GetDlgItemTe>; GetDlgItemTextA
00401098 CMP BYTE PTR SS:[ESP+13],72 ;72=='r' ( I have to set a break point here instead at getdlgitemte, flag Z set to 1)
0040109D JNZ 004014B5
004010A3 CMP BYTE PTR SS:[ESP+12],77 ;77=='w' (same thing, other break point, flag Z set to 1)
004010A8 JNZ 004014B5
004010AE CMP BYTE PTR SS:[ESP+15],70 ;70=='p' (same, 3rd break point, flag Z set to 1)
004010B3 JNZ 004014B5

I don't know what is flag Z stand for but I follow what you but I have to change the number from 0 to 1 or 1 to 0 to jump to other function
gabri3l
05-03-2005, 02:58 AM
Okay, In a debugger Step Into means Step through the code and INTO any calls you encounter.
Step Over means Step through the code and OVER any calls you may encounter. When the program Steps Over the call it doesn't mean that the code inside the call is not executed. It just means that you aren't stepping through all the code inside that call.

What you want to do is actually change how the program executes the code. By "stepping over" a Jump. In this case Olly's Step Over command does not mean Ignore a command and go to the next one.

To do what you want to do you need to change your Origin.
Step over the code until you reach the JNZ
Select the line directly under the JNZ and Right-Click
Choose "New Origin Here"
There you go you have "stepped over" the Jump.
Ricardo Narvaja
05-03-2005, 11:13 AM
is the same change the value of Z in the registers (from o to 1 or viceversa) you change the destination of the JNZ if jump to not jump or not jump to jump

Ricardo Narvaja
ilove2
05-05-2005, 12:19 AM
Thank you gabri3l, I follow what you told me and I successfully get the serials

and thank you to ricardo narvaja, to teach me that mcuh stuff, before I only know how to look for JNZ JZ and change them to others, now I know little about how to get the serials. It seens ollydbg is more powerful than I thought


How to watch a specific range of memory ?

RCE Messageboard's Regroupment > General > How to watch a specific range of memory ?
Xtra
04-30-2005, 09:49 AM
Hi all !

I was wondering how I can monitor data *changes* withing a specific memory range.
Any idea ?
thx
Ricardo Narvaja
04-30-2005, 10:46 AM
pot a MEMORY BREAKPOINT ON WRITE in this range of memory if you don´t want OLLY stop, write a little script tjam store the change in the log and make olly continue RUNNING.

Ricardo
Xtra
05-01-2005, 06:59 AM
Yep, that what's exacly what I've been looking for!
Thx


ApiBreak - New Ollydbg Plugin

RCE Messageboard's Regroupment > Plugins > ApiBreak - New Ollydbg Plugin
Nonameo
04-30-2005, 03:44 PM
Hey guys, i was debugging the other day and had an idea that i think would make it just a little bit easier for me.

So i decided to make the idea into a plugin

Its almost complete, it will probably be finished later today, but then i'll have to do some final testing.

The plugin:
My plugin lists some commonly used api calls, sorted into 6 groups. The user can quickly and easily put a breakpoint on the entrypoint to one or more of these functions.

For example:
User wants to trap all calls to RegQueryValueA, this can be done very easily without having to seach for this in "Intermodular Calls"

The 6 groups are:
Registry
Time
Dialog
Memory
Strings
Point H

Time will have things like "GetLocalTime"
Dialog will have things like "SendDlgItemMessage"
Memory will have things like "VirtualProtect"
Strings will have things like "lstrcmp"

Any suggestions would be appreciated

Thanks

-Nonameo-
Nonameo
05-01-2005, 10:57 AM
Well here it is.

Includes the plugin and help file

Enjoy

-Nonameo-

http://nikt.zog.net.au/ApiBreak.rar
1bitshort
05-01-2005, 11:54 AM
i hate to sound like a party pooper but i dont see how a plugin can simplify something that is already so simple! :)
To breakpoint on an API function its easy enough just to hit Ctrl+G (Goto Address), then type in the API name like VirtualProtect and Olly will take you there. F2 to set the breakpoint. Couldnt get much easier than that!
Anyway good work and i hope i havent discouraged you from making other plugins, im sure some will find your plugin helpful
Nonameo
05-01-2005, 02:25 PM
yea, well if anything, this was a major learning experience as far as MASM goes. even if no one uses it, i've got my foot in the door to make more stuff.

Thanks

-Nonameo-
1bitshort
05-02-2005, 02:39 AM
Then it was well worthwhile :) Now that youve made one plugin hopefully the floodgates will open!
Grumper
05-02-2005, 10:10 PM
Hi, a very good plugin and usefull.
It helps a lot, not to set the bp by hand

But just one thing:

Is it possible to set Bp on more than one group, without "Start" the
plugin again.
Because whenever i set a bp on a group the plugin closes.

Oh and you should read the posts on exetools forum (Software)
I like the idea with the ini ( if it is possible)
haggar
05-03-2005, 08:57 PM
It's not some big thing, but it's good thing for lazy peoples like me who don't want to open modules window every time when wanting to place toggle bp.

Add CreateFileA and couple more,.
Grumper
05-03-2005, 10:57 PM
Just: One more thing ( if it is possible)

Some protectors emulate the first Commands of evey APi, so whenever

they use the API they jump directly to the "middle" of every APi and not to the EP.

So of course our BP won`t work, even if the app uses the API

So if it is possible, it will be a good idea to have the possibility not to set the BP on the EP of the APi but some bytes after it.

Regards
1bitshort
05-04-2005, 09:49 AM
> So if it is possible, it will be a good idea to
> have the possibility not to set the BP on the
> EP of the APi but some bytes after it.

Two problems with attempting to automate that process ...

1) It would only be possible if the plugin used a disassembler (or instruction length disassembler like LDE32), because the plugin would need to know that the byte "in the middle of the API function" that it's breaking on is the start of an instruction - you can't set a breakpoint in the middle of an instruction, that just corrupts the code.

2) Some functions are very short. Consider GetCommandLineA for example:
7C812C8D A1 F435887C mov eax,[7C8835F4]
7C812C92 C3 retn
So in this case it would also need to disassemble and analyse the code (like Ollydbg does) to recognise where the function physically ends. The alternative to that is to assume that API functions are at least 2 instructions long and always set a breakpoint on the 2nd instruction, but if protectors "emulate the first few instructions of API functions" then that defeats that also.

In other words - don't even bother. ;)
Fumio
05-13-2005, 03:00 AM
I believe your plugin will be useful, however It will not appear in my plugin menu. Yes I have placed Apibreak.dll in olly file.
Any suggestions on what I could be doing wrong?
Regards Fumio
Nonameo
05-14-2005, 05:12 PM
thats weird, i havent had anyone else having this problem..

are you using an old version of olly ?

it needs to be 1.08 or higher

hope this helps

-Nonameo-
Fumio
05-17-2005, 01:56 AM
Hi Nonameo,
Thanks for the reply. I had been using Olly 1.10 (step 2) and have now downloaded latest version and APIBreak initializes. Thanks for your help.
Fumio
pedram
05-17-2005, 04:46 AM
Nonameo,

Interesting plug-in concept. Definetely useful. This functionality can also be achieved by creating the relevant breakpoint sets for OllyDbg Breakpoint Manager available from the stuph page.

-pedram
HAANDI
10-13-2005, 07:26 PM
Hi, that one is a really nice Plugin but doesnt cantain some functions I often need.
The SendMessageA and SendDlgItemMessageA have to have a Contidion MSG==WM_GETTEXT, because so they break to often.
THen there has to be a CallWindowProcA MSG==WM_GETTEXT.
For strings in vb a also need __vbaStrCmp.
Epsylon3
11-02-2005, 10:12 AM
with OllyScript :

// === break on load module ===
var handle
// trouve l'adresse de la fonction
gpa "LoadLibraryA","kernel32"
// stocke l'adresse de la fonction
mov handle,$RESULT
// pose un breakpoint
bp handle //or bphws handle,"x" (hardware bp)

So you can do that easily, for groups, you can also use several subscripts with #INC group_script.txt


problem with xp SP2

RCE Messageboard's Regroupment > General > problem with xp SP2
tq6643
04-30-2005, 04:09 PM
hi everybody...

i'm not speaking good english but i'm going try to explain my problems.

i'm realy newbie about cracking. I downloaded many programs and i start to keep some tutorials.

it was good at the begining. Than, in ollydbg after the breakpoints my computer is blocked. I couldn't understand why.. i tried with other crackme's but it was same. Each time just after breakpoint my computer is blocked.

And now i don't know what i must do? How can i make to work ollydbg on my pc?

i have
Xp pro Service Pack 2
Amd Athlon 2400 Xp 2.00 ghz 512 mb
Geforce mx 5200

help me please.

thanks
tq6643
05-01-2005, 06:55 PM
i restart my computer in safe mode and ollydbg worked good... But why normally it's not working?

please help!

thanks.
Ricardo Narvaja
05-02-2005, 10:49 AM
is not sp2, i have sp2 and olly work perfect, there are other problem (antivirus, services running) etc

Ricardo
1bitshort
05-02-2005, 12:35 PM
Try reinstalling Ollydbg, it only takes a minute and has fixed quite a few of my past Ollydbg problems
oh me anon
05-02-2005, 01:35 PM
hehe sp2 has become the scape goat for all ills :)

no it is not a problems of sp2 i have run ollydbg successfully in xp-sp2
it is in no way an impediment for olydbg so go find the actual problem rather than blaming sp2
hosiminh
05-02-2005, 02:59 PM
If you use some firewall as Kerio , that might be a problem if it's not properly configured 'coz it block some program to be executed. Personally i uninstalled it (Kerio FW) after 30 minutes.


set a BP on ResumeThread?

RCE Messageboard's Regroupment > General > set a BP on ResumeThread?
HEAT84
05-01-2005, 05:32 AM
I'm not programmer (wish I was). I'm following these instructions for diong something in OllyDbg and one of them says to set a BP on ResumeThread. I know BP means breakpoint but I can't find anything about a Resume Thread.
HEAT84
05-01-2005, 11:31 AM
Nevermind. Well, I might as well confess. My question was cracking related. But I'm betting you already knew that since my thread seemed to be ignored (although its only been 6 hours). Like that thread where someone was dumb enough to come right out at say they needed cracking help. What a waste of 2kb of HD space this thread (and that one) is on some server somewhere.
Ricardo Narvaja
05-02-2005, 10:55 AM
in the command bar type

BP ResumeThread

or go to right click-names in this module, search for the api reasumethread and whan you found put a BP with F2 or with the right click menu.

Ricardo Narvaja
1bitshort
05-02-2005, 11:00 AM
> or go to right click-names in this module, search for
> the api reasumethread and whan you found put a BP
> with F2 or with the right click menu.
Ctrl+G is much faster :)

Heat84:
1. press Ctrl+G (for Goto)
2. type ResumeThread (or other address or function to go to)
3. press F2 (to set breakpoint)
1bitshort
05-02-2005, 11:01 AM
My question was cracking related.
ahh, sorry. didnt see that. please ignore my previous post then
oh me anon
05-02-2005, 01:39 PM
well it was sarcasm i would presume rather than having any other relationship with cracking wanted to have immediate gratification so 6 hours is rather too long and
help file hehe what the heck why do you have boards to tell us to read help files booooooooo
1bitshort
05-04-2005, 12:23 PM
-


Damn I really need Going back???

RCE Messageboard's Regroupment > General > Damn I really need Going back???
Xtra
05-02-2005, 02:32 PM
Hi,
I'd like to know if it is possible to go back with olly, (kinda "step backward", until some level of course...) to find the exact source of error

Here's the exact problem:
I'm making a quite complex app, based on heavy random factors and with lot of interractions between them, etc
Not surprisingly there's some rare bug that occurs in a mysterious condition.
So I'd really like to go back to dat bug.
Hope I went clear...

Regards,
Xtra
Ricardo Narvaja
05-02-2005, 02:41 PM
make a TRACE INTO this point and store in a txt file the result, and if you trace and stop in a point you can step backwards for all lines executed by pressing the key minus (-)

Ricardo Narvaja
Grumper
05-02-2005, 10:14 PM
what about the stack window.

Isn´t the source/adresse of the error excactly shown there?
( Perhaps you have to look backward)
Xtra
05-03-2005, 09:50 AM
Hi Ricardo Narvaja,

It should work that way, though it's pretty slow ;)

Thanks for helping me.
Ricardo Narvaja
05-03-2005, 11:16 AM
well you need reach the more close point to the bug and trace from this adress not from the start of the program.

Ricardo


n00b : help enterpreting debug

RCE Messageboard's Regroupment > General > n00b : help enterpreting debug
abitofboth_
05-02-2005, 11:33 PM
I got this program.. it has a two session max... i wanna defeat that..
I've pinpointed the problem to be here

004f9154 CALL DWORD PTR DS:[545E40] (olly : USER32.ShowWindow)

From here the code will run into USER32, kernel etc.
Now the 'problem' is when it returns, it doesnt do it to the successive address (004f915a), depending on whetether its successfull or not, it will return to either 004f914b (success) OR 004fd1bf (wich is the deathtrap)

Now.... I dont get how a call to user32.showwindow can have an impact on the next instruction to be executed... so to speak.. I think of it in terms of

1 do somethig
2. return
3. call 1.
4. do something else

eip = 3 and we would go 3,1,2,4 ... right ? Obviosly not .. perhaps someone has the patience to explain it to the n00b ?
oh me anon
05-03-2005, 08:02 AM
the flow may not necessarily be linear it all depends on how it is coded

for example try assembling this with masm or use ollydbg inline assembing feature and step through you will see it will never reach the exitprocess :)

.CODE
infinite_routine:
pop edx
start:
push labeltrick
retn
labeltrick:
call infinite_routine
labelneverreach:
invoke ExitProcess,NULL
end start

here is disassembly
00401000 POP EDX
00401001 >PUSH timepass.00401007
00401006 RETN
00401007 CALL timepass.00401000
0040100C PUSH 0
0040100E CALL <JMP.&KERNEL32.ExitProcess>

does you 3,1,2,4 work on above code :)

as far as window creation is considered all windows will have a message loop which waits for messages if it gets notified of a message the loop checks if the message is from the window it is supposed to be or is it from some other window if it is from window that it is supposed to be then it
translates it and sends it to winproc else it will discard the message and loop again waiting for message
==============================================
v--------------------------------------------------------------------- ---------->|
|------------msg from my window --->translate--->send to winproc--->|
v
getmsg <
^
|-------------msg from other window--->|
^------------------------------------------<|
==============================================

now winproc is registered using RegisterWindowClass
this winproc will handle all messages
so you have to look in winproc to ascertain behaviour
oh me anon
05-03-2005, 08:06 AM
the flow may not necessarily be linear it all depends on how it is coded

for example try assembling this with masm or use ollydbg inline assembing feature and step through you will see it will never reach the exitprocess :)

.CODE
infinite_routine:
pop edx
start:
push labeltrick
retn
labeltrick:
call infinite_routine
labelneverreach:
invoke ExitProcess,NULL
end start

here is disassembly
00401000 POP EDX
00401001 >PUSH timepass.00401007
00401006 RETN
00401007 CALL timepass.00401000
0040100C PUSH 0
0040100E CALL <JMP.&KERNEL32.ExitProcess>

does you 3,1,2,4 work on above code :)

as far as window creation is considered all windows will have a message loop which waits for messages if it gets notified of a message the loop checks if the message is from the window it is supposed to be or is it from some other window if it is from window that it is supposed to be then it
translates it and sends it to winproc else it will discard the message and loop again waiting for message
==============================================
v--------------------------------------------------------------------- ---------->|
|------------msg from my window --->translate--->send to winproc--->|
v
getmsg <
^
|-------------msg from other window--->|
^------------------------------------------<|
==============================================

now winproc is registered using RegisterWindowClass
this winproc will handle all messages
so you have to look in winproc to ascertain behaviour
abitofboth_
05-03-2005, 10:43 AM
omg .. my head hurts lol .. i get your point... sorta... given me some ideas..

another note ; debugging the app, sudenly i see this on the stack
VNCHOOKS.00CC15C0

What ? what's vnc doing inthere ? yes, i get got vnc running on the box... is it VNC that injects/hooks processes to better grab their graphics, or should i be worried lol ? ;)
abitofboth_
05-03-2005, 12:38 PM
would you estimate you're on the right track when the 'third session' throws an ACCESSVIOLATION READING BAADF011

?? lol
abitofboth_
05-04-2005, 10:04 PM
Thanks to all who helped me ... especially "Ricardo Narvaja"

it turned out to be a mutex ... i simply rename it before its created to.. whatever, and all is good !!


load exe with parameters

RCE Messageboard's Regroupment > General > load exe with parameters
bOU
05-03-2005, 05:53 PM
i have a game i want to dbg, but the exe' loads an updating client first, then the updating client runs the game and at that point olly terminates.

but i can bypass the updclient, and go straight to the game but i need to shove in a parameter, i.e .exe -parameter;

is there a way to open up exe's with olly using parameters?

sorry if its a noob q' ;X any help apreciated!
TBD
05-03-2005, 06:06 PM
Debug|Arguments


Ricardo ayudame please

RCE Messageboard's Regroupment > General > Ricardo ayudame please
neonemek
05-05-2005, 01:50 AM
Estoy liado con un share, que porsupuesto tiene antidebuger.

Weno la historia es que este share no lo ejecuta un exe lo ejecuta un nsi, bueno me digo no es problema lo atacho, bien ejecuto el programa bajo win xp y me sale una aplicacion nmain que es el programa corriendo ya la kiero atachar y no me deja, hago click en boton comprar, y sale una segunda ejecucion cfgwiz, la atacho y tampoco error.
Todo esto bajo XP y probe otras ejecuciones diversas y me las carga sin problemas.

Me paso a win98, y aki si me deja atachar cualkiera de las dos tanto la nmain como la cfgwiz, pero me detecta siempre el ooly he probado y leido de todo llevo 5 dias, desde cambiar el nombre como Ricardo dice al olly comprimirlo etc... ,, plugin como isdebugger,, hide debug,, scripts para la maldita funcion del kernel que es la que me esta dando guerra DebugBreak(). Bueno como digo he probado de todo, bajo win98 que es cuando puedo atacharlo, pero me detecta el debuger siempre, incluso ollyghost, nada impide su detetcion.

Como puedo arrancar y debugear en XP este programa, que ya dije que lo ejecuta un archivo *.nsi que hara una llamada a nmain, le pasa unos datos ejecuta nmain que es el programa, y encima si doy al boton comprar, ejecuta una segunda aplicacion cfgwiz.

Estoy ya de los nervios, y con dolor de espalda de tanto probar y leer ;-).

Weno espero que con los datos aki expuestos, tengais para ayudarme saludos. No pongo el programa que quiere mirar, porke no se si se incumplen la reglas del foro. Pero con lo dicho no sera muy dificil adivinar de que se trata, al menos la empresa que lo hace.

P.D. ademas pa mas inri este programa no tiene ni crack ni keygen en la red, y me estraña porque es archiconocido, version 2005. y he buscado mucho creedme.
Ricardo Narvaja
05-05-2005, 12:00 PM
Nmain is a RING0 service in XP you can work with olly only softice or other RING0 debuggers, in w98 is more complicated, isdebug and hidedebug are for NT/2000 or XP not for 98, the only for hide ollydbg in 98 is ollyghost but i think is better cracking in xp (for me je)

Ricardo


How to find specific instruction?

RCE Messageboard's Regroupment > General > How to find specific instruction?
CFSworks
05-06-2005, 07:56 PM
I need to find an ADD where one of the numbers being added is '84'. How do I do that? Could someone give an example, please? Thanks in advance.
haggar
05-06-2005, 08:09 PM
You can writte script for OllyScript plugin that will find first such opcode or all ADD opcodes and wrote their addresses in log window.

You said that added number is 84. To what is added? To register, memory address...?

This is one example; if you want to find:

0040170B 05 84000000 ADD EAX,84

then script goes (search in whole code section where, for example, code section starts from 401000)

findop 401000,#0584000000#
msg $RESULT
ret

This script will find first ADD EAX,84 opcode starting from 401000 address and it will display in MessageBox it's offset.

Read readme.txt which comes with Script plugin and ou will very fast learn how to write scripts.
oh me anon
05-07-2005, 11:36 AM
right click --> search for constant -- type 84 press ok it will show the
first occurance keep pressing ctrl+ L for all other occurances or till the memory blaock ends


NonaWrite - New Ollydbg Plugin

RCE Messageboard's Regroupment > Plugins > NonaWrite - New Ollydbg Plugin
Nonameo
05-06-2005, 08:09 PM
well.. 1bitshort said now that now i've made 1 plugin, hopfully the floodgates will open, and they have :)

NonaWrite is a plugin that helps you write code injection

Lets say for example you have just written 10 lines of instructions using the Assemble command. You step through it and noticed that you need to insert line just after line 2

Now you have to copy lines 3 - 10.
Insert your line
Then restore those lines just after your new one

NonaWrite is essentially a multiline editbox which you can write your code in. If the above situation occured, you could simply insert your line in the editbox, then press the "Assemble" button on it and your code would be automatically changed.

The plugin is almost complete, i just need to add a couple more features and it should be done soon

Features include:
Code Assembler (as above)
String Assembler (syntax is: $ "my string" this will also add the null)
Open / Save previous code to / from .txt file
Comment support
Calculate String Offsets: (this one is very useful, i'll explain more about it later)

The only problem so far is when using jmp and call. when i use the olly api "Assemble", it seems to give back the opcode for the jump, but not the whole set of bytes to write.

Does anyone know how i can use Assemble with jmp & call so it gives me back the exact bytes to write to mem. my way of working it out manually is proving a bit fragile

Thanks

-Nonameo-
Ricardo Narvaja
05-06-2005, 08:50 PM
well, you cannot put the download link do yu have a download link?

Ricardo Narvaja
Nonameo
05-06-2005, 08:53 PM
Sorry Ricardo, its not quite finished yet. Soon

-Nonameo-
Ricardo Narvaja
05-06-2005, 09:22 PM
sorry

Ricardo Narvaja
garryw
05-06-2005, 10:12 PM
Hey Nonameo now that will be a useful plugin, save me having to have all those jic nop's, look forward to the realease.
Nonameo
05-07-2005, 02:29 PM
Ok its release time..

Everything should be in place.

PLEASE read the help file before using it. There is some syntax which you must use for specifying addresses etc...

Any comments / ideas / problems: post here.

Thanks

Enjoy

-Nonameo-

http://elite-tek.com/~nonameo/NonaWrite.rar
Nonameo
05-10-2005, 07:31 PM
Version 1.1 out now

All jmp / call problems fixed

-Nonameo-

http://4-0-4.info/other/NonaWrite1.1.rar
Nacho
05-24-2005, 12:54 AM
Link is not working
Post a new link please.

Nacho
Ricardo Narvaja
05-24-2005, 09:29 AM
yes the link don´t work at all, do you have other?

Ricardo Narvaja
gabri3l
05-25-2005, 02:42 AM
I uploaded it here:

http://rapidshare.de/files/1965181/Nonawrite1.1.rar.html
Ricardo Narvaja
05-25-2005, 12:06 PM
thanks

Ricardo Narvaja
Ricardo Narvaja
05-25-2005, 12:08 PM
thanks

Ricardo Narvaja
Nonameo
05-30-2005, 12:41 PM
Sorry about that guys, i've been away.

Thanks for uploading that gabri3l, i appreciate it :)

New link: http://nonameo.elite-tek.com/NonaWrite1.1.rar

I've started on getting a few more bugs out for version 1.2, thinking about adding syntax hilighting

Thanks again

-Nonameo-
Ricardo Narvaja
05-30-2005, 02:15 PM
your plugis are great, and a very good job

Ricardo Narvaja
Nonameo
05-30-2005, 08:19 PM
Thanks Ricardo, thats good to hear.

Do you use MSN ?

Feel Free to add me

Mighele@gmail.com

-Nonameo-
Ricardo Narvaja
05-30-2005, 10:49 PM
I add to my msn list thanks

Ricardo Narvaja
Nonameo
06-02-2005, 06:17 PM
Update:

NonaWrite 1.2 nearly ready

Massive improvments on the editbox, it now uses the RAEdit control by KetilO. Syntax hilighitng supported, line numbering, saving improved and more..

Release coming soon

P.S. I emailed the guy who runs the "Olly Stuph" page about NonaWrite, but have had no reply, can anyone mention it to him ?

Thank you

-Nonameo-
Nonameo
06-04-2005, 12:30 AM
Ok here it is, Version 1.2

Please report any bugs to Mighele@gmail.com

Thanks

-Nonameo-

http://nonameo.elite-tek.com/NonaWrite1.2.rar
Ricardo Narvaja
06-04-2005, 01:57 AM
Thank i test and tell you.

I´m downloading now

Ricardo Narvaja


How to set breakpoints in called EXE file

RCE Messageboard's Regroupment > General > How to set breakpoints in called EXE file
alan
05-07-2005, 07:29 AM
I'm a complete newbie. I wanted to crack a demo protection as follows:

1) Ctrl-F2
2) F8 until the nag screen appears.
3) Set breakpoint on currently highlighted call.
4) Ctrl-F2
5) F9 to arrive at breakpoint.
6) Remove this breakpoint.
6) F7 into the call.
8) F8 until the nag screen appears.
9) Set breakpoint on currently highlighted call.
10) Ctrl-F2
11) And so on. So hopefully the breakpoint moves closer and closer to the nag screen code.

The problem is that the code eventually calls a second EXE file. Any breakpoints that I set in the second EXE file are removed from the breakpoint window after each Ctrl-F2.

Of course, if I now try to open the second EXE as a new file in Olly, then the environment is completely wrong (stack, registers, and so on).

Can someone please tell me how to set breakpoints in the second EXE file. I searched the posts back to Jan 04.

Regards,
Alan
Ricardo Narvaja
05-07-2005, 11:58 AM
olly manage the actual process, if create other process you need put a bp in CreateProcessA and change the flag to 4 for CREATESUSPENDED and reach the RET of the api, look the EP and put a INFINITE LOOP in the EP of the new process, next with process manipulator put the process to RUN, and attach with other olly.

You are un the EP pause, quit the infinite loop and continue debugging this new process.

Ricardo
alan
05-07-2005, 09:15 PM
Thanks for your answer Ricardo. I've spent all day trying to understand it. The only bit I can do (I think) is to put "bpx CreateProcessA".

How do I "change the flag to 4"? Does "4" mean "0000 0100"?

How do I "put a INFINITE LOOP"?

What does "attach with other olly" mean? If I have the parent process in one Olly, and the child process in the other Olly, do I click "Attach" in the parent or in the child?

Regards,
Alan
Ricardo Narvaja
05-08-2005, 12:47 AM
Not Bpx put

Bp CreateProcessA

when stop look the parameters in the stack (this is a example creating a process named license.exe)

0012FF9C 00426090 |ModuleFileName = "License.exe"
0012FFA0 00000000 |CommandLine = NULL
0012FFA4 00000000 |pProcessSecurity = NULL
0012FFA8 00000000 |pThreadSecurity = NULL
0012FFAC 00000000 |InheritHandles = FALSE
0012FFB0 00000004 |CreationFlags = CREATE_SUSPENDED
0012FFB4 00000000 |pEnvironment = NULL
0012FFB8 00000000 |CurrentDir = NULL
0012FFBC 0040605E |pStartupInfo = 9aloader.0040605E
0012FFC0 0042605A \pProcessInfo = 9aloader.0042605A

If you look the parameter CreationFlags is in 4 (CREATE SUSPENDED) when you reach the bp this value will be in zero, right click in this parameter, MODIFY and put the value 4.

Next EXECUTE TILL RETURN

when you reach the RET you need put a infinite loop in the EP of the new process, look the name of the file, look previously with peeditor the Entry Point.

Open PUPE and go to Patch and put the adress of the OEP, and look the values in tjis adress (NOTE THE ORIGINAL VALUS IN A PAPER), and change for EB FE and click patch.

With this the program have a infinite loop in the entry point and when you quit the suspended mode will be looping in this adress.

Use ProcessMemoryManipulator and in the list of the process, look the name, and select RESUME, and the process will be RUNNING LOOPING.

The last part open OTHER OLLY INSTANCE and go to ATTACH and select the name of the new process and atach and when stop in DEBUG BREAK, press RUN again, and next pause.

You are un the EP, change the bytes for the originals of the EP and continue debugging.

DON´t CLOSE the FIRST OLLY ONLY MINIMIZE
Ugh this is a tutorial jeje if you read tutorials with imagen you understand more i think

Ricardo Narvaja
alan
05-08-2005, 07:51 AM
Thank you for your very detailed reply.

The nag window appears before I get to the breakpoint "CreateProcessA".

This is what happens:

I use F8 to set breakpoints further and further into the program.

If the programs are PARENT.EXE and CHILD.EXE, then all the calls are similar to:

CALL PARENT.nnnnnnnn

All these calls can be breakpointed.

Eventually, I arrive at calls such as:

CALL CHILD.nnnnnnnn

When I breakpoint this call, then press CTRL-F2, the breakpoint disappears from the "Breakpoints" window. All the previous breakpoints remain in the "Breakpoints" window.

(The child calls are actually listed as:
CALL nnnnnnnn

After the call is executed, the line in Olly changes to:
CALL CHILD.nnnnnnnn )

The assembly listing looks as if PARENT.EXE and CHILD.EXE are just one long program joined together.

I searched for "jeje imagen tutorial" in Google. It seems that all the tutorials are in Spanish. Unfortunately, I know less about Spanish than I do about disassembling. Expressed mathematically, this is:
Spanish < Assembler =< 0.01% :(

Regards,
Alan
Ricardo Narvaja
05-08-2005, 10:38 AM
i think you are confused, olly only can work with one process, if a second process is created is separated of the first is not posible from a process make a call to other process.

Ricardo
alan
05-08-2005, 07:37 PM
Can I send you some screen shots to prove that the parent EXE is calling routines from a second EXE?

Alan
Ricardo Narvaja
05-08-2005, 09:36 PM
send me

ricnar456@yahoo.com.ar

Ricardo


OllyDbg API - Need help using "Assemble"

RCE Messageboard's Regroupment > Plugins > OllyDbg API - Need help using "Assemble"
Nonameo
05-07-2005, 09:19 PM
Has anybody used Assemble with "jmp" and "call". its a pain in the a$$ as far as i can see. Maybe i'm missing somthing.

When i call the function giving my ascii text, jmp 401109, it gives me back the first byte of the jmp command, but doesnt give me the whole lot.

Can anybody help ??

Thanks

-Nonameo-
Nonameo
05-10-2005, 05:15 PM
dont worry about it, i found a way round it


OllyScript Editor v1.0 Beta 3

RCE Messageboard's Regroupment > OllyScript > OllyScript Editor v1.0 Beta 3
loveboom
05-08-2005, 02:15 AM
i written a Editor for ollysctipt.

and i am sorry, still now editor cann't Syntax Highlighting

download:
http://www.exetools.com/forum/showthread.php?t=7514
haggar
05-08-2005, 06:48 PM
Arghhhhhh! It's on ExeTools forum and non-members can't register on forum neither they can register. Please can you post it on some free upload site or if you have will, can you send it to my mail dalmatinac_ipo@yahoo.com.

Btw, do have some your web page? I would love to read your tutorials on unpacking since you write great scripts.
loveboom
05-13-2005, 01:15 AM
I has been send a mail to you.
my websize is :http://blog.csdn.net/bmd2chen(but chinsese only,sorry:-()
loveboom
05-13-2005, 05:10 AM
download link:

http://rapidshare.de/files/1729944/OSCEDITOr103.rar.html


Need ya help

RCE Messageboard's Regroupment > OllyScript > Need ya help
5hplayer
05-08-2005, 03:48 PM
Hi

i got a question, but first of all, i want to say iam not a n00b in general, but in cracking and dumping;). It's my first time using olly debug and the scripts and i want to ask if anyone can tell me step by step how to use the script and how to save the "unpacked" file. by the way, i want to patch a file compressed with aspack;) I hope, somebody will help me^^
TBD
05-08-2005, 05:21 PM
unfortunately is not a "cracking" board :(
5hplayer
05-08-2005, 07:59 PM
ok, iam sorry for that mistake. but, what are all the people doin' when they unpack packed files?^^


HideDebugger by Asterix

RCE Messageboard's Regroupment > Plugins > HideDebugger by Asterix
Kyd
05-08-2005, 08:03 PM
http://www.wasm.ru/forum/files/_311506657__HideDebugger123.zip
Asterix
05-13-2005, 02:54 PM
http://www.wasm.ru/forum/index.php?action=vthread&forum=5&topic=5091&p age=-1#6 (http://www.wasm.ru/forum/index.php?action=vthread&forum=5&topic=5091&page=-1#6)
dm47
09-23-2005, 07:00 PM
can some1 post a link that works?


Thread entry point

RCE Messageboard's Regroupment > General > Thread entry point
diplot
05-09-2005, 08:43 AM
Hi,

how can I find the entry point of a Paused thread?
After attaching ollydbg, the EIP register is somewhere in kernel32, but my program has many threads, and i must find out where the thread code starts executing.
Can I find this without hooking CreateThread?

Thanks!
1bitshort
05-09-2005, 09:12 AM
View menu > Threads
diplot
05-09-2005, 09:45 AM
I know this, but the Entry value seems to be some address inside kernel32 as I said before
Ricardo Narvaja
05-09-2005, 10:23 AM
when you attach the program stop in DebugBreak, go to view-memory and put a MEMORY BREAKPOINT ON ACCESS in the first section (the section start in 401000 and RUN and the program stop in any thread executed in the first section)

The memory breakpoint work in all threads simultaneosly

Ricardo


Searching the posts

RCE Messageboard's Regroupment > The Heap > Searching the posts
alan
05-09-2005, 06:03 PM
I know hardly anthing about Olly. I know even less about searching. Can someone please tell me how to use the Search feature in this forum?

Regards,
Alan
diplot
05-09-2005, 07:29 PM
I was wondering too why the Search button can't find anything
TBD
05-10-2005, 09:32 AM
it seems that are some problems with the search feature.
you can use google site search (inurl:) - search for Oleh (http://www.google.com/search?q=inurl%3Aollydbg.win32asmcommunity.net+ole h&btnI)
alan
05-10-2005, 07:17 PM
To help me to search the topic headers in the "General" section, I've copied the 25 pages of headers into a PDF file. The PDF is searchable, with links to the appropriate topic page on the site.

If anyone wants a copy, let me know.

Regards,
Alan


Deactivate SOURCE FILES.

RCE Messageboard's Regroupment > General > Deactivate SOURCE FILES.
ProfEich
05-10-2005, 02:49 PM
How can I disable "Source file" debugging.
OllyDbg automaticly imports the source files and destroys the whole debugging analyses through it.
If I copy the EXE file to another directory (where no source files are) it analyses it correctly.


attachments on posts?

RCE Messageboard's Regroupment > General > attachments on posts?
Raygun
05-11-2005, 07:31 AM
Any way to attach zips, txt files to your posts?
TBD
05-11-2005, 10:20 AM
no. attachments are (and will be) not supported due hosting/traffic reasons


Cancel "Break on new modules"?

RCE Messageboard's Regroupment > General > Cancel "Break on new modules"?
alan
05-12-2005, 03:57 PM
While stepping through a program with F8, the "Executable Modules" window opens and the status line shows the message "Break on new modules". Each F8 highlights a different entry in the "Executable Modules" window.

How do I cancel this?

Regards,
Alan
oh me anon
05-13-2005, 10:08 AM
option --> debugging options (ctrl+O) events ---> uncheck break on module load --> ok
alan
05-13-2005, 10:37 AM
Thank you.

Regards,
Alan


Breaking on file acces...

RCE Messageboard's Regroupment > General > Breaking on file acces...
GooseWrecker
05-13-2005, 08:18 AM
Hi i'm new to this forum, and pretty new to reversing to - so plz hold my hand on this.

I've just unpacked my first 3 ASProtected progs, so now i'm plaing around with reversing some algos in one of the progs.

My problem is i can't get olly to break on file acces. How do i do that ?
eg. as soon as my prog trys to open hang.dat i wan't to place a bp.

Thx in advance
Kind regards GooseWrecker
oh me anon
05-13-2005, 10:13 AM
view -->executable modules -> select kernel32.dll--> right click view names --> TYPE CreateFile -> double click you will be on the first line of
that function set conditional break point (shift +f4)
like this [string [esp+4]] == " blah blah .balh" (look at help file for syntax ) select pause on condition
when it is hit use alt+f9 (RETURN to user code )


Convert an assembly mnemonic to hex

RCE Messageboard's Regroupment > General > Convert an assembly mnemonic to hex
alan
05-14-2005, 11:34 AM
In order to use a hex editor, I need to know how to convert the replacement mnemonic into hex.

For example, I want to replace
test eax, eax
by
xor eax,eax

I know that "xor eax,eax" is "33C0", but are there any free tools that would do this conversion.

I suppose the tool would be similar to the Windows calculator, where I can type in a decimal value and convert it to hex, octal, or binary.

Regards,
Alan
arjuns
05-14-2005, 04:34 PM
why don't you try writting your own code.
I thik it is simple to code..
Ricardo Narvaja
05-15-2005, 11:21 PM
look in ollydbg, assemble the command you want and look the mnemonic.

Ricardo Narvaja
alan
05-16-2005, 09:38 AM
Thanks Ricardo.

Each time someone answers one of my posts on this forum, I learn some more about Ollydbg.

I've spent a few weeks comparing hex editors such as HIEW, BIEW, HDD, Hackman. Some of these editors can patch files, but not memory. I didn't know Ollydbg can do both :)

Regards,
Alan
PhallGuy
05-26-2005, 12:14 AM
This is a BAT script that I run for this type of thing. Create a file named t.asm and write all the code you want to convert, then run this cmd file.

@echo off
ml /c /coff /nologo t.asm
dumpbin /disasm t.obj
del t.obj
Libertyordeath
05-31-2005, 01:38 AM
Hello for all of you who dont know there is a program called RTA that converts assembly commands to mnemonic I have uploaded it to Rapidshare here is the URL http://rapidshare.de/files/2078939/RTa_2.0.zip.html its a free tool :)
bud_gd
06-26-2005, 12:01 AM
For ALL of the need to know: Hiew will take care simply of all editing,Anyone w/ A quable to this?.


Debugging a stack overflow - hardware breakpoints problem

RCE Messageboard's Regroupment > General > Debugging a stack overflow - hardware breakpoints problem
Fireice
05-16-2005, 01:29 PM
I'm trying to debug a stack overflow. I tried setting a hardware breakpoint at the location, but it doesn't fire. I know that the code gets executed, because I put some bad commands and it page faulted.

I'm running XP SP1 on AMD Athlon 2800+.
Are there any known issues with this setup? Any ideas how to diagnose the problem?
arjuns
05-16-2005, 04:36 PM
I am having the same problem........
there is still something dfferent, I have read someone's tutorials about writting explit on stack,in his tutorial stack address begins from 21XXXX
and in mine it is 002XXX and in shellcoding wehave to avoid nulls ..
so please tell me how to write code for that address.
thanks in advance
Fireice
05-17-2005, 09:30 AM
You need to return-to-libc, or in case of windows to system dll, jump to a command that will take you back to your code, like jmp esp, call esp, etc, anyone got ideas on the original topic?


i want a Calculator

RCE Messageboard's Regroupment > Plugins > i want a Calculator
overlord
05-16-2005, 03:56 PM
i want a calculator plugin which can make all logic and all arithmethic evaluations possible in assembly and in binary, decimal, hex and ascii format (like crackers tool)

you understand it must be a mixture of crackers tool and hackman calculator
joe
05-16-2005, 05:35 PM
Look at http:\\picasso.poupe.net
Go to forum -> Czech & Slovak forum -> Mini projekty/crackmes -> cme17 -> page3
There are attachment to kalkulacka.zip
overlord
05-18-2005, 05:26 PM
thank you but it MUST be an olly plugin. i already got this (and those) but why there is no calc plugin for olly.
joe
05-19-2005, 03:25 PM
I'm sorry, I don't now if this plugin exists.
overlord
05-23-2005, 07:47 AM
i also thanks a lot.


Denial of service to Ollydbg users

RCE Messageboard's Regroupment > General > Denial of service to Ollydbg users
alan
05-17-2005, 06:07 PM
I found the following statement at the link below. Because I'm a newbie, the statement means nothing to me. But it might help some of the gurus on this forum.

"OllyDbg is reported prone to a denial of service vulnerability. It is reported that the issue manifests when a target process that is being debugged attempts to load a library module that has a superfluous filename.

An attacker may exploit this vulnerability to deny service to OllyDbg users.

This vulnerability is reported to affect OllyDbg version 1.10 (final version) and prior versions."

hxxp://www.securityfocus.com/archive/88/394518/2005-03-27/2005-04-02/0

Regards,
Alan


Tutorial by Teerayout

RCE Messageboard's Regroupment > General > Tutorial by Teerayout
alan
05-18-2005, 05:23 AM
There are broken links to the screen shots in the following Olly tutorial:

hxxp://www.addict3d.org/index.php?page=viewarticle&type=security&ID=27 3

Does anyone know an alternative site for the graphics?

Regards,
Alan


System performance problems while debugging

RCE Messageboard's Regroupment > Bugs > System performance problems while debugging
Hooman
05-19-2005, 04:00 PM
I'm not so sure this is a problem with OllyDbg so much as with Windows, but I've been unable to find anything on the net so I thought I'd post here.

I've experienced system wide performance degradation while running OllyDbg. It's always when I have the same thing loaded, and code is executing in a certain DLL. I think it may be breakpoint related. I've set a breakpoint on some code which I'm sure should be executed, but rather than stopping at the breakpoint, my whole system just sort of freezes up. I can still switch between programs and use Task Manager to close OllyDbg but it takes about 5 to 10 minutes to do so. I get the same slow responsiveness from the whole system even though Task Manager reports only about 10% of the CPU is being used.

I'm quite sure the problem is related to running OllyDbg as the problem is fairly consistently repeatable. Closing OllyDbg always makes the performance issues go away, and closing other programs has no effect. I should note though, that sometimes I can get a breakpoint to fire as expected, but once the problem occurs, it tends to stick around until I restart. Unfortunatly, restarting doesn't seem to help the problem as of late.

I'm running WindowsXP SP2 and OllyDbg 1.10. And if it helps, the DLL being debugged should have just received network data at about the point where the problem occurs.
Ricardo Narvaja
05-19-2005, 09:38 PM
look in the services task list maybe a service is altering the ollydbg work (there are services hasp, securom,etc with antidebugger), of maybe the program detect the BP and make loops for use so much CPU.

Ricardo Narvaja
Hooman
05-25-2005, 07:51 PM
Well, I've toyed around a bit more. If I remove all my breakpoints, I don't get this problem. However, the program does still pause on me because of a Single Step Event. I seem to be getting these at random. Perhaps one is setup as a conditional/log breakpoint? That might explain the performance loss, yet me still getting no indication that anything has happened. Of course, I still don't see why I would get a system wide problem rather than just OllyDbg and the debugged program running slowly. I haven't seen any running tasks that I'd think would interfere here.

What strikes me as odd about the single step event, is that I never did anything to cause it (that I'm aware of). I went through a fresh run, closed down OllyDbg, came back, and ran it again, and it stoped. I seem to get this happening at random. The location changes too. The last two I've experienced were one instruction after a log breakpoint. I'm going to check to make sure they aren't causing the performance problems, but I suspect if they were, the problem would never go away like it sometimes does.


OLLYDBG USED TO FOIL STREAMING VIDEO COMPANY FOLLIES

RCE Messageboard's Regroupment > General > OLLYDBG USED TO FOIL STREAMING VIDEO COMPANY FOLLIES
MACC
05-20-2005, 04:07 AM
I thought I would post this since OLLYDBG was used and it was the
only program that was easy enough to do it.
I won't tell the whole sorted affair it would be to long so here is a link
http://www.drunkenblog.com/drunkenblog-archives/000534.html
A quick story Maui x stream is the streaming video company that
claimed it did not use any GPL code for its products. After memory dumps
it was looking like they stole code from XVId, vorbis and others.
Until these findings were posted then they started packing the EXEs.
Progress was then slow to finding out the truth.
It took me about 2-3 days to figure out a universal way to unpack all the products that they made. Then it was clear that they did indeed steal code.
The tutorial for this is on that site above. It is by EVENT_HORIZON.
My contribution was the unpacking method itself (MACC)
1bitshort
05-21-2005, 11:39 AM
> Then it was clear that they did indeed steal code.
so now what? :)
MACC
05-21-2005, 01:52 PM
Now to try and figure out how exactly these programs use the
code and how they were all put together.
Still don't know where the vxmplayer came from. I know it is
based on the sun java audio player but the main vxm class
is an iffy. It could be theirs or it may be based on something else.
I just don't know.
1bitshort
05-21-2005, 05:08 PM
I'd encourage you to contact the company that you think might've had their code stolen. A simple email would do - "here are my findings, i'm not sure if they're correct but i believe they're worthy of further investigation to ensure your technology isn't being stolen"
MACC
05-21-2005, 06:41 PM
Most of the investigation into what is used is on the drunkenblog
and the developers involved have already been notified, however
there is still the matter of how they were used and by which
means they are accessed.
There is more than one company involved whose products
were stolen.


Anyone know how to contact VolX?

RCE Messageboard's Regroupment > OllyScript > Anyone know how to contact VolX?
1bitshort
05-20-2005, 07:34 AM
Does anyone know how to contact VolX? It's about his unarmadillo script for OllyScript
Thanks
VolX
05-21-2005, 03:04 AM
Hi,
what is your problem ?
1bitshort
05-21-2005, 04:15 AM
Your Olly script (probably the best i've ever seen) for Armadillo doesnt seem to work with the latest version of Armadillo (now called SoftwarePassport). Im just wondering what limitations there are (that you know of) to your current script? and do you plan on extending it further?
Keep up the great work
VolX
05-23-2005, 03:28 AM
New Armadillo (version above 3.75 ?) add a GetTickCount check at the import table handling portion, and after version 4.0 the OutputDebugStringA trick to close the Olly, those are what I can recall.
I do have one new script for Armadillo which can handle from version 3.4 to version 4.10 -- the last version I have played, either it's configured with standard protection or CopyMEM II with or without code splicing and/or import table elimination, but I have no plan to release it to the public.
thank for your kind words
ViX
05-27-2005, 06:42 AM
Hi volx the script gives an error.Then i checked the log it said

Address=77E7A543
Message=Hardware breakpoint 1 at kernel32.CreateFileMappingA

How to disable that breakpoint?


OllyDBG BreakPoints = Olly Is not Responding!

RCE Messageboard's Regroupment > OllyScript > OllyDBG BreakPoints = Olly Is not Responding!
xcracx
05-21-2005, 11:53 AM
When i set a breakpoint on soft that opens new window

like Crack me that has Button you click th button then you got another
Dialog then you need to write the serial number
like this one: http://biw.rult.at/tuts/crue2tut.zip

ok when ANY debbugger that i use Breaks on GetDlgItemTextA
it breaks and not responding and it happens on any debbuger that im trying to use (OS:xp so didnt try SI)
Beta
08-28-2005, 06:14 PM
Do you have Any Keyloggers?Any programs that attach to a new program?
had the same problem but turns out it was aprog called ghost keylogger
oh me anon
08-30-2005, 04:34 PM
whats the problem :( its working nice its a simple repecmpsb
launches a dilaog box and closes it then hashes the serial with a harcoded
string and repecmpsb with a hardcoded hash
btw the first Letter is R and even Entering just one Letter as password you can pass the test its working fine
doesnt block nothing
works fine on windbg as well
check your pc if you find any freeze for some malwares or some such crap

or check if you are breakpointing on messageloop
if you have set a break point on message loop it might be breaking
a lot of times and you should be thinking ollydbg is freezing


OllyDbg unable to proceed

RCE Messageboard's Regroupment > General > OllyDbg unable to proceed
alan
05-21-2005, 01:38 PM
When I attach OllyDbg to a program, I get the message:

Quick statistical test of module "xxx" reports that its code section is either compressed, encrypted, or contains large amounts of embedded data. Results of code analysis can be very unreliable or simply wrong. Do you want to continue analysis?

I would be grateful if someone could give me a few hints as to how to proceed with this project?

I am currently at grade "nobrainer", but I am 25% towards grade "lamer".

Regards,
Alan
oh me anon
05-21-2005, 06:27 PM
it means olly has analysed the exe and found that it is packed or compressed or encrypted or whatever like it says
now if you still say yes olly will assume you know better and analyse the app and show you the garbage analysis
if you say no olly wont analyse but will just stop on the code and will let you find what is the mystery :)

that means you have to find some file identification programs
which would do some analysis based on predefined signatures and
may give you an educated guess as to what this app might be packed or compressed or encrypted with

there are many floating around the most popular one is peid by snaker

now if you run peid on the app it may say
packed with upx --- blah blah blah by blah blah version blah blha blah

if it was that simple then you can use upx itself with commandline option
-d to unpack it or if you are faced with some tough jock like
execryptor or similar then you are doomed for now or till you learn
more about packing unpacking crypting and such nocturnal roaming stuffs
have fun :)
alan
05-22-2005, 01:13 PM
Thanks. PEID identified the packer.

Regards,
Alan
cridia
05-23-2005, 02:26 AM
PEID always error when system running other program,why? i use win2000.


missing "plugins" menuitem after renaming OllyDbg.exe

RCE Messageboard's Regroupment > Bugs > missing "plugins" menuitem after renaming OllyDbg.exe
apfelsaft
05-21-2005, 08:43 PM
i noticed that the "plugins" menuitem is missing when i rename OllyDbg.exe (for example to renamed.exe).
looks like a bug?!
Ricardo Narvaja
05-21-2005, 09:15 PM
no you rename a copy of ollydbg.exe to renemed.exe but you need let a copy of ollydbg.exe in the folder, execute renemed.exe and the plugins work.

Ricardo Narvaja
apfelsaft
05-22-2005, 10:25 AM
ah, thanks for info ;)


im from china ,im a beginner,i wanna konw how to pronounce the software?

RCE Messageboard's Regroupment > General > im from china ,im a beginner,i wanna konw how to pronounce the software?
cridia
05-22-2005, 01:06 AM
in china ,we call it "OD",is that correct? thanks!
1bitshort
05-22-2005, 04:49 AM
OD = overdose.
Olly/Ollydbg/Ollydebug = Ollydebug.
Oleh = author of Olly.
cridia
05-22-2005, 06:01 AM
oh,i see,thank you 1bitshort :)


How to debug child process

RCE Messageboard's Regroupment > General > How to debug child process
Quasar
05-23-2005, 10:05 AM
Hi, sorry my english first

the program i'm debugging creates a process with CreateProcessA in OllyDbg, i want to debug this child process too.
There is no way to do this from ollyDbg??
Thanks
Ricardo Narvaja
05-23-2005, 10:58 AM
yes, put a bp in createprocess, change the value to 4 in the stack for suspended process, go to RET of the father.
if the father are debugging the child, go to any blank part of code and write

Push (PID OF CHILDREN)
Call DebugActiveProcessStop
nop

and mark the first line (the push) and select NEW ORIGIN HERE

trace with F8 and when you reach the NOP if EAX is 1 the child is not debugged more.

For RUN the child put a infinite loop in the entrt point and with process memory manupulator quit the resume, for make the child run and looping.

next atach with OLLY without problem, pause and quit the infinite loop and continue debugging.

Ricardo Narvaja
Quasar
05-23-2005, 12:50 PM
Thanks for your response Ricardo,

after CreateProcess i call DebugActiveProcessStop with PID of new process and fails with ERROR_ACCESS_DENIED (00000005). Does this mean the father was not debugging the child?

For run the child, how can i put a infinite loop in the entry point and resume?
I don't understand this, maybe do you mean modify the source code?

An important thing i forgot to say, the father is injecting code into the child process, and when I attach with OllyDbg (right after CreateProcessA with CREATE_SUSPENDED) a popup says "0xC0000142, application failed to initialize properly" and OllyDbg stops with "Exception C0000142 DLL_INIT_FAILED".
arjuns
05-23-2005, 05:03 PM
patch the original instruction with EB FE (jumps on the same line of eip)
but you have to remember the patched byte you need it later.
Select resume thread from the thread menu.
Ricardo Narvaja
05-24-2005, 01:44 AM
for the father debug the child there are two options:

1) in the stack when the process is created in the parameter you change to suspended 4, there are a value for DEBUG ONLY or DEBUG ONLY THS PROCESS

2) the father call to api DegugActiveProcess , following the call to createprocess

if 1 or 2 not appear the child is not debugged, (but if is not debugged the child is possible to attach with olly without problems)

the process created is originated in a file, look the name of the file in the stack, open peeditor open the file previously, and look the entry point.

If in peedittor say 1020, and image base 400000 the entry point will be 401020 for example.

when you create the process suspended, open pupe go to patch and look the value in 401020 (example) and change the 2 bytes for EB FE (write in a paper the old values)

next you put EB FE (infinite loop in the entry point) and quit the father debug if is necesary, next quit the resume with process memory manipulator, the program start to run looping, and next attach with olly, when stop in debug break RUN, and pause again, OLLY stop in the Entry point, change the values for the original values and continue debugging.

Obviously the father continue need continue running in the original, you need study what changes make tha father to the child, with WriteProcessmemory by example, and what read child from the father, maybe there are a intercourse of information.

Other possibility is change the bytes in the child file, and save the changes, and when are looping, change in memory but cn be detected is all try and try, hehe.

Ricardo Narvaja
Quasar
05-24-2005, 03:20 PM
thanks to all, i tried to put EB FE and it worked!


MapConv not loading labels or comments for a DLL?

RCE Messageboard's Regroupment > Plugins > MapConv not loading labels or comments for a DLL?
5aLIVE
05-24-2005, 02:45 PM
Hi, I have also posted this question on EXETools forum so as to reach a wider audience.

I'm experiencing a rather strange problem when using the MapConv v1.4 plugin for OllyDbg.

I have produced a MAP file using IDA which includes Autogenerated names and Demangled names. From IDAs Options\Demangled names... menu and selecting Setup shortnames, I checked the option "Inhibit everything except the main name".

I have sucessfully applied this MAP to an attached EXE process and confirmed that either Labels or Comments are present by right clicking in the CPU window and selecting either search for/user-defined label or search for/user-defined comment

When I try to do the same for a DLL, no labels or comments can be seen.
Any ideas what can be wrong? In Olly, I selected from the menu Optiions\Debugging options and selecting the Events tab I checked the Break on new module (DLL) option.

Once the attached process loads, I would expect Olly to break when the DLLs are loaded, this doesn't appear to happen though.
Next, I press Alt+E to view the executable modules of the attached process.
I highlight the desired DLL and right click and select Follow entry.
I then apply the .MAP file only to find no comments or labels present.
NOTE: I can succesfully convert this .MAP file to a .NMS and view all the labels and comments in softICE. I would prefer to work on this app using Olly thats all.

I hope someone can help me solve this interesting problem. Thanks for all your help.
Thankyou,
5aLIVE
oh me anon
05-24-2005, 03:46 PM
well your dll may be relocated and maps address doesnt match with
present image
i think you can force ida to load the dll in different image base
though i can be wrong as i dont use ida much
if you succeeded it in loading at a different address try making one more map and use it

or may be you can try godup plugin and try to apply the signatures that ida applied while analysing your dll
it should handle relocations properly if i am not wrong

or find what is the original imagebase of the dll and find out what existing dll is loaded in that address (view memory )
if possible try unloading that dll (probably some antivir realtime scan dll
must be sitting in 10000000 address (avgs for sure sits there :) at least in my system

or better if you are adventourous try editing the image base physically in the dll and experiment with ida mappping it again :)
5aLIVE
05-24-2005, 03:50 PM
>Thankyou very much for the quick reply. This must be the problem, the debugged DLL has different addresses for a particular function compared with the IDA listings.

e.g., IDA shows : .text:10001028 sub_10001028, while the same subroutine can be found at mem loc 02041028h.

Subrtracting : 10001028h - 02041028s gives 0DFC0000h.
Is this the new image base value I use to obtain the correct mapping?

i think you can force ida to load the dll in different image base
though i can be wrong as i dont use ida much
>I'll look into this, I'm far from an IDA expert myself.
if you succeeded it in loading at a different address try making one more map and use it
>That sounds like the ideal solution to me.

or may be you can try godup plugin and try to apply the signatures that ida applied while analysing your dll
it should handle relocations properly if i am not wrong
>I've seen the GODUP plugin mentioned, but have not tried this one yet.
>I'll give it a go if I am unsuccesful in adjusting the image base in IDA.

or find what is the original imagebase of the dll and find out what existing dll is loaded in that address (view memory )
>Original image base of the DLL is 1000 0000h, a module called AGM.
I'll investigate further.

if possible try unloading that dll (probably some antivir realtime scan dll
must be sitting in 10000000 address (avgs for sure sits there :) at least in my system

or better if you are adventourous try editing the image base physically in the dll and experiment with ida mappping it again :)
>Hmmm, nice idea, but a last resort as I have no experience of tinkering with PE file section at present.

Many thanks for such great advice.
oh me anon
05-24-2005, 04:09 PM
:( i dont know how this can happen TBD ?? how does the same post appear in two different names ??

anyway if you are not adventurous but still need to change imagebase
you can find editbin in masm32\bin or google for it
it can rebase the dll to any imagebase you specify like

c:\masm32\bin\EDITBIN /REBASE:BASE= " your address viz 0x12000000 " your.dll
pause
oh me anon
05-24-2005, 04:32 PM
oops %Alive you commented i thought i saw my same post in different names :(

anyay TBD I Still have a question why doesnt the board keeps me logged in ??? till i quit atleast ??
i wanted to edit the post but i cant find edit functionality :(
i am forced to make dud replies which i could have edited inside my original posts
can you have a look and confirm
5aLIVE
05-24-2005, 04:41 PM
My mistake, I pressed the login/post button, not realising that I was still logged in. Sorry about that.
5aLIVE
5aLIVE
05-24-2005, 06:28 PM
I successfully rebased the DLL file to match the imagebase of the relocated DLL. Now, the addresses in both IDA and Olly are the same :)

The target address space of 1000 0000h is occupied by another DLL used by the application under scrutiny and therefore cannot be unloaded.

Having rebased the DLL, I genuinely thought that this would solve the mapping problem. Yet I still cannot view labels or comments from the newly produced MAP file. What else could possibly be the problem?
This is starting to get to me.

Many Thanks,
5aLIVE.
5aLIVE
05-25-2005, 11:50 AM
UPDATE:

Up until now I've been using Olly 1.09d, I thought I try using Olly 1.10 since it supprots the loading of DLLs.
Using this tool still didn't give the expected results.

I changed the image base of the DLL using LordPE to make dissassembled addresses match those of the relocated DLL.

As soon as I try and apply a label or comment MAP, I gey the application error 'The instruction at "0x2c6172b" referenced memory at "0x0000000c". The memory could not be "read".

This suggests to me that there is a problem with the new image base of the DLL(loading the original DLL with the original map, doesn't produce this error, neither does it produce labels or comments :( ).

Another "clue" that tells me the rebased DLL structure is in error is that previous string references shown in IDA like:

.text:10002E6F 68+ push offset aMyString ; "MyString"
.data:1000924C 41+aMyString db 'MyString',0 ; DATA XREF: .text:10002E6F

Now become:
.text:02042E6F 68+ push 1000924Ch
.data:0204924C 41+aMyString db 'MyString'

So the new code section appears to be addressing the old data section.
As I've said before, tinkering with PE section is new to me. Do I need to change the start and end adresses of the .data section to fix this?

I hope someone can help me reach a solution.
Many Thanks.
5aLIVE
oh me anon
05-25-2005, 12:54 PM
well that is why i said you need to be adventourous and also that is the reason i gave you editbins commandline

just changing imagebase with some hexeditor will make it load at a differnent address but you also need to change all those absolute referances for making the image work

absolute referances have the old imagebase hardcoded inside them

00401002 |. 68 00304000 PUSH msgbox.00403000 ; |Title = "Iczelion's tutorial no.2"

you would need to change 40 to 1000 :)

it is kinda trivial if you know what you are doing else it is a daunting task

get editbin to do it for you it does the job properly

you should be able to find editbin in almost all program langs \bin folder

i got it here in masm32\bin ive seen it in vs\bin also n vb\bin
folders
also it is part of ms sdk microsoft coff binary editor is the full name

or search in programmers heaven or symtel you should be able to land a copy of that old rugged warhorse
5aLIVE
05-25-2005, 08:04 PM
"just changing imagebase with some hexeditor will make it load at a differnent address but you also need to change all those absolute referances for making the image work"

>Hmm, that sounds like more trouble than it's worth. My time would probablt be better spent stepping through the code trying to learn how some of the functions work.

I just fail to understand why the applied comments or labels can't be seen. After all, the labels and comments are expressed as absolute addresses in a MAP file, so they should be unaffected by the process of relocation.

The fact that SoftICE can break sucessfully on a given label or comment on the relocated code from a MAP file translated to a NMS file confirms this.

I'll probably just add user-defined comments manually for the sub-routines of interest. The only other thing I haven't mentioned is the DLL doesn't have the traditional .DLL extension, though I wouldn't expect this to be a problem would you?

Thanks,
5aLIVE
5aLIVE
05-26-2005, 07:18 AM
I meant say that labels and comments are expressed as relative addresses in a MAP file, not absolute.

Regs,
5aLIVE
5aLIVE
05-26-2005, 12:56 PM
PROBLEM SOLVED: (user error)

It wasn't until I reread the readme.txt in MapConv which states that dynamic resolution of the address of code section should now work for dlls and other processes that don't have codebase = 00401000h.

I then looked in the plugins source code to see what I could learn and saw the line:
pmodule = Findmodule((ulong)GetCurrentEIP());

I was then I realised that the EIP was outside the code section of the DLL. Applying the map inside the module code did exactly what I was hoping for all along. Doh!

It should now be obvious to you that I am somewhat new to this whole experience and still learning how to use this fine debugger.

Thankyou @oh me anon for taking the time to reply with such excellent help!

5aLIVE
oh me anon
05-26-2005, 06:41 PM
i was all the time thinking you were applying it to the module and not to some unknown place :) well it reminds me never to ignore the obvious :)
btw all this time i was thinking masm had the original editbin from ms
but nope it just gets the Argv argc and appends -edit before it
and passes it to link :) and linker is doing the job of relocating i had a nice time looking at the relocating code
it ends up at LdrRelocateProcessBlock in ntdll which does the job :)
xxxxx
05-27-2005, 01:33 PM
Hey, you don't need such mumbo - jumbo
Just take GODUP - select dll in cpu window from Olly debugger and use mapload from it

- godup contains imporved version of map loader so he can load it for any of dll-s

godfather+
(GODUP autor)


Chat dailog box

RCE Messageboard's Regroupment > General > Chat dailog box
rama711
05-24-2005, 03:00 PM
How to debug a stored dialog box from EXE file. I have this EXE file it is for a game. When you run the game and when you hit [ENTER] a dialog box pop ups (Chat box) to enter some chat. I would like to know where I can find this dialog box ? How this dialog box being called? what break point I should use. I tried many but did not work
I appreciate your responce.
Regards
xcracx
05-24-2005, 03:52 PM
load the game in ollydbg..

Hit > CTRL+N

you will see the names
find GetDlgItemTextA (find all refrence)

you can Set a Breakpoint on every refrence and it will pop at the one it access,
goodluck

xcracx
rama711
05-25-2005, 05:24 AM
Thanx
I will try it tonight
rama711
05-26-2005, 10:29 AM
I loaded the game
then Hit Ctrl N
I did not find: GetDlgItemTextA
then I looked into a file called DPLAY60A I opened this file in ollydbg
and found this:GetDlgItemTextA
but this file DPLAY60A is a dircect paly for the game. most things in it has to do with exe.
I'am stuck don't know what to do !!
xcracx
05-27-2005, 11:28 AM
Dplay60A is an executable or a dll?

the exe you've tried before was a luncher of the game?

what do you wanna do with this DialogBox?

xcracx
rama711
05-29-2005, 09:55 AM
Dplay60A is an eexecutable not dll
please note that this game is associated with the following dll files like user32, KERNEL32.dll,GDI3.dll,ADVAPI32.dll,DPLAYX.dll,DDRA W.dll,WINMM.dll,IMM3 2.dll,MSVFW32.dll,ole32.dll,WSOCK32.dll,language.d ll,DINPUT.DLL,langua gex.dll
Now this dialog box comes in the center of the screen 5cm long by 1/2cm wide white plain box
What I wanna do withis box is change it is location on the screen instead being in the center I want it on top of the screen or at the bottom
regards
rama711
06-05-2005, 11:01 AM
Any input xcracx
Anybody can tell me how to debug this dialog box
joe
06-05-2005, 12:05 PM
There may be some other API fcn used to get text.
For example (I see it today):
SendMessageA

It's possible use window to locate procedure associated with your ENTER box, but I have allways problem how to determine correct MessageBP.
rama711
06-05-2005, 12:59 PM
when I set a break point ont SendMessageA . the whole game freez
what other tricks I could use to catch the dialog chat box
joe
06-05-2005, 06:00 PM
If game isn't packed, You can search in some dissassember (Dasm) or in Olly in text (string) references for "ENTER" or other string from dialog box.
rama711
06-06-2005, 12:44 PM
If game isn't packed, You can search in some dissassember (Dasm) or in Olly in text (string) references for "ENTER" or other string from dialog box.
The exe is not packed after dissassembel(DASM)
and earching enter this is what I found
-------------
push 00559F28
push edx
pushedi
call0042C330
mov ecx, dword ptr{esi+00000164]
add esp, 00000018
cmp ecx, FFFFFFFF
jne 004CD327
mov eax, dword ptr[esi+0C]
push 00559EFC
push eax
push edi
call 0042C330
add esp, 0000000C
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0000001C
ret 0014
---------------------
Now what
joe
06-06-2005, 04:31 PM
I'm wrong! I don't read correctly Your first post. You wrote "hit ENTER", this isn't name of window. Try find name of dialog box (which is in upper border of window) or some text which is in this box. If You find any, You are probably in the right place.
I'm sorry, my english is poor.
rama711
06-07-2005, 06:42 AM
Do not worry Joe
THIS dialog box has no text and has no name
It is just plain white box 5cm long 1/2cm wide. popups in the meddile of the screen when I hit "ENTER" on the keyboard
joe
06-07-2005, 05:23 PM
It's easy!
Try go to ollydbg forums / Plugins / ApiBreak - New Ollydbg Plugin
Ther is link to usefull plugin:
http://nikt.zog.net.au/ApiBreak.rar
In this plugin You can set PointH breakpoint. (It's works as hmemcpy in non 32 applications). Or BP in Dialog from this plugin can help You set BP which You need.
rama711
06-08-2005, 12:06 PM
Thanks I used the plugin and Itried the Point H and the Dailog stuff
The game feezez(not responding).
NOTE:
by the way do u load the game first then debug or the otherway arround
joe
06-10-2005, 06:46 PM
Does Olly freezing only with this game or with some other apps too (if does have some protection or if is problem with Olly or OS)?
rama711
06-13-2005, 12:17 PM
No it freeze on the game only. even though at one time it did work and the other time freez.
:NOTE:
by the way do u load the game first then debug or the otherway arround
joe
06-13-2005, 05:20 PM
I prefer load first then debug, because I don't known if it's possible analyse program after attaching. What game does freez? I can try look to it.
rama711
06-14-2005, 12:04 PM
The name of the game "Age of empires Rise of rome" it written C++ and some assembly language
rama711
06-14-2005, 12:06 PM
I found this info when I used "wininspector"
Can any of this information below be used to debug this dialog box
------------------------
- <messages created-by="Winspector">
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message>
<name>WM_NULL</name>
- <parameters>
<parameter>wParam: 0x00000000</parameter>
<parameter>lParam: 0x00000000</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message return-value="1">
<name>WM_NULL</name>
- <parameters>
<parameter>Return: 0x00000000</parameter>
</parameters>
</message>
- <message>
<name>WM_NULL</name>
- <parameters>
<parameter>wParam: 0x00000000</parameter>
<parameter>lParam: 0x00000000</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message return-value="1">
<name>WM_NULL</name>
- <parameters>
<parameter>Return: 0x00000000</parameter>
</parameters>
</message>
- <message>
<name>WM_NULL</name>
- <parameters>
<parameter>wParam: 0x00000000</parameter>
<parameter>lParam: 0x00000000</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message>
<name>EM_GETSEL</name>
<parameters />
</message>
- <message return-value="1">
<name>EM_GETSEL</name>
- <parameters>
<parameter>Start position: 0</parameter>
<parameter>First no-selected: 0</parameter>
</parameters>
</message>
- <message return-value="1">
<name>WM_NULL</name>
- <parameters>
<parameter>Return: 0x00000000</parameter>
</parameters>
</message>
</messages>
joe
06-14-2005, 05:59 PM
It uses GetWindowTextA (after pressing any key). My system don't response too, because it need many sources & I have only 128 MB ram & poor graphics. Function with GetWindowTextA are called 9 times. Please wait, I look to it!
rama711
06-15-2005, 03:19 PM
Thanks Joe for the help I really appreciated
Do you have the game Age of empires rise of rome?
joe
06-15-2005, 03:36 PM
I downloaded it yesterday(demo version). It is interesting - 'normal' BP works fine, but some are without response. I tested older version (1?) Age of Empires & there are same problem. It looks as some anti-debug?!
I will continue to debug.
rama711
06-16-2005, 10:12 AM
My version is 1.0a
if you send me your e-mail I can email you the exe file and all what you have to do is replace it with the one you have. This way we can tlak about the same version.
Thanks
rama711
06-23-2005, 02:28 PM
Joe: HI
Any NEWS
joe
06-23-2005, 07:48 PM
Nothing! It's beyond to me today. Exceptions take control over processes (above Olly too). I must find some small exe with exception handler & test it in Olly first.
rama711
06-27-2005, 12:50 PM
Ok let me know if I can help
xcracx
06-27-2005, 02:06 PM
wtf?!

why so many shit posts!@?#

i'll make it easier for you
use OllyDbg Command bar... type : bp GetDlgItemTextA

then hit F9 and wait for olly to break if it does hit F9
until it break when the Dialog EditBox you ment pops

#########
Goodluck,
xcracx
xcracx
06-27-2005, 02:09 PM
more reference that could help you

SetWindowPos
GetWindowPos
joe
06-27-2005, 06:45 PM
This isn't so simple. Hardware BP leads to freeze too!
rama711
06-29-2005, 10:37 AM
wtf?!

why so many shit posts!@?#

i'll make it easier for you
use OllyDbg Command bar... type : bp GetDlgItemTextA

then hit F9 and wait for olly to break if it does hit F9
until it break when the Dialog EditBox you ment pops

#########
Goodluck,
xcracx
wtf?!

why so many shit posts!@?#

i'll make it easier for you
use OllyDbg Command bar... type : bp GetDlgItemTextA

then hit F9 and wait for olly to break if it does hit F9
until it break when the Dialog EditBox you ment pops

#########
Goodluck,
xcracx

We tried this from the beginning. even some plgin stuff!!!!!!!!!
xcracx
06-30-2005, 01:09 PM
-_-
read my next post..

that says.. look for SetWindowPos
and GetWindowPos
joe
07-02-2005, 07:31 PM
Oh ***! This exe uses DirectX!
Can be there same problem as in 'Is it possible?' in this forum?
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=1357
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=1357
)
Riccardo has many good idea.
rama711
07-04-2005, 01:39 PM
Joe : what do you suggest to do now I read the above link and I think I understood that you can not debug in a game uses DIRECTX?????
joe
07-04-2005, 06:01 PM
This is true partially only. It's only hardness. Try to use script from Ricardo Narvaja & now set BP to GetWindowTextA - it don't freeze. It can't steps exe, but it creates logs (maybe this script to modify to obtain needed informations).
I'm sorry, Ricardo Narvaja for mistake Your name in my previous post.


Attaching problem.. Always Pused

RCE Messageboard's Regroupment > General > Attaching problem.. Always Pused
xcracx
05-24-2005, 03:59 PM
im trying to attach an exe that run by a luncher

now... i hit F9 its working normaly, then pass a screen(login screen)
and olly breaks at module Kernel32
7C81EB33 . 5E POP ESI ; DarkEden.0088D5E0 land here
7C81EB34 . C9 LEAVE
7C81EB35 . C2 1000 RETN 10

i hit F9 again and its paused again and again and never run normaly
its only happen with this applaction

Log data, item 0
Address=7C81EB33
Message=Exception E06D7363
Ricardo Narvaja
05-24-2005, 04:12 PM
when stop, go to debugging options-exceptions and press ADD LAST EXCEPTION, and next pass with shift +f9, in each exception the program stop, add in the list and in next run don´t stop.

Ricardo Narvaja
xcracx
05-24-2005, 05:52 PM
OMG you rocks man thanks aloott

I'm quite new over here but i saw your posts and this is my respawn

why the hell this guy is not an admin guys?

xcracx


Problems while unpacking armadillo 1.xx-2.xx(PEID said so)

RCE Messageboard's Regroupment > General > Problems while unpacking armadillo 1.xx-2.xx(PEID said so)
ViX
05-25-2005, 05:05 AM
I'm new here but when i was unpacking the armadillo1.x-2.xx i got the oep & i dumped it too! But the real problem is in fixing the imports.Can anybody help me?When i run the dumped file it says that it has caused an error.
cridia
05-25-2005, 08:13 AM
i suggest you try "ImportREC",this software can help you solve that error.
ViX
05-25-2005, 09:41 AM
First i used the olly script by Hipu.Then it gave me the oep.Then i put the child process in infinite loop using PUPE.Then i attached the process to olly.Then i tried importrec to fix the imports but nothing happens.I've heard that armadillo encrypts the imports.
I wanted some help to decrypt those imports.
Ricardo Narvaja
05-25-2005, 12:31 PM
you need read some tutorial is impossible explain so big theme here.

Ricardo Narvaja
arjuns
05-25-2005, 04:40 PM
We'd be very gallent if Ricardo Narvaja could help us ,
right Vix?
arjuns
ViX
05-26-2005, 07:36 AM
right Vix?

Yeah arjuns.I've many tutorials.I've unpacked the proggy manually too! (using olly dbg) & everytime i come up to the same oep.But today when i was on that oep, i dumped the process and tried "IMPORTREC".First it gave nothing then i traced it with level1 & u wont believe it gave me some imports!!! But there were some invalid thunks.So i deleted those and fixed the file.Still it gave an error & terminated.Then again after doing the whole process as mentioned above, i used the trace level2 option.But IMPORTREC freezed!!!I gave it 5 long hours to trace the imports.but nothing.Can u help me?
Ricardo Narvaja
05-26-2005, 10:50 AM
i only use import reconstructor when the table is all correct with perfect entries, i don´t trust in the reparation of IMPORT RECONSTRUCTOR with trae 1 level, trace 2 level, the last version of IMP REC is more the 2 years and the programmers know how make this tracers fail.

Reconstruct the table manually and when all entries are correct use import reconstructor, only for reconstruct not trace at all this is very bad in new armadillos, asprotect and new packers

Ricardo Narvaja
ViX
05-27-2005, 05:47 AM
Ricardo Narvaja will you please give a tutorial to manually reconstruct the table?Or will u please write in short?pls....pls...pls
Ricardo Narvaja
05-27-2005, 03:02 PM
the tut is writed but is in spanish

http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING
(http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING
)

look

http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/ 253-IMPORT%20TABLES%20A%20MANO%20(parte%201).rar
(http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/253-IMPORT%20TABLES%20A%20MANO%20(parte%201).rar
)

this is the first part are four and there are more (explained the script in)

http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/ 332-NUEVOS%20ARMADILLOS%20SIN%20COPYMEM2%20CON%20DESTR UCCION%20DE%20TA BLA%20parte%201.rar
(http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/332-NUEVOS%20ARMADILLOS%20SIN%20COPYMEM2%20CON%20DESTR UCCION%20DE%20TABLA%20parte%201.rar
)

more parts all in spanish

there are also

http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/ 375-IID_IMAGE_IMPORT_DESCRIPTOR_by_%2bNCR.rar
(http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/375-IID_IMAGE_IMPORT_DESCRIPTOR_by_%2bNCR.rar
)

also in spanish by NCR from the same theme

and teh method is used in varios tuts, in nuevo curso, the tuts WITH DESTRUCCION DE TABLA, are with this technique.

Ricardo Narvaja
ViX
05-28-2005, 06:15 AM
Thanx Ricardo Narvaja i'll try it.And i'll download a spanish 2 english translator if possible.
ViX
05-28-2005, 06:44 AM
there's a spanish2english translator at

http://www.paralink.com/download/mt71101.exe

but its size is too large!
nick_name
05-28-2005, 02:26 PM
vix , thanks for the SPANISH 2 ENGLISH translate download link

is it better than SYSTRAN 4.0 ??
ViX
05-29-2005, 06:40 AM
try http://www.paralink.com/download/mt71102.exe

this one is much more better than mt71101.exe

When i run the dumped file in ollydbg i get a message

Don't know how to step because memory at address 00c29602 is not readable.Try to pass exception to program

And if i follow the address in dump it says that it points to nothing.And in the original file if i follow it in dump then it shows the dump.What to do now????
Ricardo Narvaja
05-29-2005, 11:12 AM
there are two possibilities

do you use a renamed ollydbg.exe?

you need copy ollydbg.exe to other folder, rename exe: PIRULO.exe copy again to ollyfolder and use this PIRULO.exe

use HIdeDegugger1.23f

if with this the error continue in my last tut of armadillo, there are explanation of olly bug of ILLEGAL INTRUCTION and how patch.

If you cannot patch download from mi FTP folder HERRMIENTAS the file

OLLYDBG CAMUFLADO PARA VPROTECTOR.rar

this has the bug patched

Ricardo Narvaja
ViX
05-29-2005, 12:19 PM
Renaming the file doesnt work!!What's the name of ur last tutorial?
Ricardo Narvaja
05-29-2005, 12:25 PM
you rename the file letting the ollydbg.exe in the same folder and using pirulo.exe, and add hide debugger 1.23f and don´t work?

armadillo is the number 332 tutorial

Ricardo Narvaja
ViX
05-29-2005, 01:47 PM
No it didn't work! I'll try the tutorial.
hosiminh
05-29-2005, 02:20 PM
Yeah PeID 0.92 might say: Armadildo 1.xx - 2.xx
But PeId is sometimes wrong especially in Armadillo case.

When target is running ,
run Winhex -> Open Ram -> target.exe (Entire memory)

Find text : armVer

003E300F 3C 61 72 6D 56 65 72 73 69 6F 6E 20 78 73 69 <armVersion xsi
003E301E 3A 74 79 70 65 3D 22 78 73 64 3A 73 74 72 69 :type="xsd:stri
003E302D 6E 67 22 3E 25 73 3C 2F 61 72 6D 56 65 72 73 ng">%s</armVers
003E303C 69 6F 6E 3E 0A 00 00 00 33 2E 37 36 ion>....3.76

-> Armadidlo v3.76

@ViX

Don't know how to step because memory at address 00c29602 is not readable.Try to pass exception to program

Ussualy it help is you press shift+F9
Ricardo Narvaja
05-29-2005, 02:25 PM
no is a olly bug, if you press shift +f9 in a ILLEGAL INSTRUCTION EXCEPTION the messagebox is repeated but donñt pass the exception, and there are no changes.

Ricardo Narvaja
hosiminh
05-29-2005, 02:31 PM
Sorry , i didn't read ViX post accuratelly enough 1st time -> didn't noticed he's talking about dumped file.
Ricardo Narvaja
05-29-2005, 02:39 PM
oghh i don´t read this too ahh i think he is talking of the original armadillo don´t run, the dumped file tell you this message for the iat is bad reconstructed or there is a antidump for repair.

Sorry
Ricardo Narvaja
oh me anon
05-29-2005, 02:58 PM
no is a olly bug, if you press shift +f9 in a ILLEGAL INSTRUCTION EXCEPTION the messagebox is repeated but donñt pass the exception, and there are no changes.

ricardo do you mean opcodes like ffffffff ??
did you try options --> security allow stepping into unknown commands

can you get me the instruction which is illegal ??
Ricardo Narvaja
05-29-2005, 03:20 PM
lea eax,eax is the most used, but any illegal instruction exception olly don´t handle the exception well.

the problem of VIX is a dumped bad or no competely repared

Ricardo
ViX
05-30-2005, 05:35 AM
Yeah my dumped file gives that message bcoz the address which it gives is missing.

1. When i dump the file with the new PEdumper plugin in olly,i select the whole memory map including the address( which the error gives).But when i run the dumped file in WinXP it says it is not a valid W32 application.

2.And if i run in windows XP the file which is dumped with LordPE it gives the message:

World Online TV has encountered a problem and needs to close. We are sorry for the inconvenience.

And when i run it in ollydbg it give the message:

Don't know how to step because memory at address 00c29602 is not readable.Try to pass exception to program

I hope u understand what i mean to say!!The problem is of the DUMPED file and fixing the IAT.
ViX
05-30-2005, 06:33 AM
I tried the hex way to find the version but the last line looks like :

00C47060 69 6F 6E 3E 0A 00 00 00 20 20 20 3C ion>. <

Version's not present!!
Ricardo Narvaja
05-30-2005, 11:12 AM
well what type of armadillo is?

is a copymem2? with two process running? one process only running?

if is a one only process running obviously they have import table elimination (in my tuts DESTRUCCION DE TABLA) and is not posible repair with Import reconstructor in the usual way(look my tuts of armadillo with destruccion de tabla and import table by hand)

the problem say is not a valid 32 bits application, well armadillo change some bytes of the header in execution, when you reach the oep the header is corrupt for this reason this message.

look the program in the start in other olly compare the header with the program stopped in the oep, i generally copy and paste all the header of the original program without run, to the program stopped in the oep before DUMP and the dumped, is dumped correctly, generally armadillo change in execution time the number of sections or 2 or 3 bytes for corrupt the header.
ViX
05-31-2005, 05:59 AM
My armadillo uses debug blocker with debugoutputstring exploit.It has two processes.No copymem2.PEID says its 1.xx-2.xx
hosiminh
05-31-2005, 08:40 AM
ViX

If two processes running then copymem2 (father+son).
But if has debugoutputstring exploit then it probably has nanos too.
ViX
05-31-2005, 10:43 AM
Oh! now wat should i do? But that debugoutputstring does not give me errors when i use the hidedebugger plugin.And how can i get the version?
Ricardo Narvaja
05-31-2005, 11:04 AM
if exploit this bug is version 4 or more, previous version don´t use this bug.

Ricardo Narvaja
ViX
06-01-2005, 09:55 AM
OK then i'll use the unpack armadillo4 tutorials.Even u have the tutorials on ur website.
ViX
06-02-2005, 08:48 AM
In Kagra's tutorial armadillo4unpack i did'nt understand the new section(segment) part.What to do to the rawsize and virtualsize of that segment?And how to calculate the size of the dummy section?


program terminated?

RCE Messageboard's Regroupment > General > program terminated?
f1re
05-25-2005, 11:13 PM
Im trying to work with a popular online game called rose online.

Ive read many tutorials and understand what I need to do..but I hit this one point and I cant pass it, I dont know what the problem is.

-anyways...it happens right when i start the game, i open the exe, click the "play rose online" button on the exe, and ollydbg says terminated.

I know its a simple problem, but if i get past this its a smooth ride.

I would be very grateful for any help. Thanks in advance.
Ricardo Narvaja
05-26-2005, 10:41 AM
ollydbg is detected, there are many forms of detection the most common is avoided hiding OLLYDBG with hidedebugger 1.23f (the last version) and renaming OLLYDBG.exe (letting a copy of ollydbg.exe in the same folder) and using the renamed.

Try this

Ricardo Narvaja
Ricardo Narvaja
05-26-2005, 10:43 AM
the other possibility the program call other process with CreateProcess and continue excuting this second process and the first terminate.

Ricardo


Editing raw packets

RCE Messageboard's Regroupment > General > Editing raw packets
Obelix1987
05-28-2005, 01:03 PM
Hi im new to this olly thing and im trying to learn how to edit raw packets. For example when i type a message with "hi" then how can i change this message to like "go away". Ive read a little and it has to do with brakepoints... . Can anyone help me out with a nice guide how to do this? As far as im now, i can open olly then somehow i cant attach the game im playing but i can open it. (its attachet then too right?) After that i get a message that the process is terminated and i press f9 the problem is that olly keeps saying the procces is terminated.. i can still play the game.. but olly says "terminated" damm i need some serious help. Any help is appreciated.
xcracx
05-28-2005, 06:18 PM
ok first of all your game has a luncher...

1) you have to run the luncher executable for running the game
2) your game has some kind of memory protection options:

a. some kind of gamehack protect like NProtect,HackShield, IOProtect.. etc
b. a dll is injected by the luncher that prevent the game to be attached or seen by the taskmanager
c. debugger protect.. (try using HideOllydbg plugin, but i think its more like those two options above)

NOTE: if it has any of those cases you need to bypass the protection
in this case... you need to check if the file is Packed(crypted) which then
you need to unpack(decrypte) it to view the orginal code that is able to get bypassed

3) after all that.. for changing the msgbox text it can be like:

a. most of the cases it will be : PUSH EAX(for msg text) so you'll need to create a code cave that will pop your own msgbox.. (that you will create in another offset)
b. it will have a call that sets the text string (change it lol)
c. otherwise look at the code and post it here then

wish you luck,
xcracx
xcracx
05-28-2005, 06:26 PM
if you did not ment to msgbox .. now that i read your post again
i think i might made a mistake and explained you something else

anyways.. you need to check if the file is packed then unpack it..
then look at the code and

1) get the routine that sends your packet to the game host then you'll need to program something that uses that routine (depend on the programming language)

2) use WPE filters.. and replace the "hi" msg packet with "???" msg packet..
Obelix1987
05-28-2005, 09:44 PM
Thnkx im gonna try a little more with youre answer and yes this wasnt just for a message... you are betweens the lines and did see it right that well we'are trying to duplicate certain items. The problem is that figuring out how to dupe isnt the problem (atleast i think that) but getting the program to work/attach that was the problem. Thnkx anyway now i can do like mre with olly (atleast the first step :P)
Obelix1987
05-28-2005, 09:50 PM
But about the memory protect, the game that im refering to is rose online and i dunnot know if this is protected and even not how. Any suggestions how i could figure this out?. And i can see it in the taskmanager , but i just can attach it.
xcracx
05-28-2005, 11:05 PM
so for my opinion it has some dll injected

humm have you tried to use HideDebugger Plugin?

what error excatly do you get? (if its on olly attaching list.)
1bitshort
05-29-2005, 06:52 AM
Welcome to Cracking 101
skyally
05-29-2005, 07:38 AM
ÕâÀï·¢ÖÐÎÄ¿ÉÒÔÂð£¿
Obelix1987
05-29-2005, 10:23 AM
Where ca i download this Debugger plugin, cant seem to find it.. btw did some tutorials on ollydbg (especially on cracking serials etc, took me on day and now i understand alot more of olly.) Only problem cant find alot of tutorials on how to bypass/find thing with attach.... so ill have to find it out myself. Anyone who can give me a link on where to download the plugin, cant find a working link...
THnkx
Obelix1987
05-29-2005, 10:30 AM
nvmind found a working link and got the plugin/dll in my olly folder ... gonna try if i can attach trose to olly.

:(.... still can get it attached... it says; unable to attach to process Trose...

this debugger is againt dll injection or do i need to do smething completely different for fighting against dll injection.

GOT it; just use processguard and then i can attach it , tnkx you guys.
Obelix1987
05-29-2005, 12:06 PM
Next thing :P... ok ive attached olly to my client and set a breakpoint on send. Then i logged in and olly popped up, show at the TOS the location of the send call. Then im stuck there are like 3 codes;
0BF4FF80/00404B00/ Call to send from Trose.00404AFB
socket = 168
data = ... bla bla
so on but the main thing is the code in TOS so ill have to use eather 0BF4FF80
... 00404B00 or 00404AFB to get directy on the send call... now i press ctrl + g and then i use one of the codes.. but them im stuck can anyone help me out with the next step.. when im on the send call i need to see the encrypted packets *dont know where* and next ill have to find the clients send function, but how do i find the clients send function ? ....
xcracx
06-05-2005, 09:25 PM
gets the code that sends packet to the internet
should be call that is using the send function which i think you already found

find the code the creates the packet and tells the send routine you've found the specific data

and change it at will btw....
give me your msn messenger for more help
crspyjohn
06-06-2005, 12:40 AM
xcracx im working on the same thing and im at the same part heh could you help me out?

crspyjohn@hotmail.com
gulan
06-06-2005, 10:42 PM
can you help me out as well? chensongfeng@hotmail.com
eman
06-06-2005, 11:45 PM
same problem oooemanooo@hotmail.com tx
steveleeht
06-07-2005, 08:50 AM
same problem with me too ~

steveleeht@hotmail.com

THX~ alot
xcracx
06-08-2005, 10:23 AM
hum lol...

i've added you guys.. i won't help ppl that has no clue
what im talking about...

remember im not gonna teach you how.. i will help ppl that is knowladaged
hope you will know what your talking about
not only "I wanna hack a game what should i do?"

xcracx
fang_3000
06-15-2005, 10:50 PM
hey, im interested to get around hackshield
do i have to use c++ to get pass?
Bob
06-20-2005, 06:55 PM
1bitshort
Welcome to Cracking 101

Yeah.. I thought it was naughty to talk of cracking ?
xcracx
06-21-2005, 10:02 AM
fang its off topic

and you need to bypass the dll injection from hackshiled folder

hackshiled injecting an dll from its folder to the applaction
that prevent locking it by normal lock.. need to use special hooking

you need to bypass the injection then make Knights Online work
without the injection

if its knight online you need to unpack it 1st
xcracx
Erick
06-21-2005, 05:11 PM
Hi xcracx can you give me hand too? i'm trying the same as the guys but i found some points of interest, can you give me a hand too please :)
msn: cyberbrand@hotmail.com
liew985
06-22-2005, 02:03 AM
xcracx
I need help in editing raw packet.
Can you add me?
msn : lkm985@icqmail.com
neonrt2
07-02-2005, 12:24 AM
xcracx...
any chance you know of a good "how to" or where to find the info..
i've never been one to just take a download to make something work.
I'm tring to get Knight Online to work without hackshield...
then I'll do my own searching for offsets..
I'm stuck on blocking this DLL inject.

Neonrt2..
blah415
11-11-2005, 05:31 PM
hey xcracx if you wouldnt mind adding me to your msn i would like to discuss something about hackshield if you dont mind.

xamaniac@yahoo.com is my msn

thanks
hcong
01-04-2006, 02:36 PM
i m interested in crack games too ~

hcong85@hotmail.com

thx 1st
olidibag
02-13-2006, 08:40 PM
hi...if someone tells or tech us how the hackshield bypass i am very please...
first Ä± unpacked the knightonline.exe and launcher..
then run with olly but olly terminated kolauncher.exe....so i didnt do anything because hackshield is running knightonline.exe....

so please help me about bypassing hackshield...
how can i this.....help me please...

thx..
Obelix1987
02-18-2006, 12:02 AM
@ Crack add me Mike.Taselaar@gmail.com.. I know its some time ago, but I really wanna understand this better.


OllyDbg site was shut down

RCE Messageboard's Regroupment > Announcements > OllyDbg site was shut down
_Servil_
05-30-2005, 03:34 PM
OllyDbg site was killed by unknown powers: http://home.t-online.de/home/Ollydbg/ not anymore

this is not only reversing site shut down in germany now...
joe
05-30-2005, 03:45 PM
What now??? I have Olly 1.10, but new users?
hosiminh
05-30-2005, 03:50 PM
hxxp://kacper.qwe.pl/strefa_zrzutu/odbg110.zip

hxxp://www.phatcode.net/downloads.php?id=115
Ricardo Narvaja
05-30-2005, 10:51 PM
Olly don´t return my mails? Any know news of him? TBD you know any new?

Ricardo Narvaja
ssb
05-31-2005, 06:16 AM
It looks that Ollydbg is going to be just another dead project.
Really hope I'm wrong :(
nick_name
05-31-2005, 07:53 AM
Noooooooooooooo , it cant be
ssb
05-31-2005, 10:44 AM
Noooooooooooooo , it cant be

I hope not, but I have months to hear news from Olly. And now main site went down :(
TBD
06-01-2005, 05:20 PM
unfortunately he didnt respond to the email that I sent to his work address. I hope everything is ok.
thefool
06-01-2005, 06:30 PM
heh im a new user so this is my first post:

i definently dont hope its shutting down. I have been using ollydbg as an dissassembler and found nothing better. i was just now learning about the debugger that it has too! (i know the debugger might be the biggest part of olly, but it really does have an fantastic disassembler too..!)

damn this was one of my most used tools as im a programmer. Sometimes the languages internal debugger just wasnt enough (purebasic that is). also to test my crackme's i wander around and makes.. And the c++ programming i was looking at. And the asm programming i was looking at..
and much more..

i was really hoping to see version 2.0 sometime.. i really hope it comes. I would even pay for this software (if it wasnt overpriced as most other software is.. i mean, so the author could earn a little $$ out of this..)
thefool
06-09-2005, 04:03 PM
thank you for welcoming a new user. please disable my account..
Chibi
07-09-2005, 10:43 PM
http://www.net-force.nl/library/downloads/
http://www.ollydbg.de/
See? The page is still there. The email address might be wrong tho.
zbx6304430
01-21-2006, 07:00 AM
god!
see a bad news once i registered~~~
jzwjk
02-16-2006, 12:35 AM
New Site :
http://www.ollydbg.de/


just wondering (java JNI DLL-call)

RCE Messageboard's Regroupment > General > just wondering (java JNI DLL-call)
JIT
05-31-2005, 10:17 AM
greetings,

I am not much into cracking. My target is a (flexlm 9.2) DLL called by a java application via JNI. IDA quickly tells me where to set the breakpoint. In SI I declare the DLL as an export, set my BPX and I am done.

Can I (how) set a similar BP in Olly? The application is started from .exe java starter and the DLL belongs to the corrosponding javaw.

cheers JIT

p.s. a standalone debugging of the DLL won't help me
bud_gd
06-26-2005, 12:05 AM
bg: If you are not much into cracking what the F**k are you doing here?
oh me anon
06-26-2005, 07:56 AM
bud_gd would you please mind the words when you post on a public forum
i see this is your second post with the big F and in what way the reply helps the poster ???
what he does is his concern not yours or mine as long as he doesnt cross certain thin invisible lines

to jit
you need to set a bp on on a dll function in ollydbg
view-->executable modules -->find your dll -->select it and right click -->view names --> find the function --> hit f2 and you are done with the break point for the session

if you need the break point to be persistent for all further session
analyze the module and hit f2 after analysing ollydbg will save your break point

if the dll is not loaded by default but loaded dynamically using load library
option --> debugging option --> event ---> stop on new module load
when it stopped on your module set your bp

also you can use commandline plugin to
set bps on dlls apis
bp mycrapdll.myuselessfunction


ENTER command

RCE Messageboard's Regroupment > General > ENTER command
rama711
05-31-2005, 10:20 AM
HI guys:

How do I debug "Enter" command
I have this exe I want to know what function is called when press ENTER on the keyboard....and can it be change from Enter to like shift or F2 for example
thankx
Ricardo Narvaja
05-31-2005, 11:10 AM
there are many methods for a program detect a key pressed, i suggest to you download winapis32, and in the search press the word key and you have all the posibilities for try break in the api used or MSG.

Ricardo Narvaja
rama711
05-31-2005, 11:54 AM
thanks Narvaja
but can you tell me what link to download winapis32
and what is it for?
Ricardo Narvaja
05-31-2005, 12:23 PM
is the list of the apis available more common and the MSG ny microsoft, if you have a idea from a key enter by example, you go to winapis32 and search key and tle list of apis and msgs when the key is used, make to you an idea in what apis you can try set a breakpoint.

put win32.hlp in goggle and you have many links to download, look there are varios versions look for the more new (winth more apis)

Ricardo Narvaja
rama711
05-31-2005, 12:49 PM
I searched and I could not find such API Hook SDK
rather ifound API Hook SDK
will this help me
can u explain more what is winapis32 fo what is the purpose of it
does it contain codes ????!!!!
Ricardo Narvaja
05-31-2005, 02:22 PM
no contain descrption of the apis with the parameters is used by programmers but for the crackers is a big help for look the correct api for breakpoint.

downlaod the archive

win32.hlp

and look

Ricardo
rama711
06-01-2005, 12:39 PM
Were can I ger this Win32.hlp
please tell
Ricardo Narvaja
06-02-2005, 12:03 AM
http://www.ricnar456.dyndns.org/ESPECIAL/winapi32%20NEW.rar

click this link

Ricardo Narvaja
rama711
06-05-2005, 10:59 AM
HI Narvaja
Why things have to be difficult with me!!!
I could not go through the link u gave me above. This is what Igot
The page cannot be displayed
Please be patient with me and send me another link
Ricardo Narvaja
06-05-2005, 12:08 PM
try the link is working maye you try in a moment is down, is this moment is working, other link i haven´t, sorry

Ricardo Narvaja
rama711
06-05-2005, 12:21 PM
Thank god it is downloading now is it 11.7 MB?
now refresh me what Iam going to do with this file
after I unzip it and how it relate to ollydbg
I want to catch this damn dialog box
can I send u a gif picture of this dialog?
Regards
rama711
06-07-2005, 06:44 AM
what Iam going to do with this file


------------ABOUT OllyDbg v1.09b-----------

RCE Messageboard's Regroupment > General > ------------ABOUT OllyDbg v1.09b-----------
labanino
06-01-2005, 01:15 AM
Hello everyone! I've been trying to download OllyDbg v1.09b or v1.10 with no luck. The sites I've found are german and arabic (SORRY, DON'T SPEAK THOSE LANGUAGES) Any help? Thanks!
ViX
06-01-2005, 10:02 AM
There's ollydbg1.10 @ http://www.crackingislife.com/downloads/dasm/odbg110.zip

if u want 2 download.


debugging a plugin for iexplorer

RCE Messageboard's Regroupment > General > debugging a plugin for iexplorer
kes
06-01-2005, 02:55 AM
Hello i'm trying to understand what does a plugin for internet explorer, and i use olly to do it.

However when i attach iexplorer to a process it crash the windows.
(acces violation, and with shift + F7 it gives nothing)

Since this plugin is a dll is it possible to understand what does this plugin with iexplorer ?

(i tried to load the plugin in olly but off course it can't check the requests done in iexplorer)

If someone has a solution to do the job, thanks for his help.


help! help!

RCE Messageboard's Regroupment > General > help! help!
cridia
06-01-2005, 01:47 PM
I am now cracking a shareware ,I found that both exe and dll file were packed with UPX.i unpacked

the exe file and run correctly.Do I need to unpack the dll file?
joe
06-01-2005, 03:33 PM
No, if protection is only in exe file!
joe
06-01-2005, 04:25 PM
But this isn't forum for cracking !!!
cridia
06-02-2005, 12:53 AM
yes ,but I use Ollydbg.I think here have numbers of good cracker!thanks! you mean I don't have to unpack dll file?
ViX
06-02-2005, 07:03 AM
no u don't have 2 unpack the dll


OllyDbg Heap Vis Plug-in

RCE Messageboard's Regroupment > Plugins > OllyDbg Heap Vis Plug-in
pedram
06-01-2005, 07:12 PM
You may have noticed the ghosted 'Heap' option under the 'View' menu in OllyDBG. The feature is available only under Windows 95 based OSes and is supposed to display a list of allocated memory blocks. The Olly Heap Vis plug-in was written to provide this functionality and more on all modern Windows OSes such as Windows 2000, XP and 2003. The OllyDbg Heap Vis plug-in exposes the following functionality:

- View Heaps
- Search Heaps
- Jump to Heap Chunk
- Create Heap Visualization

More information, screenshots and source code are available in the bundled archive hosted at:

http://www.idefense.com/iia/labs-software.jsp#olly_heap_vis
oh me anon
06-02-2005, 05:36 PM
hey pedram it kinda freezes on my ollydbg
w2k-sp4 ??
also in a clean unzipped dir with only this plugin and default cmdline plugin it executes the debugee :( not every debugee i mean it doesnt execute iczelions tut-02 but i have some antidebugged samples that i coded it executes them :( yeah i have the source but still i thought it would be good to whine first before looking further :)
oh me anon
06-02-2005, 06:00 PM
ok some update it was continously executing the thread so i used task manager to kill the debugee and my jit ollydbg popped up on the kill :)

here is the call stack

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012E154 77EBA812 KERNEL32.77EBB49C KERNEL32.77EBA80D 0012E150
0012E184 10001C48 <JMP.&KERNEL32.CreateToolhelp32Snapshot> olly_hea.10001C43 0012E180
0012E188 00000001 Flags = TH32CS_SNAPHEAPLIST
0012E18C 0000012C ProcessID = 12C
0012E1E8 0049664B Includes olly_hea.10001C48 OLLYDBG.00496649 0012E200
0012E204 0043420F OLLYDBG.004965E4 OLLYDBG.0043420A 0012E200
0012F4F4 77E13EB0 Includes OLLYDBG.0043420F USER32.77E13EAD 0012F4F0
0012F514 77E1401A ? USER32.77E13E98 USER32.77E14015 0012F510
0012F518 004323D4 Arg1 = 004323D4
0012F51C 004801C0 Arg2 = 004801C0
0012F520 00000111 Arg3 = 00000111
0012F524 0000E0C0 Arg4 = 0000E0C0
0012F528 00000000 Arg5 = 00000000
0012F5A0 77E192DA USER32.77E13F12 USER32.77E192D5 0012F59C
0012F5AC 00439442 <JMP.&USER32.DispatchMessageA> OLLYDBG.0043943D 0012FF88
0012F5B0 0012F5C0 pMsg = WM_COMMAND hw = 4801C0 ("OllyDbg - mytls.exe") Notify =
0012FF8C 004AD357 Includes OLLYDBG.00439442 OLLYDBG.004AD354 0012FF88

sorry for that unaligned dispaly may be you can copy paste to not pad and format it :)

any way it was looping on this seh handler
Log data, item 1156
Address=77EBB531
Message=Access violation in KERNEL32 ignored on request

the seh chain

SEH chain of main thread
Address SE handler
0012F58C USER32.77E61D49
0012FFB0 OLLYDBG.004A44B8
0012FFE0 KERNEL32.77EA13FD

if i shift f7 or f8 or f9 it loops out that ignored on request

the offending call seems to be ollyheap
Includes olly_hea.10001C48

well it is primary and run of the mill analysis at first sight
so if some thing is wrong from my end i am sorry :)
oh me anon
06-02-2005, 06:21 PM
ok it seems heap32next Creates thread

77F9E76A E8 C2FA0000 CALL ntdll.RtlCreateUserThread

77F9E77C E8 3BE0FEFF CALL ntdll.ZwSetInformationThread

77F9E7AD E8 1D44FEFF CALL ntdll.ZwResumeThread

and this notification is caught by my dll

during DLL_THREAD_ATTACH
and it executes the code inside that it seems :)

hope i am right :)

here is the call stack of your dll loaded on ollydbg over ollydbg :)
Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012E118 77F9E7B2 ? ntdll.ZwResumeThread ntdll.RtlQueryProcessDebugIn
0012E160 77EBAAE5 ? ntdll.RtlQueryProcessDebugInformation KERNEL32.77EBAADF
0012E164 00000360 Arg1 = 00000360
0012E168 00000014 Arg2 = 00000014
0012E16C 000000E0 Arg3 = 000000E0
0012E184 10001DB7 <JMP.&KERNEL32.Heap32Next> olly_hea.10001DB2 0012E180
0012E188 03EF0000 pHeapentry = 03EF0000
0012E1E8 0049664B Includes olly_hea.10001DB7 OLLYDBG.00496649
0012E204 0043420F OLLYDBG.004965E4 OLLYDBG.0043420A
0012E208 00000000 Arg1 = 00000000
0012E20C 0000E080 Arg2 = 0000E080
0012E210 00000000 Arg3 = 00000000
0012F4F4 77E13EB0 OLLYDBG.004323D4 USER32.77E13EAD 0012F4F0
0012F4F8 001B0250 Arg1 = 001B0250
0012F4FC 00000111 Arg2 = 00000111
0012F500 0000E080 Arg3 = 0000E080
0012F504 00000000 Arg4 = 00000000
0012F514 77E1401A ? USER32.77E13E98 USER32.77E14015 0012F510
0012F518 004323D4 Arg1 = 004323D4
0012F51C 001B0250 Arg2 = 001B0250
0012F520 00000111 Arg3 = 00000111
0012F524 0000E080 Arg4 = 0000E080
0012F528 00000000 Arg5 = 00000000
0012F5A0 77E192DA USER32.77E13F12 USER32.77E192D5 0012F59C
0012F5AC 00439442 <JMP.&USER32.DispatchMessageA> OLLYDBG.0043943D 0012FF88
0012F5B0 0012F5C0 pMsg = WM_COMMAND hw = 1B0250 ("OllyDbg - mytls.exe") Notify
0012FF8C 004AD357 Includes OLLYDBG.00439442 OLLYDBG.004AD354 0012FF88
pedram
06-02-2005, 06:44 PM
oh me anon,

Thanks for the QA testing. Weird as I have never come across this. Anyone else seeing this issue? The only time I've had a problem is when the heap is corrupted, which can be expected as the plug-in relies on the Heap32xxx() API. In a future version I will move away from the API.

The issue could be OS related as within the OllyDbg help file you can find the following excerpt regarding heap enumeration:

"This API is not implemented on Windows NT and hangs OllyDbg on Windows 2000..."

However in my testing I never came across this issue with my plugin (win2k is not my primary platform however). Please drop me an e-mail directly with an example file that is causing issues so I can look into this further.

pedram.amini [at] gmail

Thanks again.
TQN
06-09-2005, 12:44 AM
It hang on my machine: WinXP sp1 and Win2K Test server.
TQN
06-10-2005, 02:33 PM
Why forum said: Access denied when I choosed Edit my post !!!
Hi pedram !
Your plugin somtime hang or crash on my machine when I click Create Heap Visualization.
With your source code, I rebuild your plugin, debug it, and I think I found the bug. The bug occurs in the Browsefilename (or olly_browse_filename function which you redefined). The char array "char filename[MAX_PATH]" was not initialized and contained garbage data. After I change it to:
"char filename[MAX_PATH] = { 0 }; ", the bug fixed.
Regards,
TQN
pedram
06-11-2005, 04:21 AM
TQN (and oh me anon),

Thank you both for the bug reports. I've fixed the "official" release:

http://www.idefense.com/iia/labs-software.jsp#olly_heap_vis

-pedram
oh me anon
06-11-2005, 11:36 AM
you mean for regular process not for exotic processes dont you ?? :)
yep works for regular procs :)
digraph heap_vis
{
graph
[
label = "Heap Vis",
fontname = "courier",
ratio = "compress",
];


Lastest Version

RCE Messageboard's Regroupment > General > Lastest Version
paq7512
06-01-2005, 09:31 PM
Where could i download the lastest version with all the features included? Thanks for you time.
paq7512


NtGlobalFlagPlugin for ollydbg

RCE Messageboard's Regroupment > Plugins > NtGlobalFlagPlugin for ollydbg
oh me anon
06-03-2005, 06:33 AM
this plugin helps to log all the debugstrings that are emitted by the windows loader during the initialisation of the process

it can log the tls cllabacks if any and the function that is called during the
initialization

the plugin comes with source and some test samples

the whole story and download is here

hxxp://www.reversing.be/article.php?story=20050527190528983
edit xx to tt
oh me anon
06-04-2005, 11:18 AM
the plugin has been updated
it can now break on TlsCallbacks as well as Dll init routines

story here
hxxp://www.reversing.be/article.php?story=20050603193932184
edit xx to tt
TQN
06-05-2005, 09:20 AM
Does it work with HideDebugger plugin ? On ExeTools forum, I have a discussed about this issue.
oh me anon
06-06-2005, 12:33 PM
TQN
if you are talking about the thread using tls in olly
then it looks like you are reiterating the same points which were already pointed out to to you in earlier replies by the topic starter
i dont see anything new being pointed out by you

or are you talking about some other thread ?? if yes some pointers would be helpful

here is a log that is generated by this plugin on the test sample that accompanies the package

Log data
Address Message
OllyDbg v1.10
Bookmarks sample plugin v1.06 (plugin demo)
Copyright (C) 2001, 2002 Oleh Yuschuk
Command line plugin v1.10
Written by Oleh Yuschuk
Hide Debugger v1.2.3f
Copyright (c) 2005 by Asterix
NtGlobalFlag Plugin v1.10
Dedicated to oleh yuschuk author of this Debugger
authored by stingduk
and thanks to Detten for cing my asm

File 'C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\mytls.exe'
New process with ID 00000B88 created
00401000 Main thread with ID 00000CAC created
00400000 Module C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\mytls.exe
10000000 Module C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\kernl.dll
77D40000 Module C:\WINDOWS\system32\USER32.dll
77F10000 Module C:\WINDOWS\system32\GDI32.dll
7C800000 Module C:\WINDOWS\system32\kernel32.dll
7C900000 Module C:\WINDOWS\system32\ntdll.dll
CRC changed, discarding .udd data
7C901230 System startup breakpoint
Hide Debugger <Failed to apply protection against TerminateProcess>
7C946E68 Debug string: [b88,cac] LDR: Real INIT LIST for process C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\mytls.exe pid 2952 0xb88
7C946E68 Debug string: [b88,cac] C:\WINDOWS\system32\GDI32.dll init routine 77F163CA
7C946E68 Debug string: [b88,cac] C:\WINDOWS\system32\USER32.dll init routine 77D50EB9
7C946E68 Debug string: [b88,cac] C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\kernl.dll init routine 10001000
7C946E68 Debug string: [b88,cac] LDR: GDI32.dll loaded
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: - Calling init routine at 77F163CA
7C946E68 Debug string: [b88,cac] LDR: USER32.dll loaded
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: - Calling init routine at 77D50EB9
7C946E68 Debug string: [b88,cac] LDR: kernl.dll loaded
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: - Calling init routine at 10001000
7C946E68 Debug string: LDR: Tls Callbacks Found. Imagebase 00400000 Tls 0040403E CallBacks 00404000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 00402000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 0040201B
00401000 Program entry point
<---------------- snip ----------------------->
7C946E68 Debug string: LDR: Refcount msvcrt.dll (1)
7C946E68 Debug string: LDR: Refcount ADVAPI32.dll (1)
7C946E68 Debug string: LDR: Refcount RPCRT4.dll (1)
7C946E68 Debug string: LDR: Refcount ADVAPI32.dll (2)
7C946E68 Debug string: [b88,eac] LDR: Real INIT LIST for process C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\mytls.exe pid 2952 0xb88
7C946E68 Debug string: [b88,eac] C:\WINDOWS\system32\msvcrt.dll init routine 77C1F2A1
7C946E68 Debug string: [b88,eac] C:\WINDOWS\system32\RPCRT4.dll init routine 77E76284
7C946E68 Debug string: [b88,eac] C:\WINDOWS\system32\ADVAPI32.dll init routine 77DD70D4
7C946E68 Debug string: [b88,eac] C:\WINDOWS\system32\uxtheme.dll init routine 5AD71626
7C946E68 Debug string: [b88,eac] LDR: msvcrt.dll loaded
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException

<----------------------- snip ------------------------------>
7C946E68 Debug string: - Calling init routine at 5AD71626
7C946E68 Debug string: LDR: LdrLoadDll, loading uxtheme.dll from C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe;C:\WINDOWS\system32;C:\WINDOWS\sys tem;C:\WINDOWS;.;C:\ WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\Sys
7C946E68 Debug string: LDR: Refcount msvcrt.dll (2)
7C946E68 Debug string: LDR: Refcount ADVAPI32.dll (3)
7C946E68 Debug string: LDR: Refcount RPCRT4.dll (2)
7C946E68 Debug string: LDR: Refcount ADVAPI32.dll (4)
7C946E68 Debug string: LDR: Tls Callbacks Found. Imagebase 00400000 Tls 0040403E CallBacks 00404000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 00402000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 0040201B
7C946E68 Debug string: LDR: Tls Callbacks Found. Imagebase 00400000 Tls 0040403E CallBacks 00404000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 00402000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 0040201B
Thread 00000EAC terminated, exit code 0
7C946E68 Debug string: LDR: PID: 0xb88 finished - '"C:\Documents and Settings\Administrator\Desktop\NtGlobalFlagv1[1].1\NtGlobalFlagv1.1\te stexe\mytestexe\mytls.exe"'
7C946E68 Debug string: LDR: Tls Callbacks Found. Imagebase 00400000 Tls 0040403E CallBacks 00404000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 00402000
7C90EBAC Conditional breakpoint at ntdll.RtlRaiseException
7C946E68 Debug string: LDR: Calling Tls Callback Imagebase 00400000 Function 0040201B
77E70000 Module C:\WINDOWS\system32\RPCRT4.dll
Process terminated, exit code 0
TQN
06-09-2005, 12:42 AM
Hi oh me anon !
I take some time to test your plugin, and it not work with two my machine: WinXP sp1 and Win2K Test Server. It shows the message box: "strings are not equal" and Assemble dialog shows at 77F708b6 with command: "jnz 77F8083C"
Regards,
TQN
oh me anon
06-09-2005, 10:53 AM
well i tested it in winxp-sp1 ,winxp ,winxp -sp2 ,w2k all four service packs

i think you have disassemble in lower case option selected in
options --> debugging options--disasm (not on by default)
so StrCmpN from shlwapi.h is throwing that messagebox
as it is comparing with "JNZ " not "jnz "
may be you could confirm if that is the problem
TQN
06-09-2005, 03:20 PM
Hi oh me anon !
Yes, the problem is disassemble lowercase. If I uncheck the "Disassemble in lowercase" checkbox, your plugin run fine.
oh me anon
06-09-2005, 06:10 PM
thanks for confirmation TQN
so it runs well along with HideDebuggerPlugin active i assume from your comment :)
probably ill try to add strtoupper() or nest one more compare in between
to avoid this
thanks for testing :)
TQN
06-10-2005, 03:04 AM
Hi oh me anon !
I take a look into your source code. Good source code ! You call StrCmpN function at 2 point. You can change the call to StrCmpN function to strnicmp function in C RTL, and you can remove the include of ShlWapi. I don't have C++Builder/BCC and I lazy to recompile it with VS.
Good plugin !
Regards,
TQN
TQN
06-10-2005, 09:40 AM
I made the change from StrCmpN to strnicmp, create VS .NET project and recompile it. All things OK ! But I found a small bug. I think it will not occur in BCC++ compiler, but happen with VC++. Two variable: int breakontlscallback and int breakondllinitrout was not initialized at startup, so they will have random values. I change them to:
int breakontlscallback = 0;
int breakondllinitrout = 0;
Thank for your plugin !
oh me anon
06-11-2005, 11:50 AM
thanks its nice to know the source compiles wtihout problems in other compilers too


nOOb Question :( Sry for nOObisme

RCE Messageboard's Regroupment > General > nOOb Question :( Sry for nOObisme
baxis
06-03-2005, 01:05 PM
Hi,

I'm new in the world of disassembly, and i want to try ollydbg.
My first question :
How can i say to olly, make a break when anywhere in the memory you see "coucou".
I think that it's with breakpoint>set_condition, but i'm don't manage to find a list of expression annd how to use it.

I looking for something like
if memory like '%coucou%'
make_breakpoint
endif

in a upper level of code.

My second question :
When i manage to do what i want manually (i want to send a new packet when the program send a particular packet), can i devlop a program that do my action automatically by pressing a key for example.

Thanks by advance.
oh me anon
06-03-2005, 01:51 PM
well your explanations are not clear you should be looking at writing a custom debugger to suit your need
i dont think any general purpose application would be
doing this kind of search it is very exhaustive requirement to the least

well if the above rambling doesnt make sense ill tell what i assume of your request

execute one single instruction
recheck_routine:
parse the whole process memory for a specific string (can be 4 gb of space theoratically)
if found { do my bidding}
if not execute second instruction
jump to rechecking routine

is that what you are aiming at ?? :)

if not and you have narrowed down you requirement to a certain
memory place like a dword in data section or a register content
or in stack or in heap

then ollydbg can do it without problems

look at ollydbg help and search for expression help

you will find STRING [your memory place]

for example taking Createfile api for example
HANDLE CreateFile(

LPCTSTR lpFileName, // pointer to name of the file
DWORD dwDesiredAccess, // access (read-write) mode

you can set STRING [esp+0x4] == "your file name" on the first instruction of procedure so if the program is creating 1000s of files
olly will parse every file name and will break when it is opening your named file

hope that is what you are looking for
bud_gd
06-25-2005, 11:45 PM
everything I have learned,PACKET SENDIND? Cracking or hacking?
bud_gd
06-25-2005, 11:48 PM
I will help no one hack! Reverse Engineering is A Skill most likely advancing to .ASM of a sort, Hopefully.


OllyDbg 2 news

RCE Messageboard's Regroupment > Announcements > OllyDbg 2 news
TBD
06-03-2005, 01:37 PM
just received an email from Oleh:

* he is ok, T-Online shut the website
* there are too many emails sent to him - please use this forum to ask questions (read the posts before asking )
* www.ollydbg.de (http://www.ollydbg.de) (probably) will be the new home of OllyDbg
* "I have finished the known data and am working on assembler. Known data now includes not only the functions and constants, but also structures and return values. Analysis is excellent and relatively fast."
* "size of my sources is already 2060 kilobytes"

do not ask when it will be released. it will be when it is ready to be released ;)
1bitshort
06-03-2005, 01:52 PM
TBD thanks for passing on the update :)

> he is ok,
great to hear! i think i speak on behalf of everyone when i say that

> T-Online shut the website
probably costing them too much traffic, that's the problem with quality software

> www.ollydbg.de (http://www.ollydbg.de) (probably)
ssshh, not if somebody registers it first ... :(
domain: ollydbg.de
status: free

> "Analysis is excellent"
Oleh, we already know this :)
oh me anon
06-03-2005, 01:56 PM
wow that is excellent news to hear i had mailed him and didnt recieve any reply for the last 1 month and few days ago i saw the shut down news and felt too sad :)
this is indeed a very good news thanks tbd for sharing the news
arjuns
06-03-2005, 04:47 PM
Hurrey !!! at least we could listen to Oleh , Thank u TBD for writing on this post With Oleh real message.
May god bless all ...
nick_name
06-03-2005, 04:58 PM
thanks OLEH , thanks TBD
it's really nice to hear ollydbg is still there for us
Ricardo Narvaja
06-03-2005, 06:12 PM
very good new thanks TBD

Ricardo Narvaja
TBD
06-03-2005, 07:34 PM
here is the first OD2 screenshot (http://tinypic.com/5ml8aa)
joe
06-03-2005, 10:58 PM
I can't link to http://www.ollydbg.de/
What's problem?
jayte
06-04-2005, 01:40 AM
Excellent news, on all counts.
Ricardo Narvaja
06-04-2005, 02:00 AM
To joe, in the OLEH mail he say,

> www.ollydbg.de (http://www.ollydbg.de) (probably)
ssshh, not if somebody registers it first ... :(

in the future this link, maybe OLLYDBG home, not now

Ricardo Narvaja
1bitshort
06-04-2005, 04:07 AM
I just hope this sneak preview doesnt result in Oleh being bombarded with emails by every kid and his dog asking "when will it be released? can i have a beta copy?"
It'll only pointlessly slow him down, so please folks - just let Oleh do his thing!
TBD
06-04-2005, 07:37 AM
as Olly will not use anymore T-Online, the email will be soon deleted. so, better ask your questions here. hehe
ViX
06-05-2005, 03:33 AM
where can i download the new ollydbg v2.00?
1bitshort
06-05-2005, 05:29 AM
> where can i download the new ollydbg v2.00?

heh, TBD i rest my case ;)
ssb
06-06-2005, 03:56 PM
Great news.
Thanks TBD :)
kimmal
06-10-2005, 01:16 PM
How can i register for OllyDbg 2.0 now ?
and Where can i download it ?
:)
thefool
06-16-2005, 11:44 PM
what can i say? great news!
Teerayoot
06-20-2005, 08:31 PM
yes great news!
Thank a lot.
kittmaster
06-30-2005, 01:42 AM
That is great news. The interface looks nice and fresh. Can't wait for the release!!

Glad he is doing ok, he has a lot of fans......:)

Chris
ftts
09-01-2005, 12:25 PM
I'd like the new edition of ollydbg is not same as the 1.1 edition,
when debug a program and run it the CPU useing is 100%.
Shark3d
09-06-2005, 12:43 PM
Where can i download the ollydbg v2.00???
ssb
09-07-2005, 09:26 AM
Where can i download the ollydbg v2.00???

There is no v2.00 yet.
I'm not sure if it will ever release :(
thefool
09-20-2005, 07:06 PM
again? i emailed the author a while ago, and he IS working on it.
ssb
09-21-2005, 09:15 AM
i emailed the author a while ago, and he IS working on it

Thanks for news, I hope it will be release soon.
SVz
11-17-2005, 02:46 PM
TBD could you repost or send me the sceenshot please ?
Link is no more working for me :(
Bob
11-17-2005, 11:14 PM
Works for me
SVz
11-18-2005, 07:23 AM
Yep works now ! :)
ssb
11-19-2005, 07:14 AM
But still only a screenshot :(
miniC
11-19-2005, 07:35 AM
1st post => Posted: 3 Jun 2005 09:37:17
last => Posted: 19 Nov 2005 09:30:17
...
...
OllyDbg 2 is here => Posted: 3 Jun 2007 09:37:17
:)

miniC
helloword
01-12-2006, 08:47 PM
Some news screen shot or progress can be nice to hear
stanislavdimov
01-14-2006, 11:54 AM
olydbg v2 link? http://tinypic.com/5ml8aa


Memory/Packet Editing

RCE Messageboard's Regroupment > General > Memory/Packet Editing
SYNCOPATE
06-03-2005, 06:43 PM
Hi!

Finally I found the breakpoint for a special game.
Now, I'm currently stuck on the next part. I've heard
that I have to edit the memory and/or packets so
I can duplicate items. I hope that some here are able
to help me out just a bit (any kind of help will be appreciated)

- SYNCOPATE
SYNCOPATE
06-03-2005, 07:43 PM
Answer =P
Ricardo Narvaja
06-04-2005, 01:55 AM
i don´t answer if i don´t understand the question, i don´t speak english well, and don´t understand english well too, and don´t understand your question, sorry.

Ricardo Narvaja
bill
06-04-2005, 03:28 AM
could this game be...rose? lol
baxis
06-04-2005, 06:32 AM
I see that many persons are currently working on rose debug :)

I think that i have find the place like you where the game construct the packet for item placing.
But the problem is what do we have to process in order to re-send the
packet ?

The goal is to do two different things, let rose send the packet, maje a jump to the good line and edit the content of the packet to modify the position.

My real question : How can i (in ollydbg) make a manually jump (because he don't let me add the line JMP FFFFFF).
SYNCOPATE
06-04-2005, 07:40 AM
Probably.
baxis
06-04-2005, 08:32 AM
Have you try to edit the program with ollydbg, i dunno how to make him send two packects instead of one.
Normally a simple jump instruction with an update of data will solve the problem.
baxis
06-04-2005, 08:51 AM
A question for u Syncopate, i saw in another forum that u know that Matt has working hard to find, and have finally really find how to dupe.

But why did he didn't share with you what he found ?
Nonameo
06-05-2005, 03:30 PM
If we're talking about game hacking, i would recommend using WPE Pro for the packets and tSearch for finding any memory values (i.e. money etc...)

hope this helps

-Nonameo-
baxis
06-06-2005, 07:58 AM
Yes i agree with u Nonameo, but the encryption don't let us edit anything in the packet.

So we must find and code a seacond call to packet encription
Nonameo
06-06-2005, 09:18 PM
oh right. sorry lol, havent played the game. but i played a game called MTA which is a multiplayer mod for GTA Vice City.

in MTA 0.5 they used a Rijndael (Aes) encryption on their packets.

the encrytion is government standard, but their client wasnt lol

we got it in the end ! was fun, the whole mod communtiy pulled together.

hope the same happens with your game

-Nonameo-
arioco
06-07-2005, 03:15 AM
It's an online game where we found the breakpoint before the packet is encrypted and send to server, but we don't know how to edit it.
------------------------------------------
Ricardo, se trata de un juego online, donde han encontrado el breakpoint donde esta el paquete desencryptado (RAW paquet que lo llaman), luego se encripta y se envia al servidor a traves de WS2_32.send el problema es que no sabemos donde editarlo. puedes ayudar?
Vivi
06-07-2005, 07:27 AM
I've also recently started to try and dupe on this game. I've found the trade packet that I need and I've tried to manipulate the position of the item and it's quantity but nothings working yet.
mikeb
08-17-2005, 11:22 PM
ever try to decrypt and filter out your packet.You could possibly do a drop dupe , where you drop 1 of a certain item but u make server think u dropped 90 or whatever variable you wish?
phat
08-22-2005, 03:30 PM
mikeb: im trying to do that atm, i can see the number of items before being dropped, for ex. i drop 100 apples then change it to 10, but when i try to drop more than the max item i have, it will only drop the real amount i have.

also im trying the exp hack, i can see how much im getting when i kill an enemy but when i edit the packet i still get the original amount, i think i need to somehow resend the packet mulitiple times, or make olly recieve the packet multiple times? is there such a procedure or command?

i apologize if im talking non-sense, im just new to ollydbg =)
g3nuin3
08-23-2005, 05:35 PM
well, in order to decrypt roses packets theres alot of analysing, if youve managed to breakpoint right before the encryption routine, then youre on a good track, then theres the hard part of figuring out the decryption routine, You can use a software L.Spiro wrote to better analyze this thru his neat disass and debugger. you can also bp on the winsock dll's.

http://www.gwforum.ca/l-spiro/index.php
phat
08-24-2005, 12:17 AM
o thanks for the reply g3nuin3 ^_^
g3nuin3
11-01-2005, 06:21 PM
the new updated working link is http://www.memoryhacking.com for anyone who cares :)


How to debbug a program that have antidebugging routines

RCE Messageboard's Regroupment > General > How to debbug a program that have antidebugging routines
Cyph8r
06-03-2005, 10:09 PM
i/m trying to debbug a program but it crashes before start and i can do nothing can anybody help me
joe
06-03-2005, 10:54 PM
Search for ExitProcess & then jumps to it.
joe
06-04-2005, 12:15 PM
Or try to use IsDebuggerPresent
oep
06-13-2005, 11:12 AM
Hi, joe, I have the same question, But the program has detected OD, SOFTICE, ICEXT, REGMONE and so on.
And I don't know HOW the program examined the above list, Then HOW can I do then?
joe
06-13-2005, 05:15 PM
IsDebuggerPresent can help with some protection, but protections are in progress too. First of all, if it not works, You must detect protection system (FrogsICE can detect some). Then to read many tutorials about protections (for example http://woodmann.com/crackz/).
It's possible to find in the net some CrackMe with different sollution.
If I try to debugge program with protection I search for diferent behaviour (exit, warnings, ...), it can tell You what You can do.
Bob
06-20-2005, 06:48 PM
If it crashes before loading, try setting the TLS index to 0..
you can use LordPE to do this easily..


How ollybug works

RCE Messageboard's Regroupment > General > How ollybug works
jimmy
06-04-2005, 02:23 AM
yes i tried to read the tutorial on ollybug but the thread has been closed anyone else know a full on tutrial about this progrma thats simple enough for a none computer person?
1bitshort
06-04-2005, 04:09 AM
I dont know which tutorial youre referring to sorry, but first things first ... read the help file that comes with Ollydbg. There's a lot of very useful information in there and it will teach you how to use most of the main features.
jimmy
06-05-2005, 02:11 AM
thanx alot


how do you find an encryption fuction?

RCE Messageboard's Regroupment > General > how do you find an encryption fuction?
WereZ
06-04-2005, 07:05 AM
i do not fully understand wat and how to find an encryption fuction pls if any of you know pls reply to this topic thnx!
xcracx
06-08-2005, 10:42 AM
it depend on your executable protection...

its something you need experience to recognize the protection
then tweak it :p

xcracx


value edit

RCE Messageboard's Regroupment > General > value edit
oni
06-04-2005, 01:32 PM
hi I have a problem, I've managed to capture the unpacked values, in the stack window, it displays the hexes which represents my did onscreen game, this includes a window consist of slots (my weapon inventory) and the items which I have dragged onto each slot

now in the stack window, I manage to tell the slot which an item is in, the item name (in hex), and the amount of that item, I'm trying to copy the item from slot 1 into slot 2 with the item still in slot 1, so the result would be slot1 has item A and slot 2 also has itemA, how would I change the hex to get that effect

also how can I edit the hex ??

thanks any help would be appreciated
Ricardo Narvaja
06-04-2005, 08:27 PM
in the stack? mark the value, right click and press MODIFY

Ricardo
oni
06-05-2005, 01:22 AM
yea it's in the stack and I tried to do that, though I don't think I managed to change the values correctly to make the same item appear two times in slot1 and slot2

here is what another person said to do

When you put an item into a trade window, you send a packet saying "put item from pos X in inventory to pos Y in trade window". If you put an item twice in the trade window, in different positions, you dupe it

how can I use this when I change the values in the stack ??

thanks for your help
Ricardo Narvaja
06-05-2005, 11:49 AM
i can tell you how change values in the stack (rigth click modify) the correct value to put is a special case, and i need to view the program for tell you.

Ricardo Narvaja
xcracx
06-05-2005, 09:36 PM
lol just use WPE Record the packet

get the item back to the old position...and send the packet twice
that should work from what that man said to you
daihashi
06-06-2005, 03:15 PM
xcracx that would work but th packet is encrypted. He's using ollydbg to stop the packet right before the encryption process so he can see the raw information. I believe the actual problem he's having is how does he edit the raw packet so the server recognizes it.
xcracx
06-08-2005, 10:40 AM
if he just wanna dupe he should try wpe and if its not working go to olly
so... he should use the olly command line and

he should find the sending packets code
then recognize the dump address that saved the orginal packet data
then make something that will send it to the server :o


loading prog with olly

RCE Messageboard's Regroupment > General > loading prog with olly
tra
06-04-2005, 01:58 PM
Hello!

I'm a beginner in using olly debug!

if i load a special programm without to start it , it stopps first in kernel32.dll
and not at the eip. if i press play, the progzess terminates.

i used the program PEiD to watch if it is protected ,and PEiD told:

'Microsoft Visual C# / Basic .NET [Overlay]'
Entrypoint: 0004F3BE

does anyone now how the go to the OEP?

thsnx a lot...
hosiminh
06-04-2005, 06:57 PM
Snipped from Ollydbg.hlp:

OllyDbg is unable to debug .NET applications.

OllyDbg can’t debug .NET applications. .NET programs consist of pseudocode that Windows interpretes or compiles on-the-fly to native ’86 commands.

RTFM sometimes might be very helpfull :D
tra
06-04-2005, 07:33 PM
to hosiminh:

OK...Thanx


armadillo script...

RCE Messageboard's Regroupment > General > armadillo script...
Eugene123
06-05-2005, 03:58 PM
for this tut can someone explain how to do it.... i got the first part done of doing the costom exeption and hardware breakpoints.
but after that im stuck

Remove all hardware breakpoints before running the script

Add the following custom exceptions

C0000005(ACCESS VIOLATION), C000001D(ILLEGAL INSTRUCTION)
C000001E(INVALID LOCK SEQUENCE), C0000096(PRIVILEGED INSTRUCTION)
*/

var OpenMutexA
var CreateMutexA
var GetModuleHandleA
var VirtualAlloc
var CreateThread
var JumpLocation
var JumpLength
var OEP

gpa "OpenMutexA", "kernel32.dll"
mov OpenMutexA, $RESULT
gpa "CreateMutexA", "kernel32.dll"
mov CreateMutexA, $RESULT
gpa "GetModuleHandleA", "kernel32.dll"
mov GetModuleHandleA, $RESULT
gpa "VirtualAlloc", "kernel32.dll"
mov VirtualAlloc, $RESULT
gpa "CreateThread", "kernel32.dll"
mov CreateThread, $RESULT

bp OpenMutexA
esto
exec
PUSHAD
PUSHFD
PUSH EDX
XOR EAX,EAX
PUSH EAX
PUSH EAX
CALL CreateMutexA
POPFD
POPAD
JMP OpenMutexA
ende
bc OpenMutexA

bphws GetModuleHandleA, "x"
label1:
esto
cmp eax,VirtualAlloc
jne label1
esto
bphwc GetModuleHandleA
rtu

find eip, #0F84????????#
mov JumpLocation, $RESULT
mov JumpLength, JumpLocation
add JumpLength, 2
mov JumpLength, [JumpLength]
inc JumpLength
mov [JumpLocation], 0E9
inc JumpLocation
mov [JumpLocation], JumpLength

bp CreateThread
run
cob
bc CreateThread
rtu
rtr
sti

find eip, #2B??FF??8?#
mov OEP, $RESULT
add OEP, 2
bp OEP
run
bc OEP
sti
cmt eip, "<- OEP"
msg "youre at the OEP now dump with LordPE and fix the IAT with ImpRec"
ret
you cant do this on jsut any olydbg
hosiminh
06-05-2005, 04:14 PM
This is a script from TEAM RESURRECTiON

hxxp://www.exetools.com/forum/showthread.php?p=32490

It's kind of ethic to mention the name of the script writer (AvAtAr & stephenteh in this case )
xcracx
06-05-2005, 09:43 PM
use that script you've posted BY OllyScript Plugin..
as it came (txt file)

thats all

xcracx
NyBKlyNtRinI
06-06-2005, 12:40 PM
Everytime i run this script i encounter this error:

"OllyDbg, 32-bit analysing debugger has encountered a problem and needs to close. We are sorry for the inconvenience."

Can someone please tell me settins of debugger options in ollydbg?
gabri3l
06-06-2005, 05:14 PM
Your Olly is probably not fixed against the outputdebugstring.
Get RE-Pair 0.2 from RETeam to patch Olly
Should solve your problem.
NyBKlyNtRinI
06-08-2005, 02:49 AM
gabri3l: "Your Olly is probably not fixed against the outputdebugstring."

Great thanks for tip, but now i encounter this error:

http://img115.echo.cx/img115/1904/error0hc.jpg
LOG ATTACHED ABOVE
xcracx
06-08-2005, 10:29 AM
my advice...

deal with Armadillo manually,
PiEd wont tell you the correct version of Armadillo that packed the executable

i doubt that script will help you, but who knows...
maybe you are lucky

xcracx
Eugene123
06-08-2005, 01:57 PM
the only part i dont get is the var, esto, gpa exec.... can someone tell me what sites have their meanigns... and are they concepts or terms or what are they?
Orion83
06-16-2005, 05:20 PM
i run this scrip and encounter this error:

"Don't know how to step because memory at address 0000003A is not readable. Try to change EIP or pass exception to program."
hosiminh
06-17-2005, 09:55 AM
Try to change EIP or pass exception to program.

Hey Einstein , what do thing you is the solution :rolleyes: ?
bud_gd
07-12-2005, 02:20 AM
If you are the same Gabri3l of the tuts I found on ARTEAM Site I personally thank you for your olly tuts even though there were only a few! bg.
gabri3l
07-19-2005, 01:55 AM
Yes, I am the same. I am glad you enjoyed them. :) Be sure to read all 10 of the beginner series tutorials. Some good tutorials by other team members included in there as well.

Back to the thread information. There has been a modified version of the Team Ressurection script posted by Maltese. Supposedly working for a new version of armadillo. May work for some interested people:

/*
Tested on WinXP Pro SP2, OllyDbg v1.10, OllyScript v0.92
NOTES:
- Remove all hardware breakpoints before run the script.
- Add the following custom exceptions on OllyDbg:
C0000005(ACCESS VIOLATION), C000001D(ILLEGAL INSTRUCTION)
C000001E(INVALID LOCK SEQUENCE), C0000096(PRIVILEGED INSTRUCTION)
*/

// Modified by Maltese. Allows Armadillo to function within Olly.
// Armadillo functions would not work with ORIGINAL SCRIPT.
// Confirmed working with TheaterTek 2.11

var CreateThread
var OEP

gpa "CreateThread", "kernel32.dll"
mov CreateThread, $RESULT

bp CreateThread
esto
esto
rtu
bc CreateThread
rtr
sti

find eip, #2B??FF??8?#
mov OEP, $RESULT
add OEP, 2
bp OEP
run
bc OEP
sti
cmt eip, "<- OEP"

msg "You're at the OEP, now dump with LordPE and fix the IAT with ImpRec. =)"


the search

RCE Messageboard's Regroupment > Bugs > the search
rama711
06-06-2005, 12:52 PM
I think the search on this forum is not working
can u check it please?
TBD
06-06-2005, 03:24 PM
yes I know. unfortunately I cannot fix it. use google.


Armadillo Script v2

RCE Messageboard's Regroupment > OllyScript > Armadillo Script v2
AvAtAr
06-07-2005, 07:30 AM
/*
.:TEAM RESURRECTiON:.
Armadillo Standard+Strategic Code Splicing Script by AvAtAr
Tested on WinXP Pro SP2, OllyDbg v1.10, OllyScript v0.92
NOTES:
- Remove all hardware breakpoints before run the script.
- Add the following custom exceptions on OllyDbg:
C0000005(ACCESS VIOLATION), C000001D(ILLEGAL INSTRUCTION)
C000001E(INVALID LOCK SEQUENCE), C0000096(PRIVILEGED INSTRUCTION)
*/

var CreateMutexA
var CreateThread
var GetModuleHandleA
var OpenMutexA
var VirtualAlloc
var JumpLocation
var JumpLength
var adata
var regESP
var OEP

gpa "CreateMutexA", "kernel32.dll"
mov CreateMutexA, $RESULT
gpa "CreateThread", "kernel32.dll"
mov CreateThread, $RESULT
gpa "GetModuleHandleA", "kernel32.dll"
mov GetModuleHandleA, $RESULT
gpa "OpenMutexA", "kernel32.dll"
mov OpenMutexA, $RESULT
gpa "VirtualAlloc", "kernel32.dll"
mov VirtualAlloc, $RESULT

gmi eip,MODULEBASE
find $RESULT,#2E6164617461#
mov adata,$RESULT
add adata,0c
mov adata,[adata]
gmi eip,MODULEBASE
add adata,$RESULT

bp OpenMutexA
esto
exec
PUSH EDX
PUSH 0
PUSH 0
CALL CreateMutexA
JMP OpenMutexA
ende
bc OpenMutexA

bphws GetModuleHandleA, "x"
label1:
esto
rtu
find eip, #0F84????????????????????74??????????EB??#
cmp $RESULT,0
je label1
bphwc GetModuleHandleA

mov JumpLocation, $RESULT
mov JumpLength, JumpLocation
add JumpLength, 2
mov JumpLength, [JumpLength]
inc JumpLength
mov [JumpLocation], 0E9
inc JumpLocation
mov [JumpLocation], JumpLength

msgyn "Resolve Strategic Code Splicing?"
cmp $RESULT,0
je label3
bphws VirtualAlloc, "x"
label2:
esto
mov regESP,esp
add regESP,0C
cmp [regESP],1000
jne label2
add regESP,4
cmp [regESP],40
jne label2
rtu
mov eax,adata
bphwc VirtualAlloc
label3:

bp CreateThread
run
cob
bc CreateThread
rtu
rtr
sti

find eip, #2B??FF??8?#
mov OEP, $RESULT
add OEP, 2
bp OEP
run
bc OEP
sti
cmt eip, "<- OEP"
msg "You're at the OEP, now dump with LordPE and fix the IAT with ImpRec. =)"
ret
oep
06-18-2005, 04:15 AM
hi AvAtAr, I have got the OEP of the program that packed by ARM4.0, and the OEP was the one that I have found manual, but the question is I CANNOT get the IAT with this OEP, and the RecImport1.60 report that it cannot get any IAT at this address.
salma
08-15-2005, 10:58 AM
test
Newbie_Cracker
10-14-2005, 03:57 PM
oep, I think it's because of Import Elimination by Armadillo.

You must analyze packer code to find correct APIs and fix them manually, or use ArmInline to fix them.
mr haggar
10-14-2005, 07:28 PM
This script can fix IAT elimination at armadillo. It will create new thunks in some section that you want. You can read haw to use it in my tutorial on biw reversing. Good luck.

//////////////////////START OF SCRIPT/////////////////////////////
var Code
var Import
var API
var Pointer
var ModBase
var addr

ask "Enter base of section where OEP is:"
cmp $RESULT,0
je exit
mov Code,$RESULT

ask "Enter base of new section for imports:"
cmp $RESULT,0
je exit
mov Import,$RESULT

//================================================== ================
// 1. Find first redirected import in order to determ DLL module
//================================================== ================

SearchModules:

findop Code,#ff25????1102# //Find first call/jump to eliminator block:
cmp $RESULT,0
je exit

add $RESULT,2 //Geting API and pointer:
mov Pointer,$RESULT
mov $RESULT,[$RESULT]
mov API,[$RESULT]

gmi API,MODULEBASE //Determing owner of that API:
mov ModBase,$RESULT

//================================================== ================== ============

//================================================== ================== ============
// 2. Find all imports that belong to that module and place them to one thunk
//================================================== ================== ============
mov addr,Code

SearchImports:

findop addr,#ff25????1102# //Find first call/jump to eliminator block:
cmp $RESULT,0
je ModuleDone

mov addr,$RESULT

add $RESULT,2 //Geting API and pointer:
mov Pointer,$RESULT
mov $RESULT,[$RESULT]
mov API,[$RESULT]

gmi API,MODULEBASE //Does API belongs to our module?
cmp $RESULT,ModBase
jne SearchImports //If not, then search another one.

mov [Import],API //Mov API to thunk place.
mov [Pointer],Import //Set pointer to point on thunk.
add Import,4 //Next Thunk place.

jmp SearchImports
ModuleDone: //One DLL module is done.
mov [Import],0 //Finsh this thunk.
add Import,4
jmp SearchModules //Go find another dll module.
//================================================== ================== ==========

exit:

ret
//////////////////////////END OF SCRIPT/////////////////////
mr haggar
10-14-2005, 07:29 PM
Btw, you need to change this parts:

findop Code,#ff25????1102# //Find first call/jump to eliminator block:

You can read in tutorial why and how.


Help: Problem with plugin?

RCE Messageboard's Regroupment > General > Help: Problem with plugin?
tc250
06-08-2005, 03:03 PM
my friend said it should show something else in the plugin menu, i only get
http://www3.telus.net/public/dmoeung/Untitled-10.gif
arjuns
06-08-2005, 04:24 PM
Terry go to Options ---> Appearance ---> Directories and check the PLUGINS path ; in your case past the following
"C:\Olly\Plugins " (without comma)
on the plugins path.
:-)
xcracx
06-09-2005, 12:23 AM
in case you didn't download any plugins..
your friend is wrong

want some?
http://ollydbg.win32asmcommunity.net/stuph
got some

make your self plugins folder on olly's folder
and change the plugin path as arjuns told you how

then add plugins to that folder you've created
that will be nice and clean

xcracx


OllyDbg 1.10 release mirror

RCE Messageboard's Regroupment > Announcements > OllyDbg 1.10 release mirror
TBD
06-08-2005, 08:34 PM
OllyDbg 1.10 (http://ollydbg.win32asmcommunity.net/stuph/OllyDbg110.zip) (842kb)

here is a mirror of OllyDbg till Oleh's site is up.
please do not hotlink or I will remove it


Where to begin? For noobies

RCE Messageboard's Regroupment > General > Where to begin? For noobies
tc250
06-10-2005, 08:45 PM
Hey im absolutely clueless about ollydbg, but i wanna learn how to debug things, where can i start? Like for someone who knows absolutely nothing
TBD
06-10-2005, 09:46 PM
tc250: before starting "debug things" you must create things.
so, first start learning asm (use Iczelion's tutorials) and only after you can start OllyDbg.
1bitshort
06-11-2005, 04:04 AM
and then read the helpfile.
dhwch
06-17-2005, 01:00 PM
The helpfile will give you lots of help.
tc250
06-18-2005, 11:24 AM
i dont understand anything on the help file lol
joe
06-18-2005, 12:50 PM
Use Google & search for: ollydbg tutorial beginner
It give 258 links (or search something similar). Only concrete question give You right answer (sometimes You find answer without assistance, when You pass right question).
bud_gd
06-25-2005, 11:33 PM
bg, even though recruitement would not let me do so, id prefer to be bg!
that out of the way i've been doin this s**t for a little while,I & Will not take kindly to_AssHoles Shooting me down, Thank You! I will Respect All just the same as they respect ME!. , Hopefully I May Be Welcome In this Forum.


Where can I get Ultra String Reference plug-in?

RCE Messageboard's Regroupment > Plugins > Where can I get Ultra String Reference plug-in?
lynnweb
06-11-2005, 03:12 AM
Hi everybody,
Where can I get Ultra String Reference (Korean) version?

I cann't found it. (except only chinese version)
Could you please give me a hand?
oep
06-13-2005, 11:32 AM
Here is it's Homepage http://www.luocong.com/om/
lynnweb
06-16-2005, 04:17 PM
thx oep, You've been a big help.

Exactly luocong's "Ultra String Reference" plug-in URL is..
http://www.luocong.com/myworks/zipped/ustrref.zip

thx.


Help with Breakpoints please

RCE Messageboard's Regroupment > General > Help with Breakpoints please
loopah
06-11-2005, 09:14 AM
I am setting a breakpoint on an online game at a send function, am wondering if there is a way to exclude all commands except push esi commands? if its possible can someone explain to me how its done please?
xcracx
06-11-2005, 10:31 AM
use trace... to skip selection when tracing..

or just nop it..


Question on a breakpoint (new to olly and everything else)

RCE Messageboard's Regroupment > General > Question on a breakpoint (new to olly and everything else)
loopah
06-11-2005, 11:35 AM
ok first let me explain the circumstances, I am new to messing with a debugger, I'm having fun with it tho and want to learn =P.

heres my Q: There is this breakpoint that is watching all the send commands, now when I set this breakpoint it is pausing every second so I cant trace a command that I want to see when I ask the program to send something, how does one go about excluding all the commands that are making the program pause so I can watch it accurately?
loopah
06-11-2005, 11:36 AM
ps , remember I am knew so please explain in terms a noob would understand ><
oh me anon
06-11-2005, 12:08 PM
you need to understand windows its message loops assembly and a lot of other little gems and gotchas

simply put every appliction has a message queue that loops infinitely
handling what it is programmed to handle and ignoring passing all the rest to the default handlers

windows is driven by messages
it starts from 0 doesnt have a definate end you can #define my message == 0xffffffff reggister it to your program and code a handler that exclusivly handles that message

well when a message is generated system allots a little place and puts it there

so the infinite loop which contain a simple PeekMessage() takes a look periodically at that place if it finds system has put a message in that place
it gives it to TranslateMessage() gets it translated and sends it to the winproc with DispatchMessage()

now in the winproc you may have coded a handler to handle the specific message then it is handled and a return value HANDLED is returned to queue else a return value handle NOT HANDLED is returned to the queue

the queue wil then pass the message back to system and system then checks if all of the message queues have aceesed the message
if all the waiting queues have aceessed it and has returned handled or not handled the sytem discards the messages or asks a top level handler to take care of it

now since this loop is executed infinitely till the winproc handles Exitmessage and terminates it self
if by chance you put a break in this loop you are bound to break every few nanoseconds :)

now its already a big essay hope i didnt make any mistakes and you can digest the message :)
loopah
06-11-2005, 12:27 PM
oooooh ok, so instead of having the application being asked for the information from the system and sending it back, write a code for the application that will auto send to the system so it will then be bypassed?
loopah
06-11-2005, 12:28 PM
or is that not possible?


Any way

RCE Messageboard's Regroupment > General > Any way
Deba
06-12-2005, 05:19 AM
you got any way (fastest way) that i can find the right bp?
or any guide of how can i find the right bp?
or when im doing action in the game its said wich bp its use?
joe
06-12-2005, 07:19 AM
This isn't simple. There can be many generally many way. Often (but no always - it's possible to write emulated fcn). You can use BP to some API for example:
GetDlgItemText(A), GetWindowText(A), GetKeyState, LstrlenA, LstrcpyA,
CreateFileA, ReadFile, GetPrivateProfileString(A), GetPrivateProfileInt(A), WritePrivateProfileString(A), WriteProfileString, RegCreateKey(A),
RegQueryValue(A), RegCloseKey(A), RegOpenKey(A), GetSystemTime, GetLocalTime, SystemTimeToFileTime, MessageBox(A), MessageBoxExA, MessageBeep, SetRect, EnableWindow, UpdateWindow, CreateWindow, CreateWindowExA, DialogBoxParamA, ShowWindow, SendMessage, wsprintf, ...
You must know whot does program do to find right API.
You can use some plugin: ApiBreak, olly_bp_man.
Under W98 is possible often simple stop apps in Olly & look back for jmp or call references. Good way is use message BP, but it's too complicated for me.
Text references can too help.
dailo
06-12-2005, 02:01 PM
Finding the needed value:

Search on the main cpu window and find the send fuctions,
then trace it back to the main value which you then set a break point onto.

this was posted somewhere else..
what my question is how do i noe which are the send functions?


Setting Multiple Breakpoints

RCE Messageboard's Regroupment > General > Setting Multiple Breakpoints
DMCSTGN
06-12-2005, 03:11 PM
Hello, i am knew here and am not very good with olly.

I was just wondering if there was a way to select multiple (expressions, i think they are called (or if that is wrong the things inside the cpu main thread window))

ANd then set a breakpoint for that selection

its very tedious to have to keep on hitting the arrow down key and then f2 to set one breakpoint, so i am wondering if i could select multiple items and breakpoint them all at once

sorry if this sounds really stupid, i just started using olly yeaterday :)

thanks for any help
oh me anon
06-12-2005, 04:13 PM
well there is no point in setting breakpoints on every line of command it is more or less redundant to do it

assume you have this code

mov eax,0
mov ebx,0
mov ecx,10
xor edx,edx
label:
add edx,1
cmp edx,ecx
jne label

only point of exit there is the next command after jne so if you set break point on all commands you are wasting resource and your time

so select some exit points and set break points on them

for example you wish to set break points on all jne's
ok then you right click on cpu window search for all commands type jnz const
ollydbg will pop up a new window with all the jnz commands in the selected module
if you right click in that window you will see you can set break points on all thos jnz at one go :)
simple

in ollydbg everything is context sensitive so keep on right clicking everywhere to find all the easter eggs :)
DMCSTGN
06-12-2005, 04:35 PM
ok, thanks alot. That made a little bit of sense!

Ok, i have another question, it might now be possible but here it goes.

Is it possible to preform an action in a program (one that olly is attached to) and then see what expression (i guess they are called expressions) it affects? Any help on this question would also be really appreciated! Thx in advanced!


TEST EBP,EBP ;i don't understand this

RCE Messageboard's Regroupment > General > TEST EBP,EBP ;i don't understand this
tintino
06-12-2005, 07:22 PM
Im new to asm.
I dont get this:

TEST EBP,EBP ;compare ebp with ebp ??
JLE 004820AC ; jump if less than or equal.... to what ??? to itself ??
joe
06-12-2005, 08:51 PM
It's same as TEST EBP,0. But it's used because it take less time & less memory too.
TEST EBP,0 take 6 bytes & TEST EBP,EBP only 2
You can use TEST EBP,0 this is question of optimalisation of code.
For information this is some flag settings (taken from 'Intel 80386 Programmer's Reference Manual HTML translation -- 0.9 version') (386htm09)

Status Flags' Functions
Bit Name Function

0 CF Carry Flag -- Set on high-order bit carry or borrow; cleared otherwise.
2 PF Parity Flag -- Set if low-order eight bits of result contain an even number of 1 bits; cleared otherwise.
4 AF Adjust flag -- Set on carry from or borrow to the low order four bits of AL; cleared otherwise. Used for decimal arithmetic.
6 ZF Zero Flag -- Set if result is zero; cleared otherwise.
7 SF Sign Flag -- Set equal to high-order bit of result (0 is positive, 1 if negative).
11 OF Overflow Flag -- Set if result is too large a positive number or too small a negative number (excluding sign-bit) to fit in destination operand; cleared otherwise.

Key to Codes
T = instruction tests flag
M = instruction modifies flag (either sets or resets depending on operands)
0 = instruction resets flag
-- = instruction's effect on flag is undefined
blank = instruction does not affect flag

Instruction OF SF ZF AF PF CF
AAA -- -- -- TM -- M
AAS -- -- -- TM -- M
AAD -- M M -- M --
AAM -- M M -- M --
DAA -- M M TM M TM
DAS -- M M TM M TM
ADC M M M M M TM
ADD M M M M M M
SBB M M M M M TM
SUB M M M M M M
CMP M M M M M M
CMPS M M M M M M
SCAS M M M M M M
NEG M M M M M M
DEC M M M M M
INC M M M M M
IMUL M -- -- -- -- M
MUL M -- -- -- -- M
RCL/RCR 1 M TM
RCL/RCR count -- TM
ROL/ROR 1 M M
ROL/ROR count -- M
SAL/SAR/SHL/SHR 1 M M M -- M M
SAL/SAR/SHL/SHR count -- M M -- M M
SHLD/SHRD -- M M -- M M
BSF/BSR -- -- M -- -- --
BT/BTS/BTR/BTC -- -- -- -- -- M
AND 0 M M -- M 0
OR 0 M M -- M 0
TEST 0 M M -- M 0
XOR 0 M M -- M 0
tintino
06-16-2005, 08:49 AM
so TEST EBP,EBP is testing if EBP is 0
but why JLE - why not JZ thats what throws me off - dont laugh its probably newbie question i know... i just know that to jump if 0, you use JZ
joe
06-16-2005, 03:54 PM
My answer wasn't correct. Testing of zero is common usage of TEST EBP,EBP. JLE mean jump if EBP is 0 or negative (highest bite of EBP is 1).
TEST EBP,EBP can tests 3 eventuality:
1. EBP is 0
2. EBP is negative
3. parity of lowest byte (if is even or odd number of 1 in lowest byte)
Try open any program in Olly. Assemble at Entry Point TEST EBP,EBP some times & step it with some changes of EBP (in Registers window).
Look for changes in flag registers.


http://www.ollydbg.de/ - works

RCE Messageboard's Regroupment > Announcements > http://www.ollydbg.de/ - works
xxxxx
06-12-2005, 08:55 PM
thx to ghosthunter for info
godfather+
nick_name
06-13-2005, 10:25 AM
man i'm so happy to c that the portal is back
1bitshort
06-14-2005, 12:35 PM
it's back alright ....... and man is it slow ..... time to upgrade that modem boys


can you set break point

RCE Messageboard's Regroupment > General > can you set break point
rama711
06-13-2005, 02:46 PM
Hi
can you set break point at a string. lets say I found a string ie. "send toops" can olly break at this string?
arjuns
06-13-2005, 04:56 PM
rama711 , In fact your question is not clear ,and if it so you can't set a bp over a particular string.
But you can set a trace if some register or memory location containing your string is accessed while deubgging.
this is simply done like this
tc eax == "your string".
arjuns
06-13-2005, 05:07 PM
tracing takes long time.
arjuns
06-13-2005, 05:13 PM
another simple idea
go to dump view and search for your string , select it and set a breakpoint on access
u'll be stopped while accessing the sting.
rama711
06-14-2005, 12:11 PM
Sorry if I was not clear
but correct me if iam wrong
you sid go to dump viem and search for your string. This mean that when I found the suspected string I can tell olly to take me to the corresponding disassemble window the set bp on that line!!
arjuns
06-14-2005, 04:19 PM
when you select a sting and set a breakpoint point on access (Right click -> breakpoint -> memory on access ) you'll be paused somewhere where your stiring is being accessed . I hppens in diassamble window
rama711
06-15-2005, 03:22 PM
I will try tonight!!


Some questions about the usage of ollydbg

RCE Messageboard's Regroupment > General > Some questions about the usage of ollydbg
monu
06-14-2005, 12:10 PM
Hello,

I'm rather new to ollydbg and have several questions. I've searched the help and this forum for the answers but had no success.

1/
Is it possible to set a conditional bp such as:

(EAX > 00000001) && (EAX <= 000000FF)

2/
Is it possible to set "on access" or "on write" bp's on multiple memory addresses? If so, how can I see a list of these memmory bp's. They don't show up in ALT + b.

3/
Is it possible to read the contents of a **pointer on a bp?

MOV EAX, 00123456// pointer loaded in register
MOV EBX, [EAX]
monu
06-14-2005, 12:20 PM
grrrr, entered a Tab + CR which posted my incomplete message.

Here's question 3 is initially intended:

3/
Is it possible to read the contents of a **pointer on a bp?

1 MOV EAX, 00123456 // Dword at memory 0x00123456 holds a second pointer.
2 MOV EBX, [EAX] // Second pointer loaded in EBX
3 MOV ECX, [EBX] // Content at second pointer loaded in ECX

Is it possible to do something like [[EAX]] at a bp on 1 to get the value stored at pointer1->pointer2->value?

Thanks in advance,

David
oh me anon
06-14-2005, 04:23 PM
yes you can set multiple conditions on on break points refer to ollydbg.hlp and experiment
i mean if you want to set a breakpoint on eax then eax must have been filled by a prior instuction
assuming you have mov eax,fs:[0]
mov eax,[eax+2]
and whne you have set the break point on mov eax,fs:[0] you wont be getting any out put becuase the instruction is yet to be executed and the expresion fails

it is kinda tedious to explain the concept of condition

assume you have this code

00401026 B8 38304000 MOV EAX,MSGBOXMO.00403038
0040102B 8B00 MOV EAX,DWORD PTR DS:[EAX]
0040102D 8B00 MOV EAX,DWORD PTR DS:[EAX]

and you have on 403038
00403038 40 30 40 00 @0@.

on 403040
00403040 50 30 40 00 P0@.

on 403050
00403050 79 6F 75 00 you.

and if you wish to evaluate eax on first instruction it doesnt have any meaning because eax may contain any random garbage
breakpoint is hit first and the instruction at ip is executed later

but if you use the constant addr to evaluate then it will succed to get you the string you :)

try string [[[403038]]] on the first instuction
and olly will log it for you
Log data, item 1
Address=00401026
Message=COND: you

memory breakpoints by thier very nature or not set at a single address
but on a whole page as such only one memory break point is available
it is clearly mentioned in the help file

Set memory breakpoint on access - sets memory breakpoint on the whole memory block. Program will stop each time memory block is accessed. OllyDbg supports only one memory breakpoint. Under Windows 95/98, debugged program may crash when system routines access memory blocks containing memory breakpoint. Use it as a last resort.

Set memory breakpoint on write - sets memory breakpoint on the whole memory block. Program will stop each time when it writes to the memory block. Under Windows 95/98, debugged program may crash when system routines access memory blocks containing memory breakpoint. Use it as a last resort.

and to your first question yes it is possible to set multiple conditions
but you have to unsderstand the concept to effectively utilise it

tkae a look again in help file

To set breakpoint on message, OllyDbg creates specially prepared conditional logging breakpoint with explanation "<WinProc>". To see how it works, assume that we have button with handle 00001234 and request pause on all button messages. After breakpoint is set, open it as a conditional logging breakpoint. You will see the following options set:

Condition: [ESP+4]==00001234 && [ESP+8] IN (0F0..0F7,135)
Explanation: <WinProc>
Pause program: On condition


Question on Thread.

RCE Messageboard's Regroupment > General > Question on Thread.
cridia
06-15-2005, 02:07 AM
In the Thread window ,what is the different between the "User time" and "System time"?
How to debug the multi thread procedure?
TresPasser
06-15-2005, 06:34 AM
1) "User time" means the time spent running the user code (meaning the actual code of the program). "System time" is the time spent running operating system code (like in API calls and such).

2) You can only debug one thread at a time, however, you can control the execution of all the threads. Therefore, you can place breakpoints inside the threads and the program will stop when that thread is executed. This is done by double clicking on the wanted thread in the thread window, and placing the breakpoint normally (you need to find where the next command of the thread is, usually you can look at the last value in the stack, and that will show you where to place your BP).
You can also catch a thread before it starts by placing a BP on the CreateThread API, looking at the thread start addr in the stack (when the program stops), and placing a BP there.

I hope this makes sense.

TresPasser
cridia
06-15-2005, 11:43 AM
thanks very much!:-)


Qustion about Hardware Breakpoint

RCE Messageboard's Regroupment > General > Qustion about Hardware Breakpoint
jon
06-15-2005, 11:15 AM
I would like to know about how Olly implements Hardware Breakpoint..
I read the Olly help file, and also intel documentation about debug registers + Win internals, but I didnt understands exactly what happen.

I want to place Hardware Breakpoint in my proc (Not with Olly! I'll do that with Get\SetThreadContex) and to be able to catch it in my proc, somthing like raise exception and to catch it in my Exception Handler.

Example: I put H-BP on DWORD x (in memory.) ,the RD0 is set to &x and RD7 is set to break on write.

when I run this program with a debuger, it stopped after the attempt to write into x ( Olly think it was step over and stopped).

But if I run it without debuger, the execution stopped, without any exception(at least that is what im thinking now, becouse My handler is the first one, and it do nothing...)

help?
xcracx
06-20-2005, 07:25 PM
go to ollydbg and go To options.. breakpoints

mark all the checks Ignore ....
all of them

then try it out
if its not working when olly breaks go to options then breakpoints
and click add_last

if i got you right its gonna work goodluck

xcracx
bud_gd
07-12-2005, 01:11 AM
Is it not at all possible to set a hardware BP in order to follow through w/ unpacking if running win9x ? or must I rely on using scripts only to achieve my goal? thanx.
joe
07-12-2005, 04:29 PM
Is it not at all possible to set a hardware BP in order to follow through w/ unpacking if running win9x ?
I don't test it, but OllyGhost can make kernel writeablein 9x, then can be set BP.
bud_gd
07-20-2005, 01:57 AM
thanks i'll give ollyghost a try. im currently on other projects but let know how worked for me, thanx.


Problem with smth

RCE Messageboard's Regroupment > Plugins > Problem with smth
eMPeRioR
06-17-2005, 12:00 PM
hi im a newbie for ollydbg i just try to crack flax program. I tried to find which packers used in that with peid but i didnt find anything wrong and i used hidedebugger 1.23f but it says that

Log data
Address Message
OllyDbg v1.10
OllyDbg PE Dumper v3.01 by FKMA
OllyScript v0.92
Written by SHaG
OllyDump v2.00.108 by Gigapede
Nonameo's ApiBreak
Copyright (C) 2005 Nonameo
Hide Debugger <An error occurred>
Hide Debugger v1.2.3f
Copyright (c) 2005 by Asterix
IsDebugPresent plugin v1.4 (SV 2oo3)

File 'C:\Program Files\Goldshell\FlaX.exe'
New process with ID 00000098 created
00442168 Main thread with ID 0000018C created
00400000 Module C:\Program Files\Goldshell\FlaX.exe
5D5E0000 Module C:\WINDOWS\system32\COMCTL32.dll
76390000 Module C:\WINDOWS\system32\comdlg32.dll
77C00000 Module C:\WINDOWS\system32\msvcrt.dll
77D30000 Module C:\WINDOWS\system32\USER32.dll
77DC0000 Module C:\WINDOWS\system32\ADVAPI32.dll
77E70000 Module C:\WINDOWS\system32\RPCRT4.dll
77F10000 Module C:\WINDOWS\system32\GDI32.dll
77F60000 Module C:\WINDOWS\system32\SHLWAPI.dll
7C800000 Module C:\WINDOWS\system32\kernel32.dll
7C8F0000 Module C:\WINDOWS\system32\ntdll.dll
7C9B0000 Module C:\WINDOWS\system32\SHELL32.dll
76370000 Module C:\WINDOWS\system32\IMM32.DLL
62F30000 Module C:\WINDOWS\system32\LPK.DLL
75520000 Module C:\WINDOWS\system32\USP10.dll
00442168 Program entry point
773C0000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1 df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Process terminated, exit code 0

i logged all these for my question. Coz i use a breakpoint on where i write name and serial it should be stopped there but nothing goes on right way. Excuse me for my bad english (: Anyone can help this newbie?
eMPeRioR
06-17-2005, 01:21 PM
plss help....
TresPasser
06-17-2005, 01:48 PM
Looks like the program detects olly. There are many ways to detect a debugger, you could try a breakpoint on the FindWindow API and look for the title of OllyDbg. Anyway, a good way to find the protection is usually to put a bp on ExitProcess and see why the program got there.

Sorry, just noticed that you are actually asking about the plug-in error which I have no idea about.
eMPeRioR
06-17-2005, 09:39 PM
Yes i had problems with hidedebugger 1.2.3f coz i have win xp with sp2 and i think it cause that error. And my problem is still goes on like the same situation... I cant use any breakpoint for understanding wat cause process terminated... when i want to use a breakpoint it says the same
773C0000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1 df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

and ollydbg trace the module ntdll
wat can i do now?
joe
06-17-2005, 10:56 PM
I see in Your log, that You have two plugin for Olly hiding.
Try temporarily move IsDebugPresent plugin v1.4 (SV 2oo3) plugin from Olly folder, if there aren't collision.
Asterix
06-18-2005, 05:10 AM
HideDebugger works orderly in XP(sp2).
Try to kill all other plugins from plugins folder and restart OllyDbg.
Asterix
06-18-2005, 06:18 AM
eMPeRioR

Also if you use some patched OllyDbg, for example OllyXP, you may have
some problem with HideDebugger plugin.
eMPeRioR
06-18-2005, 04:07 PM
Thanks Asterix, i use ur advice so i setup a new clear Ollydbg and ur latest hidedebugger and i tried to breakpoint on the serial entry call but it crashes again :(

Log data
Address Message
OllyDbg v1.10
Hide Debugger v1.2.3
Copyright (c) 2004 by Asterix

File 'C:\Program Files\Goldshell\FlaX.exe'
New process with ID 00000AE0 created
00442168 Main thread with ID 00000968 created
00400000 Module C:\Program Files\Goldshell\FlaX.exe
5D5E0000 Module C:\WINDOWS\system32\COMCTL32.dll
76390000 Module C:\WINDOWS\system32\comdlg32.dll
77C00000 Module C:\WINDOWS\system32\msvcrt.dll
77D30000 Module C:\WINDOWS\system32\USER32.dll
77DC0000 Module C:\WINDOWS\system32\ADVAPI32.dll
77E70000 Module C:\WINDOWS\system32\RPCRT4.dll
77F10000 Module C:\WINDOWS\system32\GDI32.dll
77F60000 Module C:\WINDOWS\system32\SHLWAPI.dll
7C800000 Module C:\WINDOWS\system32\kernel32.dll
7C8F0000 Module C:\WINDOWS\system32\ntdll.dll
7C9B0000 Module C:\WINDOWS\system32\SHELL32.dll
76370000 Module C:\WINDOWS\system32\IMM32.DLL
62F30000 Module C:\WINDOWS\system32\LPK.DLL
75520000 Module C:\WINDOWS\system32\USP10.dll
00442168 Program entry point
Analysing FlaX
1070 heuristical procedures
1241 calls to known, 2922 calls to guessed functions
717 loops, 11 switches
773C0000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1 df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Process terminated, exit code 0

I didnt understand wat cause this is there good idea for cracking this prog? or wat did i do anything wrong... I know it finds the olly program and it crashes and i changed the hidedebbuger plugins options and it says the error at this time....

Log data
Address Message
OllyDbg v1.10
Hide Debugger v1.2.3
Copyright (c) 2004 by Asterix

File 'C:\Program Files\Goldshell\FlaX.exe'
New process with ID 00000410 created
00442168 Main thread with ID 00000CA4 created
00400000 Module C:\Program Files\Goldshell\FlaX.exe
5D5E0000 Module C:\WINDOWS\system32\COMCTL32.dll
76390000 Module C:\WINDOWS\system32\comdlg32.dll
77C00000 Module C:\WINDOWS\system32\msvcrt.dll
77D30000 Module C:\WINDOWS\system32\USER32.dll
77DC0000 Module C:\WINDOWS\system32\ADVAPI32.dll
77E70000 Module C:\WINDOWS\system32\RPCRT4.dll
77F10000 Module C:\WINDOWS\system32\GDI32.dll
77F60000 Module C:\WINDOWS\system32\SHLWAPI.dll
7C800000 Module C:\WINDOWS\system32\kernel32.dll
7C8F0000 Module C:\WINDOWS\system32\ntdll.dll
7C9B0000 Module C:\WINDOWS\system32\SHELL32.dll
Hide Debugger <Failed to apply protection against TerminateProcess>
76370000 Module C:\WINDOWS\system32\IMM32.DLL
62F30000 Module C:\WINDOWS\system32\LPK.DLL
75520000 Module C:\WINDOWS\system32\USP10.dll
00442168 Program entry point
773C0000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1 df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Process terminated, exit code 0

like this... Grrrr i will be crazy wat should i do?
Asterix
06-18-2005, 08:53 PM
eMPeRioR

1.2.3f latest version

about error see
http://www.woodmann.com/forum/showthread.php?t=5474&page=2

flax not simple program for cracking
eMPeRioR
06-19-2005, 08:41 AM
Thanks Asterix i will practise another program (:
tim mactroy
12-28-2005, 02:49 PM
Hey guys , I tried to download hide debugger 1.2 plugin but hell I couldnt find the file , plz help if you know the download like !
l8r


About ASProtect 1.2x - 1.3x [Registered]

RCE Messageboard's Regroupment > OllyScript > About ASProtect 1.2x - 1.3x [Registered]
cqzcj
06-18-2005, 04:23 PM
Hi, All.
I have a software packed by "ASProtect 1.2x - 1.3x [Registered]" (reported by PEiD 0.92). with ~Hellsp@wN~'s script , i can find the OEP , but i can't get the stolen bytes and correct the IAT. anyone can help me ?
arjuns
06-18-2005, 04:40 PM
I am having the same problem
Ricardo Narvaja
06-18-2005, 05:18 PM
there are a lot of tuts od stolen bytes read it first and next ask your problems

Ricardo Narvaja
cqzcj
06-18-2005, 08:07 PM
i read a lot ,but it's no use for me. usually, prog go to OEP by a retn, so analyze the code before retn , we can get back the stolen bytes. But ~Hellsp@wN~'s script find the OEP by Alt+M breakpoint, so i can't get the retn.
if with no "Alt+M" breakpoint, by 34 times Shift+F9, and F8 & F7 , i go into a close cycle , and Ctrl+F8 for 2 hours ,but can't go out. if F4 under the cycle, it'll fly at once. so i have no idea...
Ricardo Narvaja
06-18-2005, 09:07 PM
well this is no the unique method for stolen bytes, and is very unstable (little changes make this method don´t work)

if you read spanish there are in my web 40 or more tuts of asprotect of differents authors, me too, with differents methods.

i use the method of compare stack and registers with the initials and see the difference, or sirectly make an inject this inject copy the stack stored to the stack, the registers stored to the registers and next run the program , is automatic and work more quick
Ricardo narvaja
cqzcj
06-19-2005, 04:31 AM
sorry, i can't read spanish, is there any tuts wiritten in English about the method u said ? many of your articles were translated into our language, but not include above.
the method of compare stack and registers, is called ESP rule in my country, that's mean the stack and registers maybe equal in EP and OEP. this method t needs more experience, i'm not really good at it. about inject , you mean wrtie code in memory or use tool to attach process ?
could u show me a sample ?
i put code on for you:

here is EP,
00401000 u>/$ 68 01606200 push unpackme.00626001
00401005 |. E8 01000000 call unpackme.0040100B
0040100A \. C3 retn
0040100B $ C3 retn

registers here,
EAX 00000000
ECX 0012FFB0
EDX 7C92EB94 ntdll.KiFastSystemCallRet
EBX 7FFDF000
ESP 0012FFC4
EBP 0012FFF0
ESI FFFFFFFF
EDI 7C930738 ntdll.7C930738
EIP 00401000 unpackme.<ModuleEntryPoint>

stack here,
0012FFC4 7C816D4F 返回到 kernel32.7C816D4F
0012FFC8 7C930738 ntdll.7C930738
0012FFCC FFFFFFFF
0012FFD0 7FFDF000
0012FFD4 8054C038
0012FFD8 0012FFC8

here is OEP, got with script by Alt+M
004B7555 |. /73 0E jnb short unpackme.004B7565 ; :::[OEP ]:::
004B7557 |. |F7D8 neg eax
004B7559 |. |03C4 add eax,esp
004B755B |. |83C0 04 add eax,4
004B755E |. |8500 test dword ptr ds:[eax],eax
004B7560 |. |94 xchg eax,esp
004B7561 |. |8B00 mov eax,dword ptr ds:[eax]
004B7563 |. |50 push eax
004B7564 |. |C3 retn
004B7565 |> \51 push ecx
004B7566 |. 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
004B756A |> 81E9 00100000 sub ecx,1000
004B7570 |. 2D 00100000 sub eax,1000
004B7575 |. 8501 test dword ptr ds:[ecx],eax
004B7577 |. 3D 00100000 cmp eax,1000
004B757C |.^ 73 EC jnb short unpackme.004B756A
004B757E |. 2BC8 sub ecx,eax
004B7580 |. 8BC4 mov eax,esp
004B7582 |. 8501 test dword ptr ds:[ecx],eax
004B7584 |. 8BE1 mov esp,ecx
004B7586 |. 8B08 mov ecx,dword ptr ds:[eax]
004B7588 |. 8B40 04 mov eax,dword ptr ds:[eax+4]
004B758B |. 50 push eax
004B758C \. C3 retn
004B758D CC int3
004B758E CC int3
004B758F CC int3

registers here,
EAX 00000094
ECX 0041F6F2 unpackme.0041F6F2
EDX 00F60285
EBX 3D83D8BF
ESP 0012FF14
EBP 0012FF94
ESI 00D95B28
EDI 00000094
EIP 004B7555 unpackme.004B7555

stack here,
0012FF14 00F61AF3
0012FF18 00626889 unpackme.00626889
0012FF1C 00D95B28
0012FF20 3D83D8BF
0012FF24 0012FFE0
0012FF28 0012FF60

part of memory here, i think is real IAT
00588000 77DCC41B advapi32.RegOpenKeyA
00588004 77DBA7B1 advapi32.CryptDecrypt
00588008 77DB8546 advapi32.CryptReleaseContext
0058800C 77DBA254 advapi32.CryptDestroyHash
00588010 77DBA685 advapi32.CryptDeriveKey
00588014 77DBA122 advapi32.CryptHashData
00588018 77DBA2F9 advapi32.CryptCreateHash
......

i believe u can get some from above.
if u need packed prog , i'll be gald to mail it to u.
cqzcj
06-19-2005, 04:35 AM
i've forgot to tell you , it's written by Delphi 6.0-7.0
Ricardo Narvaja
06-20-2005, 11:33 AM
take the original stopped in the OEP and make binary copy of the section of the stack and bynary paste in a section of memory injected by you in the dumped:

next change the EP of the dumped to a blank part for write the inject

the inject mke this
1)copy all teh stack stored to the stack of the dumped
2)put the registers in teh same value of the original
3)jmp to the oep

Ricardo Narvaja
cqzcj
06-20-2005, 03:52 PM
i see, u mean simulate a same environment as the original run from the OEP. ok, i think it's available and realizable.

but, another problem occurs, look here and above
004B7555 |. /73 0E jnb short unpackme.004B7565 ; :::[OEP ]:::
......
......
004B7564 |. |C3 retn ; this retn will goto 00F61AF3

here,with call GetVersionExA and GetModuleFileNameA,it prove OEP's right
00F61AF3 8965 E8 mov dword ptr ss:[ebp-18],esp
00F61AF6 F2: prefix repne:
00F61AF7 EB 01 jmp short 00F61AFA
00F61AF9 F0:BE DA364800 lock mov esi,4836DA 00F61AFF 337424 08 xor esi,dword ptr ss:[esp+8]
00F61B03 8BF4 mov esi,esp
00F61B05 893E mov dword ptr ds:[esi],edi
00F61B07 56 push esi
00F61B08 FF15 88805800 call dword ptr ds:[588088] ; this call is kernel32.GetVersionExA
00F61B0E 8B4E 10 mov ecx,dword ptr ds:[esi+10]
00F61B11 890D D4C56100 mov dword ptr ds:[61C5D4],ecx
00F61B17 8B46 04 mov eax,dword ptr ds:[esi+4]
00F61B1A A3 E0C56100 mov dword ptr ds:[61C5E0],eax
00F61B1F 8B56 08 mov edx,dword ptr ds:[esi+8]
00F61B22 8915 E4C56100 mov dword ptr ds:[61C5E4],edx
00F61B28 8B76 0C mov esi,dword ptr ds:[esi+C]
00F61B2B 81E6 FF7F0000 and esi,7FFF
00F61B31 8935 D8C56100 mov dword ptr ds:[61C5D8],esi
00F61B37 83F9 02 cmp ecx,2
00F61B3A E8 C1E40500 call 00FC0000
00F61B3F 5D pop ebp
00F61B40 E9 D70E0000 jmp 00F62A1C
00F61B45 85C0 test eax,eax
00F61B47 0F85 B0030000 jnz 00F61EFD
00F61B4D ^ E9 83F1FFFF jmp 00F60CD5
00F61B52 8975 FC mov dword ptr ss:[ebp-4],esi
00F61B55 68 032AF600 push 0F62A03
00F61B5A E8 A1E40500 call 00FC0000
00F61B5F 8365 FC 00 and dword ptr ss:[ebp-4],0
00F61B63 ^ E9 DAECFFFF jmp 00F60842
00F61B68 FF15 80805800 call dword ptr ds:[588080] ; this call is kernel32.GetModuleFileNameA

of course, the section 00F60000 is not the PE's section , so it won't be dumped, and the dumped PE go here with wrong, what should i do ?
cqzcj
06-20-2005, 04:20 PM
on the other hand, i read some articles about ESP balance rule, and get it.
but for this case, it doesn't work. the ESP value is different every time at OEP. the only unaltered is [ESP-4], it's always equal to OEP, because shell retn from it to OEP.
Ricardo Narvaja
06-20-2005, 04:25 PM
you ask me for stolen bytes this are tuts of asprotect 1.2 for asprotect 1.3 or 2 the method are completely different and there are no stolen bytes are stolen code hehe.

Ricardo Narvaja
cqzcj
06-20-2005, 04:46 PM
oh, stolen code, so how to get back it ? what's the usual method ?
Ricardo Narvaja
06-21-2005, 10:14 AM
well you need add all the missed sections to the exe, it´s no so easy

Ricardo Narvaja
cqzcj
06-22-2005, 05:29 AM
for stloen bytes, we dump stack and resume it at OEP, included get registers back.
for stolen code, we dump all the sections of shell which are used by prog,
then realloc it.
is it OK ?
btw about OD:
1.how to modify code by assemble and save it in OD ?
2.can we use like "tc [ESP]==4b7550" in OD ?
hosiminh
06-22-2005, 08:33 AM
stolen bytes == stolen code

tc ESP==4b7550
Ricardo Narvaja
06-22-2005, 09:43 AM
for me stolen bytes are 10 or 15 bytes executes out of the original adress, and stolen code (asprotect 2) are sections 2000 or 3000 bytes out of the original address.

Ricardo Narvaja
cqzcj
06-22-2005, 02:59 PM
every times i break at OEP by Alt+M, the ESP value is different, but the [ESP-4] value is same, because it goto OEP by retn. so i want to break on the retn, of course "tc ESP==4b7550" is wrong ,so "tc [ESP]==4b7550" is right ?
Ricardo Narvaja
06-23-2005, 11:54 AM
well is needed view each particular case but the general method is provide the program all sectyion missed and environment of the start, if you have problems in this point look for other start, a little before (can be in other section no problem while the program are unpacked and RUN and let you make changes in the code)

Ricardo Narvaja
homersux
06-23-2005, 09:04 PM
I'm having problems too with an aspr protected target. In my case, hellspawn's script cannot find the OEP at all. I've posted some details on woodmann's forum and the thread itself has some great olly material as I am learning to use olly too. If anyone interested in said target, please PM me I'll send the link to download the target. It's written by a hacker and has proven to be very tough to crack.
oh me anon
06-24-2005, 06:01 AM
for your information there is no pm facility in this board :)
and please no offtopic crack requests there are lot of boards that deal with them explicitly so lets keep this board for ollydbg and its usage
and its quirks and whims actually if you look around you can find sHaG the author of this plugin
and i dont think even he likes to have this forum polluted with requests
also his site contains a lot of other scripts may be you could spend some time and find a combination of them
reversing and debugging is an art not some double click thingy
hope i have wrapped my wordings in a nice chocolate wrapper :)

thanks and regards
TBD
06-25-2005, 06:42 PM
thanks oh me anon. topic closed.


NEW SITE OF RICARDO NARVAJA AND CRACKSLATINOS

RCE Messageboard's Regroupment > General > NEW SITE OF RICARDO NARVAJA AND CRACKSLATINOS
Ricardo Narvaja
06-18-2005, 05:19 PM
NEW SITE OF RICARDO NARVAJA AND CRACKSLATINOS
Well it´s not a site is a web list for download all tutorials of crackslatinos, tools, contests, all is here (my FTP will be disabled and this will replace), is is construction

http://www.ricnar.webhop.org/

Enjoy

Ricardo Narvaja
Absolom1
06-19-2005, 04:27 PM
Gracias Ricardo, ni te haces una idea de como lo estaba necesitando...
arjuns
06-19-2005, 04:44 PM
please write in english
RedHawK
06-19-2005, 06:04 PM
Good work ...RicNar, I congratulate to you
1bitshort
06-19-2005, 06:07 PM
Ricardo your work is very good - you definately have a gift, but without an English translation you're really limiting your exposure.
Ricardo Narvaja
06-20-2005, 11:13 AM
the translators write in english better than I, hehe, i´m a very bad writing in english, i think a very good translator make better job than I, and the tuts hace plenty of images for help.

Ricardo Narvaja
arjuns
06-20-2005, 04:54 PM
Ricardo ! you are always there for us
yano
06-28-2005, 08:33 AM
http://www.ricnar.webhop.org/ is down !!!
Ricardo Narvaja
06-28-2005, 10:31 AM
Yes the root delete my page for illegal content, he thinks tuts of cracking are illegal, in my web the programs are not cracked all programs are in original versions, for practice with the tuts, only some tools are cracked, but this root delete all and don´t ask if you can quit the 3 or 4 tools, and delete 3 gigas of tutes and information.

by now my slow and old web of my machine is working again, till this root understand, or i can get other fast site.

http://www.ricnar456.dyndns.org/WEB

the paths are similar

Ricardo Narvaja
TBD
06-28-2005, 08:12 PM
Ricardo: I think is time for you to move to other tasks ;)
markus1268
07-13-2005, 04:39 AM
Hi Ricardo,

this links http://www.ricnar456.dyndns.org/WEB is password protected.
What is the password ?

thanks
Dexter Lab
07-13-2005, 09:53 PM
Hi Ricardo,

Your webpage:
http://www.ricnar456.dyndns.org/WEB
is password protected, what is the password ?

Thanks
Ricardo Narvaja
07-14-2005, 12:11 AM
ricnar456@yahoo.com.ar

write me i send you the password

Ricardo Narvaja
rituraj
08-08-2005, 02:50 AM
Hi Ricardo,
I read ur tutorials on hasp emulation. Really loved it. Can Please have access to ur tutorials. Please send the password on riturajm@yahoo.com
Thank you
magicbu
08-11-2005, 01:13 PM
Hi Ricardo,
I really enjoy your tutorials .It's a great job! .
Can I Please Have access to your tutorials.?
please send password on turrican81@gmail.com

thanks1
Ricardo Narvaja
08-11-2005, 02:45 PM
ricnar456@yahoo.com.ar

write me i send you the password

Ricardo Narvaja


new to ollydbg but dont wanna bug everyone

RCE Messageboard's Regroupment > General > new to ollydbg but dont wanna bug everyone
nobledevil666
06-20-2005, 01:53 PM
hi i am made new to olldbg but i dont wanna bug everyone with posts among post every tie i need help so i am asking somone to post link or somthing to a tutorial i can i use and i will figure out what i need to know instead of askign for help every 5 mins : ) thx for read plz post!
joe
06-20-2005, 03:44 PM
Go to: ollydbg forums / General / Learn Olly
Or read other posts in this forum.
Or simple Google: OllyDbg tutorial + what You need
bud_gd
06-26-2005, 12:24 AM
bg: HOW THE F" do you post new topics,sorry if i missed something!,Id like to post A aspack tut/help,found nothing in search.
Ricardo Narvaja
06-26-2005, 10:30 AM
enter in a sub forum and press the button NEW TOPIC

Ricardo


OpenRCE.org

RCE Messageboard's Regroupment > General > OpenRCE.org
pedram
06-20-2005, 10:05 PM
Don't mean to spam the forum but I figure at least some of the readers here would be interested in a new reverse engineering centric site that myself and others launched today:

http://www.openrce.org

The site is very usable but has many features still under development. The purpose of the site is foster a shared learning environment amongst advanced reverse engineers. Please share any comments, suggestions, bug reports and especially content with one of the site admins.
TBD
06-21-2005, 07:17 AM
very nice ! keep up the good work and thanks for sharing
sungt
08-14-2005, 12:34 PM
thanks for sharing. It is a good site.


how to trace into the main module only

RCE Messageboard's Regroupment > General > how to trace into the main module only
Menelao
06-21-2005, 01:15 PM
Hi,
Is it possible to trace into a function but only while the code belongs to the main module and when a call to an external function is made step over that one? I don't know if this make any sence.
Thanks
oh me anon
06-21-2005, 01:32 PM
if you are talking about tracing with ctrl+f11
ollydbg natively supports the idea

options ---> debuging options ---> trace ---> check mark always trace over system dlls

all dlls thats are in in %windir%\system or system32 will be traced over in one step
if you want to trace over custom dlls
view-->executable modules --> right click--> mark as system dll

check mark always trace over string commands
will do all the rep movsb,movsw,movsd,stos blah in one go

no need for any scripts
1bitshort
06-21-2005, 03:30 PM
> I don't know if this make any sence.
not really, but maybe press F8 (Step Over) when you get to a call/jmp that goes to an external function
Menelao
06-24-2005, 09:54 AM
oh me anon: thanks man, that's what i was looking for.


trace into the main module only

RCE Messageboard's Regroupment > OllyScript > trace into the main module only
Menelao
06-21-2005, 01:17 PM
Hi,
Is it possible to make a script to trace into a function but only while the code belongs to the main module and when a call to an external function is made step over that one? I don't know if this make any sence.
Thanks
oh me anon
06-21-2005, 01:22 PM
please dont cross post :(

answer posted to quest ion in general forum


Scan the packet send to server

RCE Messageboard's Regroupment > General > Scan the packet send to server
liew985
06-22-2005, 02:07 AM
Can anyone teach me how to trace or scan the packet send out?
Got any plugin?
Msn : liew@smjkdgs.edu.my
xcracx
06-23-2005, 10:41 AM
just follow winsock dll
in reference... then you need to back trace to the code that creates
the packet that will provide the send function

goodluck

xcracx
liew985
06-23-2005, 11:36 AM
sorry. forget to mention that i was using ollydbg debugger now.
i go view the modules of the program but cant found a module call winsock.any idea??can u teach me the way??
Can i pm u? emergency need help?


Unable to Write to....

RCE Messageboard's Regroupment > Bugs > Unable to Write to....
Heste
06-22-2005, 12:19 PM
I've had this problem for a while now, but only in 1.10.
When i load a program into olly i almost always get this error: "Unable to write to memory of debugged process (7FFD6002..7FFD6002)", the strange thing is when i get this error i can debug program, but if i don't get this error i can't, program terminates with that debugged program was unable to pass exception or something.

Im running on WinXP SP2.
oh me anon
06-22-2005, 03:01 PM
are you talking about one particular application ??
or all and every application generates this error
in my computer 7ffd6000 points to no where ?? :( and i dont think olly tries to write to process memory anywhere except in one place which is
peheader->addr of entry point (here it sets one time break point )

may be you should explain the circumstances better so as to get a coherent reply

may be you should remove all the plugins if you have from the folder
and put them back one by one and see if that error pertains to some plugins
i think some plugin in your setup is trying to write something to a hardcoded address using ollys writememory() api
i am saying this coz that message box is a part of writememory api exposed via plugin architecture
other than that i dont have an idea

i think some plugin is trying to patch ds:[fs:[18] + 30] + 2 and that address is hardcoded to 7ffd6002
Heste
06-22-2005, 07:41 PM
Damn, can't belive i didnt think about the thing with the plugins, it was some plugin called OllyHelper or something, dunno what it did, proberly from some package...

Thanks alot for your help =)


how to D FS:0 in OllyDbg??

RCE Messageboard's Regroupment > General > how to D FS:0 in OllyDbg??
playar
06-26-2005, 12:33 PM
command line prompt "Syntax error",

remember, It's fs:0, not fs:[0]
oh me anon
06-26-2005, 06:48 PM
what do you mean fs:0
you mean the segment ??

it is shown in registers window
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 1 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF) <--- fs segment = 003b
T 0 GS 0000 NULL
playar
06-27-2005, 06:40 AM
thanks for the informaion


ollydbg for x86-64?

RCE Messageboard's Regroupment > General > ollydbg for x86-64?
hell_bird
06-26-2005, 01:24 PM
will there anytime be a version for x86-64?


i have some kind of question

RCE Messageboard's Regroupment > General > i have some kind of question
sizko
06-29-2005, 11:26 AM
Hi all, I try to unpack dllfile that are packed with Neolite 2.0.
When I run the script, it found the OEP. but i don't know how to rebuild dll file.

help me.
Ricardo Narvaja
06-29-2005, 02:47 PM
i suggest read tuts of neolite 2, obvious is needed repair IAT and antidumps

Ricardo Narvaja
sizko
06-30-2005, 03:09 AM
i can unpack exe file. but dll file is driving me crazy
Ricardo Narvaja
06-30-2005, 03:26 AM
http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/ 143-ASProtect%20en%20una%20DLL%20por%20JUAN%20JOSE.rar
(http://www.ricnar456.dyndns.org/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/143-ASProtect%20en%20una%20DLL%20por%20JUAN%20JOSE.rar
)

this is a tut how unpack asprotect in a dll, is other packer but you can view certain differences betwenn exe and dll unpack

Ricardo Narvaja
Ricardo Narvaja
06-30-2005, 03:55 AM
sorry the link is

http://www.ricnar456.dyndns.org/WEB/NUEVO%20CURSO/TEORIAS%20DE%20CRACK ING/143-ASProtect%20en%20una%20DLL%20por%20JUAN%20JOSE.rar
(http://www.ricnar456.dyndns.org/WEB/NUEVO%20CURSO/TEORIAS%20DE%20CRACKING/143-ASProtect%20en%20una%20DLL%20por%20JUAN%20JOSE.rar
)

Ricardo Narvaja
aka
08-02-2005, 07:01 PM
what is the user/pass ?
Ricardo Narvaja
08-02-2005, 10:07 PM
nobody post a password in a forum, write me to my mail and i give to you.

ricnar456@yahoo.com.ar

Ricardo Narvaja


DirectX 5

RCE Messageboard's Regroupment > General > DirectX 5
Cenobyte
06-29-2005, 05:39 PM
Hi,

I'm asking if there's a way to see directX 5 calls or GDI structures from an exe without debugging informations.
I'm trying to extract a bitmap from a game.
Bitmap data are on separeted files, but are without headers.
Header ( I hope ) is created at run-time, but I cannot see it!

Any suggestion ?
Thanks.
xcracx
06-30-2005, 01:11 PM
Try ResHacker

you might find your bitmap and btw.. you can just use

PrintScreen key + photoshop/paint
Cenobyte
06-30-2005, 01:57 PM
Thank you.
But bitmap is created at runtime.


Is there an alternate URL for OllyScript download?

RCE Messageboard's Regroupment > OllyScript > Is there an alternate URL for OllyScript download?
cdward
06-29-2005, 08:38 PM
hxxp://ollyscript.apsvans.com gives the following message

Your website has been suspended
Please contact support@globedomain.com for an explanation

Thanks
duhru
06-29-2005, 09:50 PM
You can find a copy here:
https://www.openrce.org/downloads/details/106/OllyScript

Openrce.org also has a collection of ollyscripts for download:
https://www.openrce.org/downloads/browse/OllyDbg_OllyScripts
cdward
06-29-2005, 09:54 PM
Thank you very much!
Nechto
07-13-2005, 10:52 AM
Doesn't work ... broken links there .. (inside of openrce)
pedram
07-13-2005, 12:25 PM
Hmm weird. Fixed a few of them. Let me know if you find any others. Thanks for pointing that out.

-pedram


RDG Packer Detector V 0.5/1 BETA

RCE Messageboard's Regroupment > The Heap > RDG Packer Detector V 0.5/1 BETA
Youthfulhex
06-30-2005, 05:25 PM
i think this is a Hispanic program used to identify more than wat peid shows you. does anyone know were i can find this program,it doesnt seem to be on google or yahoo or anywere in aol search
Ricardo Narvaja
07-01-2005, 01:35 AM
in my ftp or http you can download

http://www.ricnar456.dyndns.org/WEB/

look in tools

Ricardo Narvaja
RDGMax
07-10-2005, 11:37 PM
RDG Packer Detector v0.5.6

Contact:RDGMax@Gmail.com
Ricardo Narvaja
07-11-2005, 03:30 AM
i write to your mail fir get the better detector i see, continue with this great job.

Thanks in advance
Ricardo Narvaja
Ricardo Narvaja
07-12-2005, 11:02 AM
i write to you but don´t have a reply

my mail is ricnar456@yahoo.com.ar
Thanks
Ricardo narvaja
RDGMax
07-20-2005, 02:18 AM
RDG Packer Detector v0.5.6

http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/5/RDGPackerDe tectorv0.5.6.rar
(http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/5/RDGPackerDetectorv0.5.6.rar
)

RDGMax@Gmail.com
Bob
08-01-2005, 01:25 AM
It's a spam advert..
A few forums have been spammed with same..


Wait 5 seconds...

RCE Messageboard's Regroupment > Bugs > Wait 5 seconds...
Acelent
07-01-2005, 04:54 PM
Hi.

Since I installed Windows XP SP2 on my laptop that OllyDbg systematically shows me this yes/no message dialog when it hits a breakpoint or when I press the pause button:

"In order to perform action that is not supported by OS, OllyDbg has injected short piece of code into the debugged application, but received no response within 5 seconds. Do you want to wait for another 5 seconds? (If you answer No, the consistency and stability of program is not guaranteed and you should restart it as soon as possible)."

It happens *sometimes* when I hit No that it stays consistent. Even when No is a good answer, it is a waste of time asking me this every time I "step into" (F7)! What the ... and I doing wrong here? Is it any device driver? (Sony Vaio) Is it any new service or policy in SP2?
Acelent
07-01-2005, 05:03 PM
Ah!... I can't believe it! I just found out what is causing this behaviour, but do not understand it...

After a more refined search in google, I found this:
http://www.exetools.com/forum/showthread.php?t=5558#post36504

"I found out that I got this error only when the "Decode registers for any IP" option was checked under Options -> Debugging Options -> Registers tab."

Well, almost quite so for me, but the cause was not that option, instead it was (in the same options tab) "Decode SSE registers". What I don't understand is why this "is not supported by OS" when I have a Pentium 4!

Well, that's for the record, might someone bump into this problem too...
oh me anon
07-01-2005, 05:28 PM
well at the moment the search function is not working properly
but this is a known problem and was discussed here and oleh replied back
he would look into the matter in v2.0 he uses code injection to
get the register status of sse registers and also to decode registers
of thread

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=158 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=158)


is unpacking illegal ?

RCE Messageboard's Regroupment > General > is unpacking illegal ?
arjuns
07-01-2005, 06:06 PM
why the hell administratoror deleted my post about unpacking ?
answer me TBD
Ricardo Narvaja
07-01-2005, 06:57 PM
he is the owner, and he put the rules, there are forum for unpacking (woodman,exetools) for me it´s not illegal but the rules are the rules hehe.

Ricardo Narvaja
TBD
07-02-2005, 12:43 PM
thanks Ricardo for the answer

arjuns: with this attitude you will not go forward.
arjuns
07-02-2005, 04:16 PM
If it is so why does Ricardo answer the unpacking relating question to this forum.
Ricardo Narvaja
07-02-2005, 05:15 PM
if is deleted for the owner i don´t answer, if is not deleted will be right and i aswer jejeje

Ricardo Narvaja


Is it possible?

RCE Messageboard's Regroupment > General > Is it possible?
Frenchy
07-02-2005, 08:25 AM
i used TRW2000 to debug some old games, now, i just discover Olly and when i try to break some game program which uses DIRECT X in full screen, the game is frozen and i dont see the ollydb windows, is it normal , is it a limitation of the product, or is it possible to avoid that??
because i loose the control of the debugger and dont arrive to switch to the olly function..

hope you understant my english..
Ricardo Narvaja
07-02-2005, 10:30 AM
All debuggers when you put a bpx and stop freeze the computer, softice, trw2000 and ollydbg but i debug directx games with olly if you work in different form only you need work different.

http://forum.exetools.com/showthread.php?t=7719

if you are exetools memeber can read the complete discussion here.

Ricardo Narvaja
Frenchy
07-02-2005, 12:07 PM
when i follow your link , i have always a blank page..grr..you haven't this problem?

Just to precise..okay i understand why the prog is stopped at the BP, the problem is it doesn't show to me the olly windows when the BP is reached, and i dont arrive to switch to this windows..

with TRW2000 i haven't this probleme i see the trw2000 windows when the BP is reached and can type commands ..

okay..i arrive to read the post...IE6 was the problem...

may be i have missed something in the launching of ollydb
Ricardo Narvaja
07-02-2005, 02:57 PM
I debug DirectX games with softice, trw2000 and is the same the screen is corrupted maybe you can continue, but you forget softice and trw2000 are RING0 debuggers and OLLYDBG is a RING3 debugger, is possible work but with certain limitations, you cannot put BPX and stop completely, but you can use scripts put BP or HE and the script log the values,the script take control and loop or continue runnning the program, you can switch to OLLYDBG with alt + tab but when the proogram is running not when the program is stopped, for this reason you need make a script than log values or a script form mantain the program looping, you swith to ollydbg with alt +tab and next you can stop the program, trace etc.

Ricardo Narvaja
Frenchy
07-02-2005, 03:37 PM
Thanks Ricardo..your help is appreciate..with sa good script i 'll arrive at the same things..no prob..


Can I host OllyScript ?

RCE Messageboard's Regroupment > OllyScript > Can I host OllyScript ?
Menelao
07-02-2005, 10:36 AM
Hi,
OllyScript site http://ollyscript.apsvans.com/ doesn't work any more. Can I host OllyScript to make it available in my site?
ElMauro
07-03-2005, 02:55 AM
I´m really needing that :( having troubles with deep freeze in a pc on my cyber cafe. the deep freeze tray icon has disapeared and can´t disable it anymore.. the only way I found to fix this is using ollydbg but I need this script and the ASPack 2.12 script too...
can you send it to my e-mail until somebody answer you about hosting it?
I will thank you forever !

ps: my e-mail is public here
Bob
07-04-2005, 04:58 PM
Your website has been suspended
Please contact support@globedomain.com for an explanation

Sounds bad, and final.. :(
duhru
07-05-2005, 04:44 PM
You can find a copy of OllyScript here:
https://www.openrce.org/downloads/details/106/OllyScript

Openrce.org also has a collection of ollyscripts for download:
https://www.openrce.org/downloads/browse/OllyDbg_OllyScripts


hacking intenet

RCE Messageboard's Regroupment > General > hacking intenet
nobledevil666
07-02-2005, 11:20 PM
my sister plays neopets ( shes 10 ) and i was wondering if anyone knows how to hack the website so she does actully have money and what would is look liek when i go to attach the process with olly i have enver done this any and all tips willb e greatly appreciated
kittmaster
07-04-2005, 01:59 AM
The short is yes

Second, I'd be surprised if anyone else responds to this thread


Modifying the stack

RCE Messageboard's Regroupment > General > Modifying the stack
5aLIVE
07-03-2005, 04:22 PM
Hello again,
I want to modify a ASCII string which can be seen on the stack. I right click to modify or edit the stack address, but it only shows four ASCII chars which doesn't correspond to the 20 char string I want to edit.

What am I doing wrong here?

Thanks
5aLIVE
oh me anon
07-03-2005, 04:31 PM
right click --> follow in dump --> select the whole string
press ctrl+e and edit what you want it to

the edit in stack shows 4 chars because it is the address of the string
not the string itself the string is situated at the address that is shown on those 4 chars

0012FFBC 00403000 ASCII "Iczelion's tutorial no.2"

now if do right click edit you will see

00304000 which is 403000 inverted

at the address you will see the string
00403000 49 63 7A 65 6C 69 6F 6E 27 73 20 74 75 74 6F 72 Iczelion's tutor
5aLIVE
07-03-2005, 04:55 PM
Wow, I'm impressed with how quickly you responded to my question.

I followed your instructions and explanation by example.

Here's what happens:
0012F8B4 |00CF249C œ$Ï. ASCII "My string info"

I follow in dump which takes me to

00CF24B1 ^76 CF JBE SHORT 00CF2482

Hmm. Something not right here. I right-clicked and selected ASCII 64 chars, and low and behold the string I want to edit.

Thank you very much. This little exercise confirmed my theory that this particular string is not used to validate a password.
Ricardo Narvaja
07-03-2005, 08:42 PM
if you obtain

00CF24B1 ^76 CF JBE SHORT 00CF2482

you not are making FOLLOW IN DUMP, in the dump the bytes are viewed in hexadecimal mode

go to the lower left part of the olly and GO TO EXPRESSION

00CF2482

(put the 0 before the C)

and you look in the dump the string

Ricardo Narvaja
5aLIVE
07-04-2005, 08:09 AM
Hi Ricardo,
I think you maybe misunderstand me?
I saw the line of disassembled code at
00CF24B1 ^76 CF JBE SHORT 00CF2482
is the dump screen, this is not actual code but the start of the string I was looking for.

I just changed the view from Disassemble to ASCII(64 chars)
to fix this.

Thanks,
5aLIVE
oh me anon
07-04-2005, 01:37 PM
well since you feel the problem is solved this is academical

0012F8B4 |00CF249C œ$Ï. ASCII "My string info"

on the above line if you follow in dump you should
reach cf249c

not 00CF24B1 like you say some thing messed up likely


how do i find a breakpoint

RCE Messageboard's Regroupment > General > how do i find a breakpoint
tofu
07-05-2005, 02:22 PM
can anyone tell me how i can find a breakpoint?
joe
07-05-2005, 04:18 PM
Your answer is too general. You must better specify it.
But if You don't know, what to search, look to API imports. Often useful APIs begin with 'Get' (GetDlgItemTextA, GetKeyState, GetWindowTextA). Or search in text references. If You write Your own program, You must know how to set BP! :-)


Contact for SHaG or ollyscript source?

RCE Messageboard's Regroupment > OllyScript > Contact for SHaG or ollyscript source?
duhru
07-06-2005, 01:07 AM
Does anyone have good contact info for SHaG? I've emailed shag@apsvans.com and looked for SHaG on efnet, but haven't had any luck yet.

Does anyone have the source for OllyScript? With his website being down, I want to make sure that it's not lost forever.
oh me anon
07-06-2005, 07:18 AM
SHaG seems is out of contact last seen on efnet was some 5 days back
:( i have to grep through my old mails


Running trace to locate breakpoints

RCE Messageboard's Regroupment > General > Running trace to locate breakpoints
ahfoong
07-06-2005, 01:55 PM
I am new to Ollydbg.
I would like to know where should I start if I wanted to find breakpoints for an online game, particularly a breakpoint for when I perform certain actions.

I think I need to use Run Trace, if I am not mistaken.
But I can't just use the Restart (Ctrl-F12) way as described in the Run Trace tutorial, since I need to login to the game first.

Can someone please enlighten me?
Thanks in advance.


Log with watches

RCE Messageboard's Regroupment > General > Log with watches
MazeGene
07-06-2005, 02:15 PM
Hi all,
I would like to add the watches to each line of the log. Is that possible? I tried to figure it out, but I failed.
In my case, I can see the order of breakpoint hits in the log, but I can't attach watches to each breakpoint.

P.S. Sorry if similar question was already asked. The search facility seems to be not working.
oh me anon
07-06-2005, 06:35 PM
log ???
you mean you are using conditional log break points
and want to log some details ??
Log data
Address Message
00401007 COND: esp = = 0012FFC0
00401009 COND: esp = = 0012FFC0
0040100A COND: esp = = 0012FFBC
0040101B Breakpoint at 0040101B (<ModuleEntryPoint>+1B)

it seems i did not understand your question
MazeGene
07-27-2005, 06:13 PM
oh me anon,
thanks for your effort, I figured it out already.
I appreciate your help anyway!


get olly script v.092

RCE Messageboard's Regroupment > OllyScript > get olly script v.092
Balthasar_magus
07-06-2005, 11:07 PM
where i can find olly script 0.92? THis link http://ollyscript.apsvans.com/ dead.
Balthasar_magus@mail.ru
tDJ
07-07-2005, 03:26 PM
Look duhru's post here: http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6& topic=1358
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6&topic=1358
)

You can find a copy of OllyScript here:
https://www.openrce.org/downloads/details/106/OllyScript

Openrce.org also has a collection of ollyscripts for download:
https://www.openrce.org/downloads/browse/OllyDbg_OllyScripts


16-bit program like ollydbg

RCE Messageboard's Regroupment > The Heap > 16-bit program like ollydbg
Kirby of Doom
07-08-2005, 02:50 PM
Is there any program like ollydbg that works with 16-bit apps?
Ricardo Narvaja
07-08-2005, 04:00 PM
softice, trw2000 are debuggers than work in 16 bits

Ricardo Narvaja
Kirby of Doom
07-08-2005, 05:26 PM
Thanks for the reply. Do you know where to download trw2000? The closest I got was softpedia.com but I can't seem to get it from them.
joe
07-08-2005, 08:45 PM
For example in ExeTools:
http://www.exetools.com/debuggers.htm
Kirby of Doom
07-08-2005, 08:53 PM
Thanks a bunch. I'll try it out and see if it helps.

edit: do you know if it's possible in trw2000 to change code?
Ricardo Narvaja
07-08-2005, 10:36 PM
yes in memory for make the changes in the file you need a editor hexadecimal (hexeditor)

Ricardo Narvaja
Kirby of Doom
07-09-2005, 12:22 AM
So I can open the exe with a hexeditor?
Also, I was able to edit in trw2000 but I don't know how to do it right (if that makes sense).
Ricardo Narvaja
07-09-2005, 03:34 AM
look the original bytes (look a 10 o 15 bytes long chain of bytes) in trw2000, and open the file in hexedit, search for this c hainf of bytes, change the bytes and save the changes.

Ricardo Narvaja
Kirby of Doom
07-09-2005, 02:56 PM
I'll try it out later. Know any good guides for x86 16-bit byte code?
joe
07-09-2005, 03:08 PM
MasmForum has 16-bit section too.
joe
07-09-2005, 03:16 PM
Usefull informations contain small DOS application: helppc21
I have this archive, but don't remember where I found it.
It contains descriptions (simple) of assembler instructions, C, hardware, interrupt services.
EDIT: It may be found in Google: "helppc21.zip"


BAMBI editor for make scripts easy for ollyscript

RCE Messageboard's Regroupment > Plugins > BAMBI editor for make scripts easy for ollyscript
Ricardo Narvaja
07-08-2005, 10:38 PM
http://www.ricnar456.dyndns.org/WEB/TOOLS5/Plugins_Olly/Bambi%20EDITOR %20DE%20OLLYSCRIPT%20por%20ARAPUMK.rar
(http://www.ricnar456.dyndns.org/WEB/TOOLS5/Plugins_Olly/Bambi%20EDITOR%20DE%20OLLYSCRIPT%20por%20ARAPUMK.r ar
)

Good editor for make scripts

Ricardo Narvaja
markus1268
07-13-2005, 04:32 AM
Hi Ricardo,

I cannot download it.

What is the password ?

Thanks
Bob
08-01-2005, 12:38 AM
Link didn't work for me either, even after password.
On your ftp it's in tools6 though, I got it from there..

It's a beautiful editor, an English translation would be useful for most people though..

I put original (Spanish) here (http://secretashell.com/BobSoft/BambiEditor_ES.rar)
and I translated the interface for anyone who can't read Spanish
here (http://secretashell.com/BobSoft/BambiEditor.rar)

I would've replaced the embedded OllyScript help file, but I don't have it.. :/

~BoB~


Translator

RCE Messageboard's Regroupment > General > Translator
Ricardo Narvaja
07-09-2005, 11:13 AM
In old post of this forum, was recommend a program for make the translation from spanish to english of the turorials, i remember but the search don´t work well, maybe any remember the name of this program, is for a english friend who need read spanish tutorials.

Ricardo Narvaja
joe
07-09-2005, 01:22 PM
Yes, this was in: ollydbg forums / General / Problems while unpacking armadillo 1.xx-2.xx(PEID said so)
Link to article:
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&for um=1&topic=1287
There are links to 2 versions of translator (reported by ViX):
http://www.paralink.com/download/mt71101.exe
http://www.paralink.com/download/mt71102.exe (57.67MB)
Ricardo Narvaja
07-09-2005, 02:25 PM
thanks a lot

Ricardo Narvaja


Protection

RCE Messageboard's Regroupment > Plugins > Protection
jaygee
07-09-2005, 08:42 PM
Is there any plugin for ollydbg that will get around that stupid debugger protection?
joe
07-09-2005, 09:21 PM
stupid debugger protection ??? What does it mean? Stupid protection doesn't exist, only stupid programmers or user!
In Stuph is IsDebuggerPlugin or You can use in OllyScript command 'dbh'.


Another Nub question for you guys..

RCE Messageboard's Regroupment > General > Another Nub question for you guys..
benfinkel
07-12-2005, 12:33 AM
I've seen the many poorly written noob questions out there and I'm sorry for posting another.

I was reading the instructions on this website:
http://www.woodmann.com/fravia/muadib_elicense.txt

But trying to translate into the world of OllyDbg.

Could someone help me with the very first part?
"Load the program in some SoftICE loader. Wait for the trial
screen to come up and then put a bpx on GetModuleHandleA.
Push the "Try It" button and press F12 until you enter the
KERNEL32 module."

Here is what I have done:

Loaded the executable with OllyDbg.
Clicked Plugins-->Command Line
typed 'bpx GetModuleHandleA', and hit enter.
Nothing happens.

Hit View-->THreads
There are two listed.
I double-click the Red one.
PLugins-->Command Line
type 'bpx GetModuleHandleA', and hit enter
An Intermodule Calls window pops up, but nothing in it looks like the call I'm looking for.

Thanks for any points in the right direction.

-Ben
benfinkel
07-12-2005, 02:15 AM
Hey, I'm even working further on this myself.

I found this following site:
http://www.digzine.com/issues/3/dig3.txt

Which is a little (okay, a LOT) beyond my skill set. I'm trying to work out the first piece of his instructions:

"The easiest way is to put a “breakpoint on read” at the start of the
main code segment, as the wrapper will have to read in the encrypted
code to decrypt it. This immediately launches into the thick of
assembler code: "

Breakpoint on Read??? Main Code segment??? These are unfamiliar terms to me. Here is how I tried to do it:

Start my executable
launced Ollydbg
File-->Attach
Chose the Executable I just launched
Clicked Attach
--It opens to CPU Thread xxxx, Module ntdll
click View --> Executable Modules
Right-Click the exe I launched (it has to be decrypted, aye?)
Choose View Code in CPU
--It opens to CPU Thread xxxxx, Module tpf (name of my exe)
Right-Click the very first line --> Breakpoint --> Memory, on access
F9 Run Program

Then I get an Access violation when executing .... press SHIFT f7/f8/f9 to pass to program.

And there I stand.
benfinkel
07-12-2005, 02:26 AM
Aren't you guys glad to join me on my expedition?

So I did this:

Launched the exe
Launched olly and attached to the exe
View Executable Modules
Right-Click the exe
Choose 'Follow Entry'
Memory Access bp on THAT line, and voila. I found the code he mentioned.

Of course, now I don't know what this means:

"So a hardware breakpoint at (in this case) 03362D5F will give the IV on a
plate: F9 A9 96 F9 BC 80 43 0E."

I know that my address is different (02583B13) but I'm not sure how to 'Put a hardware breakpoint' on it.

Thanks again,

-Ben

P.S. - How do I utilize the following piece of information he gives:

"<the following is the signture for finding this routine>
03362BB2 |. 68 00010000 PUSH 100
03362BB7 |. 6A 00 PUSH 0
"
? Thanks.
benfinkel
07-12-2005, 03:01 AM
Or how about a different approach as well.

The man says:
"...there’s nothing to stop the user waiting until the code segment is
decrypted, then dumping it back to the original exe file. This is what
most wrapper-cracking tutorials say to do."

How would I manage that? I can attach to the process, and I can get the software running (with a license), so at what point and how would I dump a decrypted version of the executable?

Thanks
Ricardo Narvaja
07-12-2005, 11:01 AM
Could someone help me with the very first part?
"Load the program in some SoftICE loader. Wait for the trial
screen to come up and then put a bpx on GetModuleHandleA.
Push the "Try It" button and press F12 until you enter the
KERNEL32 module."

translation to OLLY (only for WIndows XP, 2000, 2003 or NT not possible in W95, 98, ME)

Load the program in ollydbg, wait the trial screen, go to the command line in OLLYDBG and type Bp GetModuleHandleA, Push the "Try It" button and whan stop you are in kernel32 in the api GetModuleHandleA.

Ricardo Narvaja
benfinkel
07-12-2005, 01:47 PM
Thank you Ricardo,

I appreciate the detailed answer. I"m going to try that and play around myself some more. I'll be back.

--Ben
Bob
07-19-2005, 03:23 PM
you seem to be learning ok by yourself, you don't need our help :)

But to set a hardware breakpoint, just right-click the code (make sure hilighted line in the right place) and select Breakpoint > Hardware, on execution

Dumping should be done before executing OEP, when the code is decrypted in memory. There are many tools to do this, but you just need a good hexeditor.. Basically, save the area of memory to disk once it is unpacked, then close everything and load the original exe in a hexeditor and replace the orig (encrypted) section with the one saved.
To find the offsets use PEiD or LordPE or any of their clones..

~BoB~


a little help for an olly newb.

RCE Messageboard's Regroupment > General > a little help for an olly newb.
erus
07-12-2005, 02:02 PM
how do i search the memory for a string like "abc123" ?

please help
oh me anon
07-12-2005, 02:46 PM
alt+m right click search for text
alt+b in disassembler window
help file :)
erus
07-12-2005, 02:50 PM
i found out its not a conventional string :O

its a string of 4 bit ints each representing anumber from 0 - 9
and its dynamicly allocated :(
erus
07-12-2005, 02:55 PM
i can find the individual digits each time. ( find the first - then each other is 4 bytes after ) with tsearch.

but when i exit tsearch it stops the app and the dma changes when i start it so i can use olly to see what going on :(
erus
07-12-2005, 03:04 PM
infact my addresses are static :|

i have all eight of them.

now i know they are being compared to something.

how do i find out what?

----

so in short i want to know how to break on read of memory...
Bob
07-19-2005, 03:10 PM
select addresses in dump window, right-click, select breakpoint > memory on access (or memory on write, as need be)

run prog, it will stop when (if) your data is accessed/changed


PELock 1.0x -> Bartosz Wojcik [PlugIn needed]

RCE Messageboard's Regroupment > OllyScript > PELock 1.0x -> Bartosz Wojcik [PlugIn needed]
phil8900
07-12-2005, 08:22 PM
Hi,
i'd need a script which can:
PELock 1.0x - Auto fix IAT,remove junk code,find stolen code

Possible?
joe
07-12-2005, 09:17 PM
Try to use script for OllyScript (PELock 1.0x.txt or with other extension).

// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/*
//////////////////////////////////////////////////
PELock 1.0x -> Bartosz Wojcik Unpack script v0.1
Author: loveboom
Email : bmd2chen@tom.com
OS : WinXP sp1,Ollydbg 1.1,OllyScript v0.85
Date : 2004-7-19
Action: Auto fix IAT,Remove Junk code,Found stolen code
Config: Ignore other exceptions except 'Memory access violation'
Note : If you have one or more question, email me please,thank you!
//////////////////////////////////////////////////
*/

start:
msgyn "Setting:Ignore other exceptions except 'Memory access violation',Continue?"
cmp $RESULT,0
jne lbl1
ret

lbl1:
//Declare
var count
var espval //Esp value
var addr //address
var addr1

mov count,9
dbh //Hide debugger
run

lblloop:
cmp count,0
je lbl2
dec count
esto
jmp lblloop

lbl2:
find eip,#EB02#
bp $RESULT
esto

lbl3:
bc $RESULT
find eip,#F6C180# //Found 'Test cl,80'
cmp $RESULT,0
je lblabort
mov addr,$RESULT
cmt addr,"Running!please wait......!"
bphws addr,"x"

lbl4:
eoe lbl5
run
mov ecx,80
jmp lbl4

lbl5:
bphwc addr
find eip,#EB01??EB02#
mov addr,$RESULT
bp addr
esto

lbl6:
bc addr
mov addr,esp
bphws addr,"r"
run
bphwc addr

lblClearJunkCode:
repl eip,#E801000000??#,#E80100000090#,1000
repl eip,#EB01??#,#909090#,1000
repl eip,#EB02????#,#90909090#,1000
repl eip,#EB03??????#,#9090909090#,1000
repl eip,#EB04????????#,#909090909090#,1000
repl eip,#C1??00#,#909090#,1000
repl eip,#72037301??#,#9090909090#,1000
repl eip,#7C037D01??#,#9090909090#,1000
msg "Junkcode has been removed!"

lbl7:
find eip,#5D#
go $RESULT
sto

lbllogcode:
find eip,#C3#
bp $RESULT
eob lblgoOEP
ti

lblgoOEP:
bc $RESULT
sto
an eip
dbs
cmt eip,"Now,press ALT+V+N open trace window,you will find stolen code!"

lblend:
msg "Script by loveboom[DFCG[FCG],Thank you for using my script!"
ret

lblabort:
msg "Error,Script aborted!,Meybe target is not protect by PELock 1.0x -> Bartosz."
ret
Ricardo Narvaja
07-12-2005, 09:18 PM
any more? hehehe

nobody make a so complicated plugin

A plugin can find oep, other different can repair iat, but other work is necesary make manually

Ricardo Narvaja
ALiAS_2005
11-30-2005, 02:05 PM
Still I have problems to unpack a Pelocked application.
Who can help, with more information Please ?
mr haggar
11-30-2005, 05:59 PM
What more information? That is very good protector. Can you find OEP with above script? If it works, than IAT should be good and half job is done.

Then search for tutorial on old biw site, crusader there wrote great tutorial.

But if you are not good with unpacking, then don't waste time trying.
ALiAS_2005
12-01-2005, 09:16 AM
Hi mr haggar ;)

With the above script OEP was found but IAT is not good, imprec reports some missing ones and Sotlen bytes not found also.
Crusader tutorial deal with Softice not OllyDBG.
My Problem is to find a valid IAT for the dump obtained.

Thank you very much mr haggar :)
ricnar456
12-01-2005, 07:17 PM
in cracklatinos there are tuts of pelock with ollydbg but are in spanish, but i think if you have a tutorial in softice and you are not capable of make the same steps in ollydbg, PELOCK will be veru hard for you, maybe i´m wrong.

Ricardo Narvaja
mr haggar
12-01-2005, 09:02 PM
It doesn't matters SoftICE or Olly, tricks are the same. I have unpacked target with demo options enabled and that is IAT and stolen bytes. But full version have some more tricks like encrypted sections and god knows what more. May I know what target you traying to unpack? Maybe I could take look (if it's not too big for download).
ALiAS_2005
12-02-2005, 10:32 AM
Thank you mr haggar :)

I am trying to unpack PELock 1.06 it self.
Download here :
http://pelock.pac.pl/pelock.zip
or
http://pelock.pac.pl/pelock.exe

I have not find any full version in the Internet !!!
shERis
12-02-2005, 05:07 PM
This script is not for P E L o c k 1 . 0 6 !
It only finds OEP, but all API calls are redirected and the code is decrypted and encrypted in runtime !!!
I don´t if there is a script for solving these problems.


condition question

RCE Messageboard's Regroupment > General > condition question
mrwizeman
07-15-2005, 01:57 PM
Hello, all, Im new to Ollydbg, but not to programming and dissasemly in general, I have a question about conditions.

I want to set a condition to only break on an address IF EBX contains a UNICODE STRING

is that possible?

I dont know the string beforehand by the way... just want it to break if there is a string, any string.
joe
07-15-2005, 03:25 PM
Yes! It's simple, You must use Right click on Your instruction -> Breakpoint -> Conditional (or press Shift+F2), then set condition (for example EAX==0). Read more in help to OllyDbg.
joe
07-15-2005, 05:33 PM
Oh now! I don't read correctly Your post.
This is taken from help:
[STRING 123456]=="Brown fox" - true if memory starting from address 0x00123456 contains ASCII string "Brown fox", "BROWN FOX JUMPS", "brown fox???" or similar. The comparison is case-insensitive and limited in length to the length of text constant.
EAX=="Brown fox" - same as above, EAX is treated as a pointer.
UNICODE [EAX]=="Brown fox" - OllyDbg treats EAX as a pointer to UNICODE string, converts it to ASCII and compares with text constant.

I suppose that You can use UNICODE [EBX]=="Your unicode string"
Or UNICODE EBX=="Your unicode string" ???
oh me anon
07-15-2005, 06:34 PM
well without knowing a string beforehand it is really wide open
may be you could try logging it as expression
and then parse through the output

shift +f4
type ebx in expression box
select pointer to unicode string in decode value of expression
select log value of expression to always

then in log window you will see lot of
Log data, item 1
Address=00401027
Message=COND: 00400000 "?P"

crap like that :)
look if one of the crap is a meaning full string :)
and then set a conditional break point with
unicode [ebx] == "the string you found out"
joe
07-15-2005, 08:47 PM
2 oh me anon:
Thanks for Your correction.
Mistake is my second name :-)
mrwizeman
07-16-2005, 12:21 PM
ok, let me try to explain this better>

The string in EBX can look like this: UNICODE "<a>John Storm says 'Do you want to join my group?'</a>"

Now, as you can see, there is no way I can know what the line will be, because players can say anything... I was just wondering if, there is anyway I can get it to break if EBX 'CONTAINS' "UNICODE*"

hmm hard to explain... in SQL the condition would be "select * from registers where EBX like 'UNICODE%'
oh me anon
07-16-2005, 04:09 PM
well a condition is always two sides it needs an expression on the other side to be compared and acted upon

well like i said you can log or if you know for sure ebx could contain an unicode string you can ask ollydbg to stop on a complex condition like

byte ptr ds:[ebx+1] == 0 && byte ptr ds:[ebx+3] == 0 && byte ptr ds:[ebx+5] == 0 && byte ptr ds:[ebx+7] == 0

an unicode string (especially in english alphanumeric chars not chinese and others which uses both bytes)

is like m0r0w0i0z0m0a0n == mrwizeman

now if you have these strings

00403000 j.o.j.ov..j.a.j.a...jaebj.e...j.u.j.u...j.i.j.i... j.y.j.y...j3r5
00403040 jDr...b.a.b.a...b.i.b.i...b.u.b.u...b.o.b.o...b.e. b.e...d.a.d.a.
00403080 ..d.e.d.e...d.i.d.i...dcudd.u...n.a.n.a...n.e.n.e. D.n.u.n.u.....

it will stop not stop on 403000 (strlength 7 th byte is not 0)
or on 403014 ,40303c ,403096 (ascii string)

but wil stop on all other strings
Log data
Address Message
0040100A COND: 0040300A "jaja"
0040100A COND: 0040301E "juju"
0040100A COND: 00403028 "jiji"
0040100A COND: 00403032 "jyjy"
0040100A COND: 00403046 "baba"
0040100A COND: 00403050 "bibi"
0040100A COND: 0040305A "bubu"
0040100A COND: 00403064 "bobo"
0040100A COND: 0040306E "bebe"
0040100A COND: 00403078 "dada"
0040100A COND: 00403082 "dede"
0040100A COND: 0040308C "didi"
0040100A COND: 004030A0 "nana"
0040100A COND: 004030AA "neneDnunu" <-- it records becuse it is valid unicode string and strlen is greater than 4
0040100A COND: 004030B4 "nunu"
0040100A COND: 004030BE ""
00401011 Breakpoint at msgbox1.00401011

break point details

Breakpoints, item 0
Address=0040100A
Module=msgbox1
Active=Log when byte ptr ds:[eax+1] == 0 && byte ptr ds:[eax+3] == 0 && byte ptr ds:[eax+5] == 0 && byte ptr ds:[eax+7] == 0
Disassembly=CMP EAX, msgbox1.004030BC

code
00401000 >XOR EAX, EAX
00401002 MOV EAX, 00403000
00401007 ADD EAX, 0A
0040100A >CMP EAX, 004030BC <-- set here conditional log and stop
0040100F JB SHORT 00401007
00401011 TEST ESI, 3

hope you understand :)


RIP SHaG?

RCE Messageboard's Regroupment > OllyScript > RIP SHaG?
Menelao
07-16-2005, 03:21 AM
Does this guy SHaG know OllyScript site is down?
Is he planning to do anything about it?
Where is he anyway?
mr haggar
07-27-2005, 06:53 PM
Don't know. I hoped that there will be new versions with more instructions and fixed bugs.
Epsylon3
11-02-2005, 10:30 AM
i think i can add some functions if you want... plz ask me...
nick_name
11-02-2005, 12:57 PM
Epsylon3 ,

1. please add HOTKEYS to
run, abort, pause, resume , step menus.

2. or atleast add a MRU list (Most Recently Used scripts ) to remember the last 5 scripts location which will play upon just clicking.

thank you.
Epsylon3
11-02-2005, 03:52 PM
ok, will try to add that...
Epsylon3
11-02-2005, 09:16 PM
Sources & DLL Updated, now with a basic MRU List

Note : The Main Menu List is Static, so the MRU is updated only on Odbg reload...

This library need some more dlls... ask if you dont have one of these...

http://e3.epsylon.org/olly/ODbgScript.1.1.VC6.rar
SHaG
11-03-2005, 12:00 AM
Hey, I'm not dead! Just resting... =))
And if you REALLY want to know, I was in a place where the doors have no handles on the inside and the windows have bars on them. =/ Thats why the site died - couldn't renew the domain and some fucked-up company bought it.
Epsylon3
11-03-2005, 06:04 AM
seriously ?
SHaG
11-04-2005, 12:24 PM
Unfortunately... Did some shit that didn't please the system very much...
Epsylon3
11-07-2005, 07:39 AM
Yep, i understand ;)

I'm working on a new version...

i've almost finisned the "script trace" which shows the script and progression, and also contents of variables and eip...
shERis
11-10-2005, 06:59 PM
Hi SHaG!

I am very, very glad that you are here on earth! You made a fantastic work with your Ollyscript. It helped me very often.

I feel with you with your private problems! You surely had a bad time and it seems that you have troubles at all. But you´ll manage it!

I am a little bit sad that you won´t proceed your work! I waited month for month to hear from you - but nothing! I had some wishes for Ollyscript. Important for me. Now I hope that my wishes could be fulfilled with others help.

I wish you good luck for your future, SHaG, and many ideas for your projects!

~hERi~
shERis
11-10-2005, 07:08 PM
Hy Epsylon3!

You could be my help!

I waited month for month to hear from SHaG - but he was away. I had some wishes for Ollyscript - and nobody could help me.

I thought that I must try it for myself - but I never worked on C++ projects. So I would have to learn very, very much. Having source code of Ollyscript is too less.

But now it seems that you are proceeding SHaG´s work! That makes me very happy!

I´ll post my wishes soon, I hope you can help me.

Thanx for all, SHaG and Epsylon3! Great work!

~hERi~
SHaG
11-11-2005, 12:51 PM
shERis
I wish you good luck for your future, SHaG, and many ideas for your projects!

Thank you for the kind words! =)


question by a n00b

RCE Messageboard's Regroupment > OllyScript > question by a n00b
5hplayer
07-16-2005, 05:16 PM
hi my question is, how to use the scripts for olldbg? ive got a lot of scripts in my script folder but how can i use them?
arjuns
07-16-2005, 06:37 PM
first you've to have that plugin if it exists
Goto Menu item named "Plugins" select "ollyscript" choose "Run script..." and select the name of your desire script , job is done.
.....arjuns
5hplayer
07-16-2005, 06:48 PM
where to get the plug in for that?
5hplayer
07-16-2005, 06:53 PM
thanks for help, i could solve the prob. i had to change a line in ollydbg.ini
5hplayer
07-16-2005, 07:06 PM
sorry for "spamming" but after solving the first problem the next had come ^^ i want to unpack a file protected with armadillo 3.7(8). i have the script and i run it, than i open the exe. but what to do next? i used the "Find OEP" function and than i dumped the process. but what to do now? when i start the dumped program, a messagebox is blopping up and says, blablabl.exe has to be shutdown. i hope u can help (and im sure u can help me *g*)
joe
07-16-2005, 08:16 PM
You realy run script before opening exe???
To Armadillo: Ricardo Narvaja described this problem several times. Take look for older threads.
5hplayer
07-17-2005, 10:50 AM
yeah, i really did. yesterday i wrote an email to ricardo;) But can you explain to me, what the "general" way to unpack (with ollydbg) an packed exe is?
Ricardo Narvaja
07-17-2005, 12:40 PM
1)nobody start unpacking armadillo
2)armadillo is one of the hard packers, the goal is start with easy packers and armadillo one of the latest (only practice unpackers can unpack)
3)there are variants of armadillo (with copymem2, without copymem2, etc etc) is not a easy theme for explain in a forum, in a tutorial with images is hard, here without images is imposible)

Practice with easy packers, and go increasing the difficult slowly

Ricardo Narvaja
5hplayer
07-17-2005, 05:54 PM
yeah thats what i think now 2 ^^


gunz online

RCE Messageboard's Regroupment > General > gunz online
nobledevil666
07-17-2005, 07:33 AM
hacks plz ( god mode no reload infinite ammo flying on toggle command or osmthing) if u cant make the hacks for me could u at least explaint o me how to do it with olly and i will dof or myself and help other in forums ( newb to olly) i still havnt goten around to figuring out olly i am used to CE...plz help ( its a fun game u can get it at betawatcher.com under the open beta section
oh me anon
07-17-2005, 08:52 AM
nobledevil many of your earlier posts were simply removed because it has nothing to do with ollydbg or its usage

btw no one will be willing to download those massive mmorpg apps just to suggest you how to get infinite ammo or how to become god

may be you should actually spend some time learning the intricacies of
operating ollydbg and learn a thing or two instead of
asking how i become god
to become god you need to know something substantially more than
just nopping or changing the fate of jumps

may be this thread will go too or may be locked

i really suggest you to ask some thing related to ollydbgs usage
not how i ma gonna "add your favourite request word" this gunz and become god
xcracx
07-18-2005, 02:33 AM
its not GZP here...
no leaking + its not gamehacking forum

so don't ask for that and infinite ammo is not possible only ingame reload
please spear us from this kind of msgs and when you'll know how to deal with olly come up for help

xcarcx
nobledevil666
07-21-2005, 02:45 AM
lol i have asks for tutorials many of times no one want to tell me how to work olly and a screw atroudn with wit every day trying to understand but without no one to explain it atleast a little bit i am totally clueless on how to use it
nobledevil666
07-21-2005, 02:46 AM
and i am sorry if my posts bother/annoy/piss-off other people but unless somone wants to tell me the basics of olly and how i work the shyt on it begging for hacks is all i can doo : (
nobledevil666
07-21-2005, 02:59 AM
btww u misspelled spare please spear us from this :P ( i suk at typeing so i shouldn't be talking but since ur trying to downtalk me i ight as well say somthing ...
oh me anon
07-21-2005, 09:37 AM
nobledevil get some simple applictions from many of the places that offer them along with solutions to them
first try to work on your own and find what the authour of the app ask you
to do with it if you cant find out on your own read the tutorials that came along with it and redo what they said in the tutorials

before that get masm (hutchs package) it comes bundled with iczelions tutorial tke teh first messagebox tutorial and load it into ollydbg and see how the exe looks like then
apply your thought and change the "win 32 asm is great" string to
"oops i changed this to my name "
then take another one may be the tut 10-1,10-2 dialogbox
thingy and add a nag screen to it and assemble
then try to remove the nag screen yourself from the raw binary

then find some unsolved and apparently simple application
and try your hands at it

practice ,practice practice read a lot google like mad man
get your self familiarised with opcodes

i can recommend you to try the crackmes from crackmes.de

debugging and reversing is a time consuming and a very patient job

and begging for hacks will get you nowhere


I've hosted a few of the Olly programs up

RCE Messageboard's Regroupment > General > I've hosted a few of the Olly programs up
od fa real
07-18-2005, 05:30 AM
I found them incredibly hard to find, and many sites down. I decided to take the time to host them myself. They cannot be accessed thru the main site, so only use the link below.

http://www.odcustoms.competencywebhosting.com/olly.htm


Need Help Unlocking Armadillo 4

RCE Messageboard's Regroupment > General > Need Help Unlocking Armadillo 4
od fa real
07-18-2005, 05:46 AM
I have a program locked with what I believe is either Armadillo v4, or v4.10

I am willing to pay to get this program unlocked.
If you are interested, contact me thru here. i will give instructions
joe
07-18-2005, 03:50 PM
You don't find anybody (I think) to unlock program here! It's OllyDbg forum, not warez.
od fa real
07-19-2005, 05:07 AM
your right. its not warez.

i can get all the way up to seperating the father from the child process, but then it looks like some of it is still encoded and can't use the same techniques from the older versions.
sungt
08-14-2005, 12:17 PM
It is easy to unpack 4.10,NOW I can unpack the newest 4.30。


Error Entry Point Alert con Olly

RCE Messageboard's Regroupment > General > Error Entry Point Alert con Olly
gallegoortiz
07-18-2005, 02:46 PM
Hola tengo un programa realizado en Visual C++, al conseguir el serial me da este error:
Entry oint Alert
Module ACTIVESK has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying.
Please keep it in mind when settyng breakpoints.

El modulo en cuestion es ACTIVESKIN.OCX

Gracias
Ricardo Narvaja
07-18-2005, 03:10 PM
this is not a error is only a alert of olly, don´t have any problem

Ricardo Narvaja


ollydbg command line parameter??

RCE Messageboard's Regroupment > General > ollydbg command line parameter??
pillii
07-18-2005, 07:22 PM
hello,
is it possible to start ollydbg with parameters so that olly attaches to a running process.
i think of something like
ollydbg -pid 12345
tia
pillii
Ricardo Narvaja
07-18-2005, 07:45 PM
in the open window, there are a for put a argument see the open window of olly.

Ricardo Narvaja
pillii
07-18-2005, 08:07 PM
thx for your reply, but that isnt quite what im looking for

i want to start ollydbg.exe with an argument so that olly attaches to a running process (identified by process id) right after olly startet
i dont want to start a debugee with a parameter, the debugee is already running and i just want olly to automatically attach to it
joe
07-18-2005, 08:08 PM
I think, that this isn't possible directly. pillii want run it from commandline. Commandline support only name of attached file. Support program can indirect convert PID to name (?), then invoke Olly with this name. But why, when it can be attached after starting Olly?

EDIT: OPS I'm write too slowly.
pillii
07-18-2005, 08:51 PM
thx for your quick answer

well, i want olly to do it automatically because im a lazy guy and could save 5 seconds..
i need to give olly the process id, because there are 2 instances of the debugee exe running
so giving olly the process name i would never know to what process olly attached.
oh me anon
07-19-2005, 11:31 AM
what do you mean give process name why not attach the one which you know by process id ??
how do you get the process id ?? using winspy ??
if yes attach directly

Unnamed window, item 6
Process=00000660 <----- whats the problem with using this value ??
Name=BKEYME1
Window=B-KEY-ME
Path=C:\Documents and Settings\xyz\Desktop\BkeyMe(Fixed)\BKEYME1.EXE

Unnamed window, item 7
Process=00000668 <----- whats the problem with using this value ??

Name=BKEYME1
Window=B-KEY-ME
Path=C:\Documents and Settings\xyz\Desktop\BkeyMe(Fixed)\BKEYME1.EXE

if you already know that value ??
:(
pillii
07-19-2005, 02:44 PM
i have a exe that creates a second process of the very same exe.
i wrote a plugin that makes some things with the exe and after that the plugin should run a new ollydbg that attaches to the created process.
i know the pid of the process. i just want to know if it is possible to run ollydbg with cmdline args so that olly attaches to the created process.
i can start olly with ollydbg.exe -my.exe, in this way olly creates a new process of the exe.
assume the following:
my.exe is running and there are 2 processes of it.
my.exe processid: 1000
my.exe processid: 2000
now i want to start olly in a way so that olly attaches to my.exe (pid:2000)
the following doesnt work
ollydbg.exe -pid 2000
is there a way to achieve this?
where are the commandline parameters for olly documented?
oh me anon
07-20-2005, 10:07 AM
i dont think ollydbg handles any other params apart from name of exe
also it doesnt handle redirection params as far as i know
i mean like in gdb you can use
gdb myblah < myinput.txt
if you pass the param < myinput.txt to ollydbg it wont be able to get the redirection
oh me anon
10-06-2005, 06:46 PM
well i stand corrected ollydbg can indeed launch applications with
pid :) thats how the jit debugger technique works

use ollydbg -p pid as commandline

take a look ath this thread
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=1505 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=1505)
Lord_Looser
10-07-2005, 09:32 AM
ollydbg -AEDEBUG <pid> <EventHandle>
ollydbg -p <pid>
ollydbg -SERVICE ... //how is correct command line? what makes it?


Anti ****

RCE Messageboard's Regroupment > General > Anti ****
Xacker
07-19-2005, 07:37 AM
Hiya folks,
im having troubles understanding the protection of a crackme posted by Blue_Orka on crackmes.de
it uses some antiolly tricks that i couldnt manage to pass.. i cant get to debug the program step by step or do anything..

when loading the target i get an error msg that its not a 32-bit application or something.. p.s: Sice crashs when i run the target so its a common trick between the two debuggers..

i need some help on some known or unpublished tricks.. anti*** or antianti ****
and yeah, pumqara tricks are old ones and not used here.. so, SOS!

tnx
TQN
07-19-2005, 09:35 AM
Use Stud_PE or any PE Editor, change the value of NumberOfRvaAndSizes in Optional Header to 0x10 (16).
This is a old trick.
oh me anon
07-19-2005, 11:15 AM
hehe
take a look at honeynet nicolez brulez sotm 33 article or search in rce board for posts by nico

oops why lord pe whats the problem with using ollydbg

f9 when it is running f12 pause view call stack show procedure
when in executable module right click view executable file
right click change display to special
hit ctrl+g and type 12c
you will be here
0000012C 10FF0300 DD 0003FF10 ; NumberOfRvaAndSizes = 3FF10 (261904.)

right click modify integer to 10 save file
open this saved file in ollydbg and it shows up nice :)

00401044 >PUSH 0 ; /pModule = NULL
00401046 CALL <JMP.&kernel32.GetMod>; \GetModuleHandleA
0040104B MOV DWORD PTR DS:[403360]>
00401050 PUSH 2200 ; /Color = RGB(0.,34.,0.)
00401055 CALL <JMP.&gdi32.CreateSol>; \CreateSolidBrush
0040105A MOV DWORD PTR DS:[403368]>
0040105F PUSH 0 ; /lParam = NULL
00401061 PUSH BKEYME1.0040107C ; |DlgProc = BKEYME1.0040107C
00401066 PUSH 0 ; |hOwner = NULL
00401068 PUSH 65 ; |pTemplate = 65
0040106A PUSH DWORD PTR DS:[403360] ; |hInst = NULL
00401070 CALL <JMP.&user32.DialogBo>; \DialogBoxParamA

oops the cme has a bug on exit :)
bud_gd
07-20-2005, 02:58 AM
oh me anon, might this method be somewhat safe for other than the crackme of?, ?.
oh me anon
07-20-2005, 10:10 AM
what method ?? you mean changing the pe header info ??
i have changed many things like that including adding a new section details never faced any problems
may be you could elobarate a little so that i can understand what you are asking :)
Ricardo Narvaja
07-20-2005, 03:04 PM
for me this protection is a crap, the crackme run perfect in OLLY, if you need reach the Entry Point,
you change in debugging options-events the program stop in SYSTEM BREAKPOINT, when the massagebox of this is a not valid 32 bits bla bla, acept and go to VIEW-MEMORY and put a MEMORY BREAKPOINT ON ACCESS in the section (the only section you can see) and next press f9, and the program stop in the entry point, quit the BPM and press f9 and the program RUN perfect, there are no problem at all.

Ricardo Narvaja
oh me anon
07-20-2005, 04:37 PM
hehe thats too much work Ricardo :)
well one doesnt even have to change events olly will stop on system breakpoint automatically if it cant find winmain :)
hit alt+f1 type
bp ZwSetInformationThread and hit ok
hit f9
hit ctrl+f9
f7* you are on oep :)

*one time if you have options -->debugging options-->trace--->after executing till ret step over ret check box selected
*two times if you dont have the above check box selected

btw if you have ntdll.dll analysed you dont even have to set this breakpoint it will be there everytime :) if you have set it once


how to build a ollydbg.lib?

RCE Messageboard's Regroupment > Plugins > how to build a ollydbg.lib?
pillii
07-19-2005, 09:05 PM
hello,
im pretty new to c++, i have visual studio 7 and want to know how i can make a lib with the new ollydbg110 apis.
i already have a lib that works, but its from an old sdk and doesnt support the Attachtoactiveprocess api, which i need, from ollysdk 110 .
i guess i have to make it with 'lib /def:ollydbg.def /machine:ix86' , but the generated lib file doesnt import any funktions to me when i add it to my c++
project.
this is what lib outputs to me:

H:\olly plugins\plug110>lib /def:ollydbg.def /machine:ix86
Microsoft (R) Library Manager Version 7.10.3077
Copyright (C) Microsoft Corporation. All rights reserved.

ollydbg.def(2) : warning LNK4017: NAME-Anweisung wird von der Zielplattform nicht unterstützt; ignoriert
ollydbg.def(3) : warning LNK4017: DESCRIPTION-Anweisung wird von der Zielplattform nicht unterstützt; ignoriert
ollydbg.def(4) : warning LNK4017: EXETYPE-Anweisung wird von der Zielplattform nicht unterstützt; ignoriert
ollydbg.def(5) : warning LNK4017: CODE-Anweisung wird von der Zielplattform nicht unterstützt; ignoriert
ollydbg.def(6) : warning LNK4017: DATA-Anweisung wird von der Zielplattform nicht unterstützt; ignoriert
Bibliothek 'ollydbg.lib' und Objekt 'ollydbg.exp' wird erstellt

pls help me
pillii
joe
07-19-2005, 09:41 PM
Go to: http://www.ollydbg.de/
In the What's new section You can find 'Modified PDK' from Alex Clarke.
This update contains Attachtoactiveprocess.
pillii
07-19-2005, 10:00 PM
thank you!!
this was exactly what i was looking for


RDG Packer Detector v0.5.6

RCE Messageboard's Regroupment > General > RDG Packer Detector v0.5.6
RDGMax
07-20-2005, 02:19 AM
RDG Packer Detector v0.5.6

http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/5/RDGPackerD
(http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/5/RDGPackerD
)
etectorv0.5.6.rar


Some questions about the rtrace tutorial

RCE Messageboard's Regroupment > General > Some questions about the rtrace tutorial
Warrax
07-20-2005, 10:40 AM
I hope someone can help with my problem. I do the rtrace tutorial, but i have problems to trace rtrace back. I press ctrl-f12 for restart, then i press ctrl-f11. Olly start tracing, but nothing happens by me. I break tracing by pressing f12 and go to Executable modules to look at the trace profiles and theres is nothing that looks like in the pictures of tutorial. I hope someone can help.
Ricardo Narvaja
07-20-2005, 02:57 PM
go to ... buton, the button with three dots and this is the view-run trace window

Ricardo Narvaja


Can the TC command stop when excute a given instruction?

RCE Messageboard's Regroupment > General > Can the TC command stop when excute a given instruction?
achan
07-21-2005, 11:41 AM
It is the same word that when excute a given instruction ,
such as jmp xxxxxxxx ,
the ollydbg should stop before excution.

or some other command can implement the function?

:)
joe
07-21-2005, 03:45 PM
If I understand, You think concrete jump. There are some way how to do it:
1. Go to xxxxxxxx address, right click -> Find references to -> Address constants
2. Go to jmp xxxxxxxx instruction, right click -> Find references to -> Jump destination
3. Go to call xxxxxxxx instruction, right click -> Find references to -> Call destination
Then right click (in references window) -> Set breakpoint on every command
May be there are any other method.
oh me anon
07-21-2005, 04:41 PM
if you want ollydbg to stop on any and every unconditional jumps
right click search for all commands
type jmp const
click find
you will get another window full of jumps
right click
set break point on every command

btw the search for all commands all sequences are very powerfull if you use them properly

assuming you want to break on this sequence

like
jmp some where
some commands in between
then a call register

all you have to do is

right click
search for all sequences

type
jmp const
any 8
call r32
and hit find
ollydbg will get you all such sequnces in another mdi window

like this

004353F0 JMP SHORT 00435448
004353F2 PUSH ESP
004353F3 PUSH 4B6F03
004353F8 PUSH 0
004353FA CALL NEAR ESI

2

00435603 JMP 0043576D
00435608 OR EDI, FFFFFFFF
0043560B XOR EAX, EAX
0043560D MOV DWORD PTR SS:[ESP+18], EAX
00435611 XOR EBX, EBX
00435613 PUSH 2
00435615 CALL NEAR EBP
achan
07-22-2005, 11:04 AM
Thanks for your help~

I have a another question.
If one instruction executed followed by the follow 2 instructions sequence
push xxxxxxxx
|- ret ; I want to interupt here
| .......
|->push ebp ; But I just know the addresss of this instruction(The above instruction ret return to here.)

How can I implement it ?

What is the meaning of "any const"?
Const is between 1 and 8.
oh me anon
07-22-2005, 03:28 PM
:( i did not understand you
do you mean you want to find the specific retn that comes to your push ebp ??

if yes select the line push ebp and hit ctrl+r
ollydbg will show you all the commands that leads you to this push ebp

References in ***** to 00401006
Address Disassembly Comment
00401006 PUSH 0 (Initial CPU selection)
00401275 PUSH 401006

0040126F PUSH 401275
00401274 RETN ; RET used as a jump to 00401275
00401275 PUSH 401006
0040127A RETN ; RET used as a jump to 00401006

get the help file out and read through it

To skip up to n ambiguous commands, use construct ANY n. If you expect up to 2 intermediate commands in the header of the procedure, use

PUSH EBP

ANY 2

MOV EBP,ESP,

and possible search pattern in the second case is, for example,

LEA RB,[4*RA+RA]

ANY

LEA R32,[4*RB+RB]
arjuns
07-22-2005, 04:43 PM
I think his porblem is such
how to stop or pause the running ollydbg when it is about to perform a specified instruction.
for example,
stop olly when eax contains 123456
gabri3l
07-22-2005, 10:44 PM
If that is what he is asking then he needs to use the "Set Condition" option.

Use the Debug menu ->Set condition
In there you can set many conditions for your trace.

For example:
[x] Condition is True: Eax == 123456
-Will stop when eax contains 123456

or

[x] Command is One Of:
Push Eax
-Will stop when Push Eax is being executed

and as oh me anon mentioned, if you know how to use the variables in Olly you get much more power. You can also use CONST to take the place of any constant. For example:

[x] Command is One Of:
jmp CONST
-Will break when command being executed is: JMP program.xxxxxxxx

Once you set your conditions go ahead and choose Trace Into from the Debug menu to start your trace.
achan
07-25-2005, 12:31 PM
As oh me anon said,
I have tried the oparation,but I can't get the result as you give out.
I think the command of ctrl + r can't find reference by push const
so how can I find that reference ?

if yes select the line push ebp and hit ctrl+r
ollydbg will show you all the commands that leads you to this push ebp

References in ***** to 00401006
Address Disassembly Comment
00401006 PUSH 0 (Initial CPU selection)
00401275 PUSH 401006

0040126F PUSH 401275
00401274 RETN ; RET used as a jump to 00401275
00401275 PUSH 401006
0040127A RETN ; RET used as a jump to 00401006
oh me anon
07-25-2005, 02:34 PM
ctrl+r is a keyboard shortcut it doesnt take arguments
if you want to find all push const retn
then use search for -->all sequences
type push const
retn and hit find
if they are there they all will be shown
if you dont get it
1) they are not there
2) the code may be self modifying
3) may be stuffed into resource section and used only if some conditions are met
4) might be in some dll and may be using virtual alloc read and all other
unholy tricks
5) may be using some othere yet to be documented ingeniune freaky 0day ideas probably

and you are really not making sense yet :) of what your requirement is.

what result you are imagining ollydbg will show you ??
and why ollydbg is breaking your dreams ?? i am not able to understand :)


Ollyscript log....

RCE Messageboard's Regroupment > OllyScript > Ollyscript log....
Nikon82
07-21-2005, 05:09 PM
Excuse to all....
i am a verrryyyyyyyy newbie....

i use ollyscript with a script... where can i see the resulting log?...

THANKSSSSSSSSSS
joe
07-21-2005, 05:50 PM
You can see log in Log window. But only if script creates log.
Nikon82
07-22-2005, 07:25 AM
thanks...
it's strange because in the script there is the log item (example log "ciao")... but in the log window there are only information generated by ollydbg...
sigint33
07-22-2005, 07:58 PM
That's what the log window does, it reports what olly has been doing. A script only better defines what to report to the log.

SiGiNT


Unpacking SF protected exe

RCE Messageboard's Regroupment > General > Unpacking SF protected exe
caty
07-21-2005, 06:46 PM
hi

I am trying to unpack a Starforce protected exe,anyone here got a idea.when i try to open with ollydby it gives me the debugger protection error.
pillii
07-22-2005, 03:26 PM
i think you have to 'correct' the isdebuggerpresent api. there is a plugin in the stuph section of this site which is doing so.
btw, what exe do u debug??


Unpack aspack 2.12 with asprotect detection euristica

RCE Messageboard's Regroupment > General > Unpack aspack 2.12 with asprotect detection euristica
cota
07-21-2005, 09:02 PM
hi

I am trying to unpack Voptxp 7.22,anyone here got a idea for recostructing IAT


armadillo.... is it possible?

RCE Messageboard's Regroupment > General > armadillo.... is it possible?
Nikon82
07-22-2005, 07:23 AM
I have an exe file... this is protected with an armadillo protection...
i would like know the version before... and then search some method to unpack...

How can i see the version?...

During the debug, it open everytime a different arm* module, and it blocks with C0000005 violation...

Someone can help me?
i attempt with ollyscipt and armadillo_detector script but i haven't log and any messagebox...

THANKS IN ADVANCE!
arjuns
07-22-2005, 04:29 PM
Use PEID
www.peid.tk (http://www.peid.tk)


how does olly pass exceptions to debugee?

RCE Messageboard's Regroupment > General > how does olly pass exceptions to debugee?
pillii
07-22-2005, 03:35 PM
hello,
i wonder how exactly olly passes exceptions to the debugee. in the exceptions option window when i check every option and also ignore the exception range from 0 to ffffffff olly sometimes tells me 'dont know how to bypass exception'.
this is not what i expected.
another thing is that i get evil bluescreens when debugging certain exes, every other debugger i tried didnt give me bluescreens when exceptions have been raised.

pillii
Ricardo Narvaja
07-22-2005, 10:58 PM
OLLY have a bug in ILLEGAL EXECPTION, hwne you pass tell you don´t know how bypass exception, i repair this bug debuggin OLLYDBG with other OLLY, serach the strings of the message and you can repir this bug easily, only changing one conditional JUMP.

Olly is a RING3 debugger and cannot produce any blue screen , the program you are debugging, detect is being debugged and intentionally produce this blue screen.

Ricardo Narvaja
gabri3l
07-23-2005, 12:11 AM
Ricardo, you just saved me a whole ton of Shift+F9's. I didn't know it was a bug that could be fixed, You are my hero. :)
pillii
07-24-2005, 04:15 AM
thank you for your answer.
i followed your instructions and now i dont get the annoying message box.
i also figured out why olly makes those certain exes give me a bluescreen.
its because olly calls continuedebugevent api with dwContinueStatus=DBG_CONTINUE, this is not what i expect from olly when i tell olly in the options menu to not handle any exception. i changed the parameter dwContinueStatus to DBG_EXCEPTION_NOT_HANDLED and now everything works just fine.
i wonder if there is a plugin out there doing this automatically. if not i will try to write such a plugin, because i think this feature is a must for a good debugger.
btw, why does olly call continuedebugevent with wContinueStatus=DBG_CONTINUE when i tell olly to pass every exception to the debugee??
tia
pillii


User-defined labels

RCE Messageboard's Regroupment > General > User-defined labels
Wilmar
07-25-2005, 08:42 AM
Hi, how can I assign a label in a stack memory address?
The label option (and many other options too) disappear when I go to stack addresses from the Dump window, [shift] + : doesn't work either
oh me anon
07-25-2005, 02:46 PM
stack is dynamic whats the use of labelling there ??

anyway look in register window find esp or ebp register right click follow in dump
and use shift + : key to label

ESP ==> 0012FFC4 <whattheheck> 7C59893D =‰Y| RETURN to KERNEL32.7C59893D
ESP+4 0012FFC8 <eee> 00000000 ....
ESP+8 0012FFCC <ttt> 00000000 ....
ESP+C 0012FFD0 <ggggg> 7FFDF000 .ðý
ESP+10 0012FFD4 <ggggggg> 00000000 ....
ESP+14 0012FFD8 <wilmar> 0012FFC8 Èÿ. <eee>
ESP+18 0012FFDC <wilmar:)> 00000000 ....

or use commandline plugin and type

L esp+20 "iam the wilmar guy who wanna label stack variable "

and olly will label it for you
ESP+20 0012FFE4 <"iam the wilmar guy who wanna label stack variable "> 7C5C1F44 D\| SE handler
Wilmar
07-25-2005, 05:05 PM
IMHO labelling stack is much useful, especially when you have many variables the code becomes much more readable if you have a name instead of [LOCAL.1] [LOCAL.2] [ebp-20] etc...

However what you said makes the label appear only in the register window, what i want is to see the label in the cpu to make the code more readable.
Do you think a plugin can do that? I haven't written any plugin so far don't know either how to write one but i can try if it's feasible.

Anyway thanks for the tip, did you see the help because i searched and found nothing
oh me anon
07-25-2005, 06:59 PM
if you prefer to have args decoded may be try using analysis
assume argument options and force ollydbg to analyse

for example if you have a dialog proc
on the push ebp if you ask ollyto asseme it as winproc

it will decode the arguments accordingly

like this

[i]
EB> 77D48709 /CALL to Assumed WinProc from user32.77D48706
EB> 003B00B0 |hWnd = 003B00B0 ()
EB> 00000080 |Message = WM_SETICON
EB> 00000001 |wParam = 1
EB> 01320079 \lParam = 1320079

[/code]

if you want to change local.1 to another name i dont think its feasible
but never tried it i like it [ebp+20] :)
could you post a snippet where you like to have it labelled ??
may be label it the way you want manually and then post it
so that i can check if its feasible :)
if you are posting snippet
post the original as well as your modified both so that i can try experimenting
Wilmar
07-25-2005, 07:19 PM
well it doesn't matter if args are decoded automatically, take the following code for example:

PUSH EBP
MOV EBP, ESP
SUB ESP, 40
LEA EDX,DWORD PTR SS:[EBP-20]
PUSH EDX
MOV WORD PTR SS:[EBP-20],0F
CMP DWORD [EBP-40], EAX
...
...

Could it be possible to change [EBP-20] to whatever label so that i don't have to remember -20 -40 -50, etc....?
If i recall correct IDA has such feature, i'm not sure since i don't use it anymore
oh me anon
07-26-2005, 11:25 AM
well labelling vftable entries is not feasible in ollydbg

only thing that comes close to it is you can change [ebp-20] to local.some thing if you use
options -->analysis1 show args and locals

like this

00401031 WIN.>PUSH EBP
00401032 MOV EBP, ESP
00401034 ADD ESP, -50
00401037 MOV [LOCAL.12], 30
0040103E MOV [LOCAL.11], 3
00401045 MOV [LOCAL.10], WIN.WndProc
0040104C MOV [LOCAL.9], 0
00401053 MOV [LOCAL.8], 0
0040105A PUSH DWORD PTR DS:[hInstance]
00401060 POP [LOCAL.7] ; KERNEL32.7C59893D
00401063 MOV [LOCAL.4], 6
0040106A MOV [LOCAL.3], 0
00401071 MOV [LOCAL.2], OFFSET WIN.ClassName ; ASCII "SimpleWinClass"

WIN.Wndproc is from objscan of the objfile for which i have source
if you dont have objfile then olly will show only 401000some thing which you have to name your self
oh me anon
07-27-2005, 03:51 PM
well i was pokingaround what the 2 3 4 5 6 7 etc mean :)

well if you have the source and compile it with debuginfo

and check mark options --> stack show names of local variables

then ollydbg names all the local variables in stack and shows thier names

like this

00401055 win.Wi>PUSH EBP
00401056 MOV EBP, ESP
00401058 ADD ESP, -50
0040105B MOV [LOCAL.wc], 30
00401062 MOV [LOCAL.wc+4], 3
00401069 MOV [LOCAL.wc+8], win.0040100A
00401070 MOV [LOCAL.wc+C], 0
00401077 MOV [LOCAL.wc+10], 0
0040107E PUSH DWORD PTR DS:[hInstance] ; win.00400000
00401084 POP [LOCAL.wc+14]
00401087 MOV [LOCAL.wc+20], 6
0040108E MOV [LOCAL.wc+24], 0
00401095 MOV [LOCAL.wc+28], OFFSET win.ClassN>; ASCII "SimpleWinClass"
0040109C PUSH 7F00 ; /RsrcName = IDI_APPLICATION
004010A1 PUSH 0 ; |hInst = NULL
004010A3 CALL win.LoadIconA ; \LoadIconA
004010A8 MOV [LOCAL.wc+18], EAX
004010AB MOV [LOCAL.wc+2C], EAX
004010AE PUSH 7F00 ; /RsrcName = IDC_ARROW
004010B3 PUSH 0 ; |hInst = NULL
004010B5 CALL win.LoadCursorA ; \LoadCursorA
004010BA MOV [LOCAL.wc+1C], EAX
004010BD LEA EAX, [LOCAL.wc]
004010C0 PUSH EAX ; /pWndClassEx = 00141EE0
004010C1 CALL win.RegisterClassExA ; \RegisterClassExA
004010C6 PUSH 0 ; /lParam = NULL
004010C8 PUSH [ARG.hInst] ; |hInst = 00400000
004010CB PUSH 0 ; |hMenu = NULL
004010CD PUSH 0 ; |hParent = NULL
004010CF PUSH 80000000 ; |Height = 80000000 (-2147483648.)
004010D4 PUSH 80000000 ; |Width = 80000000 (-2147483648.)
004010D9 PUSH 80000000 ; |Y = 80000000 (-2147483648.)
004010DE PUSH 80000000 ; |X = 80000000 (-2147483648.)
004010E3 PUSH 0CF0000 ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_SYS MENU|WS_THICKFRAME|W S_CAPTION
004010E8 PUSH OFFSET win.AppName ; |WindowName = "Our First Window"
004010ED PUSH OFFSET win.ClassName ; |Class = "SimpleWinClass"
004010F2 PUSH 0 ; |ExtStyle = 0
004010F4 CALL win.CreateWindowExA ; \CreateWindowExA
004010F9 MOV [LOCAL.hwnd], EAX
004010FC PUSH 1 ; /ShowState = SW_SHOWNORMAL
004010FE PUSH [LOCAL.hwnd] ; |hWnd = FF71CFC4
00401101 CALL win.ShowWindow ; \ShowWindow
00401106 PUSH [LOCAL.hwnd] ; /hWnd = FF71CFC4
00401109 CALL win.UpdateWindow ; \UpdateWindow
0040110E win.C0>/PUSH 0 ; /MsgFilterMax = 0
00401110 |PUSH 0 ; |MsgFilterMin = 0
00401112 |PUSH 0 ; |hWnd = NULL
00401114 |LEA EAX, [LOCAL.msg] ; |
00401117 |PUSH EAX ; |pMsg = 00141EE0
00401118 |CALL win.GetMessageA ; \GetMessageA
0040111D |OR EAX, EAX
0040111F |JE SHORT win.C0002
00401121 |LEA EAX, [LOCAL.msg]
00401124 |PUSH EAX ; /pMsg = MSG(6C726F62) hw = 5C3A4422 wParam = 5C646E61 lParam = 6D73616D
00401125 |CALL win.TranslateMessage ; \TranslateMessage
0040112A |LEA EAX, [LOCAL.msg]
0040112D |PUSH EAX ; /pMsg = MSG(6C726F62) hw = 5C3A4422 wParam = 5C646E61 lParam = 6D73616D
0040112E |CALL win.DispatchMessageA ; \DispatchMessageA
00401133 \JMP SHORT win.C0001
00401135 win.C0>MOV EAX, [LOCAL.msg+8]
00401138 LEAVE
00401139 RETN 10

0012FF5C hwnd FF71CFC4
0012FF60 msg F3AC4C4C
0012FF64 msg+4 805050ED
0012FF68 msg+8 FF71CE90
0012FF6C msg+C 8054B2AF
0012FF70 msg+10 00000000
0012FF74 msg+14 E3AFA008
0012FF78 msg+18 00000000
0012FF7C wc FCF66FE0
0012FF80 wc+4 00001FE0
0012FF84 wc+8 FF71CE00
0012FF88 wc+C E3AFA408
0012FF8C wc+10 00000001
0012FF90 wc+14 00000000
0012FF94 wc+18 00000408
0012FF98 wc+1C 00000000
0012FF9C wc+20 00000001
0012FFA0 wc+24 00000006
0012FFA4 wc+28 F3AC4D04
0012FFA8 wc+2C 8058A6A9
0012FFAC 0012FFF0
0012FFB0 0040104F RETURN to win._start+2B from win.WinMain
0012FFB4 hInst 00400000 win.00400000
0012FFB8 hPrevInst 00000000
0012FFBC CmdLine 00141EE0 ASCII ""D:\borland\masm32\icztutes\TUTE03\win\win.exe""
0012FFC0 CmdShow 0000000A

so probably you could make a plugin that emulates this behaviour :)
and make it dispaly WNDCLASSEX.cbstyle instead of wc+28
blah blah

dunno but if there is a basis then could poke around and modify it to suit ones wishes :)

may be if you are intending to write one :) and want some input on internals i could provide some pointers :)


Plugin problem!

RCE Messageboard's Regroupment > Plugins > Plugin problem!
MNc99
07-25-2005, 05:02 PM
I don't get it- I downloaded ollyscript.dll and put it into my ollydbg folder (C:\program files\ollydbg) and loaded up ollydbg, but when I click the plugins folder, I only see "command line" and "bookmarks". I've checked that it scans the right plugins folder (Options..Appearance..Directories) (C:\Program Files\OllyDBG\Plugins) and 'Ollyscript' won't show up!

Help!
joe
07-25-2005, 06:00 PM
Try to check version of Olly (I'm not sure, but I think that OllyScript need least OllyDbg 8 or 9).
oh me anon
07-25-2005, 07:01 PM
C:\Program Files\OllyDBG\Plugins

C:\program files\ollydbg
both are not same

you need to put it in plugins folder if thats the folder it sans and shows
not in ollydbg folder

anyway if there is problem unzip ollydbg to new folder and try :)


What features do you want in Olly Script Editor v1.0

RCE Messageboard's Regroupment > General > What features do you want in Olly Script Editor v1.0
arjuns
07-26-2005, 04:16 PM
Currently I am writting about OllyScriptEditor (C#).
Let me know your requirments.
joe
07-26-2005, 04:56 PM
It needs some templates or dictionary often used sequences (it's important for beginners like I'm).


Size of the Log

RCE Messageboard's Regroupment > General > Size of the Log
MazeGene
07-27-2005, 06:22 PM
Hi all,
I would like to generate large log, bug it seems that the size of the log is bounded and the debugger probably throws the oldest logs away, so I can see only the newest ones.
Is there any way how to enlarge log buffer?
oh me anon
07-27-2005, 07:01 PM
options---> appearance --> startup size of log buffer :)
change to one bigger from list box :)

btw if you are logging use log to file directly right from start it will log everything to the file
MazeGene
07-27-2005, 07:30 PM
oh me anon,
maaany thanks for your clear and exhausting answer! OllyDbg seems to be really strong.

Since OllyDbg is not my primary debugger and the Help is rather weak, many things are not clear for me. I expected the setting of the buffer in debugging options.


how to view registers?

RCE Messageboard's Regroupment > General > how to view registers?
hippofear
07-28-2005, 02:05 PM
How can I view the registers in ollydbg? I looked at all the menus and searched google but cannot find out how.
oh me anon
07-28-2005, 03:31 PM
omg :( just stare harder all over your screen eventually you will find it
when the haze before your eyes has settled down in the top left corner :)
Bob
07-29-2005, 01:51 AM
:)

Or, if you mean view their contents, then right-click the data next to the register (in the Registers window..) and select 'Follow in dump'


Upack

RCE Messageboard's Regroupment > General > Upack
maze
07-28-2005, 06:46 PM
Has anyone been able to unpack a file compressed by the Upack compressor?

http://dwing.go.nease.net/

I cannot find any scripts capeable of decompressing

Maze
mr haggar
07-28-2005, 07:23 PM
Open WinUpackE.exe in Olly:

00401030 > $-E9 42820100 JMP WinUpack.00419277
00401035 . 42 79 44 77 69>ASCII "ByDwing@",0
0040103E 00 DB 00
0040103F 00 DB 00
00401040 . 50 45 00 ASCII "PE",0
00401043 00 DB 00
00401044 4C DB 4C ; CHAR 'L'
00401045 01 DB 01
00401046 02 DB 02
00401047 00 DB 00
00401048 00 DB 00

Press F8 once:

00419277 BE 88014000 MOV ESI,WinUpack.00400188
0041927C AD LODS DWORD PTR DS:[ESI]
0041927D 8BF8 MOV EDI,EAX
0041927F 95 XCHG EAX,EBP
00419280 AD LODS DWORD PTR DS:[ESI]
00419281 91 XCHG EAX,ECX
00419282 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>

Note that all jumps lead to some 41xxxx addresses. But scroll down and you will find one that jumps to our code section

0041941E AD LODS DWORD PTR DS:[ESI]
0041941F 85C0 TEST EAX,EAX
00419421 -0F84 970AFFFF JE WinUpack.00409EBE

That jump jumps to OEP, but it's conditional. Select line with jump and place contitional log breakpoint on it. For condition enter EAX==0, and select to pause program on condition. Press F9 and you'll break on bp. Press then F7, then Ctrl+A and you are on OEP:

00409EBE /. 55 PUSH EBP ; SHELL32.#584
00409EBF |. 8BEC MOV EBP,ESP
00409EC1 |. 6A FF PUSH -1
00409EC3 |. 68 C8CA4000 PUSH WinUpack.0040CAC8
00409EC8 |. 68 C8A04000 PUSH WinUpack.0040A0C8 ; JMP to MSVCRT._except_handler3; SE handler installation
00409ECD |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00409ED3 |. 50 PUSH EAX

Dump and fix IAT if needed.

By.

PS
It's easy to write script for this. Maybe you could trie it ;)
mr haggar
07-28-2005, 07:43 PM
Packer is simple and I was bored :) Here is the script.

//Start of script
//Script for unpacking WinUpack 0.30beta - by haggar
msg "Ignore ALL exceptions! "
sto
findop eip,#0F84???????F#
bpcnd $RESULT,"EAX==0"
run
sto
an eip
cmt eip,"This is OEP! Dump now. Cheers ;-)"
ret
//End of script..
maze
07-29-2005, 12:13 PM
Thanks Haggar, works like a charm
Also enjoyed your first post, explaining step by step!

Maze


Why my Topic is removed

RCE Messageboard's Regroupment > General > Why my Topic is removed
yano
07-29-2005, 08:55 AM
Hello .

Yesterday i posted a new topic about Anti Debugger Tricks used by a program (DirectCom) but now i don't see it in General Forum !!!! :(((

Why Adminisrator !!!!!:(((( so strange folks : Removed without any Botification (Strange people in so strange World) !!!!!!!!!!!!!

Thanx.
joe
07-29-2005, 03:30 PM
Bacause he has some limits. I don't remember Your topic, but if You write about concrete commercial program & it's protection, this can cause many problems. If it don't remove similar topics, You don't find ones this forum (because it may be down). I think, that You can discuss about protection, but don't exactly identify target, please!
yano
08-01-2005, 08:38 AM
Hello Joe !

You are right.

But at least the administrator should notify and warn me perhaps i didn't understand so good the desclaimer or conditions of the forum.
Any how no matter what happend :)
The only thing we must do is Qeepping learning and learning new things together :)
Bye.


How can I allocate memory in debugged program?

RCE Messageboard's Regroupment > Plugins > How can I allocate memory in debugged program?
forgot
07-30-2005, 09:26 AM
rt
joe
07-30-2005, 10:14 AM
Search for unused memory in debugged application (zeros), if You need only small memory.
If You need moore memory use redirection script:
ask "Enter new EIP"
cmp $RESULT, 0
je cancel_pressed
mov eip, $RESULT
ret

In new eip (in found free memory) You must add code to alocating moore memory (use API used in debugged application).
garryw
07-31-2005, 07:24 PM
plugin ollyhelper will allocate 2k from the menu, if you need more then as joe described.
Bob
08-01-2005, 12:20 AM
or use stack..
jack
08-09-2005, 11:07 AM
i wont money :(


Any Ideas for tracing the changed memory

RCE Messageboard's Regroupment > Plugins > Any Ideas for tracing the changed memory
andy
07-30-2005, 11:16 PM
anyone have the Idea which I can trace all the changed memory blocks such as run tracing ?

as you know Ollydbg's run trace could record all instructions and register, but not memory.

if somebody know any plug-in or something else, please let me know ?
thanks


But... If the forum is English only...

RCE Messageboard's Regroupment > The Heap > But... If the forum is English only...
Bob
08-01-2005, 01:29 AM
I just noticed, under the box to type in the post (trying not to write post box) it says "Before posting non-english message, check your browser`s encoding!"

Perhaps you can change this to be "Before posting non-english message, check the forum rules!"

:)


the link is not working any more and i dont find a good download for olly... :[

RCE Messageboard's Regroupment > General > the link is not working any more and i dont find a good download for olly... :[
Rundll32
08-01-2005, 06:59 AM
(sorry about my english but im from israel, not from USA)

the link is not working any more and i dont find a good download for olly... :[
someone can upload for me the debugger? :)

(again, sorry about my english.....)
ssb
08-01-2005, 09:20 AM
Do you know that domain has recently changed?
Try http://www.ollydbg.de
Rundll32
08-01-2005, 08:21 PM
ohhhhhhhhhhhh :o
lol
thank's dude :D


DeleteBreakpoints

RCE Messageboard's Regroupment > Plugins > DeleteBreakpoints
Darus
08-01-2005, 05:48 PM
Hello,
One question, how works DeleteBreakpoints ???
thanks for any answer
oh me anon
08-01-2005, 07:07 PM
?? you mean how to delete a brekpoint ??
if yes just hit f2 again on the same line where you have set break point
else
view breakpoints --> right click disable or remove
or do you mean how it works internally ??
if yes then it uses the same principle
when it sets
suspend thread
getthread context blah blah read process memory write process memory
Darus
08-01-2005, 07:38 PM
i mean Deletebreakpoints from pdk
in fact i've tried the function but the arguments must be wrong
what are addr0 and addr1 ??
oh me anon
08-04-2005, 03:15 PM
ah you are playing with undocumented api()
oleh probably has some reservation about you using it so he has not documented it
there are also other apis like GetbpRelname (source code support)which are undocumented

use my information below at your own risk
from what i saw
addr0 is the addr of the break point
addr1 is the addr of next byte
int silent is also not defined in pdk
its value is 1 (guess work here)

for example if you have a break point at 40122

|Arg1 = 00401022
|Arg2 = 00401023
\Arg3 = 00000001
would be addr0 addr 1 and int silent respectively


seriously need help with this

RCE Messageboard's Regroupment > General > seriously need help with this
hereforfun
08-02-2005, 02:44 AM
ok..to be honest..i dont even kno wat olly is...nor do i understand half the words u ppl say...wats a breakpoint..all i wanna do is jsut do things i can normally not do in a game...any1 wanna help tis olly noob?
1bitshort
08-02-2005, 08:54 AM
> i dont even kno wat olly is
it comes with a good helpfile, take the time to read it, it's there for a purpose

> nor do i understand half the words u ppl say
neither do we but dont let it stop you

> wats a breakpoint
a trigger that is invoked when a particular nevent happens. for example you might want to set a breakpoint on a messagebox so that you can read and modify what it will say before it is displayed

> all i wanna do is jsut do things i can normally not do in a game
whether your target is a game or a normal application is irelevant, you still must put in the time to learn some assembly language and how to use debuggers. you cant just click your fingers and expect to give yourself unlimited lives in a game.

> any1 wanna help tis olly noob?
now that i think about it ... no, not really, sorry


Nb question: specific string breakpoint

RCE Messageboard's Regroupment > General > Nb question: specific string breakpoint
cyb0rg
08-02-2005, 10:30 AM
Hello world,
I'd like to know how to set a global conditional breakpoint (that will be evaluated after any instruction) that will break when EAX value is equal to a specific string (EAX->value == ASCII("string_to_break_on"))?
joe
08-02-2005, 05:29 PM
I think, that this isn't possible. You must specify where You can sen BP. You can trace program with log & then set BP.
You can right click -> Search for -> All command -> mov eax, const
Seach too for: inc eax, dec eax, pop eax ...
In Foud commands window right click -> Set log breakpoint on every command ->
Condition: eax==0
Pause program: On condition
joe
08-02-2005, 05:40 PM
Look to older post in which are answers from oh me anon. He has very useful tips.
oh me anon
08-02-2005, 06:04 PM
:) thanks joe :)
well the search function in this board at present is not optimum
and tbd it seems cant find what is messed up

so to answer

use ctrl+t and type string [eax] == "your preferred string" int the condition is true box and hit ctrl+ f11 (trace into it will stop when the condition is true :)

for example

you have this code
00401000 >MOV EAX, 4DC9C0 ; ASCII "hello"
00401005 PUSH EAX
00401006 POP ECX ; OLLYDBG.004DC9C0
00401007 PUSH EAX
00401008 JMP SHORT 0040100C ; 0040100C
0040100A DB 4F ; CHAR 'O'
0040100B DB 4B ; CHAR 'K'
0040100C JMP SHORT 00401000 ; <ModuleEntryPoint>

now this is an infinite loop and eax will always contain the string "hello"

if you specify this as condition
STRING [EAX] == "hello" & eip != 401000 & eip != 401005

you will see it will stop according tho the condition :) like this
look at the address the stops are always in 401006

Log data
Address Message
00401006 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401007 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401008 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
0040100C Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401006 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401007 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401008 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
0040100C Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401006 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401007 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401008 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
0040100C Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401006 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401007 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401008 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
0040100C Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005
00401006 Conditional pause: STRING [EAX] == "hello" & eip != 401000 & eip != 401005

have fun


Searching for encryption/decryption

RCE Messageboard's Regroupment > General > Searching for encryption/decryption
Tom
08-02-2005, 02:43 PM
I am going to write a private server for the game: "ROSE Online"
I need to obtain information about how to decrypt/encrypt packets.

I do know that the program NoXCeeD Pro (A proxy for iROSE) uses the encryption.

You can download it here:
http://fabdavid.free.fr/divers/rose/logiciels/?M=A

Already discovred:
004039C0 // Crypt table
00403778 // Crypt table
004024a2 // Probably, alot of XOR functions. (Decrypt)
00402759 // Probably, alot of XOR functions. (Encrypt)
00408e90 // Switch tables
00425400 // Strange section
00405367 // Connecting

Can you guys help me out, explain how I can find it or find it for me?

Thanks alot.
1bitshort
08-04-2005, 07:19 PM
> am going to write a private server for the game: "ROSE Online"
why not write something useful instead?

> I need to obtain information about how to decrypt/encrypt packets.
1) find where the packets are being sent/recvd, 2) analyse the following code that processes the packets


ollygraph

RCE Messageboard's Regroupment > Plugins > ollygraph
oh me anon
08-02-2005, 05:45 PM
joestewart has released his ollygraph plugin in openrce forum
this plugin helps one to visualize a whole proc from start to end
aka ida wingraph style :)

should be a good addition to have in the arsenal of plugins

http://www.openrce.org/blog/browse/joestewart
andy
08-03-2005, 07:55 AM
I can not open the website, you mentioned. please check it
TBD
08-03-2005, 08:34 AM
http://www.openrce.org/downloads/details/173/OllyGraph
andresiraola
08-19-2005, 06:34 PM
i can't make it run.. i'm trying to use it with a vb apllication..


Help on debugging an expiration condition - Newbie

RCE Messageboard's Regroupment > General > Help on debugging an expiration condition - Newbie
gisenberg
08-02-2005, 06:39 PM
Hi all,

I have been a programmer for 20 years but I am new to assembler and OllyDbg. I have been playing around trying to learn how an EXE is doing an expiration test for a trial. I have been stepping through the EXE and see where it is moving the data into the registers, but I do not have enough knowledge yet on how the registers work and what each mean. Could someone help get me started? I am a very fast learner and would be most appreciative.

Thanks ;-)
Ricardo Narvaja
08-02-2005, 10:05 PM
you need read assemblyu tuts first, and next similar tuts with expiration theme,

Ricardo Narvaja
Bob
08-05-2005, 02:12 AM
In 20 years you never used assembly ? Wow.. I learned on Amiga :)

A good place for Assembly tutorials is http://win32asm.cjb.net/
There is a tutorial on almost everything you could want to learn.
jack
08-09-2005, 10:59 AM
im a
jack
08-09-2005, 11:00 AM
im a newbie :( i wont to be able 2 edit packets rofl.... pweez help


What's log breakpoint & how to use it?

RCE Messageboard's Regroupment > General > What's log breakpoint & how to use it?
achan
08-03-2005, 12:50 PM
What is the advantage to use it?
Ricardo Narvaja
08-03-2005, 04:06 PM
if a program pass hundred of times fir one point and you need log values each time pass foor this address but without stop.

Ricardo Narvaja


ImpREC and LordPE problems

RCE Messageboard's Regroupment > General > ImpREC and LordPE problems
mr haggar
08-03-2005, 06:10 PM
I'm interested what is the reason why ImpREC sometimes cannot find nothing when trying to fix imports. How ImpREC finds imports at all?

I have this problem trying to repair Delphi aps packed with PESpin 1.0 or 1.1. In this case, protector redirect API call (example where 401xxx is in code section and 403xxx in import one)

00401xxx JMP DWORD PTR DS:[403xxx]

to

00401xxx JMP DWORD PTR DS:[41xxxx]

where 41xxxx is in protector section. So protector has just copy-paste imports from original place to it's own section.

Second problem is that LordPE screams "Cannot grab process memory." What is possible reason of this?

OllyDump plugin 2.21.108 by Gigapede can dump and fix IAT, but Delphi and MSVC++ programs are crushing. Any advice?

Thanks.


Where did my topic go?

RCE Messageboard's Regroupment > General > Where did my topic go?
gisenberg
08-03-2005, 08:21 PM
I posted a topic and it is now gone.
TBD
08-04-2005, 05:30 AM
cracking/unpacking/reversing topics are deleted without notification. it was discussed over and over again
gisenberg
08-04-2005, 06:07 AM
Ok, I am new to your forum, so I guess that I didn't hear the dicussion over and over again.


OllyDbg v1.10 crashes with more than 32 plugins.

RCE Messageboard's Regroupment > Bugs > OllyDbg v1.10 crashes with more than 32 plugins.
Lord_Looser
08-04-2005, 08:19 AM
OllyDbg v1.10 crashes with more than 32 plugins.
oh me anon
08-04-2005, 10:20 AM
read help file ollydbg states it can support upto a maximum of 32 plugins
only so its natural that there may be some undesirable effects if you exceed permissions
Ricardo Narvaja
08-04-2005, 12:04 PM
and i have installed only 8 plugins (i thinks these are the necesary), if i need other i cann add but with this 8 plugins i have all i expect.

Ricardo Narvaja
oh me anon
08-04-2005, 12:20 PM
hehe i have installed no plugins except the default commandline plugin that comes along i even dont have the default bookmark plugin in my primary ollydbg installation which i use regularly :) a plugin by concept is to be treated as a plugin not as a permanent connection :)
having too much plugins which all poll every execution if it use pluginpaused() callback pluiginmain() actually impairs performance
and speed also it is possible that the natural flow may be degraded

like electric socket a 5 amp socket can theoratically use unlimited number of other two pin sockets plugged one over other and you can have unlimited number of appliances working from just one outlet
but practially you use an immersion rod to heat water on a 5 amp socket and after a few minutes you will see it just burst into fire retardent smoke

hope the analogy helps :)
1bitshort
08-04-2005, 07:16 PM
surely you dont use all 32 plugins? just move the ones you dont use. bug fixed
Bob
08-05-2005, 02:07 AM
haha 32 plugins!
I didn't think there WERE 32 plugins! :)

FTR, I use 2 :)
Lord_Looser
08-05-2005, 09:34 AM
hxxp://ollydbg.win32asmcommunity.net/stuph/
Bookmarks - demontration plugin
CommandLine

AnalyseThis - "Analyze code outside the PE-specified code segment"
ApiBreak - easy breakpoint group (registy, time, dialog, memory, strings, point h) setting
Borland Map File Importer
DllBreakEx - Break on loading -specified- new modules (DLLs)
Hide Debugger
NonaWrite
NtGlobalFlag
OllyGraph
OllyMachine
OllyUni
olly_sync
UnhandeldExceptionFilter
Fader CWJOWL - transparents OllyDbg, slows down with Win2k ;-(

36 plugins, more or less meaningful
oh me anon
08-05-2005, 11:45 AM
hehe there are some more too :)
the ones that come to my mind immediately are
ollyperl
ollyhelper
ollyinvisible
DebugActiveProcessStop
ultrastring some thing

:)
Lord_Looser
08-05-2005, 03:15 PM
Thanks for your contributions.
Could add further plugins my collection. :-)
g3nuin3
08-12-2005, 03:19 PM
lol thats alot of plugins mate. what are you debugging? your pc?


can I runtrace at winproc in ollydbg

RCE Messageboard's Regroupment > General > can I runtrace at winproc in ollydbg
andy
08-04-2005, 09:35 AM
when I runtrace at ollydbg, it doesn't log at runtrace view.

for example) I wanna know what a GUI program is going on after when some program's button click. so I decide to use runtrace in ollydbg. but it doesn't work.

but I don't wanna do, set a break at winproc and just trace, it would be trivial. any one have better IDEA ?
oh me anon
08-04-2005, 11:13 AM
it doesnt work is the worst kind of error report any one can generate if they request for help

it works the way it is supposed to work only you dont work properly to find out how it works
may be you could do it the supposedly trivial way and then compare with
your supposedly not working method and see where and why it differs

may be explain the problem in a bit more detailed way and
offer some tips on how to attain enlightnment would
get you some help

it doesnt work noooo it works if it didnt it would have probably crashed or blue screened or blasted your pc to smithereens :)


Olly Crashes when Pause is pressed.. HELP!

RCE Messageboard's Regroupment > Bugs > Olly Crashes when Pause is pressed.. HELP!
mcannon
08-04-2005, 05:38 PM
I am running Olly 1.10 that has been patched with re-pair..
It is running on a Xp-SP2 system.. A legal version !
I can debug most programs except this new one I am trying.. When I have the program up and running in Olly I press the pause button and Olly and the proggy freezes..

I am running plugin IsDebugPresent and the program seems not to see Olly...

I am not sure why this is happening..
Has anyone else ever seen this ??
It seems to be only this one proggy...
joe
08-04-2005, 06:48 PM
Uses this apps DirectX? If Yes, You can't stop it (in fulscreen)!
mcannon
08-04-2005, 11:55 PM
No it is not a DirectX App.. It is Spyware Doctor 3.2 it is secured by Armadillo v3.75c and is encrypted with ExeCryptor...


What will olly 2.0 improve on?

RCE Messageboard's Regroupment > General > What will olly 2.0 improve on?
Beta
08-05-2005, 05:28 PM
I have no idea how olly could be improved after this.It's stable(usually) .Does any body out there know anything about 2.0?
ssb
08-06-2005, 09:31 AM
I'm afraid that nobody, except Oleh, really knows anything about 2.0. Sometimes I doubt it will ever release :(
Ricardo Narvaja
08-06-2005, 09:03 PM
RING0 maybe?

Ricardo Narvaja
1bitshort
08-07-2005, 05:15 AM
i didnt think he could add or improve much on it either, but he is taking a long time so maybe he is adding a lot of new stuff or something like ring0 support
Ricardo Narvaja
08-07-2005, 02:16 PM
if he in the page request for originals of all SO i think is for RING0 support, for RING3 is not necesary have all SO originals

Ricardo Narvaja
1bitshort
08-08-2005, 09:19 AM
It would be quite a party trick
Beta
08-12-2005, 08:47 AM
What is ring0 may i ask?
1bitshort
08-12-2005, 02:50 PM
No, you may not. Go back to jail. Do not pass go. Do not collect $200. :)

If you(/anyone) dont know the difference between ring 3 to ring 0 you should do a little bit more reading before burying your head in debuggers, it will save you a lot of confusion - fundamentals are fundamental for a reason.

To cut to the chase, in the Windows operating systems ring 0 is essentially "kernel mode" whereas ring 3 is "user mode", a less-privileged level. Windows only uses these two rings. Any program you write will be a ring 3/usermode program, but if you want to go to ring0/kernel mode you basically need to write a kernel driver (.vxd for win9x/.sys for nt/2k/xp/vista), unless you use a ring3->ring0 trick.
mr haggar
08-12-2005, 06:40 PM
Maybe it will fix bugs related to exceptions and tracing what I read in couple tutorials:

What did I learn from reversing this beast?
c) Few Olly bugs (incorrect processing of lock int3, lock int1,
ds:int3, etc.)
d) Olly trace feature is buggy. Really buggy.

From kao solution for execryptor on crackmes.de.
mr haggar
08-12-2005, 06:41 PM
PS
Plus, OllyDbg cannot handle TLS calls so debugger can be descovered before target is loaded.
Ricardo Narvaja
08-13-2005, 03:22 AM
If you know how use olly is easy solve this

1)change the mark in debuggin options - events to stop in SYSTEM BREAKPOINT, next when stop in system breakpoint put a MEMORY BREAKPOINT ON ACCESS in the seccion of start and you stop in the TLS.

Or when you stop in the breakpoint look in peeditor in directories and look in TLS the value and FOLLOW IN DUMP this value and look for the content, and put a BPX in this adress and you start in the TLS too

Ricardo Narvaja

Olly trace is perfect i have no problems at all, the only bug is in ILLEGAL EXCEPTION and is easy repared only changing a byte in OLLY, if you know how use the trace option there are no problem at all and there are no bugs at all.
INT3 have no problema at all is perfect handled
lock INT3, LOCK INT1 are illegal exceptions and are the same case only changing a jmp is solved.

Ricardo Narvaja
mr haggar
08-13-2005, 07:49 AM
Gonna try that trick with TLS. Thanks.
oh me anon
08-13-2005, 12:00 PM
hehe haggar olly can handle tls callbacks too :)
may be you should take a look at NtGlobalFlag plugin :)
its available for download where you posted your recent pespin tut :)


How to install the IsDebuggerPlugin?

RCE Messageboard's Regroupment > General > How to install the IsDebuggerPlugin?
MidnightBlue
08-09-2005, 02:03 AM
Hey everyone, I'm pretty new to debugging related stuff and I just need help on installing the Hide Debugger plugin such as IsDebuggerPlugin. I need it to get installed into Ollydbg and I've tried to put the .dll in the dolfer but it doesn't work.

Can anyone help me?
oh me anon
08-09-2005, 10:28 AM
here is nothing called installing a plugin with ollydbg
you jus copy paste the dll into ollydbg folder
and it should be detected plain and simple
if you copypasted your dll and it still didnt show up in plugin menu
then probably you have plugin path setup and ollydbg is looking fro the plugin in tha path insted of default ollydbg directory

to check if you have a plugin path setup
click options ->debugging options ->appearance->directories
and look if the path is correct
if not change it to the required path

or just unzip odbg110.zip to a new folder and copy paste the plugin
into the new folder and see if it works

or beter yet still the blindmans way

if there is a plugin menu in ollydbg and if the default commandline plugin is showing up

start run cmd or command
cd\

dir /s /b comman*

it should show the path of that plugin

copy isdebug* \path that it showed

it should say 1 files copied

open you ollydbg the plugin should be there
MidnightBlue
08-09-2005, 03:25 PM
Dude, thanks so much for your help man. I appreaciate it!
dm47
09-23-2005, 07:43 PM
can some1 post a link for hide debugger,
none of them ever work


regarding skype ;-?

RCE Messageboard's Regroupment > General > regarding skype ;-?
mcensamuel
08-09-2005, 05:31 PM
hi,

I have a question regarding skype.

Anybody knows answer for the following question !!

Why the protocol is still not public ?? (nobody reversed it) ;-?
or is it too difficult to reverse it ?
or is there any copyright problem in that ?

anybody knows the answer ? I am very much interested to know about the protocol ?? ... ;-)

thanks
mcen
sgdt
08-09-2005, 06:21 PM
Are you concerned with the Protocol or the Compression? (they are very different things). If you are concerned with the Protocol, I would look into calls into Winsock. If you are concerned with the Compression, fire up VTune and IDA (VTune to point you to the interesting pieces, and then IDA to see where they fit in). Of particular importance will be any tables used for transformation and the huffman encoder/decoder. If you just want something quick, you could probably shim their code directly.

If you don't have VTune, find winsock send / receive routines, place a memory breakpoint on where else the data is being referenced, and you will have the huffman encoder/decoder.

Two notes: The PC version is written in Delphi, so I would give a look at it with the trial version of "PE Explorer". It'll point out the classes in a more friendly manner than Olly will. Second, if you have IDA, I would look at the Windows CE version of Skype, it might be less convoluted.
mcensamuel
08-10-2005, 07:21 AM
I like to know the protocol stuff !!
is vtune is Intel's product ??

More than getting the details about the details of skype..
i like to know the answer to the following questions...

Why the protocol is still not public ?? (nobody reversed it) ;-?
or is it too difficult to reverse it ?
or is there any copyright problem in that ?
sgdt
08-10-2005, 04:02 PM
The protocol would be trivial to reverse, most protocols are. But what is the goal? To talk to Skype or to create a product like Skype? If the goal is to talk to Skype, then your goal probably isn't to create another front end (after all, Skpye is free and works quite well). If your goal is to create a program Like Skype, you don't need to reverse the protocol at all. What is your Goal?

Why the protocol is still not public? Because the manufactures of Skype have not released it. I don't even think anyone has ever asked them?

Is it too dificult to reverse? No, it's a protocol. The compression might be hard, but I doubt it.

Is there any copyright problem? Well, why yes, there is. Everything from the EULA you clicked thru when installing Skype to the embedded strings in the program leave zero doubt that they would like to keep their stuff private.

Please note that the Protocol is just how it communicates. I really believe your more interested in the Compression. They are DIFFERENT THINGS.

The only reason I can think of to want their protocol would be to create a SPAM bot that would act like an automated client. Please tell me your not doing that...
mcensamuel
08-11-2005, 01:00 AM
i can assure you that ...i dont have any criminal mind as u think !!
like to learn how they are getting this quality sounds !!

sometime back i looked for the yahoo voice stuff...i could able to collect some data on that...but i didnt get any detabils about this .

anyway thanks for your reply !!
sgdt
08-25-2005, 05:10 PM
Skype Opens APIs To External Software, Including Games

http://www.gamasutra.com/php-bin/news_index.php?story=6320
0xebfe
09-07-2005, 09:56 PM
Actually, it seems even the snort community havent been able to come up with a signature for it.. I looked at the traffic as it loads.. seems very random or encrypted..

I am guessing the clients share some secret. The client sends a random challenge to the peers list it has (bootstrap or dynamically learnt).. the peer sends a response thats checked by the client.. then they start communicating encrypted.. Or perhaps the first handshake is a Diffie Hellman shared secret setup..

Interesting.. any body know of generic network protocol reversing papers/articles (not specific to skype)?
dyngnosis
09-14-2005, 02:41 AM
There has been some work done on reverse engineering the Skype protocol.

Two university students have put together a white paper:

http://arxiv.org/pdf/cs.NI/0412017&ei=vosnQ9_NAZ_0-AGC7JiSBg

the difficulty in reversing much of the protocol is the encryption that happens early on.

IDA took 30min to dissassemble the Skype.exe binary and blows up when launched if attached to the IDA debugger. Attaching IDA to the already running process will get you further but it still pukes. I would be interested in hearing your results attaching olly. I have also had some success with SoftIce.

If your interested in knowing more about the protocol, and arcitecture of the skype network then start at the white paper... if you are interested in reverse engineering we should chat.
dyngnosis
09-14-2005, 02:50 AM
0xebfe: There has been some excellent work done in the Protocol Informatics Projected at baselinesecurity... it is using bioinformatics and some cool algorithms to compare packet dumps .. he presented at DefCon 13 this year and has his slides up.. along with code, a white paper, background research, and a crapload more:

Def con Presentation: http://insidiae.org/PI/PI-Defcon.pdf
White Paper: http://insidiae.org/PI/pi.pdf
Code: http://insidiae.org/PI/PI-v0.01.tgz

As a sample the author took 100 ICMP dumps and reproduced the protocol structure matching the RFC almost exactly...
http://insidiae.org/PI/PI-v0.01.tgz
0xebfe
09-14-2005, 06:29 PM
Hey dyngnosis, yes I saw those two efforts.. The PI one is pretty interesting, if the protocol is indeed based on some structure, and not compressed/encoded. To a certain extent, thats pretty much what we do visually as well (look for static bytes, and check if they mean anything about the rest of the dynamic blocks). Have you tried the code on Skype?

The univ paper was a good start. Its more of a network traffic analysis though, not reversing. Besides, the clients seem to be able to login via the supernodes too, so quite a bit has changed since that paper was released.

How do I reach you outside this forum?
dyngnosis
09-14-2005, 08:52 PM
0xebfe,

I have not yet tried PI with skype traffic... without finding out more about the encryption schema I don't think it has a hope of getting very far... there *Are* however some interesting things about the inital login sequence.

I would like to get a copy of the old version of skype that only hit a single login server... then BinDiff that against the current release... the changed code should certainly contain calls to the encryption functions.

In addition there are some calls to crypt32.dll ProtectData() and UnProtectData() that warrent some investigation... however debugging a running version of Skype is still a problem that I am working on. I've yet to attach Olly... after that perhaps remote debugging is the next step(?).

I think I've seen you around at the OpenRCE site... I'll contact you ;)

Jer
0xebfe
09-14-2005, 11:29 PM
Interesting, we think quite alike ;)

http://www.oldversion.com/program.php?n=skype

I tried some of what you mention. Let's chat off line.
mcensamuel
09-15-2005, 07:29 AM
actullay i started the skype through IDA pro very easily...
there was some exception...but that is not a problem...

i got the address of the first socket call...and then..i didnt try much (;

anyway i hope skype is a big challenge for the reversers !!!
challenge by a big reverser to all other reverses !!
He chooses very good anti* reversing techniques...
attaching to the softICE is not a problem i guess...they are checking for \\.SICE and some other...that can be changed in the softICE...
Even i dont know much...had spent sometime on that...
dyngnosis
09-15-2005, 08:36 PM
0xebfe, I sent you a message on the OpenRCE forums... hopefully it goes through but one never knows. Try my name at gmail if you never get the one on OpenRCE.

It sounds like mcensamuel has some interesting experience in dealing with anti-rev techniques... we will have to keep that in mind!

mcensamuel, if you have any suggested reading on defeating anti-rev techniques I'd love to hear from you as well.

One thing I am very interested in is the development of a well documented and structured approach when it comes to a Skype-like project.
dyngnosis
09-29-2005, 07:31 PM
I've recently found this:

http://gcasiez.perso.wanadoo.fr/skypeandsoftice.html

It is a bit of information on patching skype to run with a debugger (softice).

sweet.


asm output

RCE Messageboard's Regroupment > General > asm output
int0x3
08-10-2005, 12:14 PM
does anybody know if ollydbg version2 will have an option to output asm file (maybe masm compatible) that could be re-assembled easily?
a feature similar to PEDasm but without crashing on large files lol
joe
08-10-2005, 03:22 PM
This knowns only Oleh Yuschuk. Version2 isn't completed.


Do Ollydbg detect Sent byte/Recieve byte from the source?

RCE Messageboard's Regroupment > General > Do Ollydbg detect Sent byte/Recieve byte from the source?
Lennex
08-10-2005, 07:48 PM
do someone know how to detects source from a exe that send byte to server.
Such as Wpe Pro Alpha but i wanna debug the exe then change the filter stuff..


Olly won't run on Windows XP x64

RCE Messageboard's Regroupment > General > Olly won't run on Windows XP x64
RevEng
08-11-2005, 12:14 AM
I start olly normally (ver 1.10) but when i try to debug ANY program it displays a msgbox with the title <app.name> - Application Error and with a body text The application failed to initialize properly (0x80000004) Click on OK to terminate the application. Is there a patch or something thast will allow me to debug on windows xp 64?


WPE PRO AND OLLYDBG

RCE Messageboard's Regroupment > General > WPE PRO AND OLLYDBG
Lennex
08-11-2005, 07:06 AM
what should i do if i want to edit my sent bytes to the .exe.
so i dont need to use wpe pro to filter.
Do someone know ollydbg support packet/winsock??


PESpin 0.3 , (0.7), 1.0, 1.1 & 1.3 unpacking tutorial

RCE Messageboard's Regroupment > General > PESpin 0.3 , (0.7), 1.0, 1.1 & 1.3 unpacking tutorial
mr haggar
08-11-2005, 08:58 PM
This is little self advertising ;). I used to search for PESpin tutorials on english and couldn't find none of them. Then I dig something by myself and wrote couple tuts. Not perfect but maybe it will be of some help to some noob. Includes Olly scripts and proper signatures for PEiD.

PESpin 0.3
http://www.reversing.be/article.php?story=20050726211417143

PESpin 1.0,1.1 & 1,3
http://www.reversing.be/article.php?story=20050811173217736
gabri3l
08-11-2005, 09:39 PM
That was a fantastic tutorial on pespin.

I particularly enjoyed the method you used to correct the imports in V1.1 a very ingenous idea.


No disk in the drive!

RCE Messageboard's Regroupment > General > No disk in the drive!
int0x3
08-12-2005, 12:45 AM
I am loading in OllyDbg a DLL created with VC++ Net 7.1
and a messagebox keeps appearing over and over.
"There is no disk in the drive, Please insert a disk into driver \Device\Harddisk3\DR6"

how can i get rid of it? thanks


OllyDbg tutorials

RCE Messageboard's Regroupment > General > OllyDbg tutorials
SRX
08-12-2005, 09:55 AM
Well, I am beginner.
And I don't know what are you talking about.
Where can I found Getting started guide to OllyDbg?
Thanks
oh me anon
08-12-2005, 12:05 PM
http://ollydbg.de/quickst.htm
may be this page should get you up and running :)
1bitshort
08-12-2005, 09:12 PM
the ollydbg helpfile is also a very good read. oleh has taken a lot of time to put the info together for you, it will take you a lot less time to read it.
mr haggar
08-12-2005, 09:21 PM
Here you have lot of Olly tutorials http://tutorials.accessroot.com/


How to get the call references of a procedure?

RCE Messageboard's Regroupment > Plugins > How to get the call references of a procedure?
henryouly
08-13-2005, 02:07 PM
Hi, I'm writing a plugin of OD and have the following problem.
When I try to look into who is the callee of a proc from analyse data, this piece of code fail to work.(To simplify a bit, here I removed the statements for error checking)

start = Findprocbegin(current);
decode = Finddecode(start, &decode_size);
cmdsize = Readcommand(start, cmdbuf);
Disasm(cmdbuf, cmdsize, start, decode, &disasm_result, DISASM_ALL, 0);

I didn't find helpful info in disasm_result.opinfo[] in my testing, such as "Local call from xxx,xxx" which I saw in OD's main frame.

Can anyone tell me if I made a mistake, or give me some workable code? Thanks in advance.
oh me anon
08-15-2005, 12:24 PM
may be try using DecodeAddress
many of the calls that are seen on display are generated on the fly
in ollydbg so manytimes you are forced to do all the work again to get the same results again as you cant rely on some strored database :)

also to get referance you could try using SendShortcut(blah blah ctrl+r)
and then parse through the t_dump data
henryouly
08-16-2005, 05:14 AM
Thanks very much.

I've noticed that t_module.jddata records all the anaylzed jump, so I search into it and get what I want on the fly:)

BTW, your idea of t_dump sounds wonderful that I want to have a try, too. Could you tell me which plugins used this technique so I can look into the code?
oh me anon
08-16-2005, 10:55 AM
there are no plugins as such i am aware of i was talking about some half baked code that i put together to retrieve some thing like this
when i tried to code together a visualizer but it seemed to be too much headache peering inside these structures
and i didnt have some quality time to spend on the subject
so dropped it but it is a feasible idea provided you can bypass all the
gui dependent code and directly jump into processing code

may be for example you can take a look at my NtGlobalFlag plugin
where i crete a thread and use the ollys gui to assemble in place and pass WM_COMMAND with SendMessage
oh me anon
08-19-2005, 10:52 AM
hey i see you wanted answer to this question because you are doing improvements in the visualiser :)
why dont you also post it somewhere where it is accessible to
many others who would like to take a look at the ollyflow plugin ??
henryouly
08-24-2005, 02:44 PM
I've post it in several forums, and u know it will be nightmare to update all of them when new version comes up, and I am too lazy to create a homepage. However it is welcome for anyone to cross-post my plugin to any forum. Here I provide two links for download.

exetools:
http://www.exetools.com/forum/showthread.php?t=7939

pediy(the famous cracking technical forum in china): http://bbs.pediy.com/showthread.php?s=&threadid=16171
oh me anon
08-24-2005, 03:05 PM
the whole point of my post was to say it is impossible for many to download from those forums unless they are registered and whatnot

so i meant you post it some where wher it can be freely downloaded
but it is your wish :)
henryouly
09-17-2005, 06:15 PM
It should be available here:
http://www.openrce.org/downloads/details/178/OllyFlow


mfc42 reference

RCE Messageboard's Regroupment > General > mfc42 reference
Infirmus
08-14-2005, 10:21 AM
How can i find out what calling mfc42.#xxx does. Can I find a reference somewhere that will help me convert this code into a function that can be found in the msdn documentation?

Eg.
0040126E . E8 2D180100 CALL <JMP.&mfc42.#860>
What is going on here?

As far as I can figure out this is something to do with menus - if i could work out which function listed here at MSDN (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcmfc98/html/_mfc_cmenu.asp) I might get somewhere.

Any help appreciated. Thanks.
Ricardo Narvaja
08-14-2005, 03:57 PM
use ida and export to a map file and use plugin mapconv to import to olly

Ricardo Narvaja
oh me anon
08-15-2005, 12:33 PM
well there was an utility called mfcspy in some chinese site pediy i think which decoded all those vtable calls
also in ollydbg if you take a look at call tree it almost shows the vtable names
Infirmus
08-16-2005, 12:27 PM
IDA refuses to open this particular exe. It freezes on "Please wait"..

I dont know how to use the information mfcspy gives me.... and I cant get the call tree window to come up in ollydbg ("ctrl - k" right?).

Im a noob, so please b patient ;-)

Had limited success by importing the mfc42.lib file from VC++ 6, but I have limited success only eg. what does

004013BB . E8 C8160100 CALL xxxxxx.00412A88 ; JMP to MFC42.#823_??2@YAPAXI@Z

mean?

Someone mentioned in another thread that the mfc42.lib way wasnt the best way to go. But IDA wont work, grrr. The exe is packed with PECompact 2.x but other PECompact packed exes seem to open fine.

Also some specific instructions for exporting maps in IDA and how to use the call tree would be appreciated.

Thanks.
oh me anon
08-16-2005, 01:27 PM
mfcspy gives all thos information apparently like dede
i tried it just once or twice just to check its functionality
if you look it also comes with source included (iirc authour is goldenegg)
who also has written the ollyhelper plugin

004013BB . E8 C8160100 CALL xxxxxx.00412A88 ; JMP to MFC42.#823_??2@YAPAXI@Z

is this line from ollydbg
if yes
options -->debugging options -->addresses --> check mark demagle symbolic names
it should do the trick of making this #$@ZZFRE$ to some thing more sensible like
mfcrap::bullshitfunction::just returns without doing nothing

:)
Names in mfcspy, item 110
Address=004020AA
Section=.text
Type=User
Name=AfxFindResourceHandle(char const *,char const *)

Names in mfcspy, item 114
Address=0040236A
Section=.text
Type=User
Name=AfxWinMain(HINSTANCE__ *,HINSTANCE__ *,char *,int)

Names in mfcspy, item 132
Address=00401F9C
Section=.text
Type=User
Name=CCmdTarget::OnCmdMsg(uint,int,void *,AFX_CMDHANDLERINFO *)

also if you have the lib files from vc then try doing this also shows you many more names like ida flirt
right click --> analysis --> scan object files (you can point the whole include\library directory and add it into groups then just hitting scna group 1 scan group2 should scan respective groups)

also try utilising the godup plugin by godfather it can load all those signatures directly

yes ctrl+k but i was talking about ctrl+n right click find referances and the context menu show call tree in there :)
hosiminh
08-18-2005, 12:21 PM
@oh me anon

Thanks for sharing us info about existence of this tool :)
oh me anon
08-18-2005, 04:08 PM
hosiminh

glad to be of help :) your nick suggests you should be knowing this tool before me :devilish

@infirmus

btw to answer the original question i had used a map from ida on mfc42.dll
so it was showing those names :)
like this

Call tree
Called from Procedure Calls Comment
MFC42.73DD3ADB <MFC42.CWaitCurs <MFC42.CCmdTarget::BeginWaitCursor(void)> Sys
MFC42.CRichEditView::WrapChanged(void)+12 MFC42.AfxGetModuleState(void) Sys
MFC42.73DE198F
MFC42.IPropertyPage2::`RTTI Base Class Descriptor at (0,-1,0,0)'+9
MFC42.CRecordView::OnInitialUpdate(void)+27
MFC42.CDaoRecordView::OnInitialUpdate(void)+28
MFC42.CWnd::WinHelpA(ulong,uint)+1D
MFC42.CDocument::DoSave(char const *,int)+0E6
MFC42.CDocument::OnSaveDocument(char const *)+85
MFC42.CEditView::FindTextA(char const *,int,int)+56
MFC42.CRichEditView::OnInsertObject(void)+55
MFC42.CRichEditView::OnEditPasteSpecial(void)+9E
MFC42.CRichEditView::SetParaFormat(_paraformat &)+11
MFC42.CRichEditView::InsertFileAsObject(char const *)+28
MFC42.CRichEditView::DoPaste(COleDataObject &,ushort,void *)+1B
MFC42.CRichEditView::OnReplaceAll(char const *,char const *,int,int)+52
MFC42.CRichEditView::FindTextA(char const *,int,int)+0B
MFC42.CDocument::OnFileSendMail(void)+23
MFC42.COleConvertDialog::DoConvert(COleClientItem *)+13
MFC42.COlePasteSpecialDialog::CreateItem(COleClien tItem *)+15

to get this effect
load mfc42.dll on idafree
let it complete the analysis(will take half an hour to 40 minutes)
save the idb
then get the mfc42.pdb from windbg directory
put it in same place where idb resides
then open ida again and load the mfc42.dll (its hould be quick this time)one minute max
file--> load pdb
it should load the pdb information
then
file produce map file
use this map file in ollydbg to get all names

bytes pages size description
--------- ----- ---- --------------------------------------------
1048576 128 8192 allocating memory for b-tree...
1048576 128 8192 allocating memory for virtual array...
262144 32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
2359296 total memory allocated

Loading IDP module D:\borland\freeida\IDA Freeware 4.3\pc.w32 for processor metapc...OK
Autoanalysis subsystem is initialized.
Possible file format: MS-DOS executable (EXE) (D:\borland\freeida\IDA Freeware 4.3\dos.ldw)
Possible file format: Portable executable for IBM PC (PE) (D:\borland\freeida\IDA Freeware 4.3\pe.ldw)
Loading file 'D:\borland\windbg\MFC42.pdb\78506869754E46FABF605 9C8004810DFe\mfc42.d ll' into database...
Detected file format: Portable executable for IBM PC (PE)
0. Creating a new segment (73DD1000-73E76000) ... ... OK
1. Creating a new segment (73E76000-73EA8000) ... ... OK
2. Creating a new segment (73EA8000-73EB1858) ... ... OK
Reading exports directory...
Reading imports directory...
3. Creating a new segment (73EAE390-73EB1858) ... ... OK
4. Creating a new segment (73EADF10-73EAE390) ... ... OK
Reading fixups...
5. Creating a new segment (73E76840-73EA8000) ... ... OK
Possible file format: PE executable (D:\borland\freeida\IDA Freeware 4.3\dbg.ldw)
Loading CODEVIEW debug information...
Unknown codeview information format: RSDSAssuming __cdecl calling convention by default
Marking typical code sequences...
Flushing buffers, please wait...ok
File 'D:\borland\windbg\MFC42.pdb\78506869754E46FABF605 9C8004810DFe\mfc42.d ll' is successfully loaded into the database.
Compiling file 'D:\borland\freeida\IDA Freeware 4.3\idc\ida.idc'...
Executing function 'main'...
Compiling file 'D:\borland\freeida\IDA Freeware 4.3\idc\onload.idc'...
Executing function 'OnLoad'...
IDA is analysing the input file...
You may start to explore the input file right now.
The initial autoanalysis is finished.
Initializing the symbol engine.
Preparing to open the input file D:\borland\windbg\MFC42.pdb\78506869754E46FABF6059 C8004810DFe\mfc42.dl l
Loading the symbols from D:\borland\windbg\MFC42.pdb\78506869754E46FABF6059 C8004810DFe\mfc42.dl l
Symbols are loaded at image base 73DD0000
Getting the module information from the symbol engine.
Starting to enumerate functions.
Debug information is loaded.
Map file created, total 10607 lines.
TQN
08-19-2005, 02:03 AM
As I know, when loading an executable which uses MFC42.dll, IDA will apply the mfc42.ids (in IDS dir) to replace the MFC.xxxx name with full decorative name. But the MFC42.ids of IDA have some wrong name with MFC42.dll. The IDS file of IDA created with a old version of MFC42.dll. I have create a new MFC42.ids, and it seems OK.
I am recreate the MFC42.dll/mfc42u.dll/mfc42d.dll/mfc42ud.dll/.... IDA signature.
oh me anon
08-19-2005, 10:45 AM
well when loading an exe that use mfc.dll ida uses ids yes but the poster
said somewhere ida could not load his exe :) so i gave some ways to
bypass that problem :) ida also loads vcmfc32something.sig if it successfully loads the exe :) and applies flirt too

but getting a dlls map is always a better option coz it is universal
for the pc you are operating :) just click and forget :)


Command Line

RCE Messageboard's Regroupment > General > Command Line
andresiraola
08-15-2005, 08:44 PM
Hey! I'm trying to crack an vb5 installer with ollydbg but my problems is that i need to specify ollydbg the command line the installer needs to run properly.
so.. how can i run or debug the process using a command line?
for example..
"x:\Test\\SJW\" "D:\WINDOWS\ST5UNST.009" "D:\WINDOWS\ST5UNST.EXE"

thanks
Ricardo Narvaja
08-16-2005, 12:46 AM
in the open window, there are dow for write this type of command

Ricardo Narvaja
oh me anon
08-16-2005, 12:19 PM
debug --> arguments --> type in what you want --> restart session for this to take effect
andresiraola
08-19-2005, 06:23 PM
thank u all.. u save my life :D


remove all breakpoints

RCE Messageboard's Regroupment > OllyScript > remove all breakpoints
overal
08-15-2005, 10:37 PM
Hello,
I would like to know if it's possible to remove all breakpoints using OllyScript ?

Thanks :-)


Dependable breakpoint not breaking???

RCE Messageboard's Regroupment > General > Dependable breakpoint not breaking???
5aLIVE
08-16-2005, 10:12 AM
I had been debugging a DLL with some success in the past but put it aside to make way for other things. Since returning I can't seem to repeat the initial steps I had done before.

Here's a brief summary of the details. Program A launches program B which in turn loads DLL C.

I let program A run prog B, then attach to prog B then select the DLL C from the Executable Modules list window, right click follow in dump which takes me to OEP.

I go to a memory address which I know performs a function call of interest (I have used it before) and place a breakpoint there.

The trouble is I can only get Olly to break maybe once if I am lucky, but previously I could get I to break predictably when I the program is requested to perform a particular operation.

Can anyone suggest what the proble might be?

Many thanks,
5aLIVE.
oh me anon
08-16-2005, 11:04 AM
well if it broke once then it should break ever if you did it right
unless it is some kind of polymorphic selfmodifying code which changes itself everytime even then olly should warn you about corrupt breakpoints
and should ask you for confirmation before disabling them :(

may be you load the dll seperately and hard code an infinite jump on the function start and use pause (f12) to stop while it is used by the program B

or use the plugin bookmark and create a book mark
and pause on LoadDll event and when stopped follow entry and go to
bookmark and physically put a break point ??
5aLIVE
08-16-2005, 11:54 AM
well if it broke once then it should break ever if you did it right
>I agree with that. This is very odd, I'll try a setting a BP at another location and see if that changes anything.

unless it is some kind of polymorphic selfmodifying code which changes itself everytime even then olly should warn you about corrupt breakpoints
and should ask you for confirmation before disabling them :(
>There is nothing as sophisticated as that involved in this code thankfully.

may be you load the dll seperately and hard code an infinite jump on the function start and use pause (f12) to stop while it is used by the program B
>I've used this technique before (EBFE), I could always try it again, though I shouldn't need too.

or use the plugin bookmark and create a book mark
and pause on LoadDll event and when stopped follow entry and go to
bookmark and physically put a break point ??
>I have'nt used this plugin before I'll give it a try.
>Thankyou.
>
5aLIVE
08-16-2005, 01:26 PM
I had another look at this, I followed the steps I described above and found that it will only break if I make program B load file A, If I select any other file B,C, D to load it will also break.

If I load a previously loaded file (say B) it won't break, It's still doesn't make any sense as I don't think it records the result of previously opened files.

To be honest I don't think it did this before, but I can't be certain.
5aLIVE


Armaccess.dll

RCE Messageboard's Regroupment > OllyScript > Armaccess.dll
NoLOcKs
08-17-2005, 09:58 PM
Hi, all

I used ollyscript to a app. protect with Arma 3.78. Dump with LordPE e
fix IAT with importReconstructor. But It is show a follow error:

error run-time 53
file not found: armacess.dll
Ricardo Narvaja
08-18-2005, 11:24 AM
yes if you dump you need put armaccess.dll this dll is privided withe the packer, you can downbload the packer and extract from here.

Do you ask why the original donñt use armaccess.dll?

Is created in unpacking time, if you dump this section is not in the exe, you can dump from the original, look the section called in this calls and dump and reconstruct armaccess.dll or you can try skip this calls.

Ricardo Narvaja


####RDG Packer Detector English - translate####

RCE Messageboard's Regroupment > General > ####RDG Packer Detector English - translate####
RDGMax
08-18-2005, 09:14 PM
http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/11/RDGPackerD etectorv0.5.7.rar (http://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/11/RDGPackerDetectorv0.5.7.rar)


Getting the debugger to reveal memory access to a string

RCE Messageboard's Regroupment > General > Getting the debugger to reveal memory access to a string
5aLIVE
08-19-2005, 09:27 AM
I've reached a bit of code which copies a string using :

push 100h
push ebx; source string pointer
push offset byte_2000502C; destination string pointer
call _strcpy

My aim is to find where else this newly created string is read in the program. Being a debugger newbie, it seems logical to set a memory on access BP to find out where else in the code is this string read.
Is this the usual approach?

It only breaks inside _strcpy function, but I know it must be accessed elsewhere at least to copy to a variable before being passed to a function.

Any suggestions greatfully received.
Thanks 5aLIVE.
oh me anon
08-19-2005, 10:33 AM
select ebx follow in dump right click find referances to selcted address
if it was in analysis olly should show who accessed or is going to access
that area
most probably it should be mov ebx,blah instruction some where above
5aLIVE
08-19-2005, 10:44 AM
Hi,

You are quite right, move ebx,eax is used before the strcpy.

I'm wanting to find references to address $2000502C after the copy has completed.

5aLIVE
oh me anon
08-19-2005, 10:58 AM
2000502c sounds to be a very high address
is your application (dll may be loadd in such a high memory) ??
if it is code olly can sure find referance
if it is virtuall alloced global alloced or malloc or whatever discodance alloced memory then olly doesnt have a chance unless there are hard coded referance (higly unlikely) to that address

you can set a memory access breakpoint or memory write or harware write read execute break points and deal with the breaks case by case

unless i feel the code i cant comment on how to retrieve referance for that address :) especially after strcpy is done with :)

may be you could get the analyzethis plugin by joestewart
and force analysis and try using ctrl+r (find ref to selected address)
5aLIVE
08-19-2005, 11:19 AM
Oops that's a typo, it should read $0205xxxx, the DLL is relocated to a higher address.

The string in question is a Dynamic Data Exchange object created using the DdeCreatStrinHandle API. So I think It should be possible to find all references.

I'll try using hardware BPs to see if this helps at all.

I appreciate the difficulty of discussing code that you cannot see, let alone run. Would you be willing to look at the code if I am unsuccesfull?

The hole object of this exercise is to identify where the string is passed to a MD5 function. I've found the initialisation of the chaining variables and the rounds function, I would like to identify the message string and the digest.

AS I said before, I am new to this and there are lots of question I need to answer to make progress.

5aLIVE.
oh me anon
08-19-2005, 02:34 PM
well if it is small wouldnt want to be installed could run well on non admin accounts as well and doesnt have headache antidebugging tricks that would eat more time than the real problem yes i can take a look
provided you dont ask for a time deadline :)

hey but its easy enough to spot those strings just trace a little if it is malloce it will do a free if it is virtual alloc it will do a virtual free
if it some globalalloc it will do global free
just before tha data vanishes it would be stored some where else :)
and take on from there all it takes is some concentration :)
5aLIVE
08-22-2005, 12:50 PM
Thanks for the kind offer and advice.

The software meets nearly all your crieria except for size.
I won't bother you with it now. I'll do some more reading where time permits to get a better understanding of some of the mechanisms in place before reaching for the debugger again.

I've since found the main app references this string to do some checks.
5aLIVE.


hardware breakpoints

RCE Messageboard's Regroupment > General > hardware breakpoints
5aLIVE
08-19-2005, 02:00 PM
Okay, I've been using HW BPs and I want to disable one I set previously, viewing breakpoints does not show the HW BP in the list?

I cannot remeber where in memory I set it, therefore I cannot disable BP
by right clicking i the dump window.

Then I remember, that there are 4 debug regs D0..D3.
D0 Shows an adress I previosly set a HW BP, right clicking on this address in the dump doesn't allow me to select disable.

This raised the question how do I navigate to a specific address in the dump window? How can I enter an address to jump to in the dump?

When trying to answer this question I found by the Find References menu item (Ctrl +R) which revealed another part of code which refs the string I was looking at :).
I just need to try and make sense of that now.

5aLIVE
oh me anon
08-19-2005, 02:28 PM
debug -- hardware breakpoints-->delete


Search name in modules

RCE Messageboard's Regroupment > General > Search name in modules
yezo
08-21-2005, 02:09 PM
is there a way to do a string search for the name of a function in the search for name in modules. It would be so useful.
oh me anon
08-21-2005, 02:13 PM
just type the function name and ollydbg will autoscroll to matching name
if it exists
example hit g key the module names list will scroll down to first matching
g in the list
hit e it will scroll down to the first matching ge and so on
hope that is what you are loooking for
yezo
08-21-2005, 02:31 PM
yes that helps thanks a lot


uninitalised variable in ollyEngine

RCE Messageboard's Regroupment > Bugs > uninitalised variable in ollyEngine
tibbar
08-21-2005, 10:07 PM
line 1381 of assembl.c, jmpoffset has not been initalised under case arg = 0.

this is seen when running the sample main.c with runtime checks enabled under visual studio.

easy fix is to add jmpoffset = 0 right after declaration, i did this on line 680.
oh me anon
08-22-2005, 01:50 PM
are you talking about the assemble.c in the sources that is on main site
they belong to version 1.04 the release version is 1.10
so it can contain some problems


reals and jumps

RCE Messageboard's Regroupment > General > reals and jumps
thatsgreat2345
08-23-2005, 10:04 PM
well a guy i know he is able to attack people in a game i play and he said that i need to nop some jumps and stuff but i dont know how to find those jumps since there are about 300000 jumps and i dont want to look through them all so is there any tutorials that can help me learn about jumps or u can tell me about jumps

and another thing he can like fall right through the ground into stuff and i looked at the names and he said i had to edit some real numbers so i found all the reals in the view names but how do i edit them so that the thing im standing on i can make it be ground level so that i fall right through stuff
thatsgreat2345
08-23-2005, 10:05 PM
he said that i breakpoint the jumps and then attack and if it pauses then i know i found one of the jumps but there are to many jumps to test
Nonameo
08-24-2005, 06:17 PM
you're gonna have to learn some asm first.

then you will understand the code better, you will be able to see whats going on and hopfully find the right jump using knowledge, rather than guessing
gabri3l
08-24-2005, 11:49 PM
Nonameo,
good to see you back around. :) Was hoping you hadn't dissapeared.

Thatsgreat,
take nonameo's advice and read up on some asm, also search for some tutorials on Ollydbg. jumps jump to a location in code, there are conditional jumps as well which jump if a condition is met. like if eax = 1.
If you are looking for a quick fix this is prob not the place to look, you may have a better bet asking the guy more specific questions, or if he is nice he may send the executable he is using to you.
thatsgreat2345
08-25-2005, 01:36 AM
:-/ hes not using an exe and i found some tutorials but they were all about hacking serials
Bob
08-25-2005, 02:59 PM
o-k .. ask him to send you whatever he is using to patch the game then, script, loader, etc

Try TSearch, no asm needed to cheat at games, if that's what you want to do..
thatsgreat2345
08-25-2005, 07:58 PM
well its a 3d online multiplayer game and memory editing doesnt work but there is a gameguard but a guy made a thing to bypass it so u can use olly but hes putting a breakpoint on a jump and then attacking to see if pauses but he knows how to find the right jumps and then when u find the right jumps u just nop them simple as that


Learn ASM

RCE Messageboard's Regroupment > General > Learn ASM
thatsgreat2345
08-25-2005, 03:44 AM
Does anyone know some links or some good books where i can learn asm
mcensamuel
08-25-2005, 08:35 AM
Wrox - Professional Assembly Language
good to learn from the basics...
teach you a lot...
joe
08-25-2005, 07:47 PM
Look to http://www.goosee.com/goosee/x86/
There can You find link to ArtofAsm & many informations to programing in asm.


Crashes the application

RCE Messageboard's Regroupment > Bugs > Crashes the application
Koke
08-25-2005, 12:43 PM
I tried using the search feature to find this problem.

When I attach the process I want to OllyDbg, the application I'm debugging crashes completely. I've tried restarting and all sorts, but nothing's working.
Ricardo Narvaja
08-25-2005, 04:48 PM
and if you RUN from OLLYDBG? if not RUN detect OLLYDBG, and can detect next you attach.

Ricardo Narvaja
Koke
08-25-2005, 05:01 PM
I do try and run though, the game just freezes. period.


Is there any packer for visual studio Dot net executable file?

RCE Messageboard's Regroupment > General > Is there any packer for visual studio Dot net executable file?
arjuns
08-25-2005, 05:16 PM
God will be happy if somebody could say something ?
sigint33
08-26-2005, 04:22 PM
EXEShield now supports .net apps.

SiGiNT
mr haggar
09-01-2005, 06:45 AM
Maybe this ? --> http://www.nsdsn.com/eng/index.htm


Arma protected DLL questions

RCE Messageboard's Regroupment > General > Arma protected DLL questions
5aLIVE
08-26-2005, 02:27 PM
Hello again, I am trying to unpack a DLL packed with Arma 3.75b.

I have tried using these to scripts to help:
MEPHiST0s - ARMADiLLO DETECTiVE v1.00 for olly script
Armadillo Standard+Strategic Code Splicing Script by AvAtAr

Neither of which appears to find the OEP. The app is also trial based, and needs a user name and serial to remove the time limit.

Can such an app only be unpacked properly with a valid serial?

I also tried to find the OEP manually, setting a BP at CALL EDI, Olly reports that the BP is outside the code section although it appears not to be the case.

I chose to ignore the warning and set the BP there anyway.

This BP is never reached when running the code. Is this a consequence of it having trial based protection too or have I overlooked something maybe?

I hope somebody can help me with this.

5aLIVE.
5aLIVE
08-26-2005, 02:47 PM
okay quick update, using AvAtAr Script and not fixing the code splicing the script arrives at the OEP.

Let's see how I get on with fixing the IAT after dumping.
This is my first attempt at manually unpacking anything, so there are bound to be a few hurdles along the way.

5aLIVE
5aLIVE
09-27-2005, 11:21 AM
Okay time to resurrect this thread back from the dead. I decided to put this little project on hold until I read some more tutorials on the subject (which I have).

I found a new tutorial by MaDMAn_H3rCuL3s which shows how to unpack an Arm 4.x protected DLL. It mentions a quick and easy method of find the OEP, simply by setting a break on access (F2) of the .text section of the DLL.

With the DLL at the EP, and pressing Shift-F9 a meesagebox shows "Error while unpacking program, code 5-15. Please report to author". This happens when no breakpoints are set too.

I never had this message appear when I was working on this before.
Here's a list of my setup:
XP home SP2,
Ricardo's patched Ollydbg 1.10 (Parcheado 4.EXE)
HideDebugger 1.2.3f with all the options enabled.
I also have all exceptions set to pass to the program
I've added the following custom exceptions:
000006BA, 0EEDFADE
C0000005(ACCESS VIOLATION), C000001D(ILLEGAL INSTRUCTION)
C000001E(INVALID LOCK SEQUENCE), C0000096(PRIVILEGED INSTRUCTION)
C000001D (Invalid lock sequence).

Pressing Shift-F9 gave a stack over flow (C00000FD). I added this to the custom exception list and restarted the driver. I still get the error message.
Can anyone help please?
Hank
10-02-2005, 09:07 PM
I to am working on a dll like this . do you have msn or any messenger?
SKiLLa
10-16-2005, 02:02 AM
" Error while unpacking program, code 5-15. Please report to author".

Seems like Arma still detects the debugger. I'm currently analysing some Arma-protected app too (or to be more precise: Arma self ;) and I recall a lot of these err-messages referenced in the code. I'm not sure what causes the 5-15 error exactly since I don't have the program here right now, but it might be due to the 'GetTickCount' protection; meaning that Arma measures the elapsed time between some routines and in case it took too long (stepping/breaking) it quits with such alike error. Try BPing the GetTickCount API ...

Besides, try renaming ollydbg.exe and make sure you don't have SoftIce or anything like that running. And I also have the 0EEDFACE and 0xBEEFC0DE custom exceptions passed through and I don't get caught (yet) ;)
5aLIVE
10-18-2005, 05:49 PM
That for taking the trouble to reply SKiLLa. In the end I found a later version of the DLL (with a later version of Arma) and it loaded without error.

I can't explain why, and can only guess the original bacame damage in some way. I can't say I'm convinced by my own hypothesis though!

Thanks for all the hints and tip none the less.

5aLIVE.
SKiLLa
10-20-2005, 06:58 PM
You're welcome ! Besides you do have you're Olly patched against the OutputDebugString exploit, right ? And I'm pretty sure Arma wasn't damaged but it was detecting your efforts ;)

Good luck with the DLL, and please post your results, might get you a pat on the back and even teach someone else some tricks ...


Olly Script Editor V2.0 Released

RCE Messageboard's Regroupment > General > Olly Script Editor V2.0 Released
arjuns
08-27-2005, 04:19 PM
http://www.astalavista.com/index.php?section=directory&cmd=detail&id=4 988
(http://www.astalavista.com/index.php?section=directory&cmd=detail&id=4988
)

Writting OllyScript without a syntax Highlighter is annoying , so I tried my best to write this application Written in C#, in fact this contains whole package and has all the feature of a good editor.. I hope you'll find this very useful espically for OllyLover.. If you like this application please let me know how you feel mailing at a41arjuns@hotmail.com
liuyilin
08-28-2005, 12:15 PM
Thank you very much
ftts
09-01-2005, 12:09 PM
where can I get it ???
arjuns
09-01-2005, 04:17 PM
http://tuts4you.com/pages/tools.htm


call $+5 ?

RCE Messageboard's Regroupment > General > call $+5 ?
mcensamuel
08-29-2005, 08:39 AM
I opened one of my c++ program in the IDA pro and read that assembly.
I seen a call to $+5 in the starting of the function.
anybody know the meaning for this call ?
oh me anon
08-29-2005, 05:29 PM
$+5 is relative referance
it means call the function that is 5 byte after the length of command in eip

$ ==> 00401030 E8 00000000 CALL 00401035 ; call $+5
$+5 00401035 00 DB 00
$+6 00401036 00 DB 00
mcensamuel
08-30-2005, 03:19 AM
thanks....


dump memory on function entry

RCE Messageboard's Regroupment > General > dump memory on function entry
bugking
08-30-2005, 01:41 PM
Hi, I am new to olly and were able to set the conditional break point at the funtion entry and log parameters.
When the argment type is set to ASCII, the string was displayed in the log window and I like similar thing to happen when when the argument type is PTR. i.e. I like to see the contents of memory (maybe 10 bytes) pointed by PTR displayed on log screen.
Is this possible?
Also, in condtional break point window, how to send commands to the plugins?

Thanks in advance.
oh me anon
08-30-2005, 03:41 PM
you can only see some garbage non printable output it wont format the
data to hex
use [ [blah] ] [[blah+4]] notation to get the contents

to send commands to plugin
use . (dot in front)
like
.set eax = 0
.run
.a eip , db 0x90 ,0x90
.run
etc etc
you should also set the radio button to pause always
if it isnt paused these wont be sent to plugin
also . is commandline specific function

if you write a plugin with a special char you can pass that command
for example if you write a plugin to format the memory to hex instead of the ascii junk and have a special charecter ##

if you pass the command ##mycrap
you can get what you origianlly asked for
are you going to write one :)


NTDLL patch to disallow DR0-DR7 writes from ring3

RCE Messageboard's Regroupment > General > NTDLL patch to disallow DR0-DR7 writes from ring3
0xebfe
08-31-2005, 06:51 PM
Hi, from SOTM33, Nicolas Brulez mentioned there's a way to patch the ntdll.dll to disallow writting into the debug registers from the user space. I guess that sort of functionality is invaluable to me and I guess to lots of other reversers out there. However, there's no public info on this available. Any one know how to do this? Or better yet, have a patch for WinXP's ntdll.dll? I am just tired of working around polymorphic code that erases DRxs which makes both software and hardware breaks really hard to set.

Any info would be nice!
ricnar456
09-03-2005, 12:23 PM
i use superBPM for NT and the debug registers not can be changed, but there are program, than change debug regusters and check the change and don´t run, others detect the super bpm running etc, but if you need the hardware bpx in olly not will be erased by program running use super bpm and you have the solution.

Ricardo Narvaja
oh me anon
09-03-2005, 04:49 PM
hi Ricardo
are you talking about the superBPM.sys by ddc ?? it never seemed to work always crashed with illegal operation

or are you talking about the superbpm by ElicZ ?? (iirc its 9x only vxd and
elicz didnt release a nt version i think and mostly for softice ) dunno never had the neccessity to look deep into them :)
ricnar456
09-03-2005, 05:58 PM
superbpm.sys y sue in winXP mas sp1 in varuous tuts and in crackslatinos i´m not the only use in tuts, in sp1 work perfect for me, i don´t try in sp2.

Ricardo Narvaja
0xebfe
09-07-2005, 06:20 PM
Thanks guys.. I could only find superbpm by ElicZ which indeed is a 9x VXD. Ricardo, any links for the .sys for NT? If you have used it, I guess it must be working fine. Would love to get my hands on it, and also learn how it does that..
oh me anon
09-08-2005, 10:09 AM
search some chinese forums it was written by ddcrack at yeah.net
i only have the .sys and its tester with me dont know where i downlaoded it but a smart google with translate the page option should be able to fetch it for you but as i said the testbpm.exe always crashed the few times i tested it and the .nfo file is in chinese so i understand nothing :)
and i didnt have the time to look into the .sys disassembly
i think it uses cr0.wp bit to remove the page protection and write back
Ricardo Narvaja
09-09-2005, 10:34 PM
http://www.ricnar456.dyndns.org/HERRAMIENTAS/Q-R-S-T-U/superbpmfornt.z ip
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/Q-R-S-T-U/superbpmfornt.zip
)

you can download from here and work for me, i use in several times.

Ricardo Narvaja


Class based offsets

RCE Messageboard's Regroupment > General > Class based offsets
ldle
09-01-2005, 03:47 AM
Alright mates,

This is flippin quality forum btw!

Anyway my question is this. I've got my target loaded and what I'm trying to do is hook the member procedure of an internal class. Now this procedure is not static so I can't just use the offset in the name listing.

Suppose I've deciphered the pointer address of the instance of the class. How can I go about finding the offset of a certain member procedure, and then go about calling it or even creating a function pointer based of this offset?

IE
typedef void (__cdecl * ClassMemberProcedureDef) ();
ClassMemberProcedureDef CMPCall = (ClassMemberProcedureDef)0x??????


ollydbg color

RCE Messageboard's Regroupment > General > ollydbg color
jolopez
09-03-2005, 03:09 AM
i have see in screenshots olly with asm code colorized ... is there anything to do this in 1.10? or ... how to do with previous versions?
ricnar456
09-03-2005, 08:32 AM
in any part pf olly you can put the color and highlight you want, right click-appearence and edit the colors and appearence

Ricardo Narvaja


Hey, Im looking for some information regarding Ollybg

RCE Messageboard's Regroupment > General > Hey, Im looking for some information regarding Ollybg
Andrew
09-05-2005, 02:09 AM
A good tutorial would be helpful, if anyone has the ability to help me out, would be great. Trying to experiment with a few games. Thanks a Ton
1bitshort
09-05-2005, 04:25 AM
http://www.google.com/search?q=Ollydbg+tutorial
arjuns
09-05-2005, 04:34 PM
try this
http://tutorials.accessroot.com

kind regards
arjuns


HELP....in ollydbg

RCE Messageboard's Regroupment > General > HELP....in ollydbg
darek79
09-06-2005, 11:52 AM
im happy when i found this side.....here got many pro man are using ollydbg program.....i need to intro my self ...im newb about ollydbg....

i try 2 weeks already...but still cant understand it. im bad in english...

when i use the ollydbg in other online game...that cant work properly..

i wanna know about how to find the breakpoint? what is breakpoint?
because i wanna know how to duplicated item in some onlinegame.

can anyone teach me step by step manual ....

thanx a lot....
Ricardo Narvaja
09-06-2005, 12:05 PM
and what is your original languaje i´m spanish and in my http and ftp there are more than 1000 tutorials with ollydbg in spanish.

Ricardo Narvaja
darek79
09-06-2005, 03:40 PM
i dont know spanish at all........i only know about english .... thanx for u ricardo
newbiew
09-27-2005, 09:59 AM
hi!
help me unpack armadillo 3.00a 3.61?


a Question for Ricardo Narvaja

RCE Messageboard's Regroupment > General > a Question for Ricardo Narvaja
xcracx
09-07-2005, 10:26 AM
Listen i got a huge problem when i try to crack some executables

specialy those who work with lstrcmpA or any other string detection
my olly works fine but if i set a bp on the call of lstrcmpA for example

ollydbg stuck and not respawnding.. it says Break at Kernal.lstrcmpA
for the lstrcmpA example in the status line

if anyone know how to soluve that problem i'll be very thankful

xcracx
Ricardo Narvaja
09-07-2005, 12:15 PM
ies very extrange is not a normal olly behaviour, i think is a problem in your machine, for the reason nobody experience that problem (and in cracklatinos will be 600 members hehe) i nobody hear a problem like that.

If i suffer this problem i try this

1)reinstall all visual basic runtimes 5 and 6
2)i check very strong for teh services in the CONTROL PANEL-ADMINISTRATIVE TOOLS-SERVICES and check all services are system services and you have not running services how hasp services securom, game services and other type of conflictive services.
3)i use other olly without any plugin when you have this problem and check if the problem repeat, if not you have a plugin with problems.

Ricardo Narvaja
xcracx
09-08-2005, 01:25 PM
ty yeah i wanna try that vb runtimes cuz mine must be very old so
about the service i don't really pro at those stuff if you can be more direct it will be very helpful

i'll try downloading new Runtimes and then i'll might come asking for the services, i tried another ollydbg without plug-ins even another version

tnx for the information

xcracx
xcracx
09-08-2005, 01:39 PM
ok i installed VB6 sp6 runtime
from this link (microsoft)
http://www.microsoft.com/downloads/details.aspx?familyid=7b9ba261-7a9c -43e7-9117-f673077ffb3c&displaylang=en
(http://www.microsoft.com/downloads/details.aspx?familyid=7b9ba261-7a9c-43e7-9117-f673077ffb3c&displaylang=en
)

and i still have the same problem bp+make the software active
=====
olly break + not respawnding

can you get some more information about what i have to change on my services tnx

xcracx
ricnar456
09-08-2005, 08:06 PM
first try in one ollydbg without plugins (the plugins are the most frecuent cause of problems) and you are in 2000 or XP i assume.

Ricardo
xcracx
09-08-2005, 09:20 PM
i use xp os but read my post it says
", i tried another ollydbg without plug-ins even another version "
ricnar456
09-09-2005, 12:10 PM
well you need look in the service list, if you look you can go to the properties of each service and you can look the path and the name of the exe, of each service.
Next look in the pages of task information (use google) and you can info of each process, if is a SO service or is a game, dongle,packer service pejudicial to the debuggers.

Ricardo


how to use a .map file?

RCE Messageboard's Regroupment > General > how to use a .map file?
xili
09-08-2005, 07:11 AM
I want to debug my project with OllyDbg. It's an BCB6 project.

Can OllyDbg use the .map file produced by BCB6?
xili
09-08-2005, 10:45 AM
I can import the .map file using MapConv.dll now.

Is it possible to load the .cpp source file into OllyDbg?
oh me anon
09-08-2005, 01:09 PM
yes
if you had compiled it with debuginfo use ctrl+f5
if you dont have debuginfo
then you can load obj files also
use right click -->analyze -->scan object files
you can also use the implib scanner
see view menu


Pausedex & go problem

RCE Messageboard's Regroupment > Plugins > Pausedex & go problem
sinnernot
09-08-2005, 07:02 PM
have several ollydbg plugins already done but I have a doubt and
kind of a problem with the function pausedex.

In general, in all the plugins I wrote I set a breakpoint using
Setbreakpointex at some point, and then, I handle the breakpoint at
Pausedex checking that reasonex == INT3_PPBREAK.

THe problem is i'm not sure exactly how to get out of Pausedex. I'm
using GO(0,0,STEP_RUN,0,0) but I'm having some problems.

it also seems strange to me that I have to do also a 'return' besides the GO()!!

eg:

Pausedx(...)
{
if( reasonex == PP_INT3BREAK) {

if( bp_addr == myaddress ) {
do_stuff..
}

}
// continue program execution
Go(0,0,STEP_RUN,0,0);
return 1;
}

is that the correct way to use GO? I don't think the function was
intended to be used like that, because I'm getting a lot of race
conditions and differents problems. Doing Go() and then returning
makes no sense to me, or maybe I'm missing something.
returnign 1 from Pausedex without the GO does not make the debugger
continue execution.

What I want to accomplish is to set a breakpoint, when the breakponit
is hit, I want to handle it in Pausedex and then let Ollydbg continue
execution of the program.

Using the method described above I can do it, and it is working, but
sometimes I get
very ugly race conditions and everything freezes.

Can you please help me?

Thank you!
oh me anon
09-08-2005, 07:16 PM
well may be try using SendShortcut (vk_f9) thats how i used pausedex
once never tried go as i couldnt understand its functionality :) and not sure wht threadid etc to use and first how to retrieve them etc
so opted out the first way it worked aks Sendshortcut (vk_f9)

Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
VirtualProtectEx(debproc,mbi.BaseAddress,mbi.Regio nSize,lpOld,&lpOl d);
CloseHandle(debproc);
return 0;
sinnernot
09-08-2005, 07:20 PM
Yes, I already tried uising Sendshortcut but the program DOES NOT continue.

Inside Pausedex I Did

Sendshortcut(PP_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
return 1;

but it does not work.
olly just sits there and the program does not continue.

anyways, it is still strange to me to tell the debugger to CONTINUE execution AFTER returning from the callback (Pausedex) that told me that a debug event occurred.

To me the logical thing would be for pausedex to return 1 and olly woud just continue execution.
oh me anon
09-08-2005, 07:23 PM
hehe i editeed the code and you replied
see edit above
whats pp_main ??
sinnernot
09-08-2005, 07:40 PM
he, cool, thanks.
my brain is fried and I read PP_MAIN in the helpfile instead of PM_MAIN.
thanks a lot, now it works.
but I have another problem.
With Go() I can use the givechance parameter to pass exceptions to the app.
now, with Sendshorcut()... I cant...
so everything works fine until an exceptions is thrown and I have to manually press F9 to continue.

mm, i guess I should be able to deal with that with the debugevent parameter of pausedex... right? :)..
sinnernot
09-08-2005, 07:45 PM
mm, no, ok, now it works. I correct myelf.
But I get the same issue as when I was using GO.

I guess that after the breakpoint is hit, when I do GO/Senshortcut, it gets hit again, is that possible? because olly just keeps hitting breakpoints ALL THE TIME :(.
oh me anon
09-09-2005, 11:01 AM
everything is possible :) proabbaly you have set a breakpoint on
messageloop ()
try debugging the plugin and see why its happening the way its happening
or try using conditional break points


setbreakpoint & pausedex

RCE Messageboard's Regroupment > Plugins > setbreakpoint & pausedex
sinnernot
09-08-2005, 09:40 PM
ok, I'm setting a breakponit and handling it in Pausedx(), But, the problem is the the function I set the breakpoint on is called very often, and because (I pressume) ollydbg rewrites the CPUDUMP pane everytime the breakpoint is hit, the program gets really slow.

Is there a way to put a breakpoint ni such a way that ollydbg does not rewrite the CPU PANE? I think maybe it is possible with logging conditional breakopints,has anyone tried this before?

Even if i Close the cpu dump window, every time the breakpoint is hit, it is reopened again.

any help will be appreciated.

thanks, bye!
oh me anon
09-09-2005, 10:57 AM
post some code that you have cooked up or a possible prototype to
see the problem i mean an exe and a plugin that doesnt work some where
probably rapidshare should be ok
so that one can understand what happens
yes one can set conditional breakpoint
though as i said i never used go but i have used conditional break points
to handle only the break i want

take a look at NtGlobalFlag plugin source at BiW

it works like this

Insertname((ulong)ntdll_RtlRaiseException,NM_BREAK ,"STRING [[[esp+4]+18h]] == \"LDR: Calling Tls Callback Imagebase\" | STRING [[[esp+4]+18h]] == \" - Calling\"");
Setbreakpointext((ulong)ntdll_RtlRaiseException,TY _ACTIVE|TY_KEEPCO ND,0,0);
Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
VirtualProtectEx(debproc,mbi.BaseAddress,mbi.Regio nSize,lpOld,&lpOl d);
CloseHandle(debproc);
return 0;
}

why dont you try debugging the dll ?? and finding where it errs ??

you could recompile tbd_debugplugin to suit 1.10 version
or just load ollydbg on ollydbg view names in your plugin
and set abreak point on pluginAction and every thing becomes clear :)

btw where have you stashed all your plugins :) i ve not seen even one plugin authored by sinnornot :)
sinnernot
09-09-2005, 08:51 PM
thanks a lot for your answer again! it was very helpful!

now I was able to set a conditional logging breakpoint based in the example you provided, using code like the following:

Insertname( (ulong)g_rtlfreeheap_addr, NM_BREAKEXPR,"\x24\x00");
Insertname( (ulong)g_rtlfreeheap_addr, NM_BREAKEXPL, "test");
Setbreakpointext( g_rtlfreeheap_addr, TY_ACTIVE|TY_KEEPCOND,0,0);

and I tried setting the COND_NOBREAK flag in the 'name' parameter, and everything works fine, except that of course, COND_NOBREAK means that my pausedex() function is not called.

Now, everything I want is working as expected, the problem is that is it VERY SLOW.

what I am doing is:

-setting breakpoint in a function, eg: rtlfreeheap
-when the breakpoint is hit, my pausedex() function is called and I do sthg there

the problem is that for functions that are called VERY often (eg: rtlfreeheap) every time the breakponit is hit, ollydbg redraws the whole CPU DUMP, and because of this, i guess, the program being debugged is run TERRIBLE SLOW. it is UNUSABLE.

If I set a logging breakpoint to RtlFreeHeap and set the COND_NOBREAK options, the program runs SMOOTHLY, it works great, and in the LOG WINDOW, I can see the "test" string being logged all the time.

So i guess, IT IS POSSIBLE to do what i want without a terrible regradation of the performance of the debugged process.

So, help! help! come on olly! your expertise is needed! :)
oh me anon
09-10-2005, 12:32 PM
well a conditional break point means you should give it a condition that is valid only once :) that why it called conditional :) refine your conditions better to make it break lesser :) i cant comment unless i see how or why some thing happens
iirc nm_breakexpr and nm_breakexpl are for
expressions and not conditions (in graphical shift+f4 these willl be set in the two edit boxes below the codition edit box) also if you are using expr
you should create some definitons too if i remember correctly
not sure you are creating them (actually on wrong expressions olly assumes no condition and breaks as if it is a hard break (break_always))
the codition must be a valid expression that returns eiter a true or false
check if your expression is valid
use view watch graphically and manually or use _getwatch () and parse conditions and results
if you are sure you have a real condition that happens only once you can narrow it down to break only once :)
sinnernot
09-13-2005, 07:31 PM
no, but I do not want a CONDITION.
I just tried conditional breakpoints hoping they would be faster, but they are not.

I just want olly to break EVERYTIME freeheap is called, and it does, but the problem is that it makes the debugged app TERRIBLY SLOW. An this is because, for starters, olly redraws all windows with each breakpoint hit.

This is a performance issue. I've done the same thing with other debuggers (set breakpoint on functnio and do sthg when it is hit) and the app does not crawl like it does on olly.
oh me anon
09-15-2005, 10:09 AM
good luck to you then on your future endevours on those non sucking debuggers
Best Regards


about Arma again

RCE Messageboard's Regroupment > General > about Arma again
Xinner
09-11-2005, 10:57 PM
Hi,
I've read quite a few tuts about unpacking Armadillo using Olly, so last night I started to analyze a program (Sudoku at www.sudoku.com) (http://www.sudoku.com)) protected with it.
But when I run it a MSgBox showed up saying "Don't know how to bypass command at address xxxx. Try to change EIP or pass exception to program" Of course I set the bp on IsDebuggerPresent but it doesn't break at all.
Any suggestion?? Thanks.
X
Ricardo Narvaja
09-12-2005, 01:18 AM
yhis is a ollybug with ILLEGAL EXCEPTIONS, you can patch your olly to pass easily, debug your olly with other olly and serach for the string of this message, you found a conditional junp before the call to this mesagebox you can convert in a JMP and olly hadle this exceptions perfect.

or download the patched olly from

http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Parcheado%2 04.rar
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Parcheado%204.rar
)

put in the same olly folder (don´t erase the original OLLYDBG.exe) and use parcheado 4 for debug arma, and tell me if you have problems.

Ricardo Narvaja
Ricardo Narvaja
09-12-2005, 01:19 AM
ah and don´t use isdebuggeroresent plugin use hidedebug 1.23f is more complete, you can add isdebug with extrahide for hide ntflags, but is not necesary for arma, with hidedebugger is enough.

Ricardo
hosiminh
09-12-2005, 10:15 AM
Just hit shift+F9 when "Don't know how to bypass command at address xxxx" happens :D

btw, this app uses Copymem2
Ricardo Narvaja
09-12-2005, 11:43 AM
shift +f9 don´t work in original olly handling ILLEGAL EXCEPTIONS the mesage repeats and repeats and never pass the exception.

Ricardo Narvaja
Xinner
09-12-2005, 01:24 PM
Thank you Ricardo (and thank you hosiminh).

I downloaded the file you suggested and I managed to overcome the problem. But now there's one more.
If i run the prog., no matter what bp I set, a windows messagebox appears indicating an error and asking if I want send it to M$.
The message is like the one in the image in the "armadillo, compendio de - Tomo III", pag. 4 (I managed to understand something because I'm italian).
But, at that point, I'm not able to go any further, because if I click on "don't send" the program quits giving error C0000005 (tough I pass that exception to the program in the options window).
In the tuts, as long as I understand, it says something about setting a HBPB instead of a simple BP. What is it, how does it work and... what's going on??
Thank again. You're really of great help for anybody here!
X.
Ricardo Narvaja
09-12-2005, 03:39 PM
the new armadillo detects BPs and the more news erase HE, but you can try first

He MessageBoxA

in the comandline or the api you want

if the program erase the he and don´t stop try this put Bp MessageBoxA, and go to BREAKPOINTS and double click in the BP, erase with f2 the BP and down to the first RET and put BP in the RET with f2.

When the program stop in the stack you can see the parameters (without olly explanation of each ) but you stop in the api.

Ricardo Narvaja
hosiminh
09-13-2005, 07:54 AM
Read this:
hxxp://www.geocities.com/tlatoanimt002/ArmaTute3x4x.zip


how to break when a memory address is accessed?

RCE Messageboard's Regroupment > General > how to break when a memory address is accessed?
mcnorth
09-13-2005, 05:44 AM
I'm working with RtlRunEncodeUnicodeString and have identified how charachters are encrypted and where they are store. (starting with 17bde8) Now I want to break when they are being accessed by the program. I thought about break on access (from memory map) but I think that pertains to the entire block of memory and I want to break when specific bytes are accessed.

Any ideas or suggestions? Be forwarned (as if it isn't obvious) I'm really green at this.

Thanks!!!
Ricardo Narvaja
09-13-2005, 10:07 AM
in the dump mark the bytes you need, and right click BREAKPOINT -MEMORY ON ACCESS and stop only when read, write of execute only the bytes tou mark.

Ricardo
oh me anon
09-13-2005, 01:01 PM
also hardware break on read (byte word dword) should do the trick of breaking on specific memory
mcnorth
09-14-2005, 12:27 AM
Awesome! Thanks guys.


Hide Debugger fails to provide protection against Terminate Process

RCE Messageboard's Regroupment > General > Hide Debugger fails to provide protection against Terminate Process
mcnorth
09-13-2005, 05:49 AM
I'm using the Hide Debugger plugin and set it to protect against TerminateProcess. Still, it terminates. Is there another way to protect against this?

Thanks.
Ricardo Narvaja
09-13-2005, 10:05 AM
the terminate process protection don´t work in XP sp2, only sp1.

Ricardo
Asterix
09-13-2005, 02:13 PM
I'll correct it in the future version
1bitshort
09-13-2005, 04:12 PM
hmm, there are lots of ways to terminate processes under windows:
http://www.diamondcs.com.au/freeutilities/apt-techniques.php
mcnorth
09-14-2005, 12:24 AM
Ricardo: Good to know. thanks for sharing it.

Asterix: I'll be looking for it. Do you have the future version in the works?

1bitshort: Thanks for the link. So if I identify which method is being used should I be able to patch to prevent it?
1bitshort
09-14-2005, 05:33 AM
yep. usually it's just TerminateProcess, but not always... might even be just sending window messages like WM_CLOSE/SC_CLOSE
dm47
09-23-2005, 07:41 PM
can some1 post a link for hide debugger?
none of them ever work


Howto Build a new PE Header header or fix the existing?!?

RCE Messageboard's Regroupment > General > Howto Build a new PE Header header or fix the existing?!?
fad
09-14-2005, 06:19 AM
Hi, i have unpacked a executable. When I use PEiD to scan the exe it say's "Microsoft Visual C++ 6" but when i want to edit ressources the resource editor tells me that the programm is packed. OllyDBG tells me that the Entry Point is outside the Code section as specified in pe header.
How can I Rebuild the PE-Header?

ciao,

fad
Bob
09-14-2005, 11:36 AM
Upload file to YouSendIt.com
Post link to the file on PEiD forum, so we can check if it is indeed packed or not, and can add it to the PEiD Database.

This goes for everyone who has moaned about PEiD not detecting properly by the way, submit sigs to PEiD forum and they will be added to the new version coming very soon.. Especially different Arma ones, lots of complaints but no sigs..

Anyway, to rebuild the PE header, easy to use tool like LordPE or Werk..

~BoB~
mr haggar
09-14-2005, 07:03 PM
>Entry Point is outside the Code section as specified in pe header.

Just open file in lordPE's editor. There you will probably see that code section starts at 1000 (401000-400000=1000) and that is first section. You just change that base to address that you want to be code section. It will acctually change nothing, but Olly will not complain. Read some PE format documents, btw.


c++ reversing ?

RCE Messageboard's Regroupment > General > c++ reversing ?
mcensamuel
09-14-2005, 02:53 PM
is there any good document/book that gives me the good understanding of asm code created by a c++ program ?
i am bit confused with the class/object creation/virutal function...

if not...is it worth to write a one ?

(did u understand my question ??? my english is tooo bad (; )


serious bug in olly engine!

RCE Messageboard's Regroupment > Bugs > serious bug in olly engine!
tibbar
09-15-2005, 01:46 AM
if i do:

Assemble("JS 0x463BC7", 0x483B46, &am, 0, 0, errtext);

this returns me 0x78 0x7F

But!!!

0x463BC7 - 0x483B46 = 0x81 = 129 > 127!!

This doesnt happen in the Olly 1.10, only the engine on your site when i use it in my app...

Any ideas whats going wrong?

Many Thanks.
oh me anon
09-15-2005, 10:07 AM
you mean the disasm.zip available in the main site ??
that version of disasm source is not current source it was of version 1.04 if i remember correctly if you want some source to look at try pvdasm by ben (he has released his source of the disassembler and is uptodate to match the compiled binary)
tibbar
09-15-2005, 02:30 PM
yes version 1.04.

isn't the source from 1.10 available, seems a bit strange to keep buggy source available...

i guess i will have to fix it myself, as my project is built around the ollyengine now.


Move location of application corrupts UDD file?

RCE Messageboard's Regroupment > General > Move location of application corrupts UDD file?
HerbyJ
09-15-2005, 05:23 PM
Hi,
I have not had any luck searching for an answer to this problem.

I recently moved a project I've been working on from one hard drive to another, however when I load the application now, all of my custom comments and patches are gone.
It doesn't look like OllyDbg actually uses the "File" location stored in the UDD file, as even if I change it, it still won't load any of the additions I've made. (I also have a backup, just incase I corrupt it when modifying)
It isn't possible to simply use the old location, as I no longer have multiple partitions on this computer at present time.

Can somebody please point me to a solution for this problem?
xcracx
09-17-2005, 09:07 PM
if you have to old udd file...

make a new folder called udd move it to that folder

then enter ollydbg.. options .. UDD folder: xxxxxxxxxxxxxxxxx

edit xxxxx to the location of the folder you made


Jumped from where? (and others)

RCE Messageboard's Regroupment > General > Jumped from where? (and others)
mcnorth
09-17-2005, 03:46 AM
I have a break occuring on ShowWindow. Is there a way to find out which line of instruction called ShowWindow?

Also. Some time ago my jumps showed up as a red line (in the CPU windo... Never mind. I found it.

Thanks.
mcnorth
09-17-2005, 03:51 AM
OK, that was a stupid question. I found it.


R Narvaja - do you have some tutorials about SDprotector?

RCE Messageboard's Regroupment > OllyScript > R Narvaja - do you have some tutorials about SDprotector?
mr haggar
09-19-2005, 07:59 PM
Hi! I'm pointing this question to you because it seams that you are the most active guy here in unpacking. Also you could have some info on crackslatinos tutorials.

I'm having problems with SDProtector 1.xx. I sow that there are some tutorials about it made by [+NCR/CRC! [ReVeRsEr] ] or maybe some other guys but I cannot find links anymore. Do you know where could I find them?

Also, have you beeing unpacking SDProtector maybe? I spend some time trying it but couldn't do it by the usuall way - searching for OEP and avoiding anti-debug tricks. It seams pretty complex protector. It creates threads that watch for unpacking tools, it remembers changed names of olly and others, ZwQuerySystemInformation check for enumeration of processes... and lot of. It seams that imports redirection is quite simple and can be fixed easily but that is just my impression. Any advices are wellcome.
ricnar456
09-19-2005, 11:52 PM
400-SDProtectorPro v1.12_II_by_+NCR.rar

399-SDProtectorPro v1.12_I_by_+NCR.rar

424-SDProtector 1.16_by_+NCR.rar

425-SDProtector v1.1x_C30N4_by_+NCR.rar

401-SDProtectorPro v1.12_III_by_+NCR.rar

402-SDProtectorPro v1.12_IV_by_+NCR.rar

i don´t unpack if other cracklatinos member make tuts, there so may packers is impossible view all packers availables.

http://www.ricnar.webhop.org/

go to nuevo curso and the tuts are in the teorias numeradas folder

Ricardo Narvaja
mr haggar
09-20-2005, 07:27 AM
Thanks, that is impressive collection of tutorials.
Stcruxenio
09-22-2005, 11:42 PM
Ricado:
Thanks for the link. I had time to read just a few of them (not about the packer). I couldn't find the tool "Keygen Maker" that you used. Unfortunately, they are too common words for google. I'm not a programmer so it would help me a lot. Can you give me a clue to find it? (the author?).
Ricardo Narvaja
09-23-2005, 12:05 AM
write me and i give to you access to my ftp with tools

Ricardo
Ricardo Narvaja
09-23-2005, 12:06 AM
my mail is ricnar456@yahoo.com.ar

Ricardo
Ricardo Narvaja
09-23-2005, 12:07 AM
my mail is ricnar456@yahoo.com.ar

Ricardo
bhu
12-22-2005, 03:19 AM
Hi
i was saw u r site, there is a whole bunch of tutorials but , i could not understand since it is in some other language, do u have any english versions ? if so can u please let me know the link
i am basically reading the tutorials.
thanks
bhu
ricnar456
12-22-2005, 10:27 AM
in my ftp there are few tutorials translated to english 10 no more.

I suggest to you use a translator and normally my tuts have a lot of images this help for understand.

Ricardo Narvaja


gsx problem

RCE Messageboard's Regroupment > General > gsx problem
fthree
09-20-2005, 03:51 PM
olly 1.10b used to work quite well under GSX 3.0, but now with GSX3.1, guest OS Win2kSP3, host OS RHEL3Upd4, olly locks up every time it hits a breakpoint. has anyone else seen this?
xcracx
09-20-2005, 06:20 PM
if u use any background program that works in process and hook/inject some dll into other executables that should be the problem

for example spy-my-comp and that kind of stuff
and use odbg110


Question to Trace-Log

RCE Messageboard's Regroupment > General > Question to Trace-Log
squareD
09-21-2005, 02:52 PM
What does this mean in a Trace-Log?

"KiFastSystemCallR"

I don't know what there happens...

Regards,
squareD
oh me anon
09-21-2005, 04:29 PM
KiFastSystemCall is used to enter Exceutive (also called kernel or ring 0
or in otherwords ntoskrnl.exe) to run code that is privileged and not accessible by user mode code
for example you code CreateFileA(blah blah blah)
which in turn calls CreateFileW CreateFileW after some initialization
ends in ntoskrnl via ntdll.dll with a system call using KiFastSystemCall
in earlier procesors and os it was using a interrupt (aka int 2e system services interrupt) newer processors have eliminated some overheads
and improved performance is obtained by using KiFastSystemCall

if you meant you want to trace inside this call using ollydbg
you cant do it because olly is not a kernel debugger but an application debugger that runs in normal ring 3 privilege

you would need a kernel debugger (windbgs kdb or softice for example)
to trace through those calls

in trace log if you see that then it means a system call was executed

now if you are not interested in system calls but user mode code only
you can setup a break point on the system calls return and do
ctrl+f11 or ctrl+f12 again once the break point is hit
if it was recovering from an exception it would use ZwContinue
in ntdll you can find the return address from the context structure that was passed to that call and break there
squareD
09-21-2005, 05:11 PM
OK, I understood that...

It would be only helpful, if Olly would indicate which system call was executed.
oh me anon
09-22-2005, 11:52 AM
well system calls are not standard through out the different versions of
operating systems
those are normally numbers which the sytem identifies as a specific function via a table that it holds (trap gate interrupt gate gdtr ldtr blah
and all such exotic undocumented or poorly documented structures
and it would be probably an useless over head coding identifiers on user mode code may be which would obviously be of no use to normal
debugging

for example a system call to ZwCreatefile() in ntdll may look like this
mov eax,0x## <-- the sytem service number
mov R32, the copy of params on stack
mov edx,0x7fffe000+304
call edx <-- which would enter system through KiFastCall

0x7ffe0000 is called KuserSharedpage

now if you are persistent you can find all those call numbers
from variety of sources
one good debugger combination could be using windbg and livekd from sysinternals or may be using local debugging in windbg
if you are on xp-sp2 and > os like w2k3

and getting it to spit those call address via
x Nt!C* etc
or loading kdex2x86 extensions and doing strct! blah

or look for papers by skape spoonm etc on the subject
metasploit project has a pretty good referance onall those system calls
and they have documented all those system call along with thier
respective numbers and prototypes of the calls and parameters
right from nt to w2k3

probably you could write a plugin to label them :) inside olllydbg :)
or may be make a complete ntdll.arg file and make olly recognize all thos calls along with thier parameters ?? :) just like it recognizes MessageBoxA() hows that for a suggestion ??
hope fully you could accept those suggestion and produce
some thing in return for all of those who use olly in future :)


Turbo Debugger symbols messed up

RCE Messageboard's Regroupment > General > Turbo Debugger symbols messed up
Tramb
09-22-2005, 10:41 AM
Hello everybody,

I try to debug an optimized (hum!) Delphi 5 application, but OllyDbg completely messes the Turbo Debugger format symbols.
Yet VTune gets them right!

If somebody can help me, I'd be very grateful!

Thanks,
Bertrand
oh me anon
09-22-2005, 12:02 PM
completely messes it up means what it does ?? labels them wrong ??
doesnt load ??
can you post a small comparison snippet between two ??
have you tried to find what may cause it ?? atleast give us some pointers on your research ?? so that we can atleast think of what might be the problem ??

doesnt work (i would say it works like it is supposed to work only you cant decipher how it worked maybe ?? )
Tramb
09-22-2005, 01:21 PM
> I'll check manually the link map to see if there is a constant offset or if it is > more complicated.

There is no simple linear transformation between the symbols in OllyDbg and those in the link map...
oh me anon
09-22-2005, 03:49 PM
may be a stupid question but are you using some plugins like mapconv or godup to load the map ??
if yes are you applying it to the right module ??
maps are addressed some thing like this
0001:001234 blah@##
so ifyou apply itto base address 0x780000 it will be labelled at
781234
if you apply it to 0x400000 it will be labelled at 401234
TQN
09-23-2005, 01:46 AM
Yes, oh me anon. We can create a detail map file from Delphi IDE, and import to OllyDbg it with some plugins.
As I known, IDA v4.9 will support TDS file.
Tramb
09-23-2005, 07:15 AM
I have trouble with the debug info embedded in the .EXE, in fact...
Maybe I can try importing the delphi .map file with the appropriate plugin to see if the result are more accurate.
I'll try googling for this (unless TQN posts a link? ;-) )

Cheers
TQN
09-23-2005, 01:25 PM
GoDup plugin in Stuph page: http://ollydbg.win32asmcommunity.net/stuph/GoDup1_2.zip


breaking inside modules

RCE Messageboard's Regroupment > General > breaking inside modules
jose barroca
09-22-2005, 04:17 PM
Hello all,

probably a stupid question, but all the tuts I found deal with single-file applications. Now, I'm digging inside a program that calls dlls, that call other dlls and so on, and which does not stop at any useful input window.

I'd like to stop inside a specific dll and then tinker along, but I fail to understand how that can be done. COuld anyone provide info on this?

Regards,

Barroca
oh me anon
09-22-2005, 05:16 PM
options--> debugging options --> events --> break on new module
should break on new modules that load

or juthit f12 key (pause ) it will break some where inside
use ctrl+k (call stack ) and find what called which and where it would return and so on

view executable modules find the dlls of interest
right click view names find a functions that is of interest set break on it
and tinker along after it broke

load the dlls that is loaded independently and study them and ask ollydbg to break on such function ollydbg will break if that function is called

use runtrace (trace in) and ask ollydbg to log every thing use the log to parse the execution path

use a standalone disassembler like ida dead list the module save a lst file
and parse through the flow

well there are innumerable options that could be perused if you want to
fire in the dark :)

last but not least the help file should be of immense help :) if you go through it as well as your rodents right button
just keep on right clicking and you should some day find all the
easter eggs that are hidden inside the contxt menus


Stupid question, how to remove stuff?

RCE Messageboard's Regroupment > General > Stupid question, how to remove stuff?
RonSijm
09-22-2005, 05:10 PM
Hi,

Im newb with ollydebug, and i cant find some things...

like, when im editting a .exe file of a game, and i want to remove the hackdetection, i already found what part it is, but i dont know how to remove it or something? Can i just set a breakpoint or something?

And, how can i like Save my file when im done?

tnx
oh me anon
09-22-2005, 05:22 PM
:( yeah you can always do something provided you know what to do
:) a debugger is designed to be able to set a break point
so ollydbg can set them too and that too in innumerable ways you could ever think of just try hitting f2 for a start then keep right clicking
you will find a breakpoints menu choosing that should open a pandora box
of option for you select and break

as far as saving the modification is considered
right click --> copy to executable --> all modification OR selection
ok--> in the new window that pops up right click --> should see save to executable give a new name and hit ok
RonSijm
09-22-2005, 06:00 PM
Yes, well.. im also new to debugging, not just ollydbg.

But, when i set a breakpoint, i cant run it anymore...

how should i remove stuff from it?
sgdt
09-23-2005, 04:04 PM
When you set a break point, at least temporarily, it is modifing the code (for the int 3 instruction). It sounds like it is checking for modifications. If you place a hardware read break point on where you set the software breakpoint, you should get a hit at where it's doing the CRC (or what ever method they are using). NOP the final failure, and put a hardware break there, and see if someone is checking the checker.
xcracx
09-23-2005, 08:01 PM
1st of all there is nothing like Removing in Debugging because the complier read the code and translate it to Assembler which work with
CPU-Memory-I/O
Inside the CPU you got the process counter(PC) that reads each the memory from 0000- to the end

so you can't just delete some line it works like READ and done
but you can use some command called nop that tells "Do nothing"

"Removing"

Right click > Binary Edit(or something alike) > Fill with NOP's
or Fill with zeros (for certain things)

Saving

Right click > copy to executable > ........(whatever needed)

xcracx


hex dump, or register?

RCE Messageboard's Regroupment > General > hex dump, or register?
jose barroca
09-23-2005, 01:53 PM
Hello all,

I'm puzzled with something here. I'm reading a tutorial, where a program executes the following:

:005F6F7D lea ecx, [ebp+var_280]
:005F6F83 push ecx <-- Vendor code structure
:005F6F84 mov edx, [ebp+arg_0]
:005F6F87 add edx, 30Ch
:005F6F8D push edx <-- Vendor name
:005F6F8E mov eax, [ebp+arg_0]
:005F6F91 push eax <-- Job structure
:005F6F92 call _l_sg

then, it instructs the reader to "note a copy of the vendor structure":

04 00 00 00 19 59 D5 7A ED A3 2D 80 ED 11 A0 18
97 E1 4B 27 A8 21 6A E2 41 04 58 52 09 00 00 00

My question is exactly here: is this the contents of the ECX register, or something that has been pushed onto the stack? And, in either case, how can we actually see it? Is it in some way related to the bottom right sub-window of the CPU window?

Regards,

JB
xcracx
09-23-2005, 04:13 PM
ok if i got you write you wanna dupe or something like that
by vendor as i see here you just need to copy the push ecx and note it
for using the address in another process

for your information you can view ECX's content in the Register window(top right one) by setting a bp for example and you can also changing it by the register window While process

good luck,

SasukeHa
xcracx
09-23-2005, 04:14 PM
sorryyyy Not SasukeHa but xcracx, that is my other nickname


Olly crashes

RCE Messageboard's Regroupment > General > Olly crashes
OleB
09-23-2005, 04:24 PM
I have win xp sp2. Whenever I try to start olly it's open for about 2 sek, and then close.

Can anyone help?
xcracx
09-23-2005, 07:49 PM
ok it could be any of the things i'll detail below:

*You have some protection from Debuggin at the anti-virus
*some program got anti-debugger protection detected by IsDebuggerPresent function
*some registery debuggin protection
*ollydbg bug (try different ver)

xcracx
Ricardo Narvaja
09-23-2005, 09:32 PM
a bad olly plugin Disable all plugins and try one by one

look in services list the bad services (game protectors, dongles, packers etc and disable all this junk)

Ollydbg work perfect in XP +sp2 i have the same SO.

Ricardo Narvaja


Can Someone Post a link For Hide Debugger that Actually works?

RCE Messageboard's Regroupment > General > Can Someone Post a link For Hide Debugger that Actually works?
dm47
09-23-2005, 07:45 PM
i've tried and tried to get hide debugger but it always says that im "unathorized to view this page". Can someone post a link that really works. Thanks.
xcracx
09-23-2005, 07:52 PM
click -Stuph-

on the upper menu that should get you into the plugins page
use -IsDebuggerPresent Hide-

that should work if the detection uses that function

xcracx
dm47
09-23-2005, 09:12 PM
thanks for the fast response..the reason im looking for hide debugger is because im trying to bypass a protection system..i have isdebugger present but im not sure what it does or how it works..
do u know if it will work for what im trying to do?
ne1 that knows any links please post them
thanks
Bob
09-24-2005, 01:12 AM
Stop posting the same message everywhere, it's fricking annoying.
If you have a question, ask once.

~BoB~
dm47
09-24-2005, 01:44 AM
thanks for the tip


Need website or link that will let me download HideDebugger

RCE Messageboard's Regroupment > Plugins > Need website or link that will let me download HideDebugger
dm47
09-23-2005, 09:15 PM
ive tryed tons of links and searched of google for this plugin but have had no luck? im trying to bypass a protection system but really dont know how..
if you have any info. on how to, or you have and website links please post them..i have isdebuggerpresent but im not sure what it does or how to use it
thanks
Ricardo Narvaja
09-23-2005, 09:30 PM
http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Plugins_Oll y/HideDebugger123f.zip
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Plugins_Olly/HideDebugger123f.zip
)

if you can´t enter go to the start page

http://www.ricnar456.dyndns.org

and register first

Ricardo Narvaja
dm47
09-24-2005, 02:32 AM
thanks a lot
g3nuin3
09-26-2005, 03:40 AM
Argh, doesnt work :( why!
Lord_Looser
09-26-2005, 09:25 AM
google with "HideDebugger123f" you will find this file:
http://wasm.ru/forum/files/_1278267755__HideDebugger123f.zip
Ricardo Narvaja
09-26-2005, 10:47 AM
this link works

http://www.ricnar456.dyndns.org

Ricardo Narvaja
Bob
09-26-2005, 01:04 PM
You have to register, g3nuin3 :)


Question.

RCE Messageboard's Regroupment > General > Question.
Dark Alchemist
09-24-2005, 05:58 AM
I have a simple little application written with MSVC 7.1 but the original author is now long gone.

So, I need to reverse engineer the thing so I can make my own version to continue the project.

The above is not normally a problem but this console application refuses to work in any disassembler I have tried (softice on XP SP1a I could not get to work). I can load it then hit f9 and the program will close out so it is not a fact of tracing it simply refuses in a disassembler.

Does MSVC 7.1 managed code do this or is there a disassembly detector in here hidden? What should have been 15 mins has turned into a fruitless all nighter as I am stumped.
xcracx
09-24-2005, 09:15 AM
im sick of saying that

CHECK For IsdeubbugerPresent Dectection
it could be a bug on the programming as well

or serveice detection check for those

xcracx
Dark Alchemist
09-24-2005, 06:34 PM
xcrack I already did.

Here is a funny but I just created a simple 15 line console app and it is doing the same thing.
xcracx
09-25-2005, 10:21 AM
and try to debug another applaction if it crashs

check the services and the active programs

if only your program crash then it most be a bug on the code

xcracx


How to set breakpoint on message?

RCE Messageboard's Regroupment > General > How to set breakpoint on message?
AntiPEer
09-24-2005, 08:17 AM
Please, How to set breakpoint on message?

Thanks~~~

I am waiting for you online~~
xcracx
09-24-2005, 09:18 AM
search for the messagebox call line and hit F2?!!?!@

that question is out line
google will soluve your problem..

read some tutorials before asking that simple questions

xcracx
Ricardo Narvaja
09-24-2005, 11:03 AM
do you ask for softice BMSG type breakpoints?

if this is the case go to view-windows look the window for put the message breakpoint and right click and select message breakpoint and you can select the type of message there.

Ricardo Narvaja
Dark Alchemist
09-24-2005, 06:39 PM
xcrackx if you are so tired of answering peoples questions (as you appear to be for whatever your reason might be) then how about you don't answer them and allow someone like Ricardo to give valuable info.

Some people are asses and others actually try and help.
sandy
09-24-2005, 09:02 PM
How can I set breakpoint on a message, for example, WM_PAINT? - Go to list of windows, select window of interest, right-click it and set message breakpoint. Notice that in expressions you can use symbolic names of the most important Windows constants, like WM_PAINT.
xcracx
09-25-2005, 10:43 AM
Dark Alchemist you know what!? FUCK YOU

stfu and don't talk shit because you don't know shit

and who the fuck are you think you are that make you judge me? and what i do??

all you gotta do is use the search/google..
facing noobs like you

xcracx
garryw
09-25-2005, 06:07 PM
I agree with Dark Alchemist, xcracx no forum needs people with your attitude.
arjuns
09-26-2005, 12:34 PM
To xcracx
this is not where you write nonsence, if you tired of even reading the question just ignore it. There is no one who knows everything from the begining.Be the man of honour so that everybody respect you , be the man like Ricardo.
xcracx
09-26-2005, 03:08 PM
alright... you don't want my help

if you havn't notice i answer for almost any question over here
and there is some people that apprituate that but you acting like noobs and say you don't answer or give valuable information which i do

actually i've been here for you not for myself. can't deal with some advices for not asking questions unless it isn't found in the search button no repeating..

HERE IS THE Honour FOR YOU great Ricardo deal it alone
(you are really intellegent man)
but i don't think i gonna stay here without being appreciate for my help

goodbye
xcracx
arjuns
09-27-2005, 12:51 PM
xcracx ! I'm really very sory . I didn't mean to hurt you.
..
j2innet
11-26-2005, 11:47 AM
hi xcracx, understand ur frustration. sometime is good to just ignore at the 1st place.
by the way, modern days, people dun like to get condemned. we are all learning, no end.. respect urself and respect others. u can tell ppl either to search in google or search within forum, but not "read some tutorials before asking that simple questions"

cheers!
clockwork305
12-07-2005, 05:01 PM
xcracx your posts have been really helpful to me in the past =)

and i agree, setting a bp is something you can find in the manual or in google. it doesn't require a forum post ~


how to view your memory breakpoints?

RCE Messageboard's Regroupment > General > how to view your memory breakpoints?
jaked
09-26-2005, 07:37 AM
hi.
i know alt+b is to show breakpoints.
but when i select a location in the mem dump and right click and set breakpoint on mem write, it breaks as it should, but i cant see it in the breakpoint window.
Ricardo Narvaja
09-26-2005, 10:24 AM
olly don´t show memory breakpoit at all, altough the title in your post is bad, olly only can manage one only memory brakpoint at time, if you out a second, the first is erased.-

Ricardo Narvaja
jaked
09-27-2005, 06:46 AM
k cheers mate.
hope they fix that in the future.

why is my post bad?
Ricardo Narvaja
09-27-2005, 09:40 AM
you post MEMORY BREAKPOINT (S) and there are 1 ONLY in this case is MEMORY BREAKPOINT without S jeje is a joke, sorry

Ricardo
jaked
09-27-2005, 11:56 AM
lol i see.

cheers mate!


How to change the Disasm Entry?

RCE Messageboard's Regroupment > General > How to change the Disasm Entry?
FirefoxXP
09-26-2005, 08:39 AM
My English is poor.But please help me.

I want to dubug a MFC program.

It's WinProc started at Address 400000.
But the ollydbg Disasmed from 410000.

How can change it?

thanks.
Ricardo Narvaja
09-26-2005, 10:52 AM
right clik GOTO EXPRESSION in the list and put 400000.

Ricardo Narvaja
oh me anon
09-26-2005, 11:12 AM
Firefox
winproc is at 400000 ?? are is the module loaded at 400000

if your module is loaded at 400000 then ollydbg disassembling at 401000
is probably right becuse a normal program starts only at
400000 + 1000 == 401000

if it is indeed 400000 how did you know that ?? what tools you used to find the winproc is at 400000

i dont think there is any debugger out there except may be ida which can
identify a winproc from a precompiled binary without manual intervention

if you really say that you identified winproc at 400000 can you
find what is the module base ??
view executable -->show memory and look at starting address it should show the address of pe header it should get you the module
base

also when you are there right click and do follow entry ??
and say where it jumps (what is the addresss is it 401000 ??)
FirefoxXP
09-27-2005, 10:22 AM
Just because the Address is used as a parameter.I think it is a call back.
FirefoxXP
09-27-2005, 10:23 AM
Thanks to everyone.


Breakpoint problem

RCE Messageboard's Regroupment > General > Breakpoint problem
Fuel
09-26-2005, 11:58 AM
Hi,

What i am trying to do is this:

i am developing an Eudora plugin in C++ but Eudora does not offer any function to get the currently selected email in the mail-folder window.

my plugin puts a button on Eudora toolbar, which (when pressed) needs to process the currently selected email;

in eudora, each email has an ID; i need to know what is the currently selected email ID;

for this, i was thinking to see how actually Eudora read the currently selected email;
i add to toolbar the standard Eudora button "Mark current message as unread"; now, the message which comes to the main Eudora window is a WM_COMMAND with wParam=0x0000805B (id of toolbar button)

the next step will be to see in the dissambly code how Eudora puts the message as 'unread' (and more specific how it gets the currently selected email) but its too hard for me;
what i did was to put the breakpoint to WM_COMMAND on the main window proc, but after this, when runnning, the OllyDbg finishes the eudora process (it says about writing memory failure)

can anyone give me some hints with this ?
one solution is to actually use FindWindow to locate the listbox window with the mails, and get the currently selected item (the mail id is kept, as i saw in a sample, as item data) but i feel like it must be a better option

thank you
oh me anon
09-26-2005, 12:45 PM
never used eudora but if it has an architecture that supposrts plugin
writing then have you tried asking around the user forums
if there is a neater way than mucking into disassembly of eudora ??
some times some features are neatly hidden in some apis of those plugin
that wont be visible to first time plugin writers

may be you could try searching around here if there exist a solution
://eudorabb.qualcomm.com/index.php

hope you get an easy answer instead of disassembling and poring over the whole app


will ollydbg ever be open source?

RCE Messageboard's Regroupment > Bugs > will ollydbg ever be open source?
jaked
09-27-2005, 07:02 AM
sorry for my question being in the bugs topic but there's no suggestions forum here.

anyway is this going to be planned for the future? or if the developer decides to give up on the project?

i ask mainly because i want to implement client/server remote debugging into it so i can debug full screen games, etc.
jayte
09-27-2005, 09:14 AM
i ask mainly because i want to implement client/server remote debugging into it so i can debug full screen games, etc.

I already suggested this, and Oleh's response was, "Maybe I'll implement this
feature in OllyDbg 2.0."

So... time will tell.

Jeff


armadillo

RCE Messageboard's Regroupment > General > armadillo
newbiew
09-27-2005, 10:00 AM
armadillo
newbiew
09-27-2005, 10:01 AM
unpacker armadillo 3.00a 3.61
newbiew
09-27-2005, 10:03 AM
how to unpack armadillo 3.00a 3.61?
help me unpack armadillo 3.00a 3.61, thank you.


how to get relocation address and size from packed dll ???

RCE Messageboard's Regroupment > General > how to get relocation address and size from packed dll ???
Jimbow
09-27-2005, 03:29 PM
i'm trying to unpack aspacked dll. I found Oep without difficulty then i dump it. I corrected IAT but now i only need to get relocation size and address to fix the dumped dll. How can i get these values ?

Thanks in advance..

Sorry for my bad english, i'm french ! =)
mr haggar
09-27-2005, 08:06 PM
From PE header. Open dll in olly and check PE header in memory map. For example:

100001A0 00900100 DD 00019000 ; Relocation Table address = 19000
100001A4 540B0000 DD 00000B54 ; Relocation Table size = B54 (2900.)

I don't remember did I ever unpacked dll, so good luck ;)
Jimbow
09-27-2005, 09:46 PM
Thx Mr haggar but it doesn't work. I'll try to explain my problem again :

I've aspacked a dll.

i load my aspacked dll in olly then break at oep, i check PE header in memory map :

10000198 543F0900 DD 00093F54 ; Relocation Table address = 93F54
1000019C 08000000 DD 00000008 ; Relocation Table size = 8

but i know than original dll reloc add and size are :
10000198 00F00800 DD 0008F000 ; Relocation Table address = 8F000
1000019C D4240000 DD 000024D4 ; Relocation Table size = 24D4 (9428.)

How can i find these original values while unpacking the dll ?
5aLIVE
09-30-2005, 10:20 AM
I'm also looking for some information on how to do this. Any help greatly appreciated.

5aLIVE


ODBG_Plugincmd problem

RCE Messageboard's Regroupment > Plugins > ODBG_Plugincmd problem
Robert
09-27-2005, 03:43 PM
Hi there. I need your help to create file from ODBG_Plugincmd callback. When I use CreateFile API from any other callback function (e.g. Plugininit) - everything works fine.

But when I trying to create file from ODBG_Plugincmd - something going wrong somewhere deep inside CreateFileA...

B.t.w. - it always returns "CREATE_SUCCESS" but file isn't actually created. Instead file named "C" (first letter from FileName parameter) is created inside OllyDbg install directory.

Thanks.
oh me anon
09-27-2005, 04:54 PM
you send your files name in char * cmd param ??
or is it independent of it ??
also do you have an identifier that your plugin recognises and acts on it
or you depend on the . (dot) (thats plugin commandline specifc identifier )
and trying to improve it by adding functions to it ??
i cant visualize why CreateFile should fail

can you post some specific parts of your code ??
i have recompiled commandline plugin source several times adding some specifice boring tasks to it and it didnt misbehave
for example loggin multiple data at one time to log window on specifc conditional breakpoint

int Expression()
origcode
addtolist(myspecific) <--
origcode

now if i pass all these commands to commandline plugin
.? [blah]
.? eip
.? [esp+4]
.? [String [esp+0x0c]
.run

olly would happily record all those on every supposed break

and i know ppl who have tweked this to
print UnicodeString PUNICODE_STRING structure
all three members of it
etc etc
Robert
09-27-2005, 05:41 PM
Thanks, oh me anon

1. I'm getting filename from t_module.path (after some modifications with extension of course).

2. Yes, of course I have my own identifier

3. Here is piece of code:

ODBG_Plugincmd proc C uses EBX reason:dword, reg:ptr t_reg, cmd:ptr char

...
mov EBX, reg
assume EBX: ptr t_reg

invoke Findmodule, \
[EBX].ip

mov ESI, EAX
assume ESI: ptr t_module

lea EDI, [ESI].path ; EDI-> name of debugged module
mov ECX, MAX_PATH
xor AL, AL
cld
repnz scasb

add ECX, 4
mov AL, '.'
std
repnz scasb
m2m dword ptr [EDI+2], '+gol' ; change extension

invoke CreateFileA, \
addr [ESI].path, \
GENERIC_WRITE, \
NULL, \
NULL, \
CREATE_ALWAYS, \
NULL, \
NULL

it returns CREATE_SUCCESS, but file "path\filename.log+" is not actually created. I'm sure, there is no error with "FileName" parameter, I've tried "addr fn", where fn is valid ASCIIZ string declared in data segment - e.g.

.data
fn db "C:\Program Files\DSTU\CTT\CTT.log+",0

- the same effect.
Robert
09-27-2005, 05:44 PM
And most important thing - all above constructions work fine from other callback functions (e.g. - ODBG_Pluginaction, ODBG_Plugininit)
Robert
09-27-2005, 06:17 PM
Ops... sorry. My fault. But it was really stupid mistake...

I've made little reversing of CreateFileA function and found something interesting - before calling CreateFileW inside CreateFileA (ya, CreateFileA is just a wrapper) it calls ntdll.RtlInitAnsiString. Inside this API it counts lenght of "FileName" parameter using... xor AL,AL rep scasb without cld :). As you can see - I don't clear D flag before calling (it sets after
...
mov AL, '.'
std
repnz scasb
...

in my source

Hmm... very interesting... Is it a "ntdll" bug or clearing "D" flag before calling API is documented feature?

p.s. mmm.... sorry again. plz remove topic into heap


Theory behind debugging process request -Armadillo

RCE Messageboard's Regroupment > OllyScript > Theory behind debugging process request -Armadillo
mr haggar
09-27-2005, 09:09 PM
Hi, I've been unpacking some armadillo targets and I have been quite sucsefull; standard and minimal protection I can deal without problems, code splicing is easy, import elimination is pain in the ass but I can handle it.

Then I followed MEPHISTO's tutorial for dealing with Debug Blocker feature. It's actualy easy to deattach processes and defeat this kind of protection. But I just learned way how to do it. I didn't learn what is going on there. Untill now, I found lot of tutorials that goes in detail "put bp here...put bp there" but none of them explains theory of two processes, debugging etc.

I would like to read some stuff about debugging and how applications do that, in order to understand this better. Can anyone provide me some good (but not too hard) reading material (links)? Or give me short description of Debug Blocker feature here?

Regards.
TresPasser
09-28-2005, 06:10 AM
Hi, mr haggar

From my experience with dillo, I found that the Debug Blocker feature works in the following manner:

1. First the father (first process) calls CreateProcess on the same file to start the son process
2. It then writes an infinite loop at the child's entry point (for now this is the same as the father's of course), initializes some things - I haven't studied what it does in this part, and restores the original bytes of the son process
3. At some point (probably during the last step) the father calls DebugActiveProcess API on the son process and lets the son run
4. Then, the father starts a loop of calling WaitForDebugEvent, handling events received from the son, and calling ContinueDebugEvent
5. The son process works autonomously until an exception occurs, and then the process is paused and control is passed to the father.
The father gets a DebugEvent record, checks to see if the event occurred (mostly exceptions) is expected, and usually just lets the son continue running

In order to detach the father from the son, we use the DebugActiveProcessStop API in order to be able to debug the son (only one debugger at a time can debug a process)

Now, mostly you can just detach the father from the son, and the son process will continue to run without the father. However, sometimes the code in the son process is encrypted in blocks of 1000h bytes and the memory containing this page is marked as a guarded page (using Virtual Protect). Then, when the son is trying to execute any code from these 1000h bytes, an exception occurs and the father decrypts the code for this memory page (1000h bytes). This technique is very similar to that of the operating system which marks memory pages as protected, and when the CPU is trying to access such a page, an exception occurs, the OS loads the correct page into the memory and execution continues.

Hope this answers your question.
Ricardo Narvaja
09-28-2005, 10:37 AM
read my tuts of how create a loader debugger, this loader debug the victim, and you put Bps, BPMs, and hardware bpx and catch with the loader and modify the victim in the same form armadillo father work.

Ricardo Narvaja
mr haggar
09-29-2005, 06:54 PM
TresPasser, thanks alot that clears some things and I'm gona read some papers in future. This is very interesting but it requires some knowledge about debugging which I don't have.

Going to check your tutorials Ricardo, but what the hell is with you site, I't says that site is removed for braking some rules. It seams that you have lot of problems with hosting your material.
Ricardo Narvaja
09-29-2005, 07:39 PM
yes always there are problems write and i can tell you the ftp or http server of my machine for look the tutorials.

Ricardo
mr haggar
09-29-2005, 08:13 PM
I will put this aside for now, I don't have much time for this now. Anyway, I found some spanish site whee there lot of your tutorials along with couple more guys.

Regards.


please Ricardo Narvaja i have problem with armadillo

RCE Messageboard's Regroupment > General > please Ricardo Narvaja i have problem with armadillo
ahmadmansoor
09-28-2005, 11:06 AM
i am new in cracking but i have read many tutorial about unpacking armadillo . but off all are not talking about the exe file packed with armadillo 3.7 and have password before the original prog boot .
i mean i have exe file packed with armadillo 3.7 when i try to run it , it request me user name and password then they sayed "this program need SN " then the original prog run .
so how i can pass this requested (username and password) to enter to the prog and unpack the original prog as in the tutorial i have read .
the file bigen with this code:
__________________________________________________ _______
00834000 > $ 60 PUSHAD
00834001 . E8 00000000 CALL Project1.00834006
00834006 $ 5D POP EBP
00834007 . 50 PUSH EAX
00834008 . 51 PUSH ECX
00834009 . EB 0F JMP SHORT Project1.0083401A
0083400B B9 DB B9
0083400C > EB 0F JMP SHORT Project1.0083401D
0083400E > B8 EB07B9EB MOV EAX,EBB907EB
00834013 . 0F90EB SETO BL ; Non-standard form of command
00834016 . 08FD OR CH,BH
00834018 . EB 0B JMP SHORT Project1.00834025
0083401A > F2: PREFIX REPNE: ; Superfluous prefix
0083401B .^ EB F5 JMP SHORT Project1.00834012
0083401D >^ EB F6 JMP SHORT Project1.00834015
0083401F F2 DB F2
00834020 EB DB EB
00834021 . 08FD OR CH,BH
00834023 >^ EB E9 JMP SHORT Project1.0083400E
00834025 > F3: PREFIX REP: ; Superfluous prefix
00834026 .^ EB E4 JMP SHORT Project1.0083400C
00834028 FC DB FC
00834029 E9 DB E9
0083402A 59 DB 59 ; CHAR 'Y'
0083402B 58 DB 58 ; CHAR 'X'
0083402C 50 DB 50 ; CHAR 'P'
0083402D 51 DB 51 ; CHAR 'Q'
0083402E EB DB EB
0083402F 0F DB 0F
00834030 B9 DB B9
00834031 EB DB EB
00834032 0F DB 0F
00834033 B8 DB B8
00834034 EB DB EB
__________________________________________________ ________

plaese help me
and many thanks for you

ahmad mansoor
eamsas@scs-net.org
Ricardo Narvaja
09-28-2005, 11:25 PM
this program not run and decryopts with the serial you enter is the same case of the rar file with password, only bruteforcing or if you found a valid key than make your program run you can use any tutorial in internet if not run, is not possible.
Is the same a program you don´t have the full program and is not complete, how you can reconstruct the missed code, in this case only certain bugs in cryptografics can make the program run with certain key, but this is only in olde versiions, in general if not run is impossible, or only bruteforcing or try keys in internet if you can make your program run, ypu can unpack and clean.

Ricardo


ASPack 2.12 OEP finder - cant find it

RCE Messageboard's Regroupment > OllyScript > ASPack 2.12 OEP finder - cant find it
ShadowBeast
09-29-2005, 09:57 AM
hello, i'm kinda new here and this is my first post:-)
can you please help me find the ASPack 2.12 OEP finder script?
i looked for it ib the forums, but parhaps i didn't look so well
the search function is not that great in this forum and i had trouble working with it.
i would really appriciate a link to this script

tnx in advanced, ShadowBeast
Ricardo Narvaja
09-29-2005, 02:45 PM
is very easy find the oep in aspack with olly in NT/2000/XP i think is not needed a script are three steps.

look the pushad in the EP step with F8

right click ESP-FOLLOW IN DUMP

in the dump window mark the fist byte and put HARDWARE BPX ON ACCESS.

RUN and when olly stop you are next to the popad prevvoius to the jmp to oep.

Hit f7 for execute the jmp and you land in the oep

Ricardo
Bob
09-30-2005, 03:45 AM
I just press page down 6 times, BP on PopAD ..

~BoB~
ShadowBeast
09-30-2005, 04:59 AM
yeah, but its win98 where i'm trying to crack

is the script gone?
because i would really like to have it...
hosiminh
09-30-2005, 06:58 AM
Aspack last steps

61 popad
75?? jnz some_address
b801000000 mov eax,1
c00c00 retn 0c
68 ??????00 push oep_address
c3 retn
mr haggar
09-30-2005, 08:22 AM
Hi, I have uploaded all scripts that were on ShAg's site to biw reversing

http://www.reversing.be/forum/viewtopic.php?t=173


help to improve the undocumented API info

RCE Messageboard's Regroupment > The Heap > help to improve the undocumented API info
Fuel
09-29-2005, 01:02 PM
Hi,

if you ever try to develop an Eudora plugin will see how difficult it is to get it running (depends of course what you want to do); the api they have is very poorly documented;
there is no forum available on plugin dev, just an unofficial mailing list;

on the mailing list, if you search it, you will see many questions regarding some undocumented API which Eudora is using for years but they didnt bother to change a pdf documentation which exist for 7 years now;
there are 4 API functions which Eudora.exe is calling from the 2 antispam plugins dlls (these plugins Qualcomm offer in Eudora paid version).

the 4 functions called from the plugins are:

ems_eudora_mode_notification
ems_idle
ems_score_junk
ems_user_mark_junk

the Eudora plugin idea is simple: there are some DLLs in the Eudora\Plugins\ folder which Eudora load and call the exported functions(callbacks).

the last 2 i think i know what are for (although i dont know the arguments), they seem to be called when user marks as junk or puts the email in the junk folder;

the interesting one i think is the ems_eudora_mode_notification (i have a feeling :))

i tried in OllyDbg to see the paramaters pushed when Eudora.exe is calling these functions but i am not that good in ASM, i am still learning;
here is the output before the call to the SpamHeaders.dll from Eudora.exe:

005401D1 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
005401D4 |. C745 E4 1C0000>MOV DWORD PTR SS:[EBP-1C],1C
005401DB |. 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
005401DE |. 33C0 XOR EAX,EAX
005401E0 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
005401E3 |. 66:8945 F8 MOV WORD PTR SS:[EBP-8],AX
005401E7 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
005401EA |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
005401ED |. 50 PUSH EAX
005401EE |. C745 E8 010000>MOV DWORD PTR SS:[EBP-18],1
005401F5 |. FF76 1C PUSH DWORD PTR DS:[ESI+1C]
005401F8 |. FF56 30 CALL DWORD PTR DS:[ESI+30] ; SpamHead.ems_eudora_mode_notification

when you install Eudora you will see that in the Plugins directory you have a DLL called Esp.dll;
nobody knows what is it for (Eudora works fine without it; i searched the Qualcomm forum and a supermoderator say its fine to remove that)

what is very very interesting is that the esp.dll seem to export all Eudora API available (it is all API because Eudora.exe loads by GetProcAddress the functions from plugin DLLs and you can easily see the name of the functions it tries to load)

the next functions are:

Anyone interested in helping with this ?
It would be a premiere to decode the info on that functions.
Give some hints.

10x
oh me anon
09-29-2005, 05:17 PM
well you could have posted a single thread
the code you have pasted above does nothing more than
setting the locals before calling the spam wahtever
like in the other thread you posted
this should be a subroutine and uses ebp as referance
[ebp+8] = first argument

what ever is greater than ebp = arguments
what ever is lesser than ebp = locals

to the function
so it simple means
EBP-1C = ox1c
ebp-18 = 1
ebp-14 == first arg
10,8 ,4 all are cleared to 0 (see eax is xorred with itself and moved to these places)
the 1c is pushed (must be some constant )

and this function is called
seems like some class c++ crap looking at the way it is calling
[esi+30]
vtable stuff
Fuel
09-29-2005, 07:22 PM
thanks alot.

i am c++ programmer and i dont know asm unfortunately :(

you were close with the assumptions; the first argument of the function is not the structure but a pointer to a 'global' object (as eudora api say) one which eudora pass back to plugin each time the callbacks are called (the global can be initialized in the ems_init )

the 2nd parameter is the structure.

now, i tried to change the 4th parameter to 2 as the asm code tell but it dont even it it works or not.

here is the story:

in my eudora plugin, i put 2 buttons on the toolbar; now when i hit a button, i want the currently selected email in the list to be moved in another folder;

moving mail to another folder can be done by using automation (eudora expose some interfaces you can call; it has interfaces for mail, folder like pMail->Move("JunkFolder" )
but the bad thing is that i dont know what mail is selected ; i can seach the email in all folders by enumerating them by automation objects, but i dont know what to look (i can compare each mail content, date, header params but its heavy )

now, there are some undocumented api in the esp.dll which, by the name they have, seem like notifications \ hooks to maiboxes

ems_mbox_context_folder
ems_mbox_context_hook
ems_mbox_context_info

i dont have any clue about them (and i dont think there are many people who do)
i guess with good asm knowledge you can tell when these callbacks are called from eudora.exe, because is possible that they are not what they seem to be.

anyone willing to spend 30 min looking at the eudora.exe (you can easily find where the function is kept, beacuse eudora.exe is getting the callback from DLL by GetProcAddress hence function name string is easy found in OllyDbg) ?

10x


... or some hints \ tips to find the paramaters meaning

RCE Messageboard's Regroupment > The Heap > ... or some hints \ tips to find the paramaters meaning
Fuel
09-29-2005, 02:36 PM
Hi,

can you please give me some advice\tips how to reverse engineer a function parameters ?

for example i can see clearly that the function inside the dll looks like this:

..
NOP
NOP
MOVE EAX, DWORD PTR SS:[ESP+8]
MOVE ECX, DWORD PTR DS:[EAX+8]
MOVE DWORD PTR DS:[1037040], ECX
MOVE DWORD PTR DS:[EAX+C],2
XOR EAX, EAX
RETN 8
..
..

10x
thanks
oh me anon
09-29-2005, 05:05 PM
move ?? you typed the disassembly by hand ??
esp == stack pointer
if the program entered this subroutine (assuming you pasted a subroutine
it would be the first argument that was passed to the function

for example
in masm style

proto MySomeFunction :dword :dword

invoke MySomeFunction, offset blah ,offset blah1

MySomeFunction uses ### first_arg:dword second_arg:dword
Code here

and if you had pasted this subroutines disassembly

then esp+8 will have the First_arg (blah)

now since it is dereferncing a pointer in the argument
then we can assume First_arg is some kind of structure

typedef mysomestruct {
int a;
int b;
int c;
int d;
fillers ;
}mysomestruct;
so it will be moving int c to ecx as well as that address [ 1037040]

and writes 2 back to the structure
and pops off two arguments off the stack in retn 8

some thing akin to

mysomestruct yahoo;
MySomeFunction(mysomestruct *yahoo,int dood)
int blah = 0;
blah = MysomeStruct.c;
mysomestruct->d = 2;
return False; (xor eax,eax makes eax =0 == False)


DLL unpacking tutorial

RCE Messageboard's Regroupment > General > DLL unpacking tutorial
Jimbow
09-29-2005, 05:33 PM
Hi !

I'm looking for dll unpacking tutorials, does anybody have some litterature about it ?

Thx
5aLIVE
09-30-2005, 10:18 AM
Hi I know of this one. No mention of fix the reloc table though.

http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1. php?file=Unpacking_And_Cracking_Armadillo_v4.x_DLL _by_MaDMAn_H3rCuL3s. rar (http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Unpacking_And_Cracking_Armadill o_v4.x_DLL_by_MaDMAn_H3rCuL3s.rar)
5aLIVE
09-30-2005, 10:23 AM
And this one too

http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1. php?file=Unpacking_and_Cracking_Protection_Plus_v4 .x_DLL_by_MaDMAn_H3r CuL3s.rar (http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Unpacking_and_Cracking_Protecti on_Plus_v4.x_DLL_by_MaDMAn_H3rCuL3s.rar)
Jimbow
09-30-2005, 06:28 PM
Thx !


Error: "No response from injected code"

RCE Messageboard's Regroupment > General > Error: "No response from injected code"
QvasiModo
09-29-2005, 10:59 PM
I'm experiencing a problem when stepping over some API calls, the following messagebox is shown:

No response from injected code

In order to perform action that is not supported by OS, OllyDbg has injected short piece of code into the debugged application, but received no response within 5 seconds. Do you want to wait for another 5 seconds? (If you answer No, the consistency and stability of program is not guaranteed and you should restart it as soon as possible).

Did anyone else have this problem? What could be the cause of it?

Thanks in advance :)
Ricardo Narvaja
09-29-2005, 11:11 PM
Decode SSE registers
If option is on, OllyDbg displays 128-bit SSE registers of actual thread in Registers pane of CPU window and decodes value of registers in the Information pane. Notice that this operation is slow and requires injection of small programs into the debugged application. Do not use this option unless absolutely necessary!

Quit this mark and in debugging options

Allow code injection to get address of WinProc
On NT-based systems, enables code injection to get address of window procedure. Code injection is time-consuming and internally unsafe, especially for multithreading applications

Quit this too and try

Ricardo
oh me anon
09-30-2005, 11:42 AM
there is a pretty long thread here by the name of code injections errors
you should be able to find it by searching the most active topics from the start if you require any further info on the phenomemon
apart from disabling the above two things that ricardo mentions

edit here is the link

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1& topic=158
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=158
)

as you can see if all the threads are sleeping suspended the QueueUserApc kinda fails it seems and doesnt send a reply to ollydbg back
hosiminh
10-01-2005, 06:12 PM
Disadvantage of "oh me anon" posted thread is that is to long and (boring) for Joe Average and very easy to not see answer to your question.

Hint: Search for SSE/SSE2 on above thread
QvasiModo
10-03-2005, 03:54 PM
The problem was indeed the "decode SSE registers" options. To be honest I hadn't searched the board for the solution... so my apologies for being so lazy. :(

Thanks! :)


CLBPlus! v1.0 plugin released

RCE Messageboard's Regroupment > Plugins > CLBPlus! v1.0 plugin released
Robert
10-01-2005, 10:37 AM
CLBPlus! plugin extends standart capabilities of conditional log breakpointing. It uses new feature of OllyDbg (implemented from version 1.10) which allows you to pass commands to plugins from "Set conditional log breakpoint window"

Features of version 1.0:
- Command "DUMP" implemented.

Plz, leave your suggestions for future implementations.

Direct link for downloading: http://www.brokensword.narod.ru/CLBPlus1.0.zip
Epsylon3
11-02-2005, 10:05 AM
direct link broken...
hosiminh
11-02-2005, 03:39 PM
Link work just fine , althought it is not direct link...
Epsylon3
11-02-2005, 03:51 PM
oh sorry, i have pbs with russian ;)


Couple Armadillo tutorials by me

RCE Messageboard's Regroupment > OllyScript > Couple Armadillo tutorials by me
mr haggar
10-01-2005, 07:09 PM
This is litle self-advertising :) I made couple tutorials about armadillo that describe how to find OEP, fix iat, code splicing, Import Elimination, and Debug Blocker will come soon. I tried to explain the best I could what armadillo does and how to work to fix it. I made them on the fly while unpacking and learning so they could be little different now. Targets are unpackmes (included). Anyway, here the are:

http://www.reversing.be/index.php?topic=tutorials

Good luck. Armadillo doesn't always have to be a nightmare ;)
klww2001
10-02-2005, 03:19 PM
hello mr haggar

i am a newbie, i tried to follow your tutorial till the page 1, i cannot find PUSH 22C.

i am not too sure about command bar on OutputDebugStringA API, it's is but a BP on kernel value OutputDebugStringA.

thanks for the help
mr haggar
10-02-2005, 07:04 PM
Hi

You mean that you tried to place bp "OutputDebugStringA API"? You should place it like this (without quotes) "bp OutputDebugStringA".

About PUSH 22C:
That code is kernel32.dll file/library. Since libraries can vary from Windows to windows, version to version, build to build, it is possible that your kernel32.dll is little different that somebody's else. That is not problem or issue, you just need to patch first opcode of that API with last one. And last one is probably some RETN or RETN x (x=some hex number).

This patching makes API to exit before it has done anything. So it's like that API is not used at all.

Btw, altough I tried to write tutorials simple as posible, Armadillo, not only armadillo but whole protectors family, is for totall beginners. So you should read some PE file structure info, practice on simple packers before going to this stuff.

Hope this helps.
mr haggar
10-02-2005, 07:05 PM
Shit

I mean this last is NOT for totall beginners


Windows Mobile ARM Disassembler

RCE Messageboard's Regroupment > The Heap > Windows Mobile ARM Disassembler
Naphos
10-02-2005, 08:26 AM
http://forum.xda-developers.com/viewtopic.php?t=23580&highlight=&sid=3 d314da23a089ffc3c014c94ead4ed2c (http://forum.xda-developers.com/viewtopic.php?t=23580&highlight=&sid=3d314da23a089ffc3c014c94ead4ed2c)

free, small, olly like


masm / message conditional breakpoints

RCE Messageboard's Regroupment > General > masm / message conditional breakpoints
decoded
10-05-2005, 05:08 AM
using ollydbg to debug this source code
masm32\icztutes\TUTE09\controls.asm
which is included with masm v8...

if i wanted to break on WndProc's WM_COMMAND for IDM_HELLO
or WM_COMMAND alone even. I would think i would open controls.exe with ollydbg, run the program. when it's running, click view/windows then right click and actualize. I would see "My First Button". That make's me happy because that is what i want to break on. So i would right click on it, then Message breakpoint on classproc. it brings up a window set breakpoing on winproc.. sweet, i know that this is WM_COMMAND so rather then break on the message Any Message i break on 111 WM_COMMAND. I would think any window would do but why not the actual window. i click ok, resume the program and click the button ... the breakpoint never hits... using the actual window or any window for the specific message that i selected, on this source or any source i code. i think i'm missing something, can anyone explain why this doesn't work ?
decoded
10-05-2005, 05:31 AM
i noticed people keep regurgitating the same info from ollydbg's help. from this regurgitation i can only seem to make a pink breakpoint that hits the classproc everytime it passes, but conditionally using the message breakpoint s as i mentioned above i never get a hit. i dont think most people who reply actually try to do what they say
decoded
10-05-2005, 05:57 AM
WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
.IF uMsg==WM_DESTROY
invoke PostQuitMessage,NULL
.ELSEIF uMsg==WM_CREATE
invoke CreateWindowEx,WS_EX_CLIENTEDGE, ADDR EditClassName,NULL,\
WS_CHILD or WS_VISIBLE or WS_BORDER or ES_LEFT or\
ES_AUTOHSCROLL,\
50,35,200,25,hWnd,EditID,hInstance,NULL
mov hwndEdit,eax
invoke SetFocus, hwndEdit
invoke CreateWindowEx,NULL, ADDR ButtonClassName,ADDR ButtonText,\
WS_CHILD or WS_VISIBLE or BS_DEFPUSHBUTTON,\
75,70,140,25,hWnd,ButtonID,hInstance,NULL
mov hwndButton,eax
.ELSEIF uMsg==WM_COMMAND
mov eax,wParam
.IF lParam==0
.IF ax==IDM_HELLO
invoke SetWindowText,hwndEdit,ADDR TestString
invoke SendMessage,hwndEdit,WM_KEYDOWN,VK_END,NULL
.ELSEIF ax==IDM_CLEAR
invoke SetWindowText,hwndEdit,NULL
.ELSEIF ax==IDM_GETTEXT
invoke GetWindowText,hwndEdit,ADDR buffer,512
invoke MessageBox,NULL,ADDR buffer,ADDR AppName,MB_OK
.ELSE
invoke DestroyWindow,hWnd
.ENDIF
.ELSE
.IF ax==ButtonID
shr eax,16
.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF
.ENDIF
.ENDIF
.ELSE
invoke DefWindowProc,hWnd,uMsg,wParam,lParam
ret
.ENDIF
decoded
10-05-2005, 06:03 AM
i can conditionally breakpoint using shift+f2 for the condition
msg==111
where 111 is WM_COMMAND on the translate message api call.
this works for this source code only on the menu items, not when the button is pressed, even still, when the button is pressed ..
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
is done.
this should still break and it doesn't, wtf?
oh me anon
10-05-2005, 06:26 AM
Breakpoints, item 0
Address=00401118
Module=CONTROLS
Active=Log
Disassembly=PUSH EBP

00401118 MSG == WM_COMMAND /. 55 PUSH EBP ; Decoded as <WinProc>

Log data
Address Message
00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 00000F08 ('My First Button',class='Button',wndproc=803C5E7E,parent=000 00F10)

00401118 CALL to Assumed WinProc
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = NULL

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 2.
hControl = NULL

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 2.
hControl = 00000F0C (class='Edit',wndproc=803C5FC8,parent=00000F10)

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL

00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000F10 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 4.
hControl = NULL
Process terminated, exit code
decoded
10-05-2005, 06:37 AM
using the conditional breakpoint on the translate message api call as
msg==WM_LBUTTONUP
worked well to break on the button.

what i dont understand is, why when i cbp as msg==WM_COMMAND the button doesn't break for two reasons. it's specified under
uMsg==WM_COMMAND

-----

.ELSEIF uMsg==WM_COMMAND
mov eax,wParam
.IF lParam==0
....
.ELSE
.IF ax==ButtonID
shr eax,16
.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF
.ENDIF
.ENDIF

it should have broke, one more thing

after the button was pressed, it sent a message WM_COMMAND,IDM_GETTEXT

00401246 |. 6A 00 PUSH 0 ; /lParam = 0
00401248 |. 6A 03 PUSH 3 ; |wParam = 3
0040124A |. 68 11010000 PUSH 111 ; |Message = WM_COMMAND
0040124F |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
00401252 |. E8 5F000000 CALL <JMP.&USER32.SendMessageA> ; \SendMessageA

it in code loops back, a conditional break point should be hit here as well
oh me anon
10-05-2005, 06:52 AM
00401118 MSG == WM_COMMAND && [esp+0xc] == 1 /. 55 PUSH EBP ; Decoded as <WinProc>

Windows, item 0
Handle=00000DBC
Title=Our First Window
Parent=Topmost
WinProc=00401118 CONTROLS.00401118 MSG == WM_COMMAND && [esp+0xc] == 1
ID=000009E0 (2528.)
Style=14CF0000 WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_CLI PSIBLINGS|WS_VISIBLE |WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
ExtStyle=00000300 WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE
Thread=Main
ClsProc=00401118 CONTROLS.00401118 MSG == WM_COMMAND && [esp+0xc] == 1
Class=SimpleWinClass

/CALL to Assumed WinProc from KERNEL32.BFF73638
|hWnd = 00000DBC ('Our First Window',class='SimpleWinClass',wndproc=00401118)
|Message = WM_COMMAND
|Notify = MENU/BN_CLICKED... ID = 1.
\hControl = 00000DB8 ('My First Button',class='Button',wndproc=803C5E7E,parent=000 00DBC)

three tries three breaks

Log data
Address Message
00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000DBC ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 00000DB8 ('My First Button',class='Button',wndproc=803C5E7E,parent=000 00DBC)
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000DBC ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 00000DB8 ('My First Button',class='Button',wndproc=803C5E7E,parent=000 00DBC)
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from KERNEL32.BFF73638
hWnd = 00000DBC ('Our First Window',class='SimpleWinClass',wndproc=00401118)
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 00000DB8 ('My First Button',class='Button',wndproc=803C5E7E,parent=000 00DBC)
00401118 Conditional breakpoint at CONTROLS.00401118
decoded
10-05-2005, 06:57 AM
i appreciate your post of your log dump "oh me anon", getting this information you posted was not a problem. having a breakpoint set already knowing what to break on was.

wm_lbuttonup is good to break on this button for this source code. what my problem is, is that using a cbp on msg==WM_COMMAND on the translate message api call for a known pass of this message doesn't work for a button that does send it ..

.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF

everything else in this code breaks appropiately for WM_COMMAND message, just not the button, is this because a message for WM_COMMAND is sent out of a .uMsg==WM_COMMAND ?? that would be the second place it should of hit, the first hit for the button anyways, should of been when it was pressed after WM_LBUTTONDOWN to get to WM_COMMAND for the
.IF ax==BN_CLICKED

from a non-software cracking point of view, but for a coding assembly point of view i see this problematic for my own code debugging. i'm showing code from iczelion, and have the problem, but in my own code this is becoming a larger problem.
decoded
10-05-2005, 07:06 AM
rather, the first hit for WM_COMMAND message should be hit when the button was pressed to get to .IF ax==BN_CLICKED inside uMsg==WM_COMMAND...

and the second hit would of been when i sent a message to WM_COMMAND just after .IF ax==BN_CLICKED

invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
..
yet neither hit
..
i can break differently to catch this message but from asm coding viewpoint and debugging viewpoint i dont see why these dont hit conditionally with a cbp set on translate message.
oh me anon
10-05-2005, 07:14 AM
? i really couldnt understand anything you posted right from the first post till the last post
i avoided commenting anything and just pasted the dump details hoping you could some how post a clear coherant question

a send message is meant to be sent to another hwnd in this case idm_whatever == 3
so if you need to break on the SendMessages message viz wm_command
combine it with wParam == 3 or [esp+0x0c] == 3

and if you click the button you will see it broke and if you single step
you will see it is getting the text

0040121E /CALL to GetWindowTextA from CONTROLS.00401219
00000FD4 |hWnd = 00000FD4 (class='Edit',wndproc=803C5FC8,parent=00000FD0)
00403074 |Buffer = CONTROLS.00403074
00000200 \Count = 200 (512.)
0063FBF0
BFF958F8 KERNEL32.BFF958F8
00000FD0
00000111 <---- wm_command
00000003 <----- id here
00000000
decoded
10-05-2005, 08:19 AM
you did this setting a conditional breakpoint on the api call to translate message ? with shift+f2
msg ==WM_COMMAND && [esp+0x0c] == 3
decoded
10-05-2005, 08:34 AM
without wparam, or lparam .. just a cbp with WM_COMMAND set as you described. will only break when the menu items are clicked for 0x01 0x02 0x03, not the button itself. with ollydbg v1.10 and with this source code . for this 'button' i couldn't break on wm_command, only wm_lbuttondown .. i dont see how you did it. though your source code also appears to be different, the offsets at least. from where did you download your source code ?
oh me anon
10-05-2005, 09:32 AM
wtf translatemessage you are harping about ??
you mean that translate message call in that message loop ?? @ 401101

anyway this is all the message that the winproc gets

if you really notice you can see two wm_commands one below another with two different ids and a hit on button before that
i am stopping replying to this thread unless it makes sense

00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000020 WM_SETCURSOR
00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000210 WM_PARENTNOTIFY
00401119 COND: 00000201 00000201
00401118 COND: msg to winproc = 00000021 WM_MOUSEACTIVATE
00401119 COND: 00000B98 00000B98 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
00401118 COND: msg to winproc = 00000020 WM_SETCURSOR
00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000008 WM_KILLFOCUS
00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000135 WM_CTLCOLORBTN
00401119 COND: 00000776 00000776
00401118 COND: msg to winproc = 00000135 WM_CTLCOLORBTN
00401119 COND: 00000776 00000776
00401118 COND: msg to winproc = 00000135 WM_CTLCOLORBTN
00401119 COND: 00000776 00000776
00401118 COND: msg to winproc = 00000111 WM_COMMAND
00401119 COND: 00000001 00000001
00401118 COND: msg to winproc = 00000111 WM_COMMAND
00401119 COND: 00000003 00000003
00401118 COND: msg to winproc = 00000086 WM_NCACTIVATE
00401119 COND: 00000000 NULL
00401118 COND: msg to winproc = 0000000D WM_GETTEXT
00401119 COND: 000000FF 000000FF
00401118 COND: msg to winproc = 00000006 WM_ACTIVATE
00401119 COND: 00000000 NULL
00401118 COND: msg to winproc = 00000135 WM_CTLCOLORBTN
00401119 COND: 00000776 00000776
00401118 COND: msg to winproc = 00000020 WM_SETCURSOR
00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000135 WM_CTLCOLORBTN
00401119 COND: 00000776 00000776
00401118 COND: msg to winproc = 00000020 WM_SETCURSOR
00401119 COND: 00000D1C 00000D1C ('My First Button',class='Button',wndproc=803C6062,parent=000 00B98)
00401118 COND: msg to winproc = 00000084 WM_NCHITTEST
00401119 COND: 00000000 NULL
00401118 COND: msg to winproc = 00000020 WM_SETCURSOR
00401119 COND: 00000B98 00000B98 ('Our First Window',class='SimpleWinClass',wndproc=00401118)
00401118 COND: msg to winproc = 00000200 WM_MOUSEMOVE
00401119 COND: 00000000 NULL
00401118 COND: msg to winproc = 0000001C WM_ACTIVATEAPP
00401119 COND: 00000000 NULL
decoded
10-05-2005, 05:34 PM
if anyone is not making sense, it is you, not answering a direct question
decoded
10-05-2005, 05:37 PM
what translate message api call do you think i mean ? of course the one in the api message loop and i'm not talkin gabout any of this jazz from your log dump.

if anything this alone,

00401118 COND: msg to winproc = 00000111 WM_COMMAND
00401119 COND: 00000001 00000001
00401118 COND: msg to winproc = 00000111 WM_COMMAND
00401119 COND: 00000003 00000003

how are you breaking here ? without it being from the menu items in controls.exe, but the button. is this confusing for you ? is WM_LBUTTONDOWN confusing for you ? is WM_COMMAND confusing for you ? is asm confusing for you ?
decoded
10-05-2005, 05:43 PM
i have no problems breaking on any of the other messages, like wm_paint, wm_resize, etc.... wm_command alone here, what i dont understand though is why i'm having to break on the api call with translate message rather then using the view/windows/actualize/message break on classproc which is a feature to ollydbg ... i figure it too looks for something like translate message to find this message. it's a good thing i'm not looking for user defined messages if base messages like wm_command is problematic
decoded
10-05-2005, 05:51 PM
maybe you are doing something i'm not doing, so rather then pasting dumps from your logs, why not explain how you are doing it? me? i'm using shift+f2
here
004010FC >|. E8 CD010000 |CALL <JMP.&USER32.TranslateMessage> ; \TranslateMessage

using

msg==WM_COMMAND

which is pretty simple.

and if you try it just like this, then press f9 to run the program, you'll notice this condition to break is never met when you click the "My first button", but only when you click the menu items, if this confuses you. damn. i'm sorry.
decoded
10-05-2005, 05:56 PM
since this isn't breaking on this condition, what i dont understand is why, the message for WM_COMMAND as the asm code shows, passes not once, but twice
oh me anon
10-05-2005, 06:07 PM
god damn bullshit you are talking i posted the info right in the first post
and you blind cant see through it or you dont understand shit

00401118 MSG == WM_COMMAND && [esp+0xc] == 1 /. 55 PUSH EBP ; Decoded as <WinProc>

how i break there ?? i break there either by setting a conditional break point like i pasted above

wtf 401118 means to you some gabazoom hell ??
it is the address of winproc or classproc

Breakpoints, item 0
Address=00401118
Module=CONTROLS
Active=Log "<WinProc>"
Disassembly=PUSH EBP

00401118 [ESP+8]==WM_COMMAND /. 55 PUSH EBP

Log data
Address Message
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 001C0346 ('My First Button',class='Button',parent=001402F8)
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 001C0346 ('My First Button',class='Button',parent=001402F8)
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL
00401118 Conditional breakpoint at CONTROLS.00401118

here is the detail of the windows again which i have pasted long long back
if you cant understand shit then dont whine about

write a debugger that works for you
or find one thats better than this
or if you can modify the behaviour by adding extra functionality
or write a plugin to achieve some excellent behaviour

Windows, item 0
Handle=001402F8
Title=Our First Window
Parent=Topmost
WinProc=00401118 CONTROLS.00401118 [ESP+8]==WM_COMMAND
ID=007703D1 (7799761.)
Style=14CF0000 WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_CLI PSIBLINGS|WS_VISIBLE |WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
ExtStyle=00000300 WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE
Thread=Main
ClsProc=00401118 CONTROLS.00401118 [ESP+8]==WM_COMMAND
Class=SimpleWinClass

well i know you cant and wont understand
i hate to have replied to the thread in first place

/ignore

edit the posts dont reply to yourself
why would you and should you break on some obscure TranslateMessage
inside the exe ?? if you want to break on Translate msg for some
reasons known only to you break on system dll

take a look below for the flow of messages

77E155C4 CALL to TranslateMessage from CONTROLS.00401101
pMsg = WM_LBUTTONDOWN hw = 1C0346 ("My First Button") Keys = MK_LBUTTON X = 78. Y = 7.
77E155C4 CALL to TranslateMessage from CONTROLS.00401101
pMsg = MSG(C0D5) wParam = 11 lParam = 1C0346
77E155C4 CALL to TranslateMessage from CONTROLS.00401101
pMsg = WM_LBUTTONUP hw = 1C0346 ("My First Button") Keys = 0 X = 78. Y = 7.
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 001C0346 ('My First Button',class='Button',parent=001402F8)
00401118 Conditional breakpoint at CONTROLS.00401118
00401118 CALL to Assumed WinProc from USER32.77E3A3CD
hWnd = 001402F8 ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL
00401118 Conditional breakpoint at CONTROLS.00401118
77E155C4 CALL to TranslateMessage from USER32.77E334E4
pMsg = MSG(C0D5) wParam = 1 lParam = 0
77E155C4 CALL to TranslateMessage from USER32.77E334E4
pMsg = MSG(C0D5) wParam = 11 lParam = 150304

here is the call stack when it broke on button click

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012FCE0 77E3A3D0 Maybe CONTROLS.00401118 USER32.77E3A3CD 0012FCFC
0012FCE4 001100C8 hWnd = 001100C8 ('Our First Window',class='SimpleWinClass')
0012FCE8 00000111 Message = WM_COMMAND
0012FCEC 00000003 age = Notify = MENU/BN_CLICKED... ID = 3.
0012FCF0 00000000 hControage = NULL
0012FD00 77E16381 USER32.77E3A3B8 USER32.77E1637C 0012FCFC
0012FD30 77E168C4 USER32.77E16063 USER32.77E168BF 0012FD2C
0012FD50 0040125C <JMP.&USER32.SendMessageA> CONTROLS.00401257 0012FD4C
0012FD54 001100C8 hWnd = 1100C8
0012FD58 00000111 Message = WM_COMMAND
0012FD5C 00000003 age = Notify = MENU/BN_CLICKED... ID = 3.
0012FD60 00000000 hControage = NULL
0012FD68 77E3A3D0 Maybe CONTROLS.00401118 USER32.77E3A3CD 0012FD64
0012FD6C 001100C8 hWnd = 001100C8 ('Our First Window',class='SimpleWinClass')
0012FD70 00000111 Message = WM_COMMAND
0012FD74 00000001 age = Notify = MENU/BN_CLICKED... ID = 1.
0012FD78 0015013E hControage = 0015013E ('My First Button',class='Button',parent=001100C8)
0012FD88 77E16381 USER32.77E3A3B8 USER32.77E1637C 0012FD84
0012FDB8 77E17361 USER32.77E16063 USER32.77E1735C 0012FDB4
0012FDD8 77E30963 USER32.SendMessageW USER32.77E3095E 0012FDD4
0012FDDC 001100C8 hWnd = 1100C8
0012FDE0 00000111 Message = WM_COMMAND
0012FDE4 00000001 age = Notify = MENU/BN_CLICKED... ID = 1.
0012FDE8 0015013E hControage = 0015013E ('My First Button',class='Button',parent=001100C8)
0012FDEC 77E2C150 USER32.77E3091F USER32.77E2C14B 0012FE74
0012FE04 77E28676 USER32.77E2C058 USER32.77E28671 0012FE74
0012FE78 77E2E078 USER32.77E27DB5 USER32.77E2E073 0012FE74
0012FE9C 77E3A3D0 Includes USER32.77E2E078 USER32.77E3A3CD 0012FE98
0012FEBC 77E14605 USER32.77E3A3B8 USER32.77E14600 0012FEB8
0012FF48 77E15B77 USER32.77E14321 USER32.77E15B72 0012FF44
0012FF54 0040110F <JMP.&USER32.DispatchMessageA> CONTROLS.0040110A 0012FFAC
0012FF58 0012FF60 pMsg = WM_LBUTTONUP hw = 15013E ("My First Button") Keys = 0 X = 62. Y = 9.
0012FFB0 0040102B CONTROLS.00401031 CONTROLS.<ModuleEntryPoint>+ 0012FFAC
0012FFB4 00400000 Arg1 = 00400000
0012FFB8 00000000 Arg2 = 00000000
0012FFBC 00132340 Arg3 = 00132340 ASCII ""C:\Documents and Settings\xyz\Desktop\completeolly\tut09\CONTROLS.E XE""
0012FFC0 0000000A Arg4 = 0000000A
0012FFC4 7C59893D Maybe CONTROLS.<ModuleEntryPoint> KERNEL32.7C59893A 0012FFF0
decoded
10-05-2005, 06:09 PM
also from this asm, you'll notice that

.ELSEIF ax==IDM_GETTEXT
invoke GetWindowText,hwndEdit,ADDR buffer,512
invoke MessageBox,NULL,ADDR buffer,ADDR AppName,MB_OK

clicking the menu item 3 breaks ...

but the button when pressed,

invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0

calls the same thing, IDM_GETTEXT, Menu item 3.. and doesn't break ...

purely as it was written.. i guess i too am confused
decoded
10-05-2005, 06:12 PM
you didn't say shit, except the same regurgitated bs, if you had tried what i said, you would have the same problem
decoded
10-05-2005, 06:15 PM
&& [esp+0xc] would be direct, specific for an argument passed along with WM_COMMAND, since WM_COMMAND alone isn't breaking, why make it more complex .. i would love to see it break on WM_COMMAND to begin with, before i attach a specific lparam to it. maybe someone else will see what i say and understand. thanx for your help anon which helped uhm, not me.
decoded
10-05-2005, 06:53 PM
well, i noticed your offsets were different so i tried to find the same code you had thinking maybe there was some code differentiation.

http://spiff.tripnet.se/~iczelion/files/tut09.zip

same, also same problem
decoded
10-05-2005, 06:58 PM
so, with the same code...

00401101 >|. E8 CE010000 |CALL <JMP.&USER32.TranslateMessage> ; \TranslateMessage

then press shift+f2,

a window pops up to add a condition,

msg==WM_COMMAND

i press f9 to run the program,

i click menu item 1, break
f9 to resume
i click menu item 2, break
f9 to resume
i click menu item 3, break
f9 to resume

i click the button, a messagebox appears, no break.

....................

i rewrote this code for example here,

.IF uMsg==WM_COMMAND
mov eax,wParam
.IF lParam==0
.IF ax==IDM_GETTEXT
invoke GetWindowText,hwndEdit,ADDR buffer,512
invoke MessageBox,NULL,ADDR buffer,ADDR AppName,MB_OK
.ELSE
invoke DestroyWindow,hWnd
.ENDIF
.ELSE
.IF ax==ButtonID
shr eax,16
.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF
.ENDIF
.ENDIF
.ENDIF

the button, also in WM_COMMAND .. would it not break?
if not, then surely when i send a message to WM_COMMAND

evil!
decoded
10-05-2005, 07:22 PM
ok, not using translate message api, though still confused over why WM_COMMAND didn't break cause the messae passed.

i switched to,

i pressed shift+f4 at the start of WndProc

assuming i know nothing about the button,

in the condition drop down i put

MSG == WM_COMMAND

for the explanation drop down i put

<WinProc>

for the expression drop down i put

MSG == WM_COMMAND

for the decode expression i selected

assumed by expression

for the pause program radio tabs i selected

never for pause program

for the log value of expression radio tabe i selected

on condition

for the log function arguments radio tab i selected

on condition

for the pass count, i selected

0.

i left if program pauses pass following arguements blank

then selected ok

my conditional pink break point was set now on

00401118 >/. 55 PUSH EBP

i pressed alt+L to bring up the log window

i pressed f9 to run the program

i clicked the "My first Button" and in the Log Window i see this..

00401118 COND: <WinProc>
00401118 CALL to Assumed WinProc from USER32.77D43A65
hWnd = 008C04FC ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 2.
hControl = 007004FA (class='Edit',parent=008C04FC)
00401118 COND: <WinProc>
00401118 CALL to Assumed WinProc from USER32.77D43A65
hWnd = 008C04FC ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 02FF04F8 ('My First Button',class='Button',parent=008C04FC)
00401118 COND: <WinProc>
00401118 CALL to Assumed WinProc from USER32.77D43A65
hWnd = 008C04FC ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 3.
hControl = NULL

what mattered to me was this though

00401118 CALL to Assumed WinProc from USER32.77D43A65
hWnd = 008C04FC ('Our First Window',class='SimpleWinClass')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 1.
hControl = 02FF04F8 ('My First Button',class='Button',parent=008C04FC)

i know that MENU/BN_CLICKED id = 1

this argument of one is 4*3, 12 or 0xC on the stack ...

[esp+0xC] == 1

i go back and modify my conditional breakpoint

i press shift+f4 on

00401118 >/. 55 PUSH EBP

on the condition drop down

i change it from
msg==WM_COMMAND
to
MSG == WM_COMMAND && [esp+0xc] == 1

also in the expression drop down
i change it from
msg==WM_COMMAND
to
MSG == WM_COMMAND && [esp+0xc] == 1

i change the pause program radio tab to

On condition

then press ok

i press f9 to resume the program

click the button, boom, condition is hit

looking back @ the log window

Log data, item 0
Address=00401118
Message=Conditional breakpoint at CONTROLS.00401118

was met ...

this worked for me,

obviously breaking on the api Translate Message will not always work as it should, because the problem i mentioned above is still valid .. anon did help me i suppose but not as clear as i needed, here .. i figured out my problem and maybe this will help others who dont truly understand ollydbg's non-documented areas
oh me anon
10-05-2005, 07:33 PM
i dont know whether to laugh or cry
why the fuck you want to break on some obscure TranslateMessage
do you understand how Translatemessage works ??

do you know all the internal code in user32.dll
do you know what message it sends (ever tried wm_user+ msgs)

what is the problem on breaking on winproc directly ??

if you are hell bent on breaking on TranslateMessage only why dont you break on system dll and log all the messages it recieves

if you had done that you would have surely seen the msg cod5 that is sent after WM_LBUTTONUP

or if you had looked a little in my dumps or een the call stack in my latest post you could have surely seen that DispatchMessage SendMessage
and Break on winproc with just WM_COMMAND

windows-->messagebreakpoint on WNDPROC 111 (WM_COMMAND)
will set the break on wndproc only which happens to be at
401118

please pay a little attention and read the posts
dont litter the board with repetative question like a little child
crying for a specific chocolate on a store
decoded
10-05-2005, 07:36 PM
i know how translate message api works,

if i didn't, i wouldn't of had it breaking on the menu items, reading the asm you would see that a message for WM_COMMAND was sent back from when the button was BN_CLICKED .. yet it didn't hit, though if you explained things where people could understand rather then pasting stuff from your current knowledge maybe i would have. either way, you made me explore, thank you.
decoded
10-05-2005, 07:48 PM
if you noticed, i did say something about WM_LBUTTONDOWN earlier ...

i was wanting to break on translate message for a message that does pass, and doesn't hit.. it passes twice, and doesn't hit. i still see it as a problem with ollydbg, there is this to overlook it, but why will i trust to break on apis with ollydbg. that is my oppinion
decoded
10-05-2005, 08:08 PM
forgive me, but i'm going to debug the debugger to prove my point. thank you
oh me anon
10-05-2005, 08:10 PM
you see WM_COMMAND passing through TranslateMessage where did you see it the TranslateMessage neer Recieves a WM_COMMAND

if you cant trust to break dont trust ollydbg didnt force you to trust
roll your own

the only messages the TranslateMessage reciees are like this

Log data
Address Message
00401101 COND: 0012FF60 WM_PAINT hw = 19022E ("Our First Window")
00401101 COND: 0012FF60 MSG(C0D5) wParam = 11 lParam = 19022E
00401101 COND: 0012FF60 MSG(C0D5) wParam = 0 lParam = 0
00401101 COND: 0012FF60 WM_PAINT hw = 2A01A2 (class="Edit")
00401101 COND: 0012FF60 WM_PAINT hw = 1D0236 ("My First Button")
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 19022E ("Our First Window") Keys = 0 X = 165. Y = 146.
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 19022E ("Our First Window") Keys = 0 X = 251. Y = 40.
00401101 COND: 0012FF60 WM_NCMOUSEMOVE hw = 2A01A2 (class="Edit") Hittest = HTBORDER X = 386. Y = 217.
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 2A01A2 (class="Edit") Keys = 0 X = 192. Y = 5.
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 1D0236 ("My First Button") Keys = 0 X = 88. Y = 7.
00401101 COND: 0012FF60 WM_LBUTTONDOWN hw = 1D0236 ("My First Button") Keys = MK_LBUTTON X = 88. Y = 7.
00401101 COND: 0012FF60 MSG(C0D5) wParam = 11 lParam = 1D0236
00401101 COND: 0012FF60 WM_LBUTTONUP hw = 1D0236 ("My First Button") Keys = 0 X = 88. Y = 7.
00401101 COND: 0012FF60 MSG(C0D5) wParam = 11 lParam = 31021C
00401101 COND: 0012FF60 WM_NCMOUSEMOVE hw = 19022E ("Our First Window") Hittest = HTBOTTOMRIGHT X = 415. Y = 328.
00401101 COND: 0012FF60 WM_PAINT hw = 19022E ("Our First Window")
00401101 COND: 0012FF60 WM_PAINT hw = 1D0236 ("My First Button")
00401101 COND: 0012FF60 WM_NCMOUSEMOVE hw = 19022E ("Our First Window") Hittest = HTBOTTOMRIGHT X = 412. Y = 328.
00401101 COND: 0012FF60 WM_NCMOUSEMOVE hw = 19022E ("Our First Window") Hittest = HTBORDER X = 401. Y = 327.
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 19022E ("Our First Window") Keys = 0 X = 247. Y = 148.
00401101 COND: 0012FF60 WM_NCMOUSEMOVE hw = 19022E ("Our First Window") Hittest = HTMENU X = 155. Y = 160.
00401101 COND: 0012FF60 WM_NCLBUTTONDOWN hw = 19022E ("Our First Window") Hittest = HTMENU X = 155. Y = 160.
00401101 COND: 0012FF60 WM_COMMAND hw = 19022E ("Our First Window") Notify = MENU/BN_CLICKED... ID = 1. hControl = NULL
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 19022E ("Our First Window") Keys = 0 X = 40. Y = 12.
00401101 COND: 0012FF60 WM_PAINT hw = 19022E ("Our First Window")
00401101 COND: 0012FF60 WM_PAINT hw = 2A01A2 (class="Edit")
00401101 COND: 0012FF60 WM_PAINT hw = 1D0236 ("My First Button")
00401101 COND: 0012FF60 WM_MOUSEMOVE hw = 19022E ("Our First Window") Keys = 0 X = 42. Y = 11.
00401101 COND: 0012FF60 WM_LBUTTONDOWN hw = 1D0236 ("My First Button") Keys = MK_LBUTTON X = 83. Y = 12.
00401101 COND: 0012FF60 MSG(C0D5) wParam = 11 lParam = 1D0236
00401101 COND: 0012FF60 WM_LBUTTONUP hw = 1D0236 ("My First Button") Keys = 0 X = 83. Y = 12.
decoded
10-05-2005, 08:13 PM
WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
.IF uMsg==WM_DESTROY
invoke PostQuitMessage,NULL
.ELSEIF uMsg==WM_CREATE
invoke CreateWindowEx,WS_EX_CLIENTEDGE, ADDR EditClassName,NULL,\
WS_CHILD or WS_VISIBLE or WS_BORDER or ES_LEFT or\
ES_AUTOHSCROLL,\
50,35,200,25,hWnd,EditID,hInstance,NULL
mov hwndEdit,eax
invoke SetFocus, hwndEdit
invoke CreateWindowEx,NULL, ADDR ButtonClassName,ADDR ButtonText,\
WS_CHILD or WS_VISIBLE or BS_DEFPUSHBUTTON,\
75,70,140,25,hWnd,ButtonID,hInstance,NULL
mov hwndButton,eax
.IF uMsg==WM_COMMAND
mov eax,wParam
.IF lParam==0
.IF ax==IDM_GETTEXT
invoke GetWindowText,hwndEdit,ADDR buffer,512
invoke MessageBox,NULL,ADDR buffer,ADDR AppName,MB_OK
.ELSE
invoke DestroyWindow,hWnd
.ENDIF
.ELSE
.IF ax==ButtonID
shr eax,16
.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF
.ENDIF
.ENDIF
.ENDIF
invoke DefWindowProc,hWnd,uMsg,wParam,lParam
ret
.ENDIF
xor eax,eax
ret
WndProc endp
decoded
10-05-2005, 08:14 PM
ty, actually you're right
decoded
10-05-2005, 08:33 PM
i recant what i said based on not fully understanding sendmessage/translate message ..

.IF ax==ButtonID
shr eax,16
.IF ax==BN_CLICKED
invoke SendMessage,hWnd,WM_COMMAND,IDM_GETTEXT,0
.ENDIF
.ENDIF

after breaking here, and setting a breakpoint on translatemessage, translate message was never hit. ollydbg functioned as it was suppose to, and it's a wonderful product. best advice i can give to people is do not try and do what i did, make use of log breakpoints. ollydbg is a wonderful product and for application developers it kicks a$$, i get dissed on for not using stuff like softice. for coding in asm, i prefer this product.


How ollydbg enumerates process in attach viewer?

RCE Messageboard's Regroupment > General > How ollydbg enumerates process in attach viewer?
suddenLy
10-06-2005, 03:53 AM
Hi guys,

I am trying with some target.

I can view the process in task manager,

and get the PID by using EnumProcess func in PSAPI.DLL.

But when I try to attach the target,

Ollydbg's attach viewer doesn't show the target process.

So I wonder how this situation happens.

Any ideas?
Lord_Looser
10-06-2005, 07:43 AM
Make OllyDbg just-in-time debugger (OllyDbg menu - Options).
Now you can select debug target direcly within task manager's process view (task manager - processes - mouse right click on target).
If OllyDbg appears and cannot debug target, perhaps process is created suspended for example.
oh me anon
10-06-2005, 04:17 PM
well if you can find the pid
open cmd.exe navigate to the ollydbg directory
and then
type ollydbg -p pid to make ollydbg attach to that process by pid

|hOwner = 002901DE ('OllyDbg',class='OLLYDBG')
|Text = "OllyDbg is unable to attach to process 0000007B as a "just-in-time" debugger."
|Title = "Error"
\Style = MB_OK|MB_ICONHAND|MB_TASKMODAL

well tip courtesy wtbw
suddenLy
10-09-2005, 10:23 AM
yep it works!

thanx a lot Lord_Looser and oh me anon.


How to save/load (=move) pe sections relative?

RCE Messageboard's Regroupment > The Heap > How to save/load (=move) pe sections relative?
Lord_Looser
10-07-2005, 10:19 AM
Problem: I want to move a given PE section from one address region to an other.
If I save a PE section in OllyDbg all relative jumps are wrong which pointed inside/outside the moved PE section. Inside jumps are correct.
Till now I have to extend previous section (change virtual size) in order to map new section into old address space.
In most cases it means a huge waste of memory. I want to map a given code section direcly at the end of the programm code.

Question: How to correct relative jumps automatically? All jump destinations that pointed from inside/outside to outside/inside the section only have to add with a constant number.


REQ: olly 32 plugin problem help

RCE Messageboard's Regroupment > General > REQ: olly 32 plugin problem help
nick_name
10-07-2005, 02:55 PM
guys, my olly is crashing on loading 32 plugins together
is there anyway to avoid that , any patch available there ??

thank you.
oh me anon
10-07-2005, 04:01 PM
well by default ollydbg only can load a maximum of 32 plugins
actually having a lot of plugins that you scarcely use is detrimental
to performance

but i recently saw a post in exetools that has some fixes to this bottle neck
dont know if it works or not and the poster didnt put a link to follow
and uploaded his stuff there so its of little use if you are not a memeber
Ricardo Narvaja
10-08-2005, 10:42 AM
do you use 32 plugins? i use 6 plugins and is so much, there are some plugins you use one time in your life, put other olly in other folder with this rares plugins,a nd let the necesary plugins only.

Command bar
Hidebugger
ollydmp
ollyscript
puntos magicos
windowsinfo

is rare i use more of this, if i need i put in this moment, don´t forget more plugins more problems of conflicts and errors.

Ricardo Narvaja
ciccio
10-09-2005, 01:00 AM
Ricardo Narvaja
hi m8 i'm a noob just registered...
can u help me?...i wanna only to learn some basics about using this
type of software
Ricardo Narvaja
10-09-2005, 06:08 PM
Well read tutorials there are hundreds of good ollydbg tutorials, with this you learn

Ricardo
nick_name
10-11-2005, 01:00 PM
thanks OH ANON ME, thanks RICARDO NARVAJA for ur kind perusal.

iv'e never used PUNTOS MAGICOS plugin. could u guys please tell me what this is used for 'n if possible gimme a link. i've already made a search in google 'n could find any valid link.

thank you.


Source code disassembler

RCE Messageboard's Regroupment > General > Source code disassembler
SPA
10-09-2005, 08:47 AM
Forgive, I badly speak on english.
Where to me to take source code ollydbg(disassembler).
oh me anon
10-09-2005, 01:51 PM
ollydbg is not open source as yet (atleast not the latest version which is 1.10)

but if you are satisfied with an old version of source (version 1.04)

you may take a look at

http://ollydbg.de/srcdescr.htm
SPA
10-09-2005, 04:30 PM
Thanks, I did not know that the site has moved


Why is this program crashing ?

RCE Messageboard's Regroupment > The Heap > Why is this program crashing ?
Subhobroto Sinha
10-09-2005, 10:49 AM
Hello

I have written a little snippet which :

1. adds a new section to any PE, filling it with only two bytes - 0xEBFE; which is basically a self loop.
2. Replaces the AddressOfEntrypoint to point to this instruction
3. Fill up the whole of the section which previously held the entrypoint with 0xFF

As a result, you will expect ANY PE after "infection" from this snippet will keep on looping (because execution starts in the new section which just has a self loop).
This is really what has happened with 99% of the files I tested my snippet on, but there is one file which plain crashes.

This is an ebook produced by Nata eBook compiler and packed using UPX. I have tested other UPX packed files and they DO NOT crash.

Is seems that the crash is happenning inside NTDLL, and not even inside the program at all. Infact, I feel that it's Windows failing to load the PE and the ebook does not get to execute at all !

And the preliminary debugging I did using Olly and WindBag shows that NTDLL is trying to read from an address which is the value stored at the DWORD beginning from file offset 0x399e0, which is inside section UPX1 !

The ebook which crashes is available at :

http://www.geocities.com/subhobrotosinha/example.zip

The compiled snipet is available at :

http://www.geocities.com/subhobrotosinha/crapper.zip

You first need to patch the ebook using "crapper" by opening a cmd window and typing "crapper example.exe"

Then run the ebook and see Windows give an access violation message.

Any suggestions/comments regarding this scenario ?

PS : Please tryout "crapper" on your other PE EXEs too, and see if it works fine ! Feedback badly wanted !

Regards

Subhobroto Sinha
http://www.geocities.com/subhobrotosinha


Olly_Sync Pluggin Combo iDA_Sync Plugin

RCE Messageboard's Regroupment > Plugins > Olly_Sync Pluggin Combo iDA_Sync Plugin
ShadowDark
10-10-2005, 10:05 PM
here I copy the links:

https://www.openrce.org/downloads/download_file/2 (iDA Sync)

https://www.openrce.org/downloads/download_file/169 (Olly Sync)

you should also discharge the plugin for iDA script:

http://www.python.org/ftp/python/2.4/python-2.4.msi (for processors of 32 Bit)

http://www.python.org/ftp/python/2.4.2/python-2.4.2.ia64.msi (for processors of 64 Bit)

and also the plugin to execute scripts with python...

http://www.d-dome.net/files/idapython/0.7.0/IDAPython-0.7.0_IDA4.8-wi n 32.zip
(http://www.d-dome.net/files/idapython/0.7.0/IDAPython-0.7.0_IDA4. 8-win32.zip
)

exclusively for v4.8.

it synchronizes in realtime to OllyDBG and iDA.

Enjoy it!!

----------
SPANiSH
----------
aquÃ* copio los links:

https://www.openrce.org/downloads/download_file/2 (iDA Sync)

https://www.openrce.org/downloads/download_file/169 (Olly Sync)

debÃ©is descargar tambiÃ©n el plugin para script de iDA:

http://www.python.org/ftp/python/2.4/python-2.4.msi (para procesadores de 32 Bit)

http://www.python.org/ftp/python/2.4.2/python-2.4.2.ia64.msi (para procesadores de 64 Bit)

y tambiÃ©n el plugin para ejecutar scripts con python...

http://www.d-dome.net/files/idapython/0.7.0/IDAPython-0.7.0_IDA4.8-wi n 32.zip
(http://www.d-dome.net/files/idapython/0.7.0/IDAPython-0.7.0_IDA4. 8-win32.zip
)

exclusivamente para la v4.8.

sincroniza en tiempo real a OllyDBG e iDA.

Disfrutadlo!!


bpm on execute access

RCE Messageboard's Regroupment > OllyScript > bpm on execute access
jbe
10-11-2005, 09:03 AM
Hi

I am trying to stop my script at the oep

After some exceptions I toogle a bmp with

bprm cbase, csize

but the packer section read code memory before execute the oep instruction

Can I set access to execute and toogle a bpm on access to stop the script when it executes and not reads the code section?

Where can I found a good manual or help about script commands, programation ?

Thanks in advance

Josu
Ricardo Narvaja
10-11-2005, 11:00 AM
in olly is not possible put BPM on EXECUTE without READ, or WRITE, but i make a olly patched for this case, put this olly in the same folder your and use for this cases, in this olly if you put a BPM on ACCESS don´t stop in read or write, only execute (are modified for this task for put old BPM on ACCESS use your old ollydbg)
is a little slow but if the program don´t stop in exceptions (you add in debugging exceptions for don´t stop) and you put a bpm on access and RUN this olly stop in the first line executed.

http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/OLLY%20PARC HEADO%20PARA%20BUSCAR%20OEPs.rar
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/OLLY%20PARCHEADO%20PARA%20BUSCAR%20OEPs.rar
)

take a little time take a cofeee and let the program reach the oep

Ricardo
jbe
10-11-2005, 11:54 AM
Thanks

It works fine :)

The packer jmps to the OEP without stops.

I have found about 50 bytes of stolen bytes, so I need to stop before to check the POPADs and to filter the instructions stolen by the packer.

Thanks for the pached olly

Josu


how do i do this in olly?

RCE Messageboard's Regroupment > General > how do i do this in olly?
jaked
10-11-2005, 09:35 AM
hi.
just say i have a bunch of code like so:

#1: mov edx,dword ptr[65525]
#2: push edx
#3: call 407714
#4: mov dword ptr[65525],eax
#5: ret

if the call at line #3 returns value 1 into eax and i want it to return value 0 into eax everytime how do i do this?

note i can do this by breakpoint at #4 and changing eax to 0 manually in olly, but this call it called like 60 times a second, so can olly automaticly change eax to 0 between lines #3 and #4 for me?
Ricardo Narvaja
10-11-2005, 11:06 AM
put in tis line of the call, right click FOLLOW and enter in the call, and all a inject before the RET of INC EAX.

Ricardo
oh me anon
10-11-2005, 01:46 PM
yes you can automatically change eax to 0 every time if that is what you prefer
use conditional breakpoint

select line 3
dont enter any thing on condition or expression box
choose pause always radio button
in the pause these commands to plugin box

type
.set eax = 0 (dot set eax = 0)
.run (dot run)

hit ok

now when ever this break is hit the commandline plugin will trap the break set eax == 0 and issue a run command


disable suspicious breakpoint messagebox

RCE Messageboard's Regroupment > OllyScript > disable suspicious breakpoint messagebox
jbe
10-11-2005, 02:15 PM
Hi

How Can I disable "suspicious breakpoint" messagebox?

They stop my script executions until confirmation is pressed.

Thanks in advance
oh me anon
10-11-2005, 02:42 PM
jbe i dont think you really want an answer to that question

dont you read what it says :) or cant you read ???
are you operating ollydbg with a sack covering your face and blindly clicking confirmatin

??

you dont see the note in the message box ??
cant read it ??
or you dont understand english
which say
note: you can permanently disable this warning in options security

or you cand find the options menu ??

if you can find it you cant find security menu ??

you dont see a check box saying
warn when break point is outside code section ??

the question is absolutely lame


Where to find all plugins?

RCE Messageboard's Regroupment > Plugins > Where to find all plugins?
firedance
10-12-2005, 03:46 PM
So, where can I find all useful plugins?
And, what plugins do you find useful.
oh me anon
10-12-2005, 05:47 PM
look at stuph link in top of this forum or search google for ollydbg plugins

basically only one plugin viz commandline that comes along by default is more than enough for many many situation

but if you are deeep into some unpacking ollydump should be a good addition

apart from that all others are just addons that you would need once in your life time on some odd situations :)

but grab them all and keep it stashed so you dont have to loook far ahead when in need :)


[Plugin] Polymorphic Breakpoint

RCE Messageboard's Regroupment > Plugins > [Plugin] Polymorphic Breakpoint
Mattwood
10-12-2005, 05:19 PM
Hi,

I just released a new plugin for set special breakpoint.

http://reverseengineering.online.fr/spip/article.php3?id_article=50 (Source are included)

Cheers.

Mattwood^FRET
oh me anon
10-12-2005, 05:43 PM
nice to see it here :)
Ricardo Narvaja
10-12-2005, 06:44 PM
i try but don´t work for me, i don´t know if i use well, but i try with any polimorphic bp, put run, stop in a ACCESS VIOLATION , but when i pres shift +f9 for skip the exception and continue the program generate a error and crash.

A little explanation of the method of use i think is necesary

Ricardo Narvaja
Ricardo Narvaja
10-12-2005, 06:47 PM
i try but don´t work for me, i don´t know if i use well, but i try with any polimorphic bp, put run, stop in a ACCESS VIOLATION , but when i pres shift +f9 for skip the exception and continue the program generate a error and crash.

A little explanation of the method of use i think is necesary

Ricardo Narvaja
Mattwood
10-12-2005, 06:58 PM
lol ricardo of course, look:

With the first version of breakpoint we have :
CALL unpatche.01006381
FSUB ST(5),ST
XOR DWORD PTR SS:[ESP],1337 ; <= EXCEPTION
JMP NEAR DWORD PTR SS:[ESP] ; kernel32.7C816D4F

Here the program crash because you need special caracteristic as WRITABLE

So i created a second version of breakpoint
The Stack Polymorphic breakpoint

CALL unpatche.01006398
PUSH 0FE21
XOR BYTE PTR SS:[ESP],0CA
JMP NEAR ESP

The stack is writable and executable so i use it, it 's a better way.

Mattwood^FRET
Ricardo Narvaja
10-12-2005, 07:56 PM
yes i see, when loop, pause, press minus to return to the bp adress, new origin here, quit bp and RUN.

With this sequence pause and you can continue.

Ricardo
Mattwood
10-12-2005, 08:08 PM
Yes for remove a breakpoint you need to pause ollydbg. And after go to the Polymorphic breakpoint manager

;)

Mattwood^FRET
odshell
10-19-2005, 01:55 AM
To Mattwood:

From your readme.txt:
[i]
The way of the plugin is to set a polymorphic EBFE likes :

00DE321C . E8 02000000 CALL 0x90f.00DE3223
00DE3221 . DCED FSUB ST(5),ST
00DE3223 $ 813424 371300>XOR DWORD PTR SS:[ESP],1337
00DE322A .- FF2424 JMP NEAR DWORD PTR SS:[ESP]

Here the routine decrypt DCED with 1337 and the word at [00DE3221] = EBFE, but this way need to special right : the section must be writable.
/[i]

Did you test it?Your code is wrong.
[ESP]=00DE3221,
[[ESP]]=[00DE3221]=EDDC
So "XOR DWORD PTR SS:[ESP],1337" is what meaning?Doesn't worked.
Mattwood
10-21-2005, 11:46 AM
OMFG Thanks you odshell :)

I corrected it :)

You can download the news version at http://reverseengineering.online.fr/spip/article.php3?id_article=50


Hi, rookie say hi to everyone, and have a question～

RCE Messageboard's Regroupment > General > Hi, rookie say hi to everyone, and have a question～
estena_yuan
10-13-2005, 02:40 AM
hello,everyone, i am a chinese student and interested in cracking and ollydbg,pardon for my poor english～and the following naive question..

i'm rookie and i want to use ollydbg as default debugger when programme
occured error or exception it can atomatical popup, take the place of VC.

i know SoftIce can do this by set"faults on" .Can Ollydbg atomatical catch the exception?

thank u very much～
Lord_Looser
10-13-2005, 09:10 AM
options - just-in-time debugging - make ollydbg just-in-time debugger


Some problems rebuilding a DLL.

RCE Messageboard's Regroupment > General > Some problems rebuilding a DLL.
LordLinux
10-13-2005, 04:42 PM
Im Unpacking a DLL who is protected with Armadillo.

My First problem is: when i unpack with the aVaTaR script the DLL and Dump with LordPE the size of the file is 70MB and the original is 836kb. I load with ImpREC for fix errors, but im doing domething worn, can any gime a "manito" :))

Thanx in advance


isdebuggerpresent

RCE Messageboard's Regroupment > General > isdebuggerpresent
Systikk
10-14-2005, 03:28 PM
Can anybody help or explain what needs to be done to Find and Disable isdebuggerpresent?
oh me anon
10-14-2005, 04:55 PM
you mean you want to do it manually without using the plugins that are availble for it
click in cpu window and hit ctrl+g type IsDebuggerPresnt (case sensitive)
and hit enter you will land in kernel32.dll api code
change the code to always return 0

or usingcommandline plugin type
set [byte ptr fs:[0x30]+0x02] == 0

or easy and simple way is to find the isdebuggerpresnt plugin by sv (look at stuph link in top) and tell it to hide


its a stupid question but..

RCE Messageboard's Regroupment > General > its a stupid question but..
THEcB
10-15-2005, 09:42 AM
im new in this program.. and im wonder how to save a file ? i stuck with this thing lots of time till found this forum. so.. how to save file? can some one tell me ?
Stcruxenio
10-15-2005, 12:06 PM
Push the right button on the code window: "Copy to executable-> Selection". Right button again and chose "Save file" (or you can try to close the last window and Olly will ask...).
mcnorth
10-22-2005, 08:14 AM
It's not a stupid question. This can get really frustrating at times.

If you have made some minor edits like change a JNZ to JMP or fill something with NOPs then when you right click in the code window and click on copy to executable you will have two options, either selection or all modifications. If you want to save your modified file click on all modifications. If you haven't made any edits the all modifications option will not appear.

If you want to dump from memory and save an unpacked file you will need the olly dump plugin.


Breakpoint on module

RCE Messageboard's Regroupment > General > Breakpoint on module
Stcruxenio
10-15-2005, 12:29 PM
I want to set a breakpoint in a module that is not seen (Alt + E) before execution. How can I make it without modifications on the code (CC)? Can I use a conditional breakpoint?
oh me anon
10-15-2005, 01:31 PM
option-->debugging options-->events-->break on module load then
ctrl+a (analyse the nely loaded module for having the break points saved to udd file) and set your break points
Stcruxenio
10-15-2005, 03:37 PM
Thanks! It was easier than I thought. I had to save all the comments and bpx by hand...
Epsylon3
10-24-2005, 06:29 AM
It there is many modules, you can try my module...

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=714 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=714)


Armadillo App strange Mem-behaviour ?

RCE Messageboard's Regroupment > General > Armadillo App strange Mem-behaviour ?
SKiLLa
10-16-2005, 02:57 AM
Hi Dudes,

I'm currently analysing some Armadillo protected app; especially Arma itself and I found some strange things; perhaps one of you might enlight me ;)

I'm not even sure which version of Arma it is; I guess it might be Arma 4.x, since there is no 'armVersion' stuff in the decrypter, but it does all the normal DebugBlocker and all the CopyMEM stuff. And there is also some plain-text Arma-config visible like ' ARMDEBUG, ARMSLASHOFF' and the typical registration-config-stuff (UNREGISTER,QUIETUNREGISTER,etc.)

Now, when tracing the decryptor stuff with Olly I noticed that Arma is doing it's usual stuff with the parent-child process and writing data, but just before JMPing to the OEP, the child-process (which steadily grew in memory upto ~ 8 MB; which is the working-set on startup) suddenly drops to about 1 MB and immediately rebuilds to 8 MB. I haven't been able to trace it exactly to the 'drop to 1 MB' part yet, but is this normal behaviour ? I Never noticed this before in other Arma-protected apps.
Ricardo Narvaja
10-17-2005, 09:46 AM
sure the program when unpack, change values in the header, look the original header before RUN and BYNARY COPY, and when you go to dump in the oep make bynary paste the 1000 bytes of the header, next you can see in red if have changes.

Dump and look if go better

Ricardo Narvaja
SKiLLa
10-18-2005, 08:37 PM
Thanx Ricardo,

you seem to be everywhere, providing answers to the ignorant; really appreciate that !-)

I should have known that these 1000 bytes overwrote the header and thus the 'Memory Size' ;).
Stupid me, I was looking for some evil hidden code I'd missed instead of adding 1 + 1 ... It also got me on the right track again; I guess it's Arma v4.0~v4.2 but not v4.3 (not sure which one exact) with Standard Protection & Debug Blocker ...

Hint: the first to bytes of the Arma Debugger are: 55 8B, whilst v4.3 has 60 E8, right ? Would you by chance know the exact version from it ? I don't have all v4.x subversions to verify ;)


where can I get the newest version of Ollydgb?

RCE Messageboard's Regroupment > General > where can I get the newest version of Ollydgb?
crbball
10-18-2005, 02:25 PM
I can't find it anywhere. All I get is the german T-Mobile site that says all the pages have been moved to a new host. And i tried zdnet, and that doesn't work either. If anyone has the installer, can they just email it to me?
TBD
10-18-2005, 03:12 PM
http://www.nofuture.org.uk/diary/images/i_will_use_google.jpg
hosiminh
10-18-2005, 04:38 PM
ollydbg
ollydbg
ollydbg
ollydbg
ollydbg
It is interesting how search results changes if you change 2 letters :D


ANyone got the sources?

RCE Messageboard's Regroupment > OllyScript > ANyone got the sources?
SHaG
10-18-2005, 06:38 PM
Due to some personal problems I wasn't able to renew my site at ollyscript.apsvans.com and the web hotel, so it all expired. I'm not even able to get to my old computer with the sources on... So:

DOES ANYONE HAVE THE SOURCES FOR THE LATEST VERSION???

Would be a real shame if all my hours of hard work went down the drain.... =(
o_o
10-18-2005, 08:49 PM
webarchive (http://web.archive.org/web/20041018080024/http://ollyscript.apsvans.com/) have that

But I don't know if it's the last version -_-

OKok idiot post of mine no source on that site '-'
mr haggar
10-18-2005, 08:54 PM
Glad to see you back man!
TBD
10-19-2005, 07:43 AM
last version with source in zip is OllyScript v0.52 (http://web.archive.org/web/20041018080024/http://ollyscript.apsvans.com/getPlugin.php?ver=05)
jayte
10-19-2005, 10:25 PM
last version with source in zip is OllyScript v0.52

I have v0.62 here (w/source, of course), if needed.

Jeff
oh me anon
10-25-2005, 03:00 PM
i too have 0.42,0.4 and 0.62 if you like shag and welcome back :)
SHaG
10-26-2005, 07:06 PM
Check separate topic


How to find all rows/lines with a specific memory address?

RCE Messageboard's Regroupment > General > How to find all rows/lines with a specific memory address?
tDJ
10-19-2005, 03:10 PM
Say there is a line in Olly like this:
CMP WORD PTR DS:[4800A1],0FFFF

If I want to know where "[4800A1]" is set (like "MOV WORD PTR DS:[4800A1],0FFFF" or "MOV WORD PTR DS:[4800A1],AX"), then I have to know all "[4800A1]" rows/lines. Is it possible to find them all at once with Olly?
SKiLLa
10-20-2005, 07:08 PM
You mean that you want all the code-references to that specific address ?

There are a million ways to reference an address, so just binary-searching for that particular address probably won't find you all references, especially not if the code is trying to hide 'the address'.

IDA has some nice 'reference' & 'graph' features, but it probably won't help you that much. I guess just setting a breakpoint on the address and letting the program run or trace is the easiest method.
tDJ
10-20-2005, 08:27 PM
It's enough to see all the ones that are visible in Olly. In this case I usually disassemble the program with W32Dasm, save the comments, open the saved ASM-file in a texteditor and search there for the address. But I thought it would be great if this also could be done simply in Olly.
garryw
10-20-2005, 10:29 PM
?, right click on [4800A1] select Find References to | address constant.
tDJ
10-21-2005, 06:26 AM
I tried it already, but then only the selected command is found. Same with "Find references to | Selected constant", and "Search for | All constants".


2 script Armadillo-CopymemII to detach father (method RICARDO and TENKETSU)

RCE Messageboard's Regroupment > OllyScript > 2 script Armadillo-CopymemII to detach father (method RICARDO and TENKETSU)
benina
10-19-2005, 04:48 PM
I modified hipu' Script to detach father from client and unpack (method RICARDO and TENKETSU).

Have fun.
Download:

_http://rapidshare.de/files/6451958/Armadillo_CP2.rar.html
MrLoGaN
10-22-2005, 05:15 AM
you script for unpacked would have one and to craker serial for armadillo 3.75C I am needing very


ollydbg crashes/pauses

RCE Messageboard's Regroupment > General > ollydbg crashes/pauses
asdf97
10-21-2005, 02:13 PM
hi, i am coming accross some weird crash in ollydbg when debugging a particular program. when i set a breakpoint, and i do the events which trigger the breakpoint, for example, bpx msgbox api and in program i press button to generate msg, ollydbg crashes.

however if i goto taskmanager or some process explorer and kill the child process (debuggee) ollydbg is unfrozen and breaks where it is suppose to, the only problem is that the process is now killed.. lol.

im not sure, but is this a new anti-ollydbg trick cause most the tricks for ollydbg are detection. the outputdebugstring exploit causes ollydbg to crash and terminate so it is probably not it.

so anybody got any ideas? oh yeah btw, it is packed by armadillo before hand, but im doing a quick fix live analysis via detaching child from parent, killing the father process and attaching to child process to olly, maybe there is residual protection code in child which armadillo adds after creating the child process?


Armadillo 3.75C

RCE Messageboard's Regroupment > OllyScript > Armadillo 3.75C
MrLoGaN
10-22-2005, 05:21 AM
Staff I am looking one script to remove the protection and unpecked of an archive that is protected with the Armadillo 3.75C, would have, or even though to make these alterations in the attached archive

_http://www.megaupload.com/?d=N2W0H4QE

sry my english , altavista translator =D
Thuggy
10-25-2005, 03:26 AM
What?
NemesiS
01-17-2006, 01:05 PM
I think that he looks for a script wich can unpack Armadillo v3.75c (in Olly ofcourse), or if somebody will be so kindly to unpack that program for him wich he mentioned above _http://...
Truly speeking (writing), I need that Script too! :)

I know! My English Sucks too!
PS: It's not translated!
NemesiS
01-17-2006, 01:06 PM
I think that he looks for a script wich can unpack Armadillo v3.75c (in Olly ofcourse), or if somebody will be so kindly to unpack that program for him wich he mentioned above _http://...
Truly speeking (writing), I need that Script too! :)

I know! My English Sucks too!
PS: It's not translated!


Debugging a XP service pack problem

RCE Messageboard's Regroupment > General > Debugging a XP service pack problem
ndoerre
10-22-2005, 07:43 AM
Well, it's always hard to explain a problem in a few simple and understandable words:
I would like to find out a freeze with XP SP2 of one of my executables. However, this problem does not occur with XP SP1.
The freeze of the EXE is caused immediately by a right button mouse click on a tool bar.
It seems that OllyDbg is able to handle and explore this problem. But I'm new with it and need some advice how to trap mouse events and the resulting code.
Ricardo Narvaja
10-22-2005, 08:58 AM
yes but if are a system problem, OLLYDBG are limited in this case.

But you can look the tutorials of messgespy, with this you can catch and stop in all windows messages (include mouse click and movements)

Ricardo
ndoerre
10-22-2005, 11:08 AM
The problem is that I have in fact to patch the EXE binary code just to hinder the (non necessary) popup menu to appear. Thus, I only have to replace the call. As far as I could find out, the programatically given address of the popup menu invoked by the right button mouse klick leads to different results in XP SP1 and XP SP2.
Thanks for your kind advice, nevertheless.

Norbert


IAT Specifics

RCE Messageboard's Regroupment > General > IAT Specifics
mcnorth
10-22-2005, 08:00 AM
Is there a way to tell exactly where the import address table begins and what size it is or exactly where it ends?

Thanks for any help!
Ricardo Narvaja
10-22-2005, 08:59 AM
Yes looking with the eyes hehe, this is the better method and never fail.

Ricardo
Lord_Looser
10-22-2005, 09:11 AM
ImportREC could help
Ricardo Narvaja
10-22-2005, 09:55 AM
import rec is old, and the new packers fool easily.

Ricardo
mcnorth
10-23-2005, 07:50 AM
Import Rec sometimes needs a little help, that's why I posted a question about how to isolate it in olly.
Ricardo Narvaja
10-23-2005, 10:14 AM
lokk the jmps or call to apis

JMP [xxxxx]

generally anre indirect jumps

XXXXXX will be oart of the iat

look this adress in the dump

and up to the start (continue while you look iat adresses or redirections to packer section)

when there are no more is the start the same with the final

if you have doubts put the first section in the listing and in a entry of the iat in the dump right click FIND REFERENCES and is you have a reference to an api is a part of iat, if not is not part of iat or junk value.
mcnorth
10-23-2005, 08:36 PM
Thanks Ricardo. I resolved it this way with the help of hosiminh.

In code window (after OEP is found) search FF 25, select the result, right click -> follow in dump -> memory address. Then right click in dump window -> Long -> Address. Now it's clear in the dump window where it starts and where it ends.
Ricardo Narvaja
10-24-2005, 11:40 AM
there are many methods, all are better than use automatic IMP REC feature.

Ricardo
mcnorth
10-24-2005, 09:59 PM
all are better than use automatic IMP REC feature.
I agree with that! Generally speaking tools are nice but they come at the cost of in depth knowledge.


Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation)

RCE Messageboard's Regroupment > General > Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation)
Dromidas
10-22-2005, 08:06 AM
nt
clicked twice =/


Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation)

RCE Messageboard's Regroupment > General > Stolen Bytes in ASProtect 1.23 RC4 (Magic Workstation)
Dromidas
10-22-2005, 08:09 AM
Hi everyone, this is my first time to the forums. I have a problem I need help solving and I can't seem to work through it even with the tutorials available.

I've been trying to unpack Magic Workstation (mtg program that has a bunch of annoying non-registered features) and its protected with ASProtect 1.23 RC4.
http://img463.imageshack.us/img463/5564/peid0pz.jpg
I've been able to locate the fake OEP and what I believe to be the actual OEP. I was also able to locate what I believe to be the stolen bytes, but I can't quite figure out which ones are the ones I need to copy.

OEP: http://img456.imageshack.us/img456/548/oep5is.jpg
Stolen Bytes: http://img456.imageshack.us/img456/7716/trace7gz.jpg

There are 8 "00" above there, then the C4948A00 then 4 more "00", but if you look at the trace there isn't really a defined list of bytes that I could copy up to the oep. Also I'm not sure what to make of the C4948A00 in the 00 bytes either.
Everything above 8AA4D4 are DD commands for many lines.

I'd appreciate any help I can get. I've been working with this for quite a while now and I've been stuck here all night. I'm pretty inexperienced with ollydbg and reversing yet so perhaps I'm just missing something.
Thanks.
Ricardo Narvaja
10-22-2005, 09:02 AM
the stolen bytes are previos to the jmp to the fake oep, where´s the jmp to the oep in this image?

Ricardo
mcnorth
10-22-2005, 09:40 AM
I think your stolen bytes are,

PUSH EBP
MOV EBP,ESP
MOV ECX,8

Unfortunately I can't confirm it because IMPRec keeps hanging everytime I try to rebuild the IAT. Since it's 1:30 in the morning I have to quit.

The way I came up with the bytes is I think it's Borland Delphi 4/5 and ECX is 8 at the fake ep. The way I intended to confirm them is assemble the new bytes, change the ep save, re-start and step through til the fake ep and compare the stack and registers.

At any rate I hope it gives you something to try.
Dromidas
10-22-2005, 09:52 PM
the stolen bytes are previos to the jmp to the fake oep, where´s the jmp to the oep in this image?

There isn't a jump to it anywhere that I can find, which is part of why I'm finding this so confusing.

Another thing which confused me a bit was all the ECX == 8 is for is to push 16 0's onto the stack...
I'm gonna try the suggested stolen bytes mcnorth posted and see if that works. I had been under the impression that the stolen byte count will always match the number of "00".
Thanks a lot for the posts, I'll update after I try some things then.
Ricardo Narvaja
10-23-2005, 10:10 AM
well the jump can be a push and ret or other variants but you need reach the oep in the tracing where this line in the image?

Ricardo
Lord_Looser
10-23-2005, 02:19 PM
google "stripper 2.11.02" could help
mcnorth
10-23-2005, 05:24 PM
I think you are right in that the stolen bytes Do fill the space of the 00's.

008AA4E0 55 PUSH EBP ; byte 1
008AA4E1 8BEC MOV EBP,ESP ; bytes 2 & 3
008AA4E3 B9 08000000 MOV ECX,8 ; bytes 4 thru 8

The next problem is that Magic Workstation wants to read memory that isn't there for which I don't have an answer. If you work out a solution to that would you share it with me?
mcnorth
10-23-2005, 08:17 PM
About that question, "where's the entry to the OEP in the image?"

Start at the bottom of the run trace window and work your way up. Those numbers in the left hand column of the run trace window are steps backward from the (fake) oep. To illustrate this get to your fake oep just like you did before. open your run trace window, scroll to the bottom and position it so you can see your code window, stack, registers and run trace window all at the same time. Now make sure your code window is active (click the title bar if its not) and hit the minus key once. (etiher one will do) See the Return in your code window? See the return in the run trace window one step back. Hit the minus key again and same thing. Pop ecx in code window and pop ecx 2 steps back in run trace. You can continue to use the minus key to trace back to see what the condition of the registers and stack are (or were) when the instruction was executed.

This is all new to me but I think when looking for stolen bytes in run trace you need to start from the bottom and scroll up for this reason. A PUSH EBP 5000 steps back has to be totally irrelevant if PUSH EBP occurs later on. I think the most recently occuring PUSH EBP should be your clue to start looking for more stolen bytes.

With that said and for what it's worth I don't think all compilers start with PUSH EBP. For example MS Visual C++ 4 starts with,

MOV EAX,DWORD PTR FS:[????]

and Borland C++ starts similarly with,

MOV EAX,DWORD PTR DS:[????]

Or at least that's what PEid says. (which could be wrong as well)

The answer to where's the jump is, at the bottom of the window. (not shown) It has to be. You broke on the OEP (fake) so the instruction that sent you there is the last instruction in run trace which is RETN with 8AA4E8 (the entry point) at the top of the stack.
Dromidas
10-26-2005, 07:23 AM
that stripper program actually worked, i wish i knew how it did that :)
been tryin to crack the program now, haven't really had much luck yet, but we'll see :)
thanks ^_^
mcnorth
10-28-2005, 07:42 AM
That's great. Doesn't hurt to know how to manually unpack though. Hosinimh figured out the solution for the dump trying to write to non-existent memory.

Cheers
cpprules
11-04-2005, 10:08 PM
If you succseed in cracking this program please post your crack, i really need this program.
mail me at : cpprules@excite.com
cpprules
11-04-2005, 10:11 PM
Please!!!!!!!!!!!!!
cpprules
11-05-2005, 07:25 AM
Please!!!!!!!!!!!, noone else has cracked this program
cpprules
11-11-2005, 09:21 PM
Please!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


####RDG Packer Detector v0.5.8####

RCE Messageboard's Regroupment > General > ####RDG Packer Detector v0.5.8####
RDGMax
10-22-2005, 11:09 PM
hxxp://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/25/RDGPa ckerD etectorv0.5.8.rar

Rar Archive.
tDJ
10-22-2005, 11:23 PM
Thanks, but I get this error when trying to download:
"ERROR: ACCESO RESTRINGIDO

No se te reconoce como miembro de este grupo.

Por favor, regresa a la página anterior"
hosiminh
10-23-2005, 12:37 PM
hxxp://www.egrupos.net/grupo/rvlcn/ficheros/5/verFichero/25/RDGPackerD etectorv0.5.8.rar (430kb)
tDJ
10-24-2005, 05:25 AM
Working now. Thanks. :)
nick_name
10-25-2005, 12:02 PM
guys, is there any way to change the LANGUAGE to english in the cool packer detector ??

i saw the english.ini file , but how to make the program use it ?
tDJ
10-25-2005, 03:18 PM
@nick_name
For English language, use this setting:

[lenguaje]
default=English.ini
nick_name
10-25-2005, 04:29 PM
THANK YOU , tDJ


c0000142 in Macromedia Director

RCE Messageboard's Regroupment > General > c0000142 in Macromedia Director
giulio8
10-23-2005, 02:29 PM
I downloaded Macromedia Director 2004.
I can not debug it because of the exception "c0000142".
Anybody can help?
Thanks!

Log data
Address Message
008F0000 Module C:\DOCUME~1\en21165\IMPOST~1\Temp\~efea67\~de09d7. tmp
10000000 Module C:\DOCUME~1\en21165\IMPOST~1\Temp\~efea67\~df394b. tmp
784914F4 Exception C0000142 (DLL INIT FAILED)
784914F4 Exception C0000142 (DLL INIT FAILED)
Debugged program was unable to process exception
ntdll
784914D0 > 55 PUSH EBP
784914D1 8BEC MOV EBP,ESP
784914D3 83EC 50 SUB ESP,50
784914D6 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
784914D9 8365 B8 00 AND DWORD PTR SS:[EBP-48],0
784914DD 8365 C0 00 AND DWORD PTR SS:[EBP-40],0
784914E1 8945 B0 MOV DWORD PTR SS:[EBP-50],EAX
784914E4 8D45 B0 LEA EAX,DWORD PTR SS:[EBP-50]
784914E7 C745 B4 01000000 MOV DWORD PTR SS:[EBP-4C],1
784914EE 50 PUSH EAX
784914EF E8 24FFFFFF CALL ntdll.RtlRaiseException
784914F4 C9 LEAVE
784914F5 C2 0400 RETN 4

Executable modules
Base Size Entry Name File version Path
008F0000 00086000 0093E6ED ~de09d7 2.42.000 C:\DOCUME~1\en21165\IMPOST~1\Temp\~efa53a\~de09d7. tmp
10000000 0007B000 1002F959 ~df394b C:\DOCUME~1\en21165\IMPOST~1\Temp\~efa53a\~df394b. tmp
20000000 00540000 200072F8 Director 10.1r11 C:\Programmi\Macromedia\Director MX 2004\Director.exe
68000000 00170000 680010C1 DIRAPI 10.1r11 C:\Programmi\Macromedia\Director MX 2004\DIRAPI.dll
69000000 000AB000 690019C1 IML32 10.1r11 C:\Programmi\Macromedia\Director MX 2004\IML32.dll
6A7B0000 00020000 6A7B4432 MSVFW32 5.00.2195.6612 C:\WINNT\system32\MSVFW32.dll
6C000000 00010000 6C00C05E actlib C:\Programmi\Macromedia\Director MX 2004\actlib.dll
70A70000 00066000 70A8EFD3 SHLWAPI 6.00.2800.1612 ( C:\WINNT\system32\SHLWAPI.DLL
71710000 00084000 71722A63 COMCTL32 5.81 C:\WINNT\system32\COMCTL32.DLL
74820000 00016000 74824F5C AVIFIL32 5.00.2195.6612 C:\WINNT\system32\AVIFIL32.dll
752A0000 00020000 752A1388 oledlg 1.0 C:\WINNT\system32\oledlg.dll
75980000 00006000 75981A6A LZ32 5.00.2195.6611 C:\WINNT\system32\LZ32.DLL
75E30000 0001A000 75E31264 IMM32 5.00.2195.6655 C:\WINNT\system32\IMM32.dll
76B10000 0003E000 76B11A64 comdlg32 5.00.3700.6693 C:\WINNT\system32\comdlg32.dll
77120000 00071000 77123E30 RPCRT4 5.00.2195.6904 C:\WINNT\system32\RPCRT4.DLL
773F0000 00013000 773FDA10 MSACM32 5.00.2134.1 C:\WINNT\system32\MSACM32.dll
77550000 00031000 77554164 WINMM 5.00.2161.1 C:\WINNT\system32\WINMM.dll
77590000 00249000 775AD130 SHELL32 5.00.3900.6975 C:\WINNT\system32\SHELL32.DLL
77820000 00007000 77821334 VERSION 5.00.2195.6623 C:\WINNT\system32\VERSION.dll
77E10000 0005F000 77E1DF34 USER32 5.00.2195.7017 C:\WINNT\system32\USER32.dll
77F40000 0003B000 GDI32 5.00.2195.6945 C:\WINNT\system32\GDI32.dll
78000000 00045000 78001000 MSVCRT 6.10.9844.0 C:\WINNT\system32\MSVCRT.dll
780C0000 00061000 780C1000 MSVCP60 6.00.8168.0 C:\Programmi\Macromedia\Director MX 2004\MSVCP60.dll
78460000 00082000 ntdll 5.00.2195.6899 C:\WINNT\system32\ntdll.dll
79260000 00062000 79261ECE ADVAPI32 5.00.2195.6876 C:\WINNT\system32\ADVAPI32.dll
796B0000 000BA000 796B7A40 KERNEL32 5.00.2195.6946 C:\WINNT\system32\KERNEL32.dll
7CE60000 000EF000 7CE7B671 ole32 5.00.2195.7059 C:\WINNT\system32\ole32.dll
giulio8
10-24-2005, 09:19 AM
Another point: when the application is started, I can use windbg: it breaks an goes again. If I use Ollydbg, it breaks but then it doesn't go again because it can not handle some exception... even if I set to ignore it...

In conclusion, I can not debug this program because the process terminates unexpectedly.

Any suggestion?
Please, help me! Thanks :-)
Ricardo Narvaja
10-24-2005, 11:38 AM
Sure OLLYDBG is detected use Hidedebugger 1.23f with all options activated, IsDebugPrsent with extrahide and NtGlobalflagplugin, and use parcheado 4 from my ftp, put in the same folder ollydbg.exe but use parcheado 4 not ollydbg.exe and try.

http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Parcheado%2 04.rar
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/Parcheado%204.rar
)

Ricardo Narvaja
giulio8
10-24-2005, 12:54 PM
Thank you very much for your answer!
Hidedebugger 1.23f with all options activated is working!
I'll go on and let you know..
Thanks again.
Giulio


udd files and backtracking

RCE Messageboard's Regroupment > General > udd files and backtracking
qwiyet1
10-24-2005, 05:26 PM
I'm trying to find an error I cannot recreate reported in an app. popup window stating access violation. I can see the actual error message in the udd file but because I can't recreate I'm having trouble following in disasembler - suggestions welcome - thanks


email notifications

RCE Messageboard's Regroupment > General > email notifications
mcnorth
10-24-2005, 10:04 PM
Does this forum not support email notifications? That is, send a notification to email when a new post is added to a subscribed thread.
TBD
10-27-2005, 05:21 AM
nope. not supported.
I will add, maybe, RSS support if enough demand
mcnorth
10-28-2005, 07:38 AM
That would be cool.
Thank you for the reply.
nick_name
10-29-2005, 04:29 AM
TBD, please add the RSS , that will be the greatest thing ever happened to this forum ...


REQ: how to extract armaccess.dll

RCE Messageboard's Regroupment > General > REQ: how to extract armaccess.dll
nick_name
10-25-2005, 12:10 PM
i've successfully unpacked a armadillo packed program , fixed the imports... but the app still asking for ARMACCESS.DLL

how do i eliminate this or how do i extract teh armaccess.dll ??
mr haggar
10-25-2005, 07:13 PM
You can dump it from memory with lordPE. I was thinking the same since I was wondering will some apps will work with (I doubt). Problem is that it needs to be fixed too, IAT and stuff.
hosiminh
10-26-2005, 10:23 AM
You have 2 choices:

1.) DL this shitty DLL and put it into appropriate folder

2.) Patch target so it will "think" ARMACCESS.DLL is there ...
Breaking on LoadLibraryA might help :idea:


debugger detection

RCE Messageboard's Regroupment > General > debugger detection
giulio8
10-26-2005, 01:10 PM
In my previous message "c0000142 in Macromedia Director",
I've received useful help from Ricardo Narvaja, but I'm still facing the first general problem:
I debug an application that throws an exception, supposedly to prevent debugging.
What to do next (in order to reverse the code)?
mr haggar
10-26-2005, 04:03 PM
Well, to download papers about exceptions and learn what they mean and what is expected from system or debugger when you land on such one. Protected program expect that exception should be handled with it's exception handler so when you get it in debugger you should do what protector expects.

I don't know nothing about exceptions but I think that this is how it should be.
ricnar456
10-26-2005, 06:47 PM
If the program stop in a exception press shift + f9 for skip or go to DEBUGGING OPTIONS- EXCEPTIONS and ADD to the CUSTOM LIST the last exception and the next time the program don´t stop more in this type of exception.

Ricardo Narvaja
giulio8
10-26-2005, 09:21 PM
Ricardo,
it is difficult for me to explain it exactly - sorry - however is not a question of pressing shift + f9 or adding it to the custom list in the option (I've done it, unsuccessfully)...
I don't know if you have time, but, just in case, try to download the director mx 2004 from http://www.macromedia.com/cfusion/tdrc/index.cfm?product=director
I would have the opinion of an expert of reverse engineering!
Thanks in advance.
Giulio
ricnar456
10-27-2005, 07:50 AM
you use parcheado 4?

Ricardo
giulio8
10-27-2005, 08:34 AM
Yes, of course, I followed all your instructions.
If you could try yourself...

Bye and thanks.
Giulio

Btw, an interesting article, not related to the subject, but with a some criticism against debugging...
http://www.honeynet.org/scans/scan33/ with the official writeup:
http://www.honeynet.org/scans/scan33/nico/index.html
giulio8
10-28-2005, 09:22 AM
This is the run trace (as I see in other post, it could be useful).
Thanks for any help/explanation.
Giulio

796D072E Main MOV ESI,EAX ESI=00000000
796D0730 Main MOV DWORD PTR SS:[EBP-30],ESI
796D0733 Main CMP DWORD PTR SS:[EBP-1C],EDI
796D0736 Main JE SHORT KERNEL32.796D0754
796D0754 Main MOV EAX,DWORD PTR FS:[18] EAX=7FFDE000
796D075A Main MOV DWORD PTR SS:[EBP-60],EAX
796D075D Main PUSH EBX
796D075E Main PUSH EDI
796D075F Main MOV EAX,DWORD PTR DS:[EAX+30] EAX=7FFDF000
796D0762 Main PUSH DWORD PTR DS:[EAX+18]
796D0765 Main CALL DWORD PTR DS:[<&ntdll.RtlFreeHeap>] EAX=00000001, EDX=00130608
796D076B Main OR DWORD PTR SS:[EBP-4],FFFFFFFF
796D076F Main JMP SHORT KERNEL32.796D07BE
796D07BE Main CMP BYTE PTR DS:[7970B221],0
796D07C5 Main JE SHORT KERNEL32.796D07DD
796D07DD Main CMP ESI,EDI
796D07DF Main JGE SHORT KERNEL32.796D07EB
796D07EB Main MOV EAX,DWORD PTR SS:[EBP-38] EAX=10000000
796D07EE Main MOV ECX,DWORD PTR SS:[EBP-10] ECX=0012F96C
796D07F1 Main MOV DWORD PTR FS:[0],ECX
796D07F8 Main POP EDI EDI=0012F492
796D07F9 Main POP ESI ESI=0013607C
796D07FA Main POP EBX EBX=00136070
796D07FB Main LEAVE EBP=0012F440
796D07FC Main RETN 0C
796D02B3 Main RETN 0C
796D027F Main POP EDI
796D0280 Main POP ESI
796D0281 Main POP EBX
796D0282 Main POP EBP EBP=0012F614
796D0283 Main RETN 4
6C00CC03 Main TEST EAX,EAX
6C00CC05 Main JNZ SHORT actlib.6C00CC0E
6C00CC0E Main POP EDI EDI=0012F5C4
6C00CC0F Main POP ESI ESI=00136070
6C00CC10 Main POP EBP
6C00CC11 Main POP EBX EBX=6C00F096
6C00CC12 Main ADD ESP,104
6C00CC18 Main RETN
6C00CAA9 Main MOV EBX,EAX EBX=10000000
6C00CAAB Main ADD ESP,10
6C00CAAE Main TEST EBX,EBX
6C00CAB0 Main JNZ SHORT actlib.6C00CAC0
6C00CAC0 Main MOV EDX,DWORD PTR SS:[ESP+14] EDX=6C00F096
6C00CAC4 Main PUSH ESI
6C00CAC5 Main CALL DWORD PTR DS:[EDX+C] EAX=00000000, EDX=00130608
6C00CAC8 Main MOV EAX,EBX EAX=10000000
6C00CACA Main POP EBX EBX=6C00F096
6C00CACB Main POP EDI EDI=6C000000
6C00CACC Main POP ESI ESI=00137D98
6C00CACD Main POP EBP EBP=6C00C009
6C00CACE Main RETN
6C00C376 Main ADD ESP,2C
6C00C379 Main MOV DWORD PTR SS:[EBP+24],EAX
6C00C37C Main TEST EAX,EAX
6C00C37E Main JNZ SHORT actlib.6C00C390
6C00C390 Main PUSH EBX
6C00C391 Main CALL actlib.6C00EDD0 EAX=00000000
6C00C396 Main PUSH 1
6C00C398 Main CALL actlib.6C00E380 EAX=6C00E3F5, ECX=00000000, EDX=6C00E3F5
6C00C39D Main LEA EDX,DWORD PTR SS:[ESP+18] EDX=0012F5C4
6C00C3A1 Main PUSH EAX
6C00C3A2 Main MOV EAX,DWORD PTR SS:[EBP+24] EAX=10000000
6C00C3A5 Main PUSH EDX
6C00C3A6 Main PUSH EBX
6C00C3A7 Main PUSH EAX
6C00C3A8 Main CALL actlib.6C00C9D0 EAX=10003010, ECX=0012F96C, EDX=00130608
6C00C3AD Main ADD ESP,18
6C00C3B0 Main TEST EAX,EAX
6C00C3B2 Main JNZ SHORT actlib.6C00C3C4
6C00C3C4 Main MOV ECX,DWORD PTR SS:[ESP+1C] ECX=00001000
6C00C3C8 Main LEA EDX,DWORD PTR SS:[ESP+F0] EDX=0012F6A4
6C00C3CF Main MOV DWORD PTR SS:[ESP+2C],EDX
6C00C3D3 Main MOV DWORD PTR SS:[ESP+28],ECX
6C00C3D7 Main LEA EDX,DWORD PTR SS:[ESP+20] EDX=0012F5D4
6C00C3DB Main LEA ECX,DWORD PTR SS:[ESP+1F4] ECX=0012F7A8
6C00C3E2 Main PUSH EDX
6C00C3E3 Main MOV DWORD PTR SS:[ESP+24],EDI
6C00C3E7 Main MOV DWORD PTR SS:[ESP+28],ESI
6C00C3EB Main MOV DWORD PTR SS:[ESP+38],EBP
6C00C3EF Main MOV DWORD PTR SS:[ESP+34],ECX
6C00C3F3 Main CALL EAX EAX=F0920000, ECX=00000014, EDX=00000000, EBX=00000000, EBP=0012EF18, ESI=00136748, EDI=7FFDE000
78465EAD Main RETN 28 EAX=00000001, ECX=0000000B, EDX=1006C8D8, EBX=6C00F096, EBP=6C00C009, ESI=00137D98, EDI=6C000000
6C00C3F5 Main ADD ESP,4
6C00C3F8 Main TEST EAX,EAX
6C00C3FA Main JE SHORT actlib.6C00C40C
6C00C3FC Main POP EDI EDI=6C00C05E
6C00C3FD Main POP ESI ESI=0012F8F0
6C00C3FE Main POP EBP EBP=0012F8DC
6C00C3FF Main MOV EAX,1
6C00C404 Main POP EBX EBX=6C00C05E
6C00C405 Main ADD ESP,2E8
6C00C40B Main RETN
6C00C0AA Main ADD ESP,8
6C00C0AD Main POP ECX ECX=00000001
6C00C0AE Main CMP EAX,0
6C00C0B1 Main JE SHORT actlib.6C00C0CF
6C00C0B3 Main MOV BYTE PTR DS:[EBX],0C2
6C00C0B6 Main MOV BYTE PTR DS:[EBX+1],0C
6C00C0BA Main TEST ECX,ECX
6C00C0BC Main JE SHORT actlib.6C00C0C7
6C00C0BE Main POPAD ECX=6C00C05E, EDX=00000000, EBX=00000000
6C00C0BF Main POP EBP EBP=0012F8FC
6C00C0C0 Main MOV EAX,0 EAX=00000000
6C00C0C5 Main JMP SHORT actlib.<ModuleEntryPoint>
<ModuleEntryPoint> Main RETN 0C
784630E7 Main MOV ESP,ESI
784630E9 Main POP EBX
784630EA Main POP EDI
784630EB Main POP ESI ESI=00133308
784630EC Main POP EBP EBP=0012F97C
784630ED Main RETN 10
7846D96B Main MOV BYTE PTR SS:[EBP-3C],AL
7846D96E Main OR BYTE PTR DS:[ESI+36],8
7846D972 Main TEST AL,AL
7846D974 Main JNZ ntdll.7846D8E8
7846D97A Main JMP ntdll.784793C1
784793C1 Main PUSH -1
784793C3 Main LEA EAX,DWORD PTR SS:[EBP-10] EAX=0012F96C
784793C6 Main PUSH EAX
784793C7 Main CALL ntdll.7846B419 ECX=0012F8EC, EDX=00130608
784793CC Main POP ECX ECX=0012F96C
784793CD Main POP ECX ECX=FFFFFFFF
784793CE Main MOV EAX,C0000142 EAX=C0000142
784793D3 Main JMP ntdll.7846D997
7846D997 Main MOV ECX,DWORD PTR SS:[EBP-10] ECX=0012FD0C
7846D99A Main MOV DWORD PTR FS:[0],ECX
7846D9A1 Main POP EDI EDI=00131F78
7846D9A2 Main POP ESI ESI=7FFDF000
7846D9A3 Main POP EBX EBX=00131F04
7846D9A4 Main LEAVE EBP=0012FC98
7846D9A5 Main RETN 4
7847171B Main MOV EDI,EAX EDI=C0000142
7847171D Main TEST EDI,EDI
7847171F Main JL SHORT ntdll.7847172F
7847172F Main MOV EAX,EDI
78471731 Main POP EDI EDI=7FFDF000
78471732 Main POP ESI ESI=7FFDE000
78471733 Main POP EBX EBX=00000000
78471734 Main LEAVE EBP=0012FD1C
78471735 Main RETN 0C
784716CB Main MOV DWORD PTR SS:[EBP-30],EAX
784716CE Main MOV DWORD PTR SS:[EBP-4],EBX
784716D1 Main JMP ntdll.7846807E
7846807E Main OR DWORD PTR SS:[EBP-4],FFFFFFFF
78468082 Main CALL ntdll.784680C0 EAX=00000000, EDX=784B0348
78468087 Main CALL ntdll.ZwTestAlert ECX=01010101, EDX=FFFFFFFF
7846808C Main CMP DWORD PTR SS:[EBP-30],EBX
7846808F Main JL ntdll.784789D2
784789D2 Main CMP BYTE PTR SS:[EBP-34],BL
784789D5 Main JNZ SHORT ntdll.784789DF
784789D7 Main PUSH DWORD PTR SS:[EBP-30]
784789DA Main CALL ntdll.7847AAC5
784789DF Main PUSH DWORD PTR SS:[EBP-30]
784789E2 Main JMP SHORT ntdll.78478985
78478985 Main CALL ntdll.RtlRaiseStatus EAX=0012FC50, EBP=0012FCA0
End of gathered information, live log begins
Run trace closed
giulio8
11-06-2005, 03:21 PM
Using PEiD I found the protection of actlib.dll:
SafeDisc 2.42.000 -> Macrovision [Overlay]
ep: stxt371
I've read the tutorials:
https://quequero.org/uic/sr2cracking.htm
http://xoomer.virgilio.it/pinc0pall/crktute/2/mohaa.htm
http://www.reverse-engineering.info/cd/TSD27p.txt
They are very detailed but too complex for me.

They also use softice instead of ollydbg :-((

Thanks for any help
ricnar456
11-07-2005, 07:43 AM
Maybe is hard for your level, th worst step in cracking is put one hard program, and only look this, and try crack, if you can´t let the program for the future is not for you in this moment, and continue learning with easy programs, when yoy reach the level, you can crack easily.

Ricardo Narvaja


breakpoint on non-API function

RCE Messageboard's Regroupment > General > breakpoint on non-API function
gromozeka
10-27-2005, 10:12 AM
Hello everyone!
First of all, sorry for my english, it is bad..( But i want to try to formulate my question...)

I use OllyDbg 1.09...
I have an applocation, that use dll-library...
I need set a breakpoint on function, that is in the dll...
this funtion is not API function...
to set breakpoint on api-function i use command line and the next command, for example:
bp MessageBoxA
- and it works OK....
But if I try to set a breakpoint on funtction from dll (for example , name of the function myFunc), it does not work:
bp myFunc
or bpx MyFunc

the cause: debbuger may be can not recognize this function (because it is not-API function)...

What should i do?
Could anyone help me please??

Thanks...
giulio8
10-27-2005, 10:30 AM
I'm a beginner in ollydbg, but I'll tell you what I would do....
Clearly, wait for another expert answer!
I would see all the modules loaded (alt + E),
double click the dll and put the bp directly on the point (F2).
Don't know if is correct and can help...
Bye
Giulio
mr haggar
10-27-2005, 11:00 AM
What do you mean that bp doesn't work? If bp is there and that opcode needs to be executed, then bp must and will work.

>the cause: debbuger may be can not recognize this function (because it is not-API function)...

Do you know the address of that function in dll, for example it is at 76543210? Then place "bp 76543210" and it will work.

Also you must be sure that your dll is loaded in memory (check modules window). If it is not loaded Oly cannot place bp on that address.

Also, you can go to that dll and press Ctrl+A to analyse dll. In this case Olly will remember any bp placed here so when you restart app in Olly, you will not have to place bp on the same place again ans again.

Btw, Get OllyDbg 1.10, maybe there is some bugs in 1.09 version.
gromozeka
10-27-2005, 12:54 PM
Thanks a lot!
1.09 can not load dll to debug, but 1.10 can...
I've found the adress of the function , that was inside dll, and bp began to work properly...
i am a beginner in OLLY, so i did not hit upon an idea to use adress of the function (with bp)...

Thanks!


RICHARDO : movie collector problem

RCE Messageboard's Regroupment > General > RICHARDO : movie collector problem
nick_name
10-27-2005, 01:46 PM
1. i detach child from father
2. at child, i find IAT begins at 6961e0
3. i put a HW bp on write there

4. i restart olly , detach the father from child ( while the hw bp is already there)
5. i'm at child again
6. with a f9 , the child starts to run

OLLY does'nt break anytime on the IAT writting , where i'm going wrong ??
is there any other way to find the MAGIC jump or get the full IAT

where i'm going wrong ??
mr haggar
10-27-2005, 09:38 PM
Yep, it can be weird. Try memory bp then.

Btw, does that target have spliced code or IAT elimination. Is it CopyMemII or just DebugBlocker?

Armadillo uses _stricmp API to compare which API's need to be obfuscated so you can break there, but problem is that api is used for other things too and it would take ages to break at right spot. Check this http://www.reversing.be/article.php?story=20051002151932648 and this http://www.reversing.be/article.php?story=20050926230011232
nick_name
10-28-2005, 03:57 AM
mr hagger, THANKS for the reply.

the target has NANOMITES, which i think is the last thing to take care of.
the target does'nt have any IAT ELIMINATION.

but i've noticed one thing, if i use OpenMutexA trick, it does'nt even break on CreateThread 'n shows the error message 'Debugged program was unable to process the exception'

if i use the WriteProcessMemory trick, i can detach the child from father but when in the OEP of child, some of the IAT imports are already missing
mr haggar
10-28-2005, 06:12 PM
Ops, I don't know how to unpack nanomites. I was planing to read some papers about that but I'm little tired from this unpacking. If there are no IAT elimination, then IAT should be simple to fix.

From what I noticed, nanomites are some threads, what they do - I'm not sure. I have deatached processes in easy cd-da extractor and it was working oK. But when I placed couple bp's, code was screwed.
SKiLLa
11-03-2005, 07:43 PM
I've been trying to unpack Movie Collector and also Photo Collector, but I too fail with the NanoMites, eventhough I found a Spanish tutorial about NamoMites, I just can't figure it out (translation-sites s#ck :( ). Can anyone explain this to me (or provide a link to a English tutorial) ?

Strangely enough, although both programs are protected with Arma v4 (i just tried the latest version of both programs) , the Movie Collector license-protection-scheme is quite easy to patch, while Photo Collector licensing is just completely different (code-wise). The same nag and (basicly) the same protection, but it seems there are other Arma options used, since I can't phish the serial-routine :( Both use DebugBlocker, NanoMites and at least of of the 2 also has code-slicing and (some ?) IAT elimination (redirects) ..if I'm not confusing things here, I haven't looked at it lately; too confusing ;)

So it seems Photo Collector is better/different protected ... I found several cracks for Movie Collector (I don't care for the program and I don't use it, I'm just using it to learn about Arma v4 with most protection-options enabled), but none for Photo Collector ... quite strange ...
mr haggar
11-03-2005, 11:42 PM
Protections can differ but that is usually minor anoyance after unpacking. If you want to practice, you have on http://tuts4you.com/ unpackmes , more than you need for 4.30, 4.20... armadillo's. With ALL protections, including nanomites.

Back to nanomites, there is on old biw site crusader's tutorial for armadillo 2.x with nanomites. Old but armadillo is pretty much the same and tut is good. There is also new, very very detailed tutorial for 4.20 on reteam site.
nick_name
11-04-2005, 09:58 AM
mr. hagger thanks for ur replies.

i'm finally successful with MOVIE COLLECTOR
fixed the nanos with ArmInline

but no-luck with N-REC + ARMTOOLS

i've opened a new thread mentioning my problems, could you please take look there ??

thank you


OllyScript v0.92 incl source available!

RCE Messageboard's Regroupment > OllyScript > OllyScript v0.92 incl source available!
SHaG
10-27-2005, 02:08 PM
The complete package (v0.92) can be downloaded at:

http://rapidshare.de/files/6797069/OllyScript.rar.html

I am sorry, but I really don't think I'll update it further until OD2.0 comes out, just too much stuff going on in my life atm. My only request is that if you use the source somehow, please leave my name in the about box. =)


When developing a plugin, how can i debug it?

RCE Messageboard's Regroupment > Plugins > When developing a plugin, how can i debug it?
Fatmike
10-28-2005, 03:45 PM
Hi,

does anyone know how i can debug a olly plugin during developing time? i use ms visual stuido. i want to attach to olly debug and then set breakpoints in my dll code in visual studio, so that i can debug it.

thx!
oh me anon
11-07-2005, 03:59 PM
load ollydbg on ollydbg and then load and then go on from there

view executable module --> find names on your plugin on parent ollydbg
set bp on plugin main or any other code in your plugin
now switch to child ollydbg and then use your plugin (for example
pluginmenu --> your plugin-->click would break on plugin main callback

there is a debug plugin made by tbd but it has not been updated to 1.10
it comes with source :) if you are enterprising enough you can try
upgrading that plugin :)
Lord_Looser
11-07-2005, 04:33 PM
Project preferences - configuration active(Debug)
Debugging - Command: C:\OllyDbg\OLLYDBG.EXE
Linker - Output file: C:\OllyDbg\plugins\plugin.dll

For testing set breakpoint at
extc int _export cdecl ODBG_Plugindata(char shortname[32]) {
strcpy(shortname,"name"); // Name of plugin <-- breakpoint
...
}
Epsylon3
11-07-2005, 08:40 PM
Yep... it's not the "!" icon (Ctrl F5).... it's RUN (F5) to debug in VC6.... erfgh ;)
Fatmike
11-07-2005, 08:42 PM
thanks! :-) i will try that...


Check on what address a jump was taken

RCE Messageboard's Regroupment > General > Check on what address a jump was taken
Eliana
10-28-2005, 06:03 PM
Hi. I'd like to check on what address a jump was taken.
Here's some code:

...
0E253322 83C4 08 ADD ESP,8
0E253325 81C4 04100000 ADD ESP,1004
0E25332B C3 RETN
0E25332C B0 FF MOV AL,0FF <- it jumps here
0E25332E 8D4C24 04 LEA ECX,[DWORD SS:ESP+4]
0E253332 51 PUSH ECX
0E253333 8D5424 04 LEA EDX,[DWORD SS:ESP+4]
...

What I mean is, I'd like to check what the address to the jump to 0E25332C is. (last jump)

Any ideas?
Answers are greatly appreciated.

Eliana
tDJ
10-28-2005, 07:21 PM
There are a few ways. But simply try to trace from there to the next RETN code, step into this code which leads to the previous section, then go one line up and you see the call.
ricnar456
10-28-2005, 07:23 PM
if you put in this line E25332C and right click -find references and have no results,, put a bP in E25332C and when stop, look the first line of the stack for see the adress of returning of the previosu call.

With this info you can put a bp here and trace till jump.

Ricardo Narvaja
Eliana
10-28-2005, 11:02 PM
Great! Thank you for your answers :) It has helped me alot! I tried to use "Find ref." as ricnar456 said, and it worked. Thanks again :)

Eliana


Super n00b

RCE Messageboard's Regroupment > General > Super n00b
Bailer
10-28-2005, 06:58 PM
Hello, i want to start with cracking and i need to learn from scratch. How will i do?? Is there any super n00b tutorials?? Or can you least tell me how you started and give me some hints?
Thx

/Bailer
arjuns
10-29-2005, 08:13 AM
Bailer!
don't tell urself super noobe because noone knows everything form the begining, if you are really interested in Cracking do learn some Asm programming ....
and you can have olly tutorials at
tutorials.accessroot.com
Bailer
10-29-2005, 10:42 PM
Bailer!
don't tell urself super noobe because noone knows everything form the begining, if you are really interested in Cracking do learn some Asm programming ....
and you can have olly tutorials at
tutorials.accessroot.com

Hehe thx ^^ I will learn myself some programming in school next year and i hope i will get started with it earlyer. Ok thx alot!


thinstall over upx

RCE Messageboard's Regroupment > General > thinstall over upx
axterix
10-28-2005, 09:05 PM
Hi, sorry for my very bad english :(
I want unpack/dump a prog packed with upx 1.24 and after crypt/protect with ThinStall .
I see a very good tutor of MaDMAn_H3rCuL3s, and bypass with success the first protection ... ThinStall ...
Now I am at UPXed EP, tried a manual unpacking, I see some techniques, but bypassed upx and find the OEP the dump dont work ... the IAT "still invalid" :) and incomplete .

Some suggestion for a Newbiessss ?
thanks .

Axterix


Access violation question

RCE Messageboard's Regroupment > General > Access violation question
woody
10-29-2005, 09:56 PM
Hi,

I have a problem on an application on few servers I admin whereby I get the error:

Application Error : The instruction at "<some mem location>" referenced memory at "0x00000008". The memory could not be "read".

(which bombs the application out)

It has just started happening and I can't figure out why. I have done all the usualy tests (tested mem with memtest86, uninstalled latest hotfixes, compaired DLL versions / checksums with working systems, even re-built the server, changed hardware), but due to the complexities of the install its been rather difficult to asertain what the problem is. I've turned to Ollydbg to try to see if it can shead any light on what is happening.

The above error is one example of a few errors that I get. The only common feature is that they are all "referencing" memory at very low addresses (sometimes 00000000, 00000030, or 00000080). I've used Ollydbg to find out where the instructions are that are causing these problems, and they are mostly in the MFC42.dll file that the program loads. An example of one of the instructions is:

6C3B7E50 8B06 MOV EAX,DWORD PTR DS:[ESI]

What the problem would be is that the ESI register at that point in time would be un-initiallised (00000000), hence there being a problem.

Unfortunatly I have been unable to get Ollydbg to 'catch' the problem when it occurs as it is not *that* frequent, and there is no re-producable pattern to it.

However (i'm finally getting to my question you'll be glad to hear), I have run Ollydbg on a 'good' system, and it halts the program running quite frequently stating "Access violation when writing to [00000000] - use shift +F7/F8/F9 to pass exception to program". This is also occuring in MFC42. Now this sounds exactly the same as the error I get on the 'bad' servers, yet the application is fine. It continues to run even though I pass the exception to the program. Can anyone explain why the 'bad' servers would not be able to handle such exceptions, yet good ones can.

Any pointers to help me understand what is going on would be great.

Thanks
SKiLLa
11-03-2005, 07:06 PM
Well MemTest86 isn't that fool-proof as you might think, I read a (Dutch) topic about memory-issues the other day and MemTest86 didn't find any problems with the Memory while - as it turned out - the Memory was broken after all. You might try some other Memory Tester (MemTest+ or something). But it might also be some other bad component (motherboard / cooling / power-supply / hdd). Did you monitor the CPU / motherboard temperature ?

Software-wise it could be a bad component or wrong DLL version, or device-driver. You're not running any Debugger-software or system-level Antivirus are you ? And if changing hardware didn't solve the problem, I guess the best option is just a clean install ...


How to use exports?

RCE Messageboard's Regroupment > General > How to use exports?
Maniax
10-30-2005, 10:18 PM
Hi,
i analyzed the main exe and the dll but olly doesn't show me export names in the exe. I tried to load the dll with 'select import libraries' but doesnt work. Whats the trick?


unaable to locate data in executable file

RCE Messageboard's Regroupment > General > unaable to locate data in executable file
arjuns
10-31-2005, 02:15 AM
Hello all ,
I want to inject some code in an application (compilled with Borland delphi) and while injecting some code and saving to an executable it displays a messagebox, it says "unaable to locate data in executable file", for that reason I add some 100 bytes of data using hex editor and I changed the virtual size of the code section by 100 againg it also repeats the same MessageBox while saving to an exectable file..............
all help will be appreciated.
ricnar456
10-31-2005, 08:54 AM
you can have a section with 0 long and all virtual example 10000 long, and when you want save in the executable, is not posible is all virtual.

This is the extreme but is the same sections have a RAW size and virtual size, if the virtual size is larger than raw size, will be parts of this section not posible to write (dont existe in executable)

look this section in ultraedit and you can look where the executable end, and you can add the missed bytes in ultraedit for make equeal raw and virtual, in this case you can write without problems.

sorry my english is bad maybe is very confuse.

try playing with an exe without importance, add with peeditor a new section this have initially 0 and 0 (virtuaal and raw size) if you change the virtual size to 1000 by example and increase the image size in 1000, the exe continue working and the section is created but only exist virtually this 1000 bytes are not addedd to the exe in the HD.
If you try copy to executable olly show the error message (cannot store the bytes)
Go to ultraedit, look the end of the section and add 1000 bytes.

Now the exe is more big (have 1000 bytes more) and in this section when you go to COPY TO EXECUTABLE you can write without problems)

Sorry for the confusing english

Ricardo Narvaja
arjuns
11-01-2005, 02:07 AM
Thank you Ricardo
I'll try this today and write you again the result.
ricnar456
11-01-2005, 09:38 AM
i hope you understand any word of my bad english.

Ricardo
Bob
11-01-2005, 11:52 AM
Your English really isn't that bad Ricardo, I always understand you. :)

~BoB~
arjuns
11-04-2005, 06:40 AM
Ricardo This doesn't work for me .. what to do next.
ricnar456
11-04-2005, 07:40 AM
explain what do yo make and i tell you what´s is your error.

maybe you don´t understand my bad english but is not work or not work, is the real, olly cannot write out of the raw data, but is a delicate theme and is needed not to make the minimum error.
read this tuts

http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/253-IMPORT%20TABLES%20A%20MANO%20(parte%201).rar
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/253-IMPORT%20TABLES%20A%20MANO%20(parte%201).rar
)

http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/254-IMPORT%20TABLES%20A%20MANO%20(parte%202).rar
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/254-IMPORT%20TABLES%20A%20MANO%20(parte%202).rar
)

http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/255-IMPORT%20TABLES%20A%20MANO%20(parte%203).rar
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/255-IMPORT%20TABLES%20A%20MANO%20(parte%203).rar
)

http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/256-IMPORT%20TABLES%20A%20MANO%20(parte%204).rar
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/256-IMPORT%20TABLES%20A%20MANO%20(parte%204).rar
)

this are tuts for repair IMPORT TABLES by hand (without import reconstructor) but i add a section by nand with peeditor and when i go to write the inject in executable OLLY tell me UNABLE TO WRITE DATA IN EXECUTABLE FILE, and is repared in the tut and is possible write.

And read all tut if you can i think is veru useful hehe.

Ricardo Barvaja
Ricardo
arjuns
11-05-2005, 05:37 AM
Ricardo,thanks a lot for your reply. I've found the english version of above mentioned tutorials,they are very cool...
arjuns


Disassembling a kernel function

RCE Messageboard's Regroupment > General > Disassembling a kernel function
1bitshort
10-31-2005, 06:47 AM
I need to disassemble a kernel function (just disassemble, not debug in realtime). Can this be done with Ollydbg or IDA?

For example here is ZwTerminateProcess in ntdll.dll as seen from Ollydbg:
7C90E88E > B8 01010000 MOV EAX,101
7C90E893 BA 0003FE7F MOV EDX,7FFE0300
7C90E898 FF12 CALL DWORD PTR DS:[EDX]
7C90E89A C2 0800 RETN 8
Ollydbg can disassemble this code because its usermode but when the CALL is made it goes to kernel mode and Ollydbg cant debug there. If I made a copy of ntdll.dll would I be able to disassemble from that? I know that the CALL doesnt go directly to the kernel TerminateProcess function but rather a handler that checks the value of eax (101 in this case) and then calls the related kernel function

Has anyone done this before or know how to?
arboc
10-31-2005, 06:58 AM
in ntoskrnl.exe its the function ZwTerminateProcess ,read this to know more about.
http://www.codeguru.com/Cpp/W-P/system/devicedriverdevelopment/article .php/c8035/
(http://www.codeguru.com/Cpp/W-P/system/devicedriverdevelopment/article.php/c8035/
)
http://www.codeguru.com/Cpp/misc/misc/system/article.php/c8223
oh me anon
11-07-2005, 04:18 PM
if you are interested only in disassembling a kernel function but dont want to debug it and dont have two machines

you can use windbg (avl from ms for free and then get livekd from sysinternals)

now with the above combination you can disassemble any kernel function without problems

after successfull installation of windbg
unzip the live kd package too to the windbg dir
then open command prompt and navigate to the dir

when you are the
c:\your path\livekd -w
-w is to activate windbg (gui screen) without -w you will have a console window only
it would ask you if you want to set up the path for pdbs
(i would suggest you to get them it makes life very very easier wading through those wierd mmprobeforphysinkernel functions but you would need an active inet conection if you want to fetch those pdbs from
ms servers)

now to disassemble
try uf nt!ZwTerminateProcess (uf == unassemblefull)
would show you the complete disassembly of the whole
ZwTerminateProcess() call

pretty nifty but you would need to persist and grow with its
awkward gui :) if you persist windbg is a very very usefull tool
to have in your debugging arsenal

and after that if you have two machines you can delve into live debugging of those kernel functions
Epsylon3
11-07-2005, 04:22 PM
You can also use VMWare to do that... but never tried...


drivers

RCE Messageboard's Regroupment > General > drivers
arboc
10-31-2005, 07:03 AM
Hi does any body know how to debug drivers?
ricnar456
10-31-2005, 08:44 AM
use softice or some kernel debugger

Ricardo Narvaja
arboc
10-31-2005, 07:53 PM
Hi ricardo do you know any good tuto to start with sofftice and drivers?
ricnar456
10-31-2005, 09:06 PM
use google softice and ring0, or drivers, maybe have luck, i,m not making tuts with softice now.

Ricardo
arboc
10-31-2005, 09:33 PM
ok thanks man


OllyScript 0.92 Sources for VC6

RCE Messageboard's Regroupment > OllyScript > OllyScript 0.92 Sources for VC6
Epsylon3
11-02-2005, 09:16 AM
Hi.

I ve repacked 0.92 VC7.1 sources for VC6...

I changed Name and version to ODbgScript 1.0 (to be able to have Original OllyScript charged too for comparaison)

i project to enhance this plugin to be able to see script progression, and variables values in odbg..

here is the project :

http://e3.epsylon.org/olly/ODbgScript.0.92.VC6.rar

the dll inside is aspacked... to reduce size (release dll was 308kB sized)

hum... i've some problems to reduce the DLL size, i dunno every things to do that...

maybe somebody could help me to set project settings correctly ?
Epsylon3
11-02-2005, 09:18 PM
updated with a basic MRU List (multithread dll shared version) :

http://e3.epsylon.org/olly/ODbgScript.1.1.VC6.rar
SHaG
11-02-2005, 11:58 PM
Nice going Epsylon3! =) Glad someone wanted to take over the project... Ask me if you don't understand any part of my quite messy sources!
One question, why VC6?
Epsylon3
11-03-2005, 06:02 AM
hi, thanks :)

Why VC6... euh because i think VC6 dlls are often present...
i only have VC6 libs for CE... and i dont want to install every version ;)

also i'm learning VC++, and i will begin with this one...

I'm from Delphi and BCB world.... ;)
Epsylon3
11-03-2005, 06:29 AM
euh... my problem... debuging... i cant do that... my first delphi plugin was able... but here i've a problem to do that...

do you think it's possible ?
Epsylon3
11-03-2005, 07:39 AM
MRU fixed, was some problems due to the static Menu...

http://e3.epsylon.org/olly/ODbgScript.1.1.VC6.rar
SHaG
11-04-2005, 12:27 PM
You mean debugging the plugin's source? Yeah, I did that.... Just write a bat file to copy the newly compiled dll into ollys plugins dir (i had one called copy.bat) and then when the debugger asks you for what exe to start choose your olly installation... Or am i getting your question wrong?
nick_name
11-05-2005, 08:52 AM
Epsylon3 , THANKS for ur nice effort.

** problem seems to be seen while 2 OLLY is running

there seems to be one error in the MRU implementation.

if have 2 scripts in MRU :

script1
script2

now if in that state, i run script2 , the list will become

script2
script1

but still if i run script2, selecting the 1st MRU list item,

script1 will be executed
NOT script2

please check the problem.

thank you.
Epsylon3
11-07-2005, 07:45 AM
i'll make a second context menu on the future script "debug/trace" window... this one can be dynamic... in v1.2

>> i never used ollydbg twice...

tx for the info anyway... i'll maybe try to popup another dynamic context menu in the future (from main menu)... but i think ive other things to do first :p
Epsylon3
11-07-2005, 07:47 AM
Shag:
You mean debugging the plugin's source?

Yep it's what i mean...

ive already made this 2 bat (debug/release)... will try.. maybe i need to copy some lib too ?
SHaG
11-10-2005, 12:07 AM
in my environment (VS.NET 2003) the dll was enough... But then I put all the shit inte the dll so it was quite big...


Scripts from the old site can be found here

RCE Messageboard's Regroupment > OllyScript > Scripts from the old site can be found here
SHaG
11-03-2005, 12:18 AM
Hey again!
You can still view and download scripts from the old site by visiting
http://web.archive.org/web/20041018080024/http://ollyscript.apsvans.co m/
(http://web.archive.org/web/20041018080024/http://ollyscript.apsvans.com/
)

If anyone knows of any other service like web.archiev.org - please post the link here!


NanoMite Table DUMP or ArmInline 0.7.1

RCE Messageboard's Regroupment > General > NanoMite Table DUMP or ArmInline 0.7.1
nick_name
11-04-2005, 09:55 AM
guys, i've been playing with easy cdda extractor v8.2.4(build 1)available at www.poikosoft.com (http://www.poikosoft.com)

it has Debug Blocker + Import Elimination + Nanomite

i fixed Debug Blocker , Import Elimination there.

tried to fix the Nano there with ArmInline 0.7.1 but seems like some INT 3 are still left
like when i try to exit the app or select from the menu Action > Copy Selected Tracks , INT 3 exception shows up ...

i tried to dump tables with N-REC 1.7 'n follow the rest of the process with ArmTools v0.3, but no luck.

i followed the MOVIE COLLECTOR tutorial, i could fix the nanos there with ArmInline but with n-rec + ArmTools ... NO LUCK

** so, am i doing anything wrong with ArmInline or N-Rec ??
** is N-Rec still able to dump file for the new armas ??
** if not, could anyone help me with DUMPING NANO TABLES ??

thank you.
ricnar456
11-04-2005, 11:07 AM
i don´t use this tools, i always use few tools, and if is possible only very few, is simple this tuts was readed by chad and change in the next version of armadillo, for this tools don´t work, this is the problem in make the nanomite repair with tools.

Ricardo Narvaja
nick_name
11-04-2005, 01:53 PM
ricnar THANKS for your quick reply

can you please point me to any tutorial which shows how to handle with NANOMITES without these tools

and specially how to get those NANO TABLES ?

thanks again
ricnar456
11-04-2005, 02:08 PM
i don´t write tutorial with manual methods for nanomite, for the reason the last time i write tuts of armadillo, next version the author change the program
I change slightly my methods and make the manual method for nanomites next, but don´t write tut sorry.
If you have an idea i can suggest you some ideas by mail.
And the manual method is a hard work, work in all nanomites and version but is very hard, if the automatic tool method is posible, i suggest you try this is more easy.

Ricardo Narvaja
nick_name
11-04-2005, 05:32 PM
ricnar, THANKS A LOT AGAIN for your kind reply.

i have the overall theoritical idea about nanomite ... please contact me by mail

nick_name@coolgoose.com

thank you
ricnar456
11-04-2005, 07:35 PM
do you think made manually?

ricnar456@yahoo.com.ar

if have any problem

Ricardo Narvaja


How to find text in Ascii

RCE Messageboard's Regroupment > General > How to find text in Ascii
Dalinkquint
11-06-2005, 08:29 PM
i got actual text i need to find in Ascii...
is there an easy way to find the text without looking threw all of it.
thanks
ricnar456
11-07-2005, 07:38 AM
you need have a serach of a text in the entite memory?

Go to M window or go to VIEWINDOWS and right click serach and in the asc par type your string and SEARH, when you find the first, hit CTRL +L for search NEXT and so.

Ricardo Narvaja
ricnar456
11-07-2005, 07:39 AM
you need have a serach of a text in the entire memory?

Go to M window or go to VIEW - WINDOWS and right click search and in the asc part of the box, type your string and SEARCH, when you find the first, hit CTRL +L for search NEXT and so.

Ricardo Narvaja
Epsylon3
11-07-2005, 07:48 AM
you can use "?" character for unknown chars... in the bin string
Dalinkquint
11-07-2005, 01:40 PM
when i search it doesnt move to what it finds it just stays still.
ricnar456
11-07-2005, 03:53 PM
i don´t understand sorry

Ricardo
Dalinkquint
11-08-2005, 04:15 PM
this might be better detailed...

now, the the text is "delay" its in the ASCCI place or w/e its 3 below iscashitem. ur gonna have to find out how to search for it...

i just need to know how to search for it. ty
ricnar456
11-09-2005, 07:46 AM
go to M and RIGHT CLICK-SEARCH and tye delay in the asc part of the window, when you find the first ocurrence, tyoe ctrl +L for find the second and so on.

Ricardo


CRC Check on aspr 2.1x

RCE Messageboard's Regroupment > General > CRC Check on aspr 2.1x
JimmyX
11-06-2005, 10:01 PM
Hello to all.
I know, i'm a noob, but i need begin of somewhere. After read a lot of noobs guides, search on Google, i can't find one thing. I need know if is possible bypass CRC Check on aspr 2.1x. I need some tips of "how to do" or where i can find the location of CRC Check.
Any help will be appreciate.

Thx guys and sorry for my english.


Armadillo - son doesn't run

RCE Messageboard's Regroupment > General > Armadillo - son doesn't run
cps530
11-07-2005, 05:48 PM
I have and application packed with Armadillo. PEiD says 1.xx - 2.xx. stdu_PE, 2.5x-2.6x and RDG Packer Detector 2.60. It has father and son (Copymen II). I can detach son from the father and found OEP. The problem is: if I press F9 in Olly to run the son I get the message from Windows (XP): '... Executable has encountered a problem and needs to close...'. I have searching again and again and reading lot of tutorials, but I can't find the reason. Maybe the son needs information from the father (now stopped). Sorry if the answer is too stupid but I'm new in Armadillo. Any idea to continue will be wellcomed. Thanks
ricnar456
11-07-2005, 06:40 PM
read tutorial of nanomites

Ricardo Narvaja
cps530
11-07-2005, 07:59 PM
OK. I will. Thanks again.


ODbgScript v1.20 - New Script Window !

RCE Messageboard's Regroupment > OllyScript > ODbgScript v1.20 - New Script Window !
Epsylon3
11-07-2005, 08:18 PM
What's new?
---------------
1.21 (8 Nov 2005)
+ Remember Script Window Position & State
+ Automatic Scroll to follow script
+ Context Menu (Real MRU/Follow) in Script Window
# Fix table refresh
# CMP string compare is now case insensitive

1.20 (7 Nov 2005)
+ Script Window with values and eip
+ CMP now accepts strings from address

1.10 (5 Nov 2005)
+ MRU List

1.0 (4 Nov 2005)
# ODbgScript (VC6 Based)

You can download here :
http://e3.epsylon.org/olly/ODbgScript.1.21.VC6.rar

http://e3.epsylon.org/olly/script.png

http://e3.epsylon.org/olly/contextmenu.png
nick_name
11-07-2005, 08:41 PM
Epsylon3, the new SCRIPT WINDOW is really really helpful !!
i'm already using it ...

hope u'll look into the matter to fix the tiny menu bug too

THANK YOU.
Epsylon3
11-07-2005, 08:59 PM
=)

Next version :
- Remember Window State & Position (already made)
- Optimize Refresh when window hidded (some pbs with dual screen i've seen)
- Context menu in Script Window
SHaG
11-07-2005, 10:24 PM
Beautiful work Epsylon3!
Thought about script tracing for a long time but never got around to implementing it... Guess I'm too lazy.
Epsylon3
11-07-2005, 10:57 PM
tx =)

next version will be nice :)

1.21
+ Script Window Position & State
+ Automatic Scroll to follow script
+ Context Menu in Script Window
# Fix table refresh
# CMP string compare is now case insensitive
....
Epsylon3
11-07-2005, 11:09 PM
do you have some other ideas ? :)
nick_name
11-08-2005, 08:04 AM
epsylon3 , bueautiful work !!

how about adding a right click SCRIPT menu + MRU in the CODE WINDOW of olly like we use to c in Asm2Clipboard 'n in some other plugins ...

thank you, hope u'll keep up the good work !
mr haggar
11-08-2005, 10:06 AM
New plugin needs word and byte variables, ROL and ROR opcodes. I had couple more ideas, maybe I'l post it later.
Epsylon3
11-08-2005, 02:53 PM
Nick:
Ok for MRU, i ll try

Haggar:
If i make a third parameter to the MOV instruction (size 1 2 4, more for string), does that would solve your problem ? << could somebody tell me the right english sentence for this question (US person plz) i'm not sure :p)
Bob
11-08-2005, 11:40 PM
It would be : "Would that solve your problem?"
:)
Epsylon3
11-09-2005, 09:46 AM
thanks bob ;p)
SHaG
11-10-2005, 12:05 AM
# CMP string compare is now case insensitive

May I humbly suggest implementing it as a new command, something like scmp (String CoMPare) or cmpi (CoMPare case Insensitive)?
Epsylon3
11-11-2005, 10:43 AM
yes, i think it's a good idea... maybe two new functions... SCMP and SCMPI
SHaG
11-11-2005, 12:49 PM
Epsylon3: yeah, both are needed I think... By the way, if you are on EFnet would you please msg me? Have some things to ask. =) Nick: SHaG (surprise!).
Epsylon3
11-11-2005, 02:24 PM
My Nick : Epsylon3
mr haggar
11-11-2005, 07:13 PM
>If i make a third parameter to the MOV instruction (size 1 2 4, more for string), does that would solve your problem ? << could somebody tell me the right english sentence for this question (US person plz) i'm not sure :p)

You mean that only one byte is loaded in variable? Or in memory too? I was writing one script that decrypts Krypton0.5 pices of code that are encrypted. There I needed ROL and ROR opcodes, also that could work with bytes operands. I needed to decrypt byte-by-byte that pice of code. So what I need is:
- move one byte to variable
- ROL or ROR it
- place decrypted byte instead.
If you can make this working, that would be great. Maybe it can be done with present plugin, but that would be lot of working around.

Next thing that I would like to see. You know this:

gpa "SomeApiNameHere","SomeDllNameHere"

Can you make that script can read api and dll names from ASCII strings in exe? Like:

gpa x,y

where x and y would be addresses of ASCII strings terminated with zero, hardcoded in exe. I was unpacking beria and this would be usefull to rebuild thunks.

Thanks.

O yeah, I din't find manuall in your new plugin. Did I mised it? It would be nice to see new feature explained.
Epsylon3
11-13-2005, 06:21 PM
try

gpa [x],[y]

humm... you are right, not working i think...
i will add that in next version...

i'm waiting for some fixes from exetools forum.... to release this next version...

where x y are string addresses
mr haggar
11-13-2005, 07:47 PM
Great, thanks.
Epsylon3
11-14-2005, 11:01 AM
New version uploaded with sources :

http://e3.epsylon.org/olly/

1.23 (14 Nov 2005)
+ Enhanced String by Address support for commands (ex: gpa [nAddr],"KERNEL32.DLL")
+ lm, load Dm file to mem: lm, 0x401000, 0x100, "test.bin" (MetaCore)
# fix the dm, lm, dmp, dpe 's default dump path to debugging app's path. (MetaCore)
# fix dm, ...the open file parameter is incorrect, will add mess "0a 0d" at each lines tail. (MetaCore)
# fix all dump related function's parameter check, so when the real mem is smaller then gived
dump length, will not add mess data at the end, and the $result also catched the real dump size. (MetaCore)

1.22 (11 Nov 2005)
+ Added SCMP and SCMPI for string comparaison (SCMPI for case insensitive)
# Restored CMP string comparaison to case sensitive


LordPE problem

RCE Messageboard's Regroupment > General > LordPE problem
nick_name
11-08-2005, 01:22 PM
guys, with some armadillo targets (specially with nanomites 'n copymem/debug blocker) i've seen weird LordPE delux B behavious

if i select full dump with LordPE, it silently crashes 'n produces a error-prone dump file.

the options that r ticked in my LordPE settings are :

1.section table : autofix SizeOfImage
2.full dump : paste header from disk
3.full dump : fix header
4.full dump : rebuild image
5. delete temp files for pe editior

REBUILDER :

status window
dumpfix
realign file : nice
wipe relocation
rebuild import table
validate PE

is there any rebuilder options which i should not use ??

thank you.
Lord_Looser
11-08-2005, 03:25 PM
I'm not sure but I think rebuilder options are only for "rebuild pe" and activated "full dump: rebuild image" option. Perhaps you should first dump file without rebuild option. I've always disabled "Rebuild import table". Therefore I use ImpRec.
But im not sure with nanomites...
nick_name
11-08-2005, 06:00 PM
Lord_Looser , then do u suggest i should disable the option

full dump : rebuild image

keeping the other options like full dump : fix header

??
ricnar456
11-09-2005, 07:45 AM
look this, before dump when you are in the oep, open other instance of the program but don´t RUN only go to 400000 and copy the 1000 bytes of the header with BYNARY COPY and next paste in the header of the son stopped in the oep, look the differences (will be in red).
Armadillo make changes in the heade while unpacking for make imposible or hard dump, next dump.

Ricardo Narvaja
nick_name
11-09-2005, 11:38 AM
ricnar THANKS for your reply.

well, i have been actually using the technique that you mentioned. 'n afterward ollydump 3.00.110 to dump it

but i was just wondering, is it any bug in LordPE

** somewhere i read, ollydump 3.00.110 is buggy 'n they were suggesting to use 2.xx version, is it true ??
i was using 2.xx 'n recently upgraded to 3.00.110

THANK YOU.
ricnar456
11-09-2005, 01:15 PM
if you reconstruct the iat with IMP REC is the same use Version 3 or 2, the version 2 recoonstruct IAT in some UPX , ASPACK or esay packers, the version 3 have a bug in this but, for armadillo is the same.

I use OLLYDMP 3 for dmps armadillos without problem.

Ricardo
nick_name
11-09-2005, 02:05 PM
THANKS Ricardo


virtual function comments

RCE Messageboard's Regroupment > General > virtual function comments
5aLIVE
11-09-2005, 10:11 AM
Hi, when debugging a program (with it's IDA map file loaded) I can see a call to a virtual function such as :

005A6AD7 FF91 20010000 CALL DWORD PTR DS:[ECX+120]

As expected, there is no comment string present until the EIP is at this instruction and the virtual table address pointer is calculated

Olly then displays a comment string like;
005A6AD7 FF91 20010000 CALL DWORD PTR DS:[ECX+120]
<Debugee.ParentClass::DerivedClass::MemberFunction>

After this call has been executed, the comment string is cleared.
Is there a hot key or something else I can use to make an interesting comment "stick"? Or can comments only be added manually with copy and paste?

Thanks for any help.
Regards,
5aLIVE.
5aLIVE
11-09-2005, 10:30 AM
Or can I change the runtime comment to be a label? Either way would be useful. Perhpas there is a plugin available that can do this?

5aLIVE.
5aLIVE
11-09-2005, 10:31 AM
Or can I change the runtime comment to be a label? Either way would be useful. Perhpas there is a plugin available that can do this?

5aLIVE.
5aLIVE
11-09-2005, 10:34 AM
Repeat post please delete
ricnar456
11-09-2005, 01:16 PM
you can add a coment, right click in the line, and add coment manually.

Ricardo Narvaja
5aLIVE
11-09-2005, 01:31 PM
Hi Ricardo, I've been entering them manually (the ; key), but I am lazy and wondered if there was a key I could press to do this automatically?

It's not a big problem, I just wondered if it is possible?

5aLIVE
ricnar456
11-09-2005, 02:11 PM
i don´t know sorry

Ricardo


Unable to find binary known ASCII string in dump

RCE Messageboard's Regroupment > General > Unable to find binary known ASCII string in dump
5aLIVE
11-09-2005, 01:19 PM
This has got me puzzled. If I run an exe and do a text search for a given ASCII string I can find it easily using WinHex.
If I try binary search (Ctrl-B) in the dump screen Olly cannot find it.

If I enter the offset (Ctrl-G) given in WinHex Olly gives the "unknown identifier" which I take to mean that this is outside the dumped address space??

I can find other strings in both Olly and WinHex at the same offset provided that they can be seen in the Olly dump screen address range.

Can anyone suggest what is wrong please?

Thanks 5aLIVE
5aLIVE
11-09-2005, 01:27 PM
PS. If I scroll down the dump screen, I will see empry adresses, hex dump and ASCII values in every row.
Some broken horizontal lines can be seen in the area too??

PPS I am using Oll 1.09d, I don't know if that will make any difference, I'll try v1.10 to see if this makes any difference.
ricnar456
11-09-2005, 02:10 PM
OLLY serach for BYNAR STRING for default ONLY IN CODE SECTION, change in DEBUGGIN OPTIONS - EVENTS - change the mark to

SERACH FOR REFERENCES in MEMORY BLOCK SELECTED IN DISASSEMBLER.

Go to the section in the dissassembler you need serach , and make the search.

Ricardo
5aLIVE
11-09-2005, 04:12 PM
Excellent! Thankyou Ricardo.
Stcruxenio
11-11-2005, 02:04 AM
Thanks, too! I had the same problem.
Just a minor correction: Debugging options\Debug (not Event).
5aLIVE
11-11-2005, 08:33 AM
@Stcruxenio, yes that right, it took me a little while to find it in all the options found in Olly. I should have added the minor correction to Ricardos helpful information myself.

Thanks guys.
5aLIVE


how to duplicate items in flyff with ollydbg?or other hacks?

RCE Messageboard's Regroupment > General > how to duplicate items in flyff with ollydbg?or other hacks?
123hacks
11-11-2005, 11:18 AM
Hi guys iam new here and i want to work a little bit with ollydbg.
I want to duplicate items or other interesting hacks.
But i need tutorial for the first steps.I dont know anything about this tool xD
But i think if any1 give me some help i will be able to work a little bit with it.
So guys plis anyone make a step by step intreduction how to duplicate items in flyff or other hacks.
THX


[Plugin] Bypass Hardware breakpoint protection

RCE Messageboard's Regroupment > Plugins > [Plugin] Bypass Hardware breakpoint protection
Mattwood
11-11-2005, 03:35 PM
Hi all,

i wrotten a new plugin wich hook the SEH to bypass the hardware protection.

http://reverseengineering.online.fr/spip/article.php3?id_article=53

You can be found it here.

And i wrotten an article about the SEH hooking you can found it at the same address.

Mattwood^FRET
Lord_Looser
11-12-2005, 07:14 AM
Thanks a lot, very nice idea.
ShubNigurrath
11-15-2005, 01:34 PM
excellent idea. Well done


? - command

RCE Messageboard's Regroupment > General > ? - command
Steffen Sveegaard
11-13-2005, 12:10 PM
Hi all

I'm trying to follow a tutorial where softICE is used, but I use OllyDbg instead. But, the tutorial says something about a '?'-command and I try that in OD's commandline.

I get no useful output and it's totally different to the tutor's.

How do I convert the output to something useful?
ricnar456
11-13-2005, 02:15 PM
type in the commandbar of OLLY

?

and you have de value of de expression

? eax (value of eax in HEX,DEC and ASC) by example

Ricardo
Steffen Sveegaard
11-13-2005, 02:44 PM
Well, I get a value, but not the same as in the tutor.

So I have to type:
? eax asc

or something similar?
ricnar456
11-13-2005, 03:59 PM
i don´t know what value have eax in the tutor if you typ

? EAX you will have the hex, dec and asc value of EAX, only work with positive numbers if eax=0FFFFFFFF by example the result will be wrong is a command bar bug.

Ricardo


Armadillo :-)

RCE Messageboard's Regroupment > General > Armadillo :-)
HANDS
11-13-2005, 04:55 PM
Hi everyone.
I am dealing with a prog packed with armadillo (from PEiD 1.xx-2.xx). i am new in armadillo unpack and tried follow some tuts, but sometimes i cannot apply in this app.
It has Copymen2 so i tried the folowing approach:
a) bp WriteprocessMemory - at 2nd break, the father writes 2 bytes into son... i followed address in dump and patched with EBFE. The removed bp and let it run
b) bp WaitForDebugEvent - and olly breaks, then goto the ret, and landed in a test eax, eax (eax==0)
c) checked the PID of son, then assemble the PUSH and DebugActiveProcessStop and trace over this instructions
d) open a new olly and attached the son, F9, F12, then reverte the patched bytes and Bp CreateThread..... It breaks at SetProcessWorkingSetSize and after exit the call and trace down a bit i find the "Call EDI" but seems not to be the OEP :-(
(Also in the son process, the IAT is not completed yet)
Anyway son doesn't run and stop if we hit F9.

Well.., i must miss something! (lol) Some magic jump, almost for sure.. or something more complicated as nanomites?? Please give me some hints from the above description.
Thanks in advance.
ricnar456
11-13-2005, 05:10 PM
you have differents types of armadillo and you mix all types hehe.

Ricardo
HANDS
11-13-2005, 08:43 PM
Thanks for replying Ricardo..

I mixed all!! (LOL) So it was a bad approach..... :-s
I deal for sure with Copymem II and import table in son have that 'strange' calls for Import API's... In your opinion, what methods shall i do not mix from my approach????

The RDG gaves me Armadillo 2.85, but i cannot found any good tute to aply my app.......
I have some tuts (some from yr site;-) ) but in this particular app, i cannot follow some important steps of them. I mean, the 'father' seems to be a good guy, but the 'son' is a «son of»..... :-)
Lord_Looser
11-13-2005, 09:18 PM
Use "Armadillo Process Detach 1.1" (google) to detach son from parent process. Don't close Detacher while debugging son process. Attach debugger to child process will break at son's EP (not OEP).
HANDS
11-14-2005, 09:19 AM
Thanks Lord_Looser.

I only found ArmDetach v1.1 in a toolkit for crackers :p but its a rar with password encrypt..... (the given password doesn't work)
Anyway, my intention is learn the process of detach and unpack armadillo(educational proposes)!

It seems to be easy unpack, but i must be missing some trick.... Also the ollyscripts seemed to patch a wrong address in the child process :-(

The app is packed, but it doesn't have any restrition or time limite, so i would not cause a big trouble if saying its name: Docucabinet
(erase the post if compromise something).

If possible, have a try and please tell me what i doing wrong (in my 1st post).
Thanks.
Hands
ricnar456
11-14-2005, 12:15 PM
first step locate what type de OLLY is

1) if have two process and have a 3er stop in writeprocessmemory (take care with this armadillo protect writeprocessmemory against BP and don´t stop the third time, put HE or put the BP in the RET of the API), if armadillo stop a 3 time in writeprocessmemory is a tradicional copymem2.

2)Ir armadillo stop only 2 times in writeprocessmemory and don´t stop, putting HE, BP in the Ret of the api, is a non copymem2, two process armadillo.

3)one only process is a 3er type

What type of arma is

Ricardo Narvaja
HANDS
11-15-2005, 08:55 PM
Hola Ricardo...

It is a first one type of armadillo...
It can stop several times in WriteProcessMemory... (copying/writting the sections for the child)!
Anyway the Ollyscripts and my tries to find the EP of child and then the OEP seemed out of place or something still need to decrypt! :-(

Was my approach right? or needed to wait till 3rdt Bp on WriteprocessMemory (i put hardware bp or bp at end of call)?

More... This type of protection has <u>usually</u> 'Magic Jump'?
or/and IAT elimination? ...nanomites?

Thanks again.
Hands
ricnar456
11-16-2005, 05:56 AM
ream my old tutorials (there are english version) of armadillo with copymem2 GETVERSION PROGRAM and you understand how armadillo work in copymem2, is a old version of armadillo but the work continue being the same, only was added more proteccion against BP and ollydbg, the general wprk is the same for find the oep.

Ricardo
Lord_Looser
11-16-2005, 07:31 AM
Armadillo Process Detach 1.1
hxxp://sosrock.free.fr/forum/lire.php?msg=7363

a) don't patch EBFE in dump, patch in child process memory with e.g. WinHEX

I have to correct my 1st declaration:
Close Detacher after attaching to son process.
(Parent process must continue after step c) DebugActiveProcessStop.)

parent EP 0060E0B9
child EP 0060E0B9
chilld OEP ?
HANDS
11-16-2005, 08:26 AM
Thanks to both...
I'll give a try!


Hola Ricardo¡¡¡

RCE Messageboard's Regroupment > General > Hola Ricardo¡¡¡
lucho
11-13-2005, 05:46 PM
Te saluda un disipulo tuyo desde las clases del curso antiguo, mira que si tengo material impreso.

Bueno, por cuestiones de tiempo me he desfasado del apasionante mundo del Cracking. y tengo un problema con las interrupciones en Olly.

Quisiera que me orientes acerca de algun tutorial sobre el manejo de las interrupcion y poder interceptarlas ( int3, int0, int1)

Que me disculpen los amigos del foro por escribir en castellano.

Saludos.

PD: sabes algo sobre nuestro comun y buen amigo Karpoff ?
ricnar456
11-13-2005, 07:39 PM
Karpoff se retiro hace un tiempo nos upe mas nada de el.

En ollydbg todas las excepciones esas parara cuando las ejecute siempre que en debugging options-execptions no este puesta la marca en INT 3 por ejemplo para que las evite.

Una vez que para vas a VIEW-SEH CHAIN y veras donde continuara ejecutando la execpcion pones un BP alli y apretas SHIFT mas F9 y parara.
Luego segun lo que ejecute y lo que se modifique en el context tenes adonde volvera y si borra hardware box o que es lo que hace alli.
Ricardo
lucho
11-14-2005, 11:41 AM
Gracias mil Ricardo por el dato.
manius
01-03-2006, 09:12 PM
Hola Ricardo, enhorabuena por el curso de Ollydbg, es lo mejor que hay en internet....de lejos.
Espero que sigas con el curso, no me pierdo ni un solo capitulo, todos excelentes, claros, practicos.
¿Sabes que no se puede acceder a tu página web?
Te pide un password.
Por otro lado ¿sabes donde puedo encontrar los 400 tutoriales hechos con el Ollydbg y que corresponden al curso antiguo?

Gracias por todo lo que haces para que nos iniciemos en el mundo de la ingenieria inversa.....es fascinante.

Un saludo desde españa.
ricnar456
01-03-2006, 09:24 PM
http://www.ricnar456.dyndns.org/

ftp://www.ricnar456.dyndns.org/

user:hola
pass:hola

alli esta todo pero no confundas esta es la introduccion al cracking con ollydbg, hay tambien un nuevo curso con ollydbg y un viejo curso con softice.

o sea el nuevo curso con ollydbg era muy complejo y de nivel muy alto por eso para los que se inician empece a escribir y aun continuo la introduccion, para empezar de cero.

Ricardo
manius
01-03-2006, 10:18 PM
Gracias Ricardo, no me pierdo ni un solo capitulo de tu curso, espero impaciente las proximas entregas...

Un saludo desde el otro lado del charco
comrade
01-03-2006, 10:37 PM
Viva Emanuel Ginobili!
manius
01-11-2006, 11:11 PM
Hola Ricardo,

No me ha quedado clara tu explicación sobre la diferencia entre un PID y un handle, creo que "casi" lo entiendo, pero no logro ver claramente la diferencia:

.......¿Que diferencia hay entre el PID y el handle?, muy sencillo, el PID es un identificador genérico, en toda tu maquina, en cualquier proceso el PID del OLLYDBG será el mismo mientras no se reinicie, en mi caso será 2d4, ahora el handle, como su nombre lo indica es un manejador, o sea que es un número que te devuelve el sistema para que tu programa pueda manejar ese proceso, y el número puede variar para cada programa, es como una solicitud para controlarlo, si no la ped�*s no tendrás el numerito y no lo podrás controlar, si lo ped�*s el sistema te devolverá el manejador y lo podrás manejar.......

¿Te importaria explicarmelo de nuevo?.

Tus tutoriales son increibles, muchas gracias por el esfuerzo.

UN abrazo.
ricnar456
01-12-2006, 08:56 AM
bueno cuando un proceso arranca el sistema le otorga un numero que lo identifica que es el pid y que dura hasta que se cierra el proceso, si lo volves a arrancar nuevamente le dara otro PID, o sea que mientras dura funcionando tendra su numerito y cualquier programa que consulte sobre este proceso, obtendra si lo pide este PID.

el handle o manejador es otro cosa, pongamosle que mi programa se llama pirulo.exe y pide el handle para otro programa llamado jeje.exe, el sistema le otorga un handle, para poder manejarlo, lo cual le permitira entre otras cosas, cerrarlo, escribir en el, leer de el, etc, ahora los handles no son genericos para todos lo programas, este sera de uso interno solamente, y si te fijas el programa tiene una lista de handles que se van otorgando en orden, o sea te doy un ejemplo en general los handles son entregados en numeros que van de 4 en 4, asi que ponele que el sistema le entrega al programa el handle 40 para manejar jeje, porque no esta en uso en ese momento en la lista de handles de pirulo, asi como se otorga un handle se quita mediante la api CloseHandle, y si le pedis al sistema un handle para otra cosa, y esta sin uso pues ya lo dejaste de usar, te otorgara el 40 para otra cosa, o sea que a mi me decis 40, y no me identificas nada pues en una misma ejecucion el famoso 40 puede haber sido handle de un programa, luego de un thread, luego de otro programa diferente, es algo temporal solo para manejar al susodicho programa durante un tiempo, nada mas no es como el pid que es como un documento, desde que nace hasta que muere el proceso lleva ese numero en tu maquina, para cualquiera que lo solicite,

Ademas tu programa puede pedir un handle para jeje y ser 40, y otro programa puede pedir un handle para jeje y ser 3C o 40 o 4C pues es un numero interno que no tiene validez fuera de el programa que lo solicito.

Por lo demas saber el PID te ayuda a identificar un proceso, pero si queres cerrarlo, escribir o leer de el necesitas un handle para hacerlo, el handle es el poder sobre el programa.

La diferencia es como si de una persona averiguas el NUMERO DE DOCUMENTO, tenes informacion pero no te da poder eso es el PID, ahora, si tenes el handle es como si sos el jefe de esa persona, podes darle ordenes y te obedecera dentro de los limites del trabajo.

Ricardo
manius
01-12-2006, 11:56 AM
Hola Ricardo,

Muchas gracias por la aclaración, ahora si lo he entendido, aunque tengo una duda: ¿Como es posible que un programa tenga la capacidad de cerrar otro programa?,
Segun me dices en tu mensaje, esto es posible solo con pedir un "handle" al sistema. Suponia que para cerrar un programa deberia pedir permiso al que lo abrió.

Un saludo


Changing ascii strings

RCE Messageboard's Regroupment > General > Changing ascii strings
Locutus
11-14-2005, 01:45 AM
Ignore please, found the solution.


Change the window name

RCE Messageboard's Regroupment > General > Change the window name
MagMa
11-14-2005, 02:47 PM
hi im trying to change the window name, but i cannot find where the string is stored. :(

hola.. estoy tratando de cambiar el nombre de una ventana, pero no encuentro donde esta el string.

any idea?
or any tutorial explaining how the window handles works in olly?
thanks
ricnar456
11-14-2005, 03:03 PM
put a Bp in CreateWindowExA maybe stop when is created

Ricardo Narvaja
MagMa
11-14-2005, 03:36 PM
thanks for reply ricardo..
it doesn´t stop with that api..
i was looking and it create multiple threads, first a nag screen and then the window using a name, and then it change the name,... it uses windowprocA and wm commands, but anyway i cannot find where stores the name :(
i tried setting a bp everytime it calls windowprocA but when it change its name, it seems to use another api O_o
MagMa
11-14-2005, 03:43 PM
i also tryed searching for the string in the memory before start the program and it doesn´t apear to be there at least as ascii or unicode
ricnar456
11-14-2005, 08:47 PM
try mesaagespy method look in my http there are two tutorials.

Ricardo


ODbgScript - my wishes for improvement

RCE Messageboard's Regroupment > OllyScript > ODbgScript - my wishes for improvement
shERis
11-15-2005, 01:32 AM
Dear Epsylon3!

I made a new topic for our wishes of improvement of ODbgScript!

Here are my wishes (I am waiting very long time for fulfillment :-[ ):

1. OPCODE addr -> new function
OPCODE addr sets the $RESULT variable to the opcode bytes, $RESULT_1 variable to mnemonic opcode (i.e. MOV ECX,EAX) and $RESULT_2 to the length of the opcode. If an invalid opcode appears, $RESULT_2 should be 0. addr is increased by the length of the opcode (disassemble command). With this function you can step forward through code.

2. PREOP addr -> new function
PREOP addr sets the $RESULT variable to address of previous opcode of addr. If any error occurs, $RESULT is 0. With this function you can step back through code.

3. REF addr -> new function
REF addr works as "Find references to .. Selected command" and "Find references", Ctrl R, in OllyDbg. Now the problem is, that there are not defined arrays. The $RESULT variable should now be set to the first reference addr and $RESULT_1 to the opcode if available and $RESULT_2 to the comment (like reference window). The next refs you can get by using NEXTREF.

4. NEXTREF addr -> new function
NEXTREF addr works as REF, but results in the next reference. Another call of NEXTREF should result in the next reference and 0 if no more is found.

5. GMI -> more arguments
gmi addr,MEMBASE and
gmi addr,MEMSIZE
The $RESULT variable is set with the base memory adress / the memory size of an existing memory block.
If addr is in module the result could be MODULEBASE/MODULESIZE. (MODULEBASE and MODULSIZE now returns 0 if an address outside module is used.)

6. ALLOC len -> new function
ALLOC allocates a new memory block of length len, the base address is returned in the $RESULT variable. If any error occurs, $RESULT is 0.

7. FIND -> improvement
FIND should work with variables too (instead of only constants now)!
Example:
var x
mov x, "6A00E8"
find eip, x // find a PUSH 0 followed by some kind of call

8. FINDOP -> improvement
FIND should work with variables too (instead of only constants now)!
Example:
var x
mov x, "6A00"
findop eip, x // find a PUSH 0

9. GPA -> improvement -> OK !
GPA should work with variables too (instead of only constants now)!
Example:
var api
mov api, "MessageBoxA"
var dll
mov dll, "user32.dll"
gpa api, dll // After this $RESULT is the address of MessageBoxA

10. FINDMEM addr, what -> new function
Same as FIND, but searches in all allocated memory blocks (like search function in memory map window), not only in the memory, in which addr is located !

11. WRT what, file -> new function
WRT writes what (string or value) to specified file file. If file exists, it is overwritten.

12. WRTA what, file -> new function
WRT writes what (string or value) to specified file file, but it appends data to existing file.

I hope, this is not to much for you. But I think some functions are not very difficult to realize.

Thanx for implementing in ODbgScript, Epsylon3 :-))

~hERi~
Epsylon3
11-15-2005, 07:24 PM
if somebody has some time to do some functions... give me the code... i'll merge to the plugin....

i'm very busy this week...

but i'll add this new funcs and also other GUI things... like "edit script file", "script breakpoints (to pause or step)"
shERis
11-16-2005, 04:44 AM
Hi Epsylon3!

I am a newbe in programming C. So I can´t help you. But if someone else could do ...

Thank for your help!

~hERi~
Epsylon3
11-16-2005, 11:33 AM
i've made a new version for script debugging (step to step and breakpoints) and hotkeys...

these commands will be implemented soon :

FIND & FINDOP improvements
WRT WRTA implementation

Check the "1.20" thread, i will edit it when done...
shERis
11-18-2005, 09:23 AM
Hi Epsylon3!
I tried to help you and made a new function GMEMI instead of improving GMI (point 5).
You can see it here (ollyscr.balder.prohosting.com/GMEMI.txt).

Furthermore I changed GPA (point 9). Errorhandling now can be made by the script with $RESULT_1.
You can see it here (ollyscr.balder.prohosting.com/GPA.txt).

The code is NOT tested, there could be bugs! Please check and integrate in your script!

I have added help text for your help file readme.

Thanks

~hERi~
shERis
11-18-2005, 09:27 AM
Links were not well !
GMEMI.txt (http://ollyscr.balder.prohosting.com/GMEMI.txt)
GPA.txt (http://ollyscr.balder.prohosting.com/GPA.txt)
nick_name
11-18-2005, 02:22 PM
for the GPA's case , instead of using another variable $RESULT_1 cant it simply return string " INVALID DLL / LIB " in the $RETURN variable ??
shERis
11-18-2005, 02:37 PM
Hi nick_name!
This is the current state. But I is not useful. When a variable address is given to GPA by the script and this address is invalid, then the script stops with an error message and you cannot handle the error with the script himself! The execution of the script is canceled.
Therefore it is better you include some code (only 5 lines) and make your own error message handler (with your own error message!).

~hERi~
nick_name
11-18-2005, 05:39 PM
shERis , ya i understand ur point, but after handling that error why dont u just strcopy CUSTOM ERR MSG into $RETURN
( i mean if that's not impossible , i have'nt looked into the code )

i guess that'd just keep things a little less complicated

thank you.
mr haggar
11-18-2005, 06:56 PM
gpa [x],[y]

gives error message and exit script if x ordinal is not found in y dll, as you noticed. It would be good that in next versions in case of wrong ordinal, return value to $RESULT is 0 instead of exiting script. In this way script can continue or we can chose to continue or not.

Next issue; script plugin uses always focused - always on top message box. It would be good to make them not focused in case of trouble shoting script. Because you are allowed then to abort script or pause it.

So Epsylon3 I hope that you will find some time for this in new versions. I know that you have probably more important things than this, I just wanted to say that new plugin is great and you are doing great job. Thanks.

Regards, haggar.
shERis
11-19-2005, 05:36 AM
That´s all right, mr haggar!

I hope too, that Epsylon3 has more time to improve ODdbgScript. We all are waiting for it!

Perhaps I have some additional ideas for improvement.

~hERi~
Epsylon3
11-19-2005, 04:13 PM
yea... i will make changes as soon as possible...

made :
1.24 (19 Nov 2005)
+ FIND and FINDOP supports strings and string vars arguments
+ MSG and MSGYN have now Cancel buttons to pause script (MSGYN returns 2 if canceled)
# Script will now pause instead of stop when error is returned from commands
+ Script Breakpoints (to "debug" a script)
+ Added Real "Load Script" to start paused (script window)
+ Added Step/Resume and Hotkeys (script window)
Epsylon3
11-19-2005, 06:36 PM
http://e3.epsylon.org/olly/
shERis
11-22-2005, 12:48 AM
Hi Epsylon3!

I tried your new version - and found a bug !

1. FIND eip, #8B??# (wildcard search) doesn´t work any more !!!
2. FIND only works with string constants and string vars! Binary searching is not possible! Perhaps there should be a function to set a string variable supported by the FIND function with the content of a pointer to a string or binary value in memory.
3. I find script pausing after an command error not useful. A command error must be corrected by modifiying the script. This is only possible if you always manually abort the script! Please restore the original function of aborting the script when a command error appears.
5. The context menu of the script window should have the abort menu item too.

All other improvements are very good !

~hERi~
Epsylon3
11-22-2005, 02:00 AM
ok, i will try to fix that....

made for 1.25 (22 Nov 2005)
+ Added WRT (write a file) and WRTA (append) commands: WRT file, data
# fixed OllyDbg focus problem
# fixed path of created files when full path given

For the 3. ... i will keep the pause, could be usefull to ignore after error, but you can use the MRU to restart script.... or Restart Debug session, which requieres script reloading too (for the moment)...
Epsylon3
11-22-2005, 05:29 AM
the PREOP concept is a very good idea....

and i think it could be a full new concept :) the reverse execution....
but i dont know if it's really possible to know last eip with plugins....
because the plugin is not called on every CPU commands...

hmm so... i release 1.25 :

1.25 (22 Nov 2005)
+ Added FINDMEM to search into the whole memory
+ Added WRT (write a file) and WRTA (append) commands: WRT file, data
+ Added GMEMI function (Memory Block Informations)
# GPA now returns 0 and continue if the API is not found, $RESULT_2 set to Proc name if found.
# fixed OllyDbg focus problem
# fixed path of created files when full path given
# fixed FIND binary wildcards, broken in 1.24
shERis
11-23-2005, 05:35 PM
Hi Epsylon3!

Great thanx for adding some of my wishes!

I tried FINDMEM, but it only finds the first appearance of "what". Can you add the addr variable as in FIND? Addr should be any address in the whole memory and FINDMEM should begin search with a valid memory block address greater or equal addr. If addr==0 then FINDMEM should find the first appearance.

I think this should be possible. Please improve the function for me!

PREOP:
I don´t think about reverse execution (this could really be a full new concept!), no, I only think about getting the previous opcode of an address in code. I found "Disassembleback" in Ollys plugin help - this is the function PREOP should call. And OPCODE should call "Disasm".

Can you add my other wishes too ?

~hERi~
SHaG
11-24-2005, 01:14 AM
PREOP is kinda hard to implement... SoftIce has a feature that shows the last instruction (or last eip) before the breakpoint was hit, but the opcode used for that feature is a protected one - it cant be used by a user-mode program, only in kernel-mode... I tried to implement that and ended up with a kernel-mode driver which was quite unstable..
Epsylon3
11-24-2005, 02:22 AM
ok, i've made some changes in released 1.26

PREOP addr
FINDMEM what [,from]

but the preop will not give last eip after a jump or ret... just last instruction before this address...
shERis
11-24-2005, 04:52 AM
Hey, Epsylon3, you are quite fast!

I know, that PREOP only can find the last instruction before the given address and not the last eip before a given eip!

I will test out new 1.26.

Thanx

~hERi~
shERis
11-24-2005, 03:04 PM
Hi Epsylon3!

I tried PREOP - and found a problem.
Some apps allocate memory and run code in this allocated memory block. When you try to call PREOP with such memory address you get 0 as result. Is it possible to use mod->codebase/mod->codesize and/or membase/memsize for Disassembleback depending on the memory block of addr? PREOP now works on for example in kernel32, but not in an allocated memory block.

Furthermore I would need OPCODE!

Please help me !

Thanx

~hERi~
Epsylon3
11-24-2005, 09:03 PM
ok... i will set preop to membase instead of codebase... i hope that will work...

1.27 (25 Nov 2005)
+ Added REF to get References to selected command
+ Added OPCODE command to get command bytes, text and size at specified address
# Better comments handling
# Better #inc handling (using also current script path)
# PREOP now works in memory block, not only in code block
hila123
11-25-2005, 05:00 PM
Epsylon3,

thanks for updating the Ollyscript so frequently...

the script windows is very useful for debugging script but i would like to have an option to change the value of specific variable from this script windows as well...is that possible to do that in next version?

another thing is can u give the "Step" command a shortcut key that we do not need to go to the plugin menu every time when we need to step through the script...

thanks in advance
shERis
11-25-2005, 05:37 PM
Hi Epsylon3!

I tried your improvements of 1.27.

PREOP: works fine !
REF: works fine !
OPCODE: works fine, but it doesn´t increase addr by the opcode length

The new functions are very helpful !

Now I´m only ALLOC missing...

Much thanx to you, you made really great work. Especially the script window is very, very useful ! Step shortcut would be useful too.

I hope that you are able to make more improvements of the script :-))

~hERi~
nick_name
11-25-2005, 06:35 PM
Epsylon3, GREAT WORK MATE !!!

i had a tiny request ... please try to add a menu in the olly's right click menu in the code section ... as shown the following picture
and if possible please IGNORE that full script location thing, just the filename would be good enough

http://img458.imageshack.us/img458/5184/odbgscript2zw.jpg
Epsylon3
11-26-2005, 02:25 AM
Ctrl + S is not working to step script ?

for the ALLOC function, could you tell me more on what do you wanna do ?

For the plugin menu, i can do that, but it will be as buggy as MRU of main menu.... (i can't refresh menu, made only at load time)
XanSama
11-26-2005, 07:21 AM
hey Epsylon3, just wondering if we could see a second $result output for the ask command that states the length of the string the user input. would be quite useful on occasion :) also, if it's possible to fix the set width of the ask dialog box that would be good. it seems to only display about 40chars or so.
XanSama
11-26-2005, 08:12 AM
and for the alloc thing i think he means something like an automated usage of VirtualAllocEx, where instead of having to make the call and specify the process handle and all the other stuff. so you could simply type "alloc 1024" and it would allocate 1024bytes of memory to the processes address space and set $RESULT to the starting address.

edit: err VirtualAlloc is probably closer than VirtualAllocEx, but i'm sure you get the idea.
Epsylon3
11-26-2005, 08:15 AM
Ok, i will try to do that...
XanSama
11-26-2005, 08:16 AM
lol ^_^, that was a fast response.
Epsylon3
11-26-2005, 08:36 AM
yup... reply notification is really missing here :p
Epsylon3
11-26-2005, 10:30 AM
1.28 (26 Nov 2005)
+ Added "Load Script" in DISASM Context Menu
+ Added "ALLOC size" and "FREE addr, size" to (un)allocate memory page
# Modified Run Script to Load in Main MRU
# MRU is now more showing full path of scripts
# ASK now returns string len in $RESULT_1
XanSama
11-26-2005, 10:51 AM
nice :) and quick too. my suggestions are next right? :P
Epsylon3
11-26-2005, 11:21 AM
oups, forgot to write them in readme, i made them too ;)
XanSama
11-26-2005, 11:29 AM
xD tyvm
Epsylon3
11-26-2005, 11:43 AM
yep, i have just updated ASK command details in help
mr haggar
11-27-2005, 07:11 PM
He he , plugin is updated faster than I can test it. That's good.
shERis
11-28-2005, 04:16 PM
Hi Epsylon3!

ALLOC and FREE is just all what I wanted :-)) (thanx XanSama, I always executed this code with many instructions)

You are really fast with your work !!!

Thanx for all - all your improvements are very good !!!
I´m a bit inquisitive: are you from france, Epsylon3 ?

~hERi~
Epsylon3
11-29-2005, 05:38 AM
Next functions :

REV dword
Reverse order of bytes

yes, im (just) french
hila123
11-29-2005, 05:59 AM
hi Epsylon3,

can u implement a string copy and string length function in next version as well

STRCPY destination, source if success $RESULT is the length of string copied else 0

STRLEN source $RESULT is the length of the string if success else 0

thanks in advance
Epsylon3
12-01-2005, 02:27 AM
for STRCPY you have mov

STRLEN will be a new LEN command

made:
# Script is kept on program restart/change
+ Added LEN to get string length
+ Added REV to reverse dword bytes
# Fixed FIND commands to search dwords variables

todo:
new command HANDLE class, caption to find handle of a window (or editbox etc)
shERis
12-02-2005, 05:14 PM
Hi Epsylon3!

Could it be possible to add subroutine functionality to ODbgScript? I mean CALL procname,param1,param2,... and RETCALL res.
This would be helpful, if longer code is to be executed some times.

~hERi~
shERis
12-02-2005, 11:01 PM
Hi Epsylon3!
I included a script an a script with the #inc command - and found a bug.
In OllyLang.cpp, proc int OllyLang::InsertScript(vector<string> toInsert, int posInScript) there are two MsgInt(posInScript,filename), which must be deleted. I think, they were inserted for debugging only.
shERis
12-03-2005, 12:07 AM
Hi Epsylon3!

A command TC for "Close run trace" (stops tracing) would be useful.

Perhaps a command CLLW is possible, which cleares the log window.

Great thanx!
~hERi~
Epsylon3
12-03-2005, 01:20 AM
you are right, i will delete these MsgInt (sorry)

i'll see for these 2 commands...
Epsylon3
12-03-2005, 12:57 PM
1.29 (03 Dec 2005)
+ Added LEN to get string length
+ Added REV to reverse dword bytes
+ Added HANDLE to find a window handle (like "Edit" Boxes) in debugged application
# Script is kept on debugged program restart/change
# Fixed FIND commands to search dwords variables
# MRU on DISASM window is now the real one
nick_name
12-03-2005, 10:33 PM
great work as always !!

there's a bug in MRU in disam window

if the script name is too long , then it's wrapped in the 2nd line
but the problem is the wrapped line also get highted 'n acts like
another MRU entry.

could u take a look into that ??

guess the following pic would explain it a bit more ...

http://img226.imageshack.us/img226/4839/mru6at.jpg
Epsylon3
12-04-2005, 06:37 AM
wow... that's weird, could you paste me the real full path ?

maybe you have comma....

made for the next major release (1.3x) :

+ Added support of reg8 & reg16 registers (al,ah...dl,dh,ax,bx,cx,dx,bp,sp,si,di)
+ Enhanced Style of Script Window (current line, jumps, labels, same values)
+ Added Result column
+ Value column keeps history of values
+ Added TC to close and delete runtrace
# Fix MRU when a filename contains comma or {}

continue thread in the 1.3x one :
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6& topic=1590 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6&topic=1590)


Please Help Me ...

RCE Messageboard's Regroupment > General > Please Help Me ...
MclarenF1
11-15-2005, 05:01 AM
Hi,
I have a path that it is for a previous version of a software for crack it.
Now I have a newest version of that software and there isn't any crack or patch for it.
how can i found that this pacth change what code from a dll of softwares?
with this method i can change that code manualy by ollydbg in new version of software.
Please Help me.
Or guide me who can i help me to crack this DLL. I need it hurry.
Thanks for your attention.
REGARDS.
ricnar456
11-15-2005, 08:26 AM
you can use a filecompare betweennthe old original and the patched and see the bytes diferents, netx found this bytes in olly in the old.

The problem is locate the same routine in the new, is posiblehave not the same byte sequence or will be in the same address, try.

Ricardo
MclarenF1
11-15-2005, 09:47 AM
Hi Mr.Ricardo,
Thanks for your attention.
But I haven't the orginal file to patch it an then compare it !!!
Software is Version 3.18 and patch is for version 3.14.
in this software there is a DLL file that limited it to 30 days and 5 full use only.
I can crack 30 days ( By Ollydbg ) but I cant crack 5 use limited...
If there is a way to know which code changed with this patch then I could crack it But ...
Can you help me how can i do for crack it with ollydbg?
Thank you very much.
REGARDS.
ricnar456
11-15-2005, 11:36 AM
if you don´t have the original unpatched and the patched for compare is not possible.

Ricardo


Acceso a Pagina de Ricardo

RCE Messageboard's Regroupment > General > Acceso a Pagina de Ricardo
lucho
11-16-2005, 11:53 AM
Estimado y respetado Ricardo, he intentado ingresar a tu pagina y tiene el acceso restringido, podrias enviarme a mi email, el codigo de acceso.

mi correo es: luisvasquezpaz(arroba)yahoo.com

gracias mil por adelantado.

Saludos.
ricnar456
11-16-2005, 07:58 PM
hay un link para registrarse dice I WANT REGISTER antras pones tus datos y listo

Ricardo


I will pay real cash for someone to hack a game for me <Dead Serious>

RCE Messageboard's Regroupment > General > I will pay real cash for someone to hack a game for me <Dead Serious>
emanxs13
11-17-2005, 03:09 AM
Sup let me get down to the point.. i will pay real cash to anyone that can hack a game for me .... basically give me admin powers all that stuff.. im serious about this.....pm me for more details

msn: oooemanooo@Hotmail.com


Setting breakpoints in dll's

RCE Messageboard's Regroupment > General > Setting breakpoints in dll's
Solus
11-18-2005, 05:23 AM
Whenever I try to set a breakpoint on a function in a dll of a certain program, olly crashes. Is there a way to stop execution when any function in the dll is called?
Epsylon3
11-19-2005, 04:14 PM
yep, try ollyscript...

or.... stop on dll load, then in memory window... set break on access in the dll code page...


SmartCheck

RCE Messageboard's Regroupment > General > SmartCheck
MagMa
11-18-2005, 10:28 AM
Does anyone know where can i ger Smartcheck from?
and some other tools to play with a vb6.0 app?
thanks!
ricnar456
11-18-2005, 11:28 AM
http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/NuMega.Smar tCheck.v6.03
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-%d1-O-P/NuMega.SmartCheck.v6.03
)

Ricardo Narvaja
MagMa
11-18-2005, 12:25 PM
Muchisimas Gracias Ricardo hace un tiempito que lo estaba buscando y no lo encontraba por ningun lado!
miniC
11-18-2005, 07:36 PM
Smart Check 6.2 RC2
http://secrecy.ayinfo.ha.cn/jiemi/%B8%FA%D7ٵ%F7%CA%D4/SmartCheck%206. 2%20RC2.rar
(http://secrecy.ayinfo.ha.cn/jiemi/%B8%FA%D7ٵ%F7%CA%D4/SmartCheck%206.2%20RC2.rar
)

Very good progy, but download is very slow!
miniC
11-18-2005, 07:39 PM
I forgot
screen shot is here
http://minic.ns.users.sbb.co.yu/slike/SC%206.2.jpg

miniC


Stop a process from exiting

RCE Messageboard's Regroupment > General > Stop a process from exiting
thatsgreat2345
11-20-2005, 06:43 PM
I modifyed a jump to jump past the first exitprocess but on the second i cant get it cuz there arent any jumps that jump by it and it gets called by something but when ever i bp it and run it to get the call stack the OEP changes so yeah 0058665B \. FF15 C8347000 CALL DWORD PTR DS:[<&kernel32.ExitProces>; \ExitProcess

thats what it is and like it calls to a MOV ,EDI,EDI and im just super lost now can anyone help me
ColdWinterWind
11-30-2005, 03:14 AM
I'm new to Olly, but damn I love it! I've seen some references to setting a conditional breakpoint - in meatspeak "If <some.condition=true THEN Break>". So, if EDI points to .ExitProcess then activate BP. The EIP will show the instruction where the condition evaluated as true. Sorry, but I don't know the syntax for it.


IDA Pro- Bad Character !

RCE Messageboard's Regroupment > General > IDA Pro- Bad Character !
mcensamuel
11-21-2005, 05:18 AM
when i used the following simple script with ida..it is giving this error
Bad character '!'

is anybody getting the same error ??

#include <idc/idc.idc>

static main()
{
auto ea;
auto pattern1, pattern2;

pattern1 = "hi";
pattern2 = "test";

if(pattern1 != pattern2)
Message("Test");
}
mcensamuel
11-21-2005, 05:32 AM
sorry guys...when i tried it yesterday it didnt work for me...
but today it works for me !!
sorry ;-))


Import

RCE Messageboard's Regroupment > General > Import
Snitch
11-21-2005, 03:26 PM
Hi,
I am new to ollydbg and have a question about the prog.

You can simple export code by selecting and copy to clipboard.
Now I want to import a txt file with addresses in ollydbg

example:
copy this line into ollydbg:
205285E2 . 57 PUSH EDI

anyone know the best way to do this?

thx in advance!
Lord_Looser
11-21-2005, 07:59 PM
NonaWrite plugin?
Epsylon3
11-21-2005, 10:54 PM
OllyScript
Snitch
11-22-2005, 02:23 PM
will try this, thx!


Olly's Shadow

RCE Messageboard's Regroupment > General > Olly's Shadow
Bob
11-22-2005, 10:03 PM
Hm, found this on net. Enhanced Olly v1.10 with fixes for detections and bugs..

Olly's Shadow - http://navig8.to/Shadow
(site text is hard to read tho)

~BoB~
arjuns
11-23-2005, 11:22 AM
Try downloading Ollydbg v1.1(almost all bug fixed) from Ricardo's site
Epsylon3
11-23-2005, 04:46 PM
what is the url of ricardo's web site ?
Bob
11-23-2005, 11:33 PM
This is fixed and hidden from process list etc much more improvements than the version on Ricardo's site

~BoB~
flinflon
11-24-2005, 09:07 AM
I get the dreaded 404 message for http://navig8.to/Shadow - anyone else have same problem?
Lord_Looser
11-24-2005, 11:28 AM
try this: http://www.host-no-cost.com/the_shadow/main/main.html
flinflon
11-25-2005, 10:15 AM
thanks worked fine
milad
11-25-2005, 02:15 PM
thank you Bob are great


OllyDbg XP style

RCE Messageboard's Regroupment > General > OllyDbg XP style
5aLIVE
11-23-2005, 12:08 PM
I've seen screen shots of OllyDbg using the XP style manifest in tutorials and Olly's shadow. How can I do do this manually? I have tried using Heaven Tools Resource Tuner which doesn't work on OLLYDBG.EXE for some reason??

I'd like to try this for myself rather than use someone else's file, or use a version of Olly that only has the XP manifest and no other patches/fixes.

I seem to remember Trsh release such a file although I could be wrong as I cannot find it on the web.

Thanks guys.

5aLIVE.
5aLIVE
11-24-2005, 10:07 AM
UPDATE Here's the file I was looking for:http://www.free-for-all.ru/tsrh/reliz/2004/12/ollydbg.1.10.xp.tool-tsr h.zip (http://www.free-for-all.ru/tsrh/reliz/2004/12/ollydbg.1.10.xp.tool-tsrh.zip)


A few general debugging questions

RCE Messageboard's Regroupment > General > A few general debugging questions
murph
11-24-2005, 05:07 PM
I have two questions.

(1) I've scoured the documentation for a while, and it seems to me that there is no way to automatically execute a small set of instructions whenever a MEMORY ACCESS breakpoint is hit, as you can do with the conditional logging breakpoints that always break on a particular address. (This seems evident to me from the fact that setting these instructions-to-be-executed-upon-hit involves setting a NM_PLUGINCMD string that is firmly tied to a particular address.) Am I correct?

(2) Is there a way to tell, when back-tracing a program, that when we break on a certain instruction, that we have in fact jumped to that instruction as opposed to simply stepping to it from the immediately previous instruction? Like a flag in a register somewhere, some "fingerprint" that tells us we have taken a jump to this instruction?
murph
11-26-2005, 07:03 PM
Okay, I think (1) is probably correct and there's no way around it. As for (2), I found something called "run trace" in the documentation that might be able to solve the problem... only problem is, I don't seem how to set up the run trace to begin with. The documentation lists a number of options you can set, but in the ollydbg user interface, I don't see any way to set them. I must be missing a particular menu or something. Does anyone know what I'm talking about?
Lord_Looser
11-26-2005, 08:49 PM
debug - set condition (ctrl-t)
view - run trace
right mouse click at selected cpu command - run trace - ...
murph
11-26-2005, 11:09 PM
Thank you Lord_Looser. With your help, I was able to get the run trace working.


how I find Overflow?

RCE Messageboard's Regroupment > General > how I find Overflow?
bjn
11-24-2005, 11:36 PM
how I find Buffer Overflow Or Stack Overflow with ollydbg?
Mad_guy
11-25-2005, 08:36 AM
Look for vulnerable functions and loop constructs. Functions like gets, scanf, strcpy, sprintf, strcat, etc. etc.
bjn
11-26-2005, 06:06 PM
I do this but i don't know how to put data in the vulnerable functions with the software.

example:
i found the function strcpy but i don't know how to get to the function with put data in the software.
Mad_guy
11-27-2005, 02:53 AM
This won't always be exploitable so you should know that.

What I'd do is find the parameters to the function and set breakpoints on them, this way when they're accessed in any way, you'll know via the debugger. I'd also set a break on that strcpy call and analyze the memory dump to see if it has any direct correlation to any previous input you might have given the program (for example, if it breaks when the program accesses some data you give it then you have a high probability of finding this vuln, say you give the program AABBCC, then when the strcpy call is made and it breaks, look in the memory dump where the strings are stored and if you see a 414142424343 as a parameter to the strcpy call there is an even higher chance of it being exploitable.) Some strcpy calls will not use user input and therefore in a lot of situations they will not be exploitable, so you will have to find a better way to do things.

I suggest you not stop analyzing your program there, however. Be sure to look for format strings and heap overflows as well.


dll for mobile can't ollydbg open it

RCE Messageboard's Regroupment > General > dll for mobile can't ollydbg open it
milad
11-25-2005, 02:25 PM
when unmakesis software for moobile contain file.dll in ollydbg can't open
it ... what you can help me in that
thanks for ricardo narvaja and all in ollydbg.win32asmcommunity.net
thanks again


How can I set a breakpoint on HMEMCPY using olly?

RCE Messageboard's Regroupment > General > How can I set a breakpoint on HMEMCPY using olly?
wizwar67
11-25-2005, 04:26 PM
I cant seem to get it to set a breakpoint on HMEMCPY , says it can't fine it.
anyone know how I can make it find it . Any help would be appreciated.
joe
11-25-2005, 04:38 PM
Try to find in google help file punto_h_english.zip
shERis
11-25-2005, 05:48 PM
read this (http://support.microsoft.com/kb/129947/en-us) !
ricnar456
11-26-2005, 12:23 AM
http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/033-PUNTO_%20H%20INGLES.rar
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/033-PUNTO_%20H%20INGLES.rar
)

use punto H

Ricardo Narvaja


Very basic Olly question

RCE Messageboard's Regroupment > General > Very basic Olly question
Streebgreebling
11-25-2005, 06:36 PM
Hi,

I have just started using Ollydbg to do my first crack. It's tough going, but I've made progress already and found some of the areas that I need to modify.

But there's something really basic that I haven't been able to work out from the tutorials. I can only get Olly to break if I already know where I want it to break, i.e. if I can search for some text that identifies an appropriate code segment.

In the program I am cracking, I have to click a button to start the registration process. I want Olly to break the moment I click that button. Trouble is, I don't know what code it runs when that button is clicked - I've been able to find some code later on and break in there, but it's later on than I need and I haven't been able to trace far enough back through the jumps.

So, is there a way to tell Olly to break "on next mouse click" or something similar?

A second question - I have been working my way backwards through the code by following the 'Jump from xxxx' reference shown in the pane under the CPU window. However I've reached a point where no reference is given to the calling function, so I have no idea how to trace back to the previous code. Are there any other ways of finding out what line of code executed immediately before the current breakpoint?

Thanks in advance!

Arthur
Streebgreebling
11-25-2005, 07:43 PM
Re my second question, I've done some reading here and tried the following:
1. Right clicking on the code and choosing 'Find References to'
2. Right clicking and choosing View Call Tree

Neither helps - Find References just shows a single reference, which is the line I am looking at. The Call Tree is blank under 'Called From'
ricnar456
11-25-2005, 11:58 PM
use breakpoint on messages is the first option, use point H second option, use GetwindowsTextA or other apis than recive text is other option

Ricardo


TrueTime, TrueCoverage, and BoundsChecker

RCE Messageboard's Regroupment > General > TrueTime, TrueCoverage, and BoundsChecker
Mad_guy
11-26-2005, 03:00 AM
I saw someone asking for SmartCheck and I figured I might as well go ahead and ask: Does anybody know where I can get copies of BoundsChecker, TrueTime, and TrueCoverage? I've been looking for them recently but turned up nothing.

If anybody could help, it would be great. Thanks!
ricnar456
11-26-2005, 10:05 AM
they are in the exetool ftp but only VIP members can download from here, i cannot have more space in my hard drive for download nothing, but ask other VIP member of exetools if he can download and put in some yousendit or so for you, there are big packages is a hard work.

Ricardo Narvaja
Mad_guy
11-27-2005, 02:57 AM
Thanks for the reply, however, I do not know of any exetools.com VIP members, and I don't think that asking out of the blue would be the best thing to do. Is there anybody here who happens to be such a member?
flinflon
11-28-2005, 09:31 AM
found this

http://www.vckbase.com/tools/downtools.asp?id=22

but haven't tried to download
ColdWinterWind
11-30-2005, 03:05 AM
Download using your favorite d/l manager, I used FlashGet, worked okay. Speed was what it was, I'm on dialup, so I'm no judge. I just set FlashGet to hang up the phone & shutdown when finished.


break on click?

RCE Messageboard's Regroupment > General > break on click?
j2innet
11-26-2005, 11:32 AM
hi expert out there..
i need u guys to advice how can i set a break point on button click.
i have gone through some c* tutorial and practising on some "problem" by using run trace. but break on click will be more helpful, i suppose.
ricnar456
11-26-2005, 01:13 PM
use message breakpoint on WM_LBUTONDOWN

Ricardo
clockwork305
12-07-2005, 05:05 PM
conditional bp on the translatemessage call?

msg == wm_lbuttondown

you can also set bp for double-click, mousewheel etc just change the wm_xxx


How to find text from incoming packets?

RCE Messageboard's Regroupment > General > How to find text from incoming packets?
MysTiCy
11-26-2005, 12:20 PM
So, when i start a onlinegame, and go where i can choose what character i pick, where i can find character's names in olly? I have tried all kind of searches with it...

sorry if this is said already somewhere in 32 pages, but search didnt work :/
Mad_guy
11-27-2005, 02:56 AM
If it's online, I'd go for a tool like Ethereal or TCPdump (Ethereal automatically analyzes packets for you, TCPdump just gives you raw output which can be used for trying to trace data, however, be sure to know whether or not the program communicates with Unicode or ASCII strings.)


anyone know debuger/sniffer to the mobile?

RCE Messageboard's Regroupment > General > anyone know debuger/sniffer to the mobile?
bjn
11-26-2005, 06:09 PM
anyone know debuger/sniffer to the mobile?

give links please


New plugin - ASM to HTML

RCE Messageboard's Regroupment > Plugins > New plugin - ASM to HTML
HolyView
11-28-2005, 04:12 PM
Hello :)

First, sorry for my accent ... I'm french ...

I have written a plugin which permits to convert snippet code from asm window to an HTML file with syntax highlighting.

To install, just put all the files into the OllyDbg directory.

You select lines and after, right click from the ASM window -> Conversion ASM->HTML

To change the colors :
Plugins menu -> Convertisseur ASM->HTML -> Configuration des couleurs

download : hXXp://pagesperso.laposte.net/holyview/coding/mes_progs/asm2HTML.rar

-> XX=tt

Enjoy :)

PS : Source code is included (Delphi)
garryw
11-28-2005, 06:03 PM
Hi,
Source code is always appreciated cheers, and your accent is barely noticable ;)
HolyView
12-06-2005, 02:22 PM
Updated :)
less bugs
more accessibility

enjoy :)

hXXp://pagesperso.laposte.net/holyview/coding/mes_progs/Conv2HTML-3.7. rar

XX=tt


ascii window

RCE Messageboard's Regroupment > General > ascii window
nofx
11-28-2005, 07:06 PM
Hello, im cant find the window anymore that showed all the ASCII strings it finds in one window.
I dont mean the main CPU window, cause it also displays it there, but there was another window that showed them all under eachother, that made it easier to find a ascii string.
Can anyone help me out with this.
ricnar456
11-28-2005, 07:33 PM
the dump windows is in the left corner, down to the dissassembler, sure you change the visualization for this reason don´t see the asc more, change again and will be ready, right click you have all options.
Lord_Looser
11-29-2005, 04:59 AM
right mouse click at cpu command - search for - all referenced text strings.
If nothing help, rename ollydbg.ini


ODbgScript v1.30 - Feature Requests and Bug Report

RCE Messageboard's Regroupment > OllyScript > ODbgScript v1.30 - Feature Requests and Bug Report
Epsylon3
12-04-2005, 07:35 AM
ODbgScript is the Visual version of OllyScript (discontinued by ShaG), it's capable to trace script execution and variables, and also to toggle script breakpoints...

I make this new thread because I can't edit title of 1.20 thread... which had 10 versions 1.20 to 1.29...

These versions have introduced the Script window and MRU Lists, have enhanced strings and pointers handling and also has some new commands... more or less usefull

The Download web directory is http://e3.epsylon.org/olly/

Archives includes sources and documentation (readme.txt)

1.31 (05 Dec 2005)
+ Added support of operators in pointers ex: [eax+1]
+ Added support of operator + for strings
+ Decimal values are now supported, with the point (ex: 102.)
+ Variables Menu in Script Window to show/edit variables
+ Edit Script Command in Script Window Context Menu
# Modified script window hotkeys, and added Pause

1.30 (04 Dec 2005)
+ Added support of reg8 & reg16 registers (al,ah...dl,dh,ax,bx,cx,dx,bp,sp,si,di)
+ Added support of operators (+-*/&|^><), operators don't have priority, it's made from left to right
">" and "<" are shr and shl, "^" for xor, "&" for and, "|" for or.
+ Variables are now also declared by the destination of mov, if they don't exist
+ Added Result column
+ Value column keeps history of values
+ Enhanced Style of Script Window (current line, jumps, labels, same values)
+ Added KEY to send custom key shorcut to ollydbg (global KEY_DOWN)
+ Added TC to close and delete runtrace
# Fix MRU when a filename contains a comma or { }

The TODO List :
+ Change the icon << if somebody could tell me how :confused:

Please discuss here about new commands you want, please give a look in plugins.hlp to see if your wishes could be made with the current plugin SDK of OllyDbg 1.10...
Epsylon3
12-04-2005, 07:40 AM
... will be edited later ...

HISTORY :

1.29 (03 Dec 2005)
+ Added LEN to get string length
+ Added REV to reverse dword bytes
+ Added HANDLE to find a window handle (like "Edit" Boxes) in debugged application
# Script is kept on debugged program restart/change
# Fixed FIND commands to search dwords variables
# MRU on DISASM window is now the real one

1.28 (26 Nov 2005)
+ Added "Load Script" in DISASM Context Menu
+ Added "ALLOC size" and "FREE addr, size" to (un)allocate memory page
# Modified Run Script to Load in Main MRU
# MRU is no more showing full path of scripts

1.27 (25 Nov 2005)
+ Added REF to get References to selected command
+ Added OPCODE command to get command bytes, text and size at specified address
# Better comments handling
# Better #inc handling (using also current script path)
# PREOP now works in memory block, not only in code block

1.26 (24 Nov 2005)
+ Added Optionnal Start Address to "FINDMEM what [, StartAddr]" (to continue global search)
+ Added PREOP command to get previous command address before specified address

1.25 (22 Nov 2005)
+ Added FINDMEM to search into the whole memory
+ Added WRT (write a file) and WRTA (append) commands: WRT file, data
+ Added GMEMI function (Memory Block Informations)
# GPA now returns 0 and continue if the API is not found, $RESULT_2 set to Proc name if found.
# fixed OllyDbg focus problem
# fixed path of created files when full path given
# fixed FIND binary wildcards, broken in 1.24

1.24 (19 Nov 2005)
+ FIND and FINDOP supports strings and string vars arguments
+ MSG and MSGYN have now Cancel button to pause script (MSGYN returns 2 if canceled)
# Script will now pause instead of stop when error is returned from commands
+ Script Breakpoints (to "debug" a script)
+ Added Real "Load Script" to start paused (script window)
+ Added Step/Resume and Hotkeys (script window)

1.23 (14 Nov 2005)
+ Enhanced String by Address support for commands (ex: gpa [nAddr],"KERNEL32.DLL")
+ lm, load Dump file to mem: lm, 0x401000, 0x100, "test.bin" (MetaCore)
# fix the dm, lm, dmp, dpe 's default dump path to debugging app's path. (MetaCore)
# fix dm, ...the open file parameter is incorrect, will add mess "0a 0d" at each lines tail. (MetaCore)
# fix all dump related function's parameter check, so when the real mem is smaller then gived
dump length, will not add mess data at the end, and the $result also catched the real dump size. (MetaCore)

1.22 (11 Nov 2005)
+ Added SCMP and SCMPI for string comparaison (SCMPI for case insensitive)
# Restored CMP string comparaison to case sensitive

1.21 (8 Nov 2005)
+ Remember Script Window Position & State
+ Automatic Scroll to follow script
+ Context Menu (Real MRU/Follow) in Script Window
# Fix table refresh
# CMP string compare is now case insensitive

1.20 (7 Nov 2005)
+ Script Window with values and eip
+ CMP now accepts strings from address
Epsylon3
12-05-2005, 11:59 AM
1.33 (06 Dec 2005) (Fix version)
# Some fixes
# Added some constants in code
# Fixed a big bug with string operands containing dword operator

1.32 (05 Dec 2005)
+ Execute Script Command Manually is now possible
+ LOG is now highlighted and displays also message in OllyDbg Status bar
+ LCLR command to clear log window
# Updated this Documentation and added a neutral sample script
# Abort Command enhancement
shERis
12-05-2005, 01:25 PM
Hi Epsylon3!
Great improvements! I´m really surprised!

I found the following:
When I singlestepped a script with the S key in script window and arrived an ESTO command, ESTO was executed normally. After an exception the script line continued with the next line and not at eoe-label! Perhaps it is the same with eob-label, I didn´t verify that.

I think, it would be more useful, if a script can be loaded only in script window, otherwise the script should be runned immediately. If you have finished a script and you only want to run it (without debugging and looking, what the script does), you always have to change to script window to run it.

In the values row of script window the both values of two parameter instructions are in other order. I think this is a little bit irritating.

Great thanx for your work!
kwazar
12-05-2005, 05:16 PM
New version every two days? Please include autoupdater ;P
Epsylon3
12-05-2005, 07:45 PM
@shERis :

yes you are right, i will restore the Run Script in Disasm window...

for the values row.. yea... was the fastest way to keep history and last values... i will try to fix that..

tx for the infos =)

@kwazar :

i was curious... i never really used C++ before ;) now i understand vectors and iterators, and i have learn many things... a nice month =) even i dont really like the C++

now i think ollyscript is ready to be used, fast.... :) and i m sure these enhancements will save precious hours =)
GaBoR
12-05-2005, 11:57 PM
I don't know why, but for me the MRU is not working.I have Odbgscript 1.32.
And what this supposed to be(it should say"Dump & fix IAT now!")?
http://img478.imageshack.us/img478/8808/msg7zx.png
VolX
12-06-2005, 02:09 AM
Hi Epsylon3!

To me, version 1.3x can't handle the following script

var count

mov count,8

loop:
cmp count, 0
je end
sub count, 1
jmp loop

end:
ret

Thanks for your enhancement to this olly plugin.
Epsylon3
12-06-2005, 05:10 AM
hmm yea... 1,31 and 1.32 have introduced many new things.... i will check what is the problem

Gabor : the cause is the operator & but that's not normal :p) i check that
Epsylon3
12-06-2005, 05:56 AM
VolX
try 1.33, don't have seen problem with this one... but tell me

1.33 (06 Dec 2005) (Fix version)
# Some fixes
# Added some constants in code
# Fixed a big bug with string operands containing dword operator
nick_name
12-06-2005, 08:14 AM
BUG !! BUG !! BUG !!

i've loaded a target in olly
now moved to the script window
no script loaded , version 1.33
pressed X for executing script command
var a [enter] .... everything okey
mov a , eip ... Olly CRASHED !!!

http://img230.imageshack.us/img230/9047/odbgscript1335pn.jpg
nick_name
12-06-2005, 08:23 AM
same problem if i try :

msg eip
or,
eval " eip is {eip} "

i think the problem is somehow related to EIP
when the app is just loaded in olly 'n not still getting debugged

guesswork :
olly takes ODBGscript to an unreferrenced invalid memory
coz, the app is not being debugged yet
so NO eip is set

i'll better leave the amendment to Epsylon3
thanks again for the great work !!!
nick_name
12-06-2005, 08:31 AM
[...]
Epsylon3
12-06-2005, 12:17 PM
hmm yea... ok tx... will fix that....

did you know var command is now useless...

mov eax, a will report an error if "a" is not declared but...

mov a, eax creates variable a with the value of eax

no, the problem was not eip, it's just window try to set value to the values column...
nick_name
12-06-2005, 02:39 PM
thanks for the quick reply Epsylon3
u r doing a great job
hope u'll keep it up
Epsylon3
12-06-2005, 03:23 PM
1.34 (06 Dec 2005)
+ Added Mark for pointers in values column
+ Added Icons to Windows
+ Added Script Log Window
# Fixed Manual Command when no debugged app or no script loaded.
# Modified Load into Run in main and Disasm Menu
# Added Version ressource, and clean source architecture

delayed... some things to fix before the 1.34 release ;) as you can see :

http://e3.epsylon.org/olly/screenshot.png
nick_name
12-06-2005, 06:18 PM
Epsylon3, i dont c any 1.34 on ur website !!
Epsylon3
12-06-2005, 07:26 PM
incoming.... i ve finished, there is some weird things with Step command... but that doesnt trouble script execution... only the display
shERis
12-09-2005, 04:11 PM
Hi Epsylon3!

I found >> mov [addr+4],#EB04# << not working.

When starting plugin, script log windows pops up too and is focused. The focus ist not really good.

When restarting app, plugin should be reloaded too to be able to run the script from the beginning.

There are some bugs in script execution window, but you will know them surely.
Epsylon3
12-10-2005, 10:24 AM
yea, ive seen for the restart, and i will try to see for the focus, there is no focus function for log, that's weird...

i've made some things, but i got some problems, a new version will be out... in some days
Epsylon3
12-18-2005, 06:14 PM
1.37 (18 Dec 2005)
+ Ask dialog accepts now the Return & Escape Keys
# Log windows Auto Scroll
# The Log Window is no more called with Script Window from main menu
# Fixed bugs in mov command with pointers and buffers
# Fixed bug with hex buffer variables containing bytes < 0x10 (no pb with constants)

1.35 (12 Dec 2005)
+ Added a size optional third parameter to mov Command (strcpy)
+ Added "Clear Log" To Log Window Context Menu
+ Enhanced Support of "dump" variables
# fixed some log problems
nick_name
12-19-2005, 08:39 AM
epsylon3 , going great !!

can u make one change in the SCRIPT WINDOW
when steppign thru the scripts , the line highlighted is already EXECUTED
can u make it TO BE EXCUTED ... like in olly code window

i dont if it's discussed b4 but i think it makes it a little more literal
thank you.
Epsylon3
12-19-2005, 01:27 PM
yep, you are right... and this will fix cursor when the line is a jmp
shERis
12-19-2005, 03:13 PM
Hi Epsylon3!

Sorry but this doesnt work any more:

mov addr,00406F00
mov dat,12345678
mov [addr],dat
ret

MOV does simply nothing :-(
Epsylon3
12-19-2005, 03:33 PM
arf,

yea, i will test that... 1.38 will be ready after that

there is a problem with hex buffers too

mov dat,#12345678#
mov [addr],dat
Epsylon3
12-19-2005, 04:25 PM
1.38 (19 Dec 2005)
+ Added optional LOG command parameter to set log prefix, "" to disable
+ Added LC to clear main log window
# Fixed hex buffer variables, and big mov,<dword> bug
# Script cursor is now normal
# LCLR command clears now the script log only
# (internal) added backup system for sources in post-link batch

the script position (cursor) is not exact when stepping to a label... but it's not really a problem...
nick_name
12-19-2005, 08:32 PM
epsylon, very fast update !!

at the beginning of the script loading, the line no.1 is highlighted 'n works perfectly as it should

but when the app is restarted , should'nt the script also go back to it's
line no.1 ?? well, it did'nt

and when i reinitiated with ESC , it went back to it's old behaviour 'n started from LOCATION line ( d:\documents and settings\ ....) while
it should start from line no.1

and on RET i can also go back to line no.1

it's quite minor i know ... but jst wanted to inform you like always

thank you for your great work once again.
Epsylon3
12-19-2005, 09:54 PM
thanks, it's now fixed... in 1.39
nick_name
12-20-2005, 12:32 PM
BUG !! BUG !! BUG !!

epsylon, the script window works lovely.
if i step thru the script which has RUN , STO the script window retains
its focus which seems great.

but the problem is : if is step thru with S, upon pressing ALT+C the
code window wont get focus !! ... even after the end of the script !!
it seems to remain ALWAYS ON TOP !!
please look into it ...

thank you.
Epsylon3
12-20-2005, 12:39 PM
please check if your script window has the option Always on Top Checked... (Context Menu/Appearance)

hmm, oh yea, i see... hmm weird....

yea, focus is now ok... only when needed
shERis
12-20-2005, 12:47 PM
Hi Epsylon3!

I found the following:
When I singlestepped a script with the S key in script window and arrived an ESTO command, ESTO was executed normally. After an exception the script line continued with the next line and not at eoe-label! Perhaps it is the same with eob-label, I didn´t verify that.

In the values row of script window the both values of two parameter instructions are in other order. I think this is a little bit irritating.

When script window is opened now, all other applications windows are disabled, OllyDbg too. You are not able to change window content!!! Thats very ugly!

Great thanx for your work!
shERis
12-20-2005, 12:51 PM
Behaviour is the same if "Always on top" (Alt F5) is set or not!
shERis
12-20-2005, 12:54 PM
Another little bug:
when you load a large script in cript window and then you reload a shorter script, the old script length with content persist, the longer script is only overwritten with the shorter content.
Epsylon3
12-20-2005, 06:33 PM
yep... try with this new version (1.40), and tell me if you have any of these problems

1.40 (20 Dec 2005)
+ Added Float variables, registers st(0) <-> st(7), and "in line" operations (+-*/)
Float operations must contain float operands only (no support for integers for the moment)
Float syntax : mov flt, 5.0
# enhanced script window focus
# fixed progress window data if script reloaded is smaller than old one

1.39 (20 Dec 2005)
# Fixed Ask memory alloc problem
# Always Re-focus to Script windows on "Step" from script.
# Fixed cursor on ret/abort
nick_name
12-21-2005, 11:08 AM
BUG !! BUG !! BUG !!

in the sample script = sample.osc
the script kills olly at :

=====================
Line=15
Command= log [[esp+4]]
=====================

when stepping with S, after ESTO, RUN
the script window does'nt get auto-focus
anymore

please check !!
Epsylon3
12-21-2005, 02:36 PM
hmm, yea, there is a problem with this command : i cant know the type of the pointer... is why the line after is log ""+[[esp+4]]

but this script doesnt kill my ollydbg... weird

the autofocus is made for "go" command, but here there is a breakpoint... hmm i'll try to do something...
Epsylon3
12-21-2005, 05:13 PM
1.41 (21 Dec 2005)
+ Support for Integer operands in Float Operations (first operand need to be a float)
+ Added Edit Variable dialog for Float vars
# log default type (pointers) is set to DW, was Float in 1.40
# enhanced focus with Ollydbg breakpoints
nick_name
12-21-2005, 07:47 PM
BUG !! BUG !! BUG !!

first of all ... GREAT work epsylon i've never seen anyone updating his
plugins so fast !! ... it's great

now the problem ...
my target is : calc.exe XP.SP2
script : sample.osc (supplied with the plugin)

i load the target
i load the script
then i press SPACEBAR

the script runs and the app's also RUNNING
the script window now is stopped at :
==============================
Line=12
Command= cmp handle, eip
Result= j
EIP= i
Values <---=7C810856 7C882FC4,7C882FC4
7C882FC4,7C882FC4 7C882FC4,7C882FC4
7C882FC4,7C882FC4 7C882FC4
==============================

now keeping the script like this, if i restart the app in olly, the app wont
wont stop at it's EP ...

it will simply run !!
please check the phenomenon !!

i would propose : if the app is restarted in olly, the
script should restart too

thank you.
Epsylon3
12-21-2005, 08:06 PM
hmm, yea it's made... but 1.42 will be released later...
helloword
12-23-2005, 10:06 AM
I don't know if it's really helpfull but it should be nice to have on mouse over some information on value of variable or help of the function
shERis
12-23-2005, 11:33 AM
Hi Epsylon3!
Hi Olly (Oleh)!
Hi all other OllyDbg and ODbgScript fans!

Very much thanks for your works - we all hope that your works will proceed.

I wish all of you a merry christmas and a happy new year.

I´ll be back in some days.

Your´s
shERis
nick_name
12-23-2005, 12:49 PM
merry christmas everyone !!
Epsylon3
12-23-2005, 09:58 PM
Merry and happy OllyD =) will try to find something nice to do =)

@helloworld :
hmm yea, could be possible... but... not as tooltips, maybe in a status bar....

no, i made the variables menu to show, and edit or copy/paste variables

ps: visibile only when dbg proggie is paused...
hila123
12-30-2005, 05:40 AM
i found a problem with the mov str with len

example

mov location, 402000
mov str, 401000
mov [str], "OllyDBG"

mov [location], [str], 3

if the strlen is less than 4 it will not copy the correct data the location....

if i changed the above command to mov [location], [str], 4, it worked by copying the 4 bytes to the location
Epsylon3
12-31-2005, 04:18 PM
in this instruction :

mov [location], [str], 3

[str] is a pointer, not a string... to force the string operation, use that :

mov [location], ""+[str], 3

:)
hila123
01-02-2006, 06:51 PM
something wrong with the below script, try to test the script with a delphi program, it will not pause....

var temp1

mov temp1, eip
add temp1, 0b
bphws temp1, "x"
//bp temp1

eob check
eoe check
esto

check:
cmp eip, temp1
je test
esto

test:
sti
mov [401000], eip <-this line will not execute if using hardware breakpoint
pause
esto

if i changed the hardware breakpoint to memory breakpoint....the above script work....this happened to ollyscript 0.92 as well....
hila123
01-03-2006, 01:45 AM
found a problem with find function...

find function cannot find these values...

7C80A405
77DEB908
7C826E0C
77D86C0F

below is the sample script

mov count, 0
mov temp1, 402000
mov temp2, temp1
mov temp3, 0

mov [temp1], 7C812C8D
add temp1, 4
mov [temp1], 7C80A405
add temp1, 4
mov [temp1], 77DEB908
add temp1, 4
mov [temp1], 56800C00
add temp1, 4
mov [temp1], 7C826E0C
add temp1, 4
mov [temp1], 77D86C0F
add temp1, 4
mov [temp1], 7C80AA66

log_data:
cmp count, 7
je end
mov temp3, [temp2]
find 401000, temp3
log $RESULT
add temp2, 4
inc count
jmp log_data

end:
msg "check log"
ret

seem likes the find function not able to find value pattern ??????0?
nick_name
01-03-2006, 07:22 AM
(1)
mov eip,402233 ...... eip = 401000
mov eax,1000 ....... eip = 401000

but on the 2nd line, the EIP should reflect EIP=402233 in the script window.

(2)
when the script is not finished, but the app terminates due to
exeption or something else.
after a restart/ctrl-F2 , the rest of the script will try to execute
and will show a SCRIPT FINISHED msg like it shows for RET.

i would suggest : the script should restart back as the apps gets
restarted.

and on the script reload, the src should be RE-read 'n reloaded
coz after editing, it becomes a little tiresome to reload each time.

(3)
the input box of ASK does'nt always take inputs properly on clicking
OK button by mouse !!
please look into the matter

(4)
the prob with EOB persists, it does'nt work as it's supposed to

feature request
**is it possible to add a READ or READ-LINE feature.
which will add the first token or the first line from a file
into $RESULT variable.

**the script should re-read the script-source upon restart.

**is it possible to implement a FIND REFERENCES TO > CALL DESTINATION

thank you.
Epsylon3
01-03-2006, 06:47 PM
- I fixed the problem with find... here only... you can use findmem or findop (for code search) which works for that

- eip is read only... and hmm i need to test some things about that...

i will release 1.42 soon... it's on my second pc...

for EOB/EOE... hmm i never used that, do you have something (a script and prog) to help me to test that ?
nick_name
01-04-2006, 11:21 AM
Feature Request

Epsylon3, can you make the input requesting boxes like
1. msg
2. msgyn
3. ask
NOT to be MODAL ??

this way, for example, if i need to check the address of IAT section
from a alt+m in olly ... i can do that and put it into the ASK question
box.

THANK YOU
nick_name
01-04-2006, 12:19 PM
BUG!! BUG!! BUG!!

ODBGScript 1.41 crashes if i try to execute with X
the follwoing command ... i was going to perform

exec
popfd
popad
ende

but after X..exec[ENTER] in the script window
ODBG crashes

please look into it
nick_name
01-04-2006, 01:02 PM
MSG shows messagebox with OK / CANCEL buttons
i think only OK button is enough for that

MSGYN shows messagebox with YES/NO/CANCEL buttons
i guess only YES / NO buttons are required

thank you.
nick_name
01-04-2006, 02:39 PM
BUG!! BUG!! BUG!!

1.)
shr tm1,24 seems to have problem

i had to replace with

shr tm1,8
shr tm1,8
shr tm1,8

to get it working properly
Epsylon3
01-04-2006, 06:02 PM
shr tm1,24 <- 0x24 ! not 24.

the cancel in MSG boxes permits to pause and to cancel, after, a script
nick_name
01-04-2006, 08:15 PM
rev 401204 returns 4124000
can it return 04124000

please check

** thanks Epsylon3, the SHR,24 was my mistake
thanks for pointing me to it.
nick_name
01-05-2006, 10:54 AM
EOB/EOE Demonstration Code

bp 402233 // bphws 402233,"x"

L1:
eob LOG
esto
jmp L1

LOG:
log eip,""

the eob wont trigger if bphws xxxxxx,"x" is set <-- hardware bp
it works for bp xxxxxx memory bp's only

thank you.
nick_name
01-05-2006, 01:24 PM
problem with - ASK
------------------------------
ask cant handle the following script :
=========================================
ASK "emni+emni --> onno shob ulta palta [HEX] kotha ??"
ret
=========================================

problem with - lower/ UPPER CaSe
------------------------------------------------
some of the commands can handle both upper 'n lower cases
but some can not .... for example RET

please look into the matter.

THANK YOU.
nick_name
01-06-2006, 12:04 AM
Problem with LM

mov alloc_size,1000

alloc alloc_size
mov binary_paste,$RESULT
lm binary_paste,alloc_size,".\log-HIGHMEM-calls.BIN" <-- this line wont work

log-HIGHMEM-calls.BIN = is a file previously dumped with
dm dump_addr,alloc_size,".\log-HIGHMEM-calls.BIN"
am i going wrong anywhere ??
Epsylon3
01-07-2006, 03:32 PM
LM : Relative paths with .\ and ..\ are not supported, just remove it
Epsylon3
01-07-2006, 04:38 PM
1.42 (07 Jan 2006)
+ Script Auto Reset if debugged app is restarted
* Better script uppercase support
* Problem with strings containing brackets
hila123
01-07-2006, 08:47 PM
hi Epsylon3,

thanks for the update but i think it's better to make the script stop instead of resetting and start execute again...

btw, is it possible to have a function to read comment? we have cmt to write comment not read....
nick_name
01-08-2006, 03:35 AM
LM still fails !!

====================
mov path3,"test.BIN" // test.bin was previously dumped by DM
lm alloc_addr,alloc_size,path3
====================

this script still fails to load the test.BIN into memory !!
the .\ relative path works with DM ... but still as you've
mentioned i've removed the relative path ... but no help
nick_name
01-08-2006, 05:27 AM
Feature Request :

1. "Set BREAK-ON-ACCESS" ... breakpoint on memory map sections.
shERis
01-10-2006, 06:07 PM
Hi nick_name!
Your feature request:
Do you mean, that you want to set memory breakpoints to different places of memory? In OllyDbg you only can set one BP to a peace of memory, if you try to set a BP to another memory position old memory BP is cleared. I don´t know if this behaviour could be changed by a script. Either it was to difficult to Olly or it isn´t possible at all.
But I would be glad if this could be possible!
Epsylon3
01-11-2006, 05:38 PM
hila :)

if you want to stop only, select pause or step on context menu before reloading the program... the script will not start automatically...
Epsylon3
01-11-2006, 05:41 PM
nickname :

Break on access :

BPRM addr, size
---------------
Set memory breakpoint on read. Size is size of memory in bytes.
Example:
bprm 401000, FF

BPWM addr, size
---------------
Set memory breakpoint on write. Size is size of memory in bytes.
Example:
bpwm 401000, FF

note : BPWM is MEMBP_READ | MEMBP_WRITE (since 0.92)
Epsylon3
01-11-2006, 05:48 PM
LM

are you sure the memory block has ReadWrite attributes ?

if yes, what is the size you wanna load ? if its big, could you try to reduce size and report me the maximum size... (not sure it's limited but...)
shERis
01-12-2006, 04:52 AM
Hi Epsylon3!
I am working on a script and now I would need the follwing function:
GCMT addr: gets the comment of addr set by CMT (because I use comment for saving information). Is that possible?

And a question:
how can I transform a string into a DW (memory address)?
shERis
hila123
01-12-2006, 05:04 AM
hi Epsylon3,

find function in version 1.42 still not able to find value in this pattern ??????0?....i can't use findop because it is for finding instruction and it will find nothing in my case....
nick_name
01-12-2006, 05:21 AM
BUG!! BUG!! BUG!!

epsylon, no matter wht ... LM fails ... i tried this script

=================
dm 401000,1000,"test.bin"
alloc 1000
lm $RESULT,1000,"test.bin"
=================
nick_name
01-12-2006, 07:28 AM
EOB does'nt work for bprm , bpwm
shERis
01-12-2006, 03:15 PM
Hi Epsylon3!
I don´t want to be annoying, but I found a bug.
When you single step a script and you come to a RUN command (or ESTO,..), then run is executed (app does something). When app reaches a breakpoint, app execution is stopped.
The script pauses and had to jump to the eob label .
But it does not. The highlighted line in the script window is at the next line of the RUN command and not at the eob label. When you then type S, the script proceeds with the line after the run command!
Please correct the script!
Thanx
shERis
nick_name
01-12-2006, 03:54 PM
shERis, could u post the script here ??

EOB dont seem to work with = HARDWARE BP & BPRM , BPWM
but it works fine with BP only
Epsylon3
01-13-2006, 06:23 PM
ok :) seems i have work to do... so lets go...
nick_name
01-13-2006, 06:59 PM
shERis, post the script here ...
nick_name
01-13-2006, 07:00 PM
shERis, post the script here ...
Epsylon3
01-13-2006, 08:46 PM
hila, to search a DW, you need to reverse it... else find addr, #00112233#

1.43 (13 Jan 2006)
+ Added GCMT to retrieve comment at specified addr
* Fixed LM function

i will try to see the problem later with find... did you try Findmem ?
hila123
01-13-2006, 09:05 PM
findmem giving the same result of find.....cannot find value pattern ??????0?

thanks for looking into this problem...
shERis
01-13-2006, 11:01 PM
Hi Epsylon3!
Thanx four GCMT command! Works fine!
But I don´t know how to get back an address stored with CMT as string and recalled with GCMT. Result of GCMT is a string (thats ok). But I don´t find a function, which makes a DW address from a address string (reverse of EVAL}.
Please help me!

To nick_name: which script do you mean?
nick_name
01-14-2006, 06:12 AM
Hi Epsylon3!
I don´t want to be annoying, but I found a bug.
When you single step a script and you come to a RUN command (or ESTO,..), then run is executed (app does something). When app reaches a breakpoint, app execution is stopped.
The script pauses and had to jump to the eob label .
But it does not. The highlighted line in the script window is at the next line of the RUN command and not at the eob label. When you then type S, the script proceeds with the line after the run command!
Please correct the script!
Thanx
shERis

.... i indicated this one
nick_name
01-14-2006, 06:22 AM
Epsylon3,
just tested the LM with 1.43 it's working GREAT.
thank you.
nick_name
01-14-2006, 07:25 AM
Hi Epsylon3!
Thanx four GCMT command! Works fine!
But I don´t know how to get back an address stored with CMT as string and recalled with GCMT. Result of GCMT is a string (thats ok). But I don´t find a function, which makes a DW address from a address string (reverse of EVAL}.
Please help me!

sheris,
when u pass an address to eval, eval checks tht address/pointer for strings

but if u pass a string, it's tough to find the address for it ... only way i can
think is to search the whole memory ... not so smart way to do it anyway

to find the address of a comment ....
u can loop thru the whole section
read thier comments and comparing with ur comment
if they matches, u found the address ur looking for

to epsylon3 : if olly keeps a table of comments then i guess the address
retrival against a particular comment can be done easily without that
looping idea
nick_name
01-14-2006, 08:47 AM
Feature Request :

it would be nice to see a command returning the debugged exe/dll's
informations, like ...

filename
path
size
process id ... etc.
Epsylon3
01-14-2006, 12:15 PM
there is only a search for NM_LABEL, NM_EXPORT, NM_IMPORT, NM_LIBRARY or NM_CONST

not for comments

int Findlabelbyname(char *name,ulong *addr,ulong addr0,ulong addr1);

OllyDbg Plugin API v1.10
nick_name
01-14-2006, 04:09 PM
Feature Requests :

1.

int Plugingetvalue(int type);

VAL_HPROCESS (HANDLE) Handle of debugged process
VAL_PROCESSID Process ID of debugged process
VAL_HMAINTHREAD (HANDLE) Handle of main thread of debugged process
VAL_MAINTHREADID Thread ID of main thread of debugged process
VAL_MAINBASE Base of main module in the debugged process
VAL_PROCESSNAME (char *) Name of the debugged process
VAL_EXEFILENAME (char *) Name of the main debugged file
VAL_CURRENTDIR (char *) Current directory for debugged process
VAL_SYSTEMDIR (char *) Windows system directory

it would be nice to see a command returning the debugged exe/dll's
informations, like ...

filename
path
size
process id ... etc.

2.

int Deletehardwarebreakpoint(int index);
Parameters: index - index of hardware breakpoint to delete (0..3).

delete / disable hardware bp depending upon provided
numbers like ... 1,2,3,4

sometimes it's important for a script to function properly
having no hwbp set ... 'n script does'nt know if there's any hwbp set
this way script will have an option to enable/disable all the hwbp

3.

void Tempbreakpoint(ulong addr,int mode);
Parameters:
addr - code address where temporary breakpoint should be set;
mode - type of breakpoint to set:

TY_ONESHOT|TY_KEEPCOND Set one-shot breakpoint. OllyDbg automatically removes one-shot breakpoint when hit and pauses debugged application
TY_ONESHOT|TY_KEEPCOND|TY_STOPAN Same as above, additionally stops any kind of trace or animation when hit
TY_TEMP|TY_KEEPCOND Set temporary breakpoint. OllyDbg automatically removes temporary breakpoint when hit and immediately continues execution
Any other combination Sets INT3 breakpoint of specified type

int Setbreakpointext(ulong addr,ulong type,uchar cmd,ulong passcount);

Parameters:

addr - address of breakpoint. If address points to data or in the middle of the command, OllyDbg will ask you for confirmation;

type - combination of bits TY_xxx that specify requested actions and type of breakpoint:

Flag Meaning
TY_ACTIVE Set permanent (user) breakpoint or restore disabled
TY_DISABLED Temporarily deactivate permanent breakpoint. If TY_ACTIVE and TY_DISABLED are set simultaneously, TY_DISABLED is ignored
TY_ONESHOT Set one-shot breakpoint that will be automatically removed when hit. Doesn't interfere with active breakpoint
TY_TEMP Set temporary breakpoint that will be automatically removed when hit. Execution continues automatically. TY_TEMP does not interfere with active breakpoint
TY_STOPAN Stop animation if breakpoint is hit
TY_KEEPCODE Force original command (parameter cmd)
TY_SETCOUNT Force pass count even if breakpoint already exists
TY_KEEPCOND Leave associated names of types NM_BREAK, NM_BREAKEXPR, NM_BREAKEXPL and NM_PLUGCMD unchanged. If this bit is not set, breakpoints of types TY_ACTIVE and TY_DISABLED clear these names
cmd - original command that will be saved to descriptor if bit TY_KEEPCODE is set. Otherwise, this parameter is ignored and command is read from the memory;

passcount - pass count, i.e. the number of times this breakpoint should be skipped. If breakpoint already exists and flag TY_SETCOUNT is not set, this parameter is ignored and pass count remains unchanged.

the above 2 fucntions can be helpful setting

TEMPORARY BP
DISABLING A BP
SETTING NUMBER OF PASSES
ONESHOT BREAKPOINT
shERis
01-16-2006, 12:34 PM
Hi Epsylon3, hi nick_name!
Thanx for your answers.
But I think, that I was mistakable. I don´t want a function to search the address of a string variable or the address of string in memory or the address of a comment string (maybe someone else does ...).

What I want is function like this VAL.

mov d,00000040 /d= 040h
eval "{d}" /$RESULT= 000000040
mov strg,$RESULT
VAL strg /$RESULT= 040h !
mov d1,$RESULT /d1= 040h now !
add d1,4 /d1= 044h now !

I think that I now explained better what I ment.
Epsylon3, please can you add such a function ?
shERis
nick_name
01-16-2006, 05:48 PM
sheris, u can directly do it by "msg d" ... u wont need to eval
but still it would be help wht u r saying

eplylon3, i think this can be done quite easily with atoi or functions like tht

THANK YOU.
shERis
01-16-2006, 06:20 PM
Hmm .. Like >atoi< seems to be good. Result must be in hex.
nick_name
01-16-2006, 07:27 PM
after atoi ... epsylon3 can always use some of his own converters to convert it into hex ... i guess he already has them
Epsylon3
01-17-2006, 06:02 PM
ok so, i think i will make this commands :

atoi s, 16. > hex String to int
atoi s, 10. > dec String to int

itoa n, 16. > int to Hex String
itoa n, 10. > int to Dec String
nick_name
01-17-2006, 06:36 PM
epsylon3, please keep under consideration , the process info and breakpoint feature requests i made above ...
scherzo
01-19-2006, 01:17 AM
Hi!!! Thanks Epsylon3 for the very useful plugin!!!
I have a problem: I need search all commands "JMP 00402512", for example, and I write this script:

var address
var jmp_content
var jmp_address
mov jmp_address,00402512
search:
find eip,#E9#
mov address,$RESULT
mov jmp_content,address
inc jmp_content
mov jmp_content,[jmp_content]
add jmp_content,address
add jmp_content,5
cmp jmp_content,jmp_address
jne search

I can't use only "find eip,#E912254000", for example because the bytes of a jmp depends of the address when is the jmp.
This problem happens with CALLs, JMPS and other conditional jumps. But the biggest problem is the speed: the script spend very
very time for search commands in the code section.
I suggest a command for this search that it works more fast, like this:

FINDCOM what, addr, start_addr

What - CALL,JMP,JNZ,JE,JA,etc.
addr - address of the command.
start_addr - search code starting at start_addr

For example, I want to search for all "CALL 00402512" starting at 00401000. So, I write this:

FINDCOM CALL, 00402512, 00401000

I don't know if this is possible, but this command will is very useful.
Thanks a lot,
scherzo
nick_name
01-19-2006, 01:47 AM
use FINDOP

FINDOP
FINDOP addr, what
----------------------
Searches code starting at addr for an instruction that begins with the specified bytes.
When found sets the reserved $RESULT variable. $RESULT == 0 if nothing found.
The search string can also use the wildcard "??" (see below).
Example:
findop 401000, #61# // find next POPAD
findop 401000, #6A??# // find next PUSH of something
shERis
01-19-2006, 04:45 AM
Yes, there is FINDOP, but this command doesn´t solve scherzo´s problem. The problem is the relative address with CALL und JMP commands !!! I think, FINDCOM would be useful.
But you can use the new REF command instead! You´ll find all references to your addr and you only must select all JMP´s.
shERis
shERis
01-19-2006, 08:33 AM
Hi Epsylon3!
I am very sad :-((
We are all waiting for you!
nick_name, hila123 and sometimes I made several posts for bugfix or improvement of ODbgScript, but you seem to be too busy to do anything!
Please take care of your little baby ODbgScript! It´s ill and had to grow.
We all need you and your plugin.
Best wishes
shERis
scherzo
01-20-2006, 01:35 AM
Hi shERis!!!
I know the REF command, but this command don't work if I want to find CALLs, for example, in a main thread because these kind of section don't pertain to a module ("dll").
So, I hope that the improvement and bugfix will be fixed up.
Thanks so much
shERis
01-20-2006, 04:48 AM
Hi scherzo!
You didn´t say that you want to search in main thread. REF doesn´t work here. Sorry.
Epsylon3
01-20-2006, 01:15 PM
yea shERis, i was busy these last 2 weeks, and i ve another week to work hard... after that i think i could work more on our baby :p

today and this week end, there is an open beta test of GuildWars Factions

66DG9-C4RHB-9FKD6-287BJ-LRGCJ

http://www.guildwars.com/downloads/GwSetup.zip

give it a try :p
Epsylon3
01-21-2006, 11:46 AM
1.44 (21 Jan 2006)
+ Enhanced GCMT to retrieve automatic comments or comments from analysis
+ Added ITOA and ATOI commands
+ Added GPI (getprocessinfo) command (see docs for info)
* GPA uses LoadLibraryEx to fix a Comctl32 double load
scherzo
01-21-2006, 03:47 PM
Hi!!! Epsylon3
I have an improvement for ODBGScript: for example, look this script:

var constant
var count
loop:
mov constant,00421548
add contant,count
mov [constant],esi
add count,4
cmp count,1000
ja End
jmp loop
End:
ret

I would write this script like this:

var constant
var count
mov constant,00421548
loop:
mov [constant+count],esi
add count,4
cmp count,1000
ja End
jmp loop
End:
ret

But the plugin don't accept "[constant+count]".
I think that support of variables (two or more) in pointers is a interesting improvement!
Thanks,
scherzo
scherzo
02-06-2006, 05:38 PM
Hi! I can't edit my last post.
So, I can do this:
mov temp,[address+8]
But I can't do this:
mov [address+8],temp
Why?
scherzo
P.S.: "mov [constant+count],esi" will be interesting too.


how can i set the plugin icon ?

RCE Messageboard's Regroupment > Plugins > how can i set the plugin icon ?
Epsylon3
12-04-2005, 08:10 AM
in documentation of Registerpluginclass...

it's wrote :

int Registerpluginclass(char *classname,char *iconname,HINSTANCE dllinst,WNDPROC classproc);

iconname - name of icon resource in plugin DLL;

If iconname is NULL, uses standard plugin icon (letter 'P').

but Ressources are integer Constants
#define IDI_ICON1 115

I am unable to set icon :/ could somebody tell me how ?
GaBoR
12-05-2005, 11:45 PM
HICON LoadIcon(

HINSTANCE hInstance, // handle of application instance
LPCTSTR lpIconName // icon-name string or icon resource identifier
);
Declare a handle to an icon & an instance of the module :
HICON ico;
HMODULE hInstance;

hInstance=GetModuleHandle(

LPCTSTR lpModuleName // address of module name to return handle for
);
ico=LoadIcon(hInstance,MAKEINTRESOURCE(IDI_ICON));
SendMessage(hWnd,WM_SETICON,false,(long)ico);
But maybe you don't need all of these, because you can use:
The MAKEINTRESOURCE macro converts an integer value to a resource type compatible with Win32 resource-management functions. This macro is used in place of a string containing the name of the resource.

LPTSTR MAKEINTRESOURCE(

WORD wInteger // integer to convert
);
Epsylon3
12-06-2005, 12:07 PM
Thanks :)


WS2_32.dll need help

RCE Messageboard's Regroupment > General > WS2_32.dll need help
Outlaw
12-07-2005, 07:29 PM
I'm reading tutorial about toggling breakpoint on send "in view names WS2_32.dll", but when I attach to the game it just minimizes . I need be able to get in for sec "run w/o exception" send packet then have it come back to olly.

Then when get the packet write a program that will use the send()


about ep

RCE Messageboard's Regroupment > General > about ep
milad
12-07-2005, 07:51 PM
I have mobiola webcam whem put it in olly give me ep =ff
in pied don't show anything is there any help
thank you very much


Welcome back =)

RCE Messageboard's Regroupment > General > Welcome back =)
Epsylon3
12-18-2005, 06:13 PM
Happy to see the forum up again =)
gabri3l
12-19-2005, 03:25 AM
I agree!
shERis
12-19-2005, 06:34 AM
Yes, I am very happy too !
milad
12-19-2005, 11:33 AM
I am too happy for see the forum again
and thanks for all in it


Dumping function arguments

RCE Messageboard's Regroupment > General > Dumping function arguments
xml
12-21-2005, 07:32 AM
I'm reverse engineering a relatively small program so that I can reimplement it in java for my phone. I'm pretty sure that it's a fairly simple exercise, but I need to dump the function arguments for a set of key internal functions within the program. I took a look at dumbug which does exactly what I want, i.e. allow me to specify function prototypes and print them out as they are called. Unfortunately, it only works with exported symbols, which isn't sufficient.

I can use ollydbg's conditional log breakpoints to dump (it appears) a maximum of one argument per function call, and even then I can't get it to dump, say, an array of 32 bytes in hex.

Can someone tell me what's the best way to do this, or point me at an example? Do I need to write a plugin, is there one already, or could I do it with ollyScript?
oh me anon
12-21-2005, 01:35 PM
one argument per function ? if ollydbg can recognize the function
viz as an example MessageBoxA
if you set a conditional break point (shift+f4)
condition == nothing
explanation = = nothing
pause program == never
log value of expression == never
log function arguments == always

then it would log all the function arguments to that call not one argument per call

Log data
Address Message
7F920000 Module C:\WINDOWS\SYSTEM\MSSHRUI.DLL
7FBF0000 Module C:\WINDOWS\SYSTEM\MPR.DLL
7F950000 Module C:\WINDOWS\SYSTEM\SVRAPI.DLL
7FB00000 Module C:\WINDOWS\SYSTEM\MSNET32.DLL
00477660 CALL to MessageBoxA
hOwner = 00000744 ('OllyDbg',class='OLLYDBG',wndproc=004323D4)
Text = "File 'C:\WINDOWS\Desktop\odbg110\register.txt' is probably not a 32-bit Portable Executable. Try to load it anyway?"
Title = "Not a valid PE file"
Style = MB_YESNO|MB_ICONQUESTION|MB_DEFBUTTON2|MB_TASKMODA L
004AF516 CALL to MessageBoxA from OLLYDBG.00477660
hOwner = 00000744 ('OllyDbg',class='OLLYDBG',wndproc=004323D4)
Text = "File 'C:\WINDOWS\Desktop\odbg110\register.txt' is probably not a 32-bit Portable Executable. Try to load it anyway?"
Title = "Not a valid PE file"
Style = MB_YESNO|MB_ICONQUESTION|MB_DEFBUTTON2|MB_TASKMODA L

like above

now if the call is not recognized by ollydbg as standard call
but some user coded proc you would need to do some spleunking to findout how many params are passed to that call

and then use analyze assume arguments stdcall

for example if you try to shift+f4 on this call you will see log function arguments is grayed up

if you goback you will see that it pops up 1c from stack == 7 arguments

0040BA38 |. E8 0BA50000 CALL OLLYDBG._Disasm ; \_Disasm
0040BA3D |. 83C4 1C ADD ESP,1C

so right click --> analysis -->assume arguments --> stdfunc7-->apply

00415F48>/$ 55 PUSH EBP ; Decoded as <StdFunc7>

now if you try shift+f4
you can seee the log function arguments enabled
if you ask ollydbg to log now
it will log all the arguments to that call

00415F48 CALL to Assumed StdFunc7 from OLLYDBG.00447302
Arg1 = 0078E775
Arg2 = 00000007
Arg3 = BFF76899
Arg4 = 00000000
Arg5 = 0078DE0C
Arg6 = 00000004
Arg7 = 00000000
00415F48 CALL to Assumed StdFunc7 from OLLYDBG.00447302
Arg1 = 0078E774
Arg2 = 00000008
Arg3 = BFF76898
Arg4 = 00000000
Arg5 = 0078DE0C
Arg6 = 00000004
Arg7 = 00000000
00415F48 CALL to Assumed StdFunc7 from OLLYDBG.00428D53
Arg1 = 0078ED68
Arg2 = 00000010
Arg3 = 00401000
Arg4 = 01998D5C
Arg5 = 004CE45C
Arg6 = 00000005
Arg7 = FFFC5AA7

hope thats what you were looking for
xml
12-21-2005, 02:34 PM
Excellent, that's a lot closer, thanks. That seems to allow me to log any integer function arguments, but if the argument is a pointer to a string, or a pointer to an array of bytes, there isn't a standard way of logging them? If it's a string, I suppose I could put a conditional log breakpoint at the call entry point to log [esp+4] as a string, and then one instruction later I could log [esp+8]?

Basically the program I'm looking at does some hashing and encryption and I want to log all the data being passed to the encryption and hashing functions.
oh me anon
12-21-2005, 02:57 PM
well answering some thing generic is easy a specific question need some
examples or some snippet of code and some exact requirement

can you post the call the function the actuall passed string or whatever
so that i can answer ?

generic answer to log a lot of bytes would be to
set break on consequnt address and ask olly to log
[esp+4] on first line
[esp+0c] on second line 0c coz push ebp would alter esp and the next 4 bytes would be located 4 bytes down etc

but if you want to log lot of data it would be best to modify the commandline plugin to add a logging function and use it
with pass the following commands to plugin when paused option

i think some one added a logging plugin here in this forum
i did not test it but i think its named clb some thing check it out
i remember coz i answered one of the authours query
use google site search the forums search function is kinda screwd up

ok check this thread out i fetched it from google take a look at my additional code to commandline plugin exapmle
that should give you some insights
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=14 93&forum=2&page=-1
(http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=1493&forum=2&page=-1
)

also this is the plugin that the guy released after that question
try it out
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=1501 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=1501)
xml
12-21-2005, 04:58 PM
Thanks, cblp seems to be something like what I need, but it doesn't seem to be doing anything. I'll investigate.

To be more specific, there are functions such as:
md5_update(md5_ctx *c, void *data, int len)
des_set_key(des_cblock *key, des_key_schedule *sched)

If the first function is called, I want to log len, data[0..len] (but a sufficient fixed number will do), and in the second I want to log the appropriate sizes of the data as hex in the two arguments. If a function takes a char *, then I'd probably want to log the argument as a string.

dumbug: http://www.phenoelit.de/dumbug/ allows you to specify function arguments like this:
int CreateProcessA(
[in] char * lpApplicationName,
[in] char * lpCommandLine,
[in] void * lpProcAttr,
[in] void * lpThreadAttr,
[in] int bInherit,
[in] int dwFlags,
[in] void * lpEnv,
[in] char * lpCurrentDir,
[in] void * lpStartup,
[out]void * lpProcInfo
);

but as I said earlier, it only works on exported functions.
oh me anon
12-22-2005, 07:15 AM
well i found some md5.exe from net

hxxp://www.msoworld.com/programming/md5.zip

the code in c is as follows

static void MDString (string)
char *string;
{
MD_CTX context;
unsigned char digest[16];
unsigned int len = strlen (string);

MDInit (&context);
MDUpdate (&context, string, len);
MDFinal (digest, &context);

printf ("MD%d (\"%s\") = ", MD, string);
MDPrint (digest);
printf ("\n");
}

now i added assume arguments to that md5update

004010F1 |. 57 PUSH EDI ; /Arg3
004010F2 |. 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] ; |
004010F6 |. 56 PUSH ESI ; |Arg2
004010F7 |. 51 PUSH ECX ; |Arg1
004010F8 |. E8 53030000 CALL MD5.00401450 ; \Assumed StdFunc3

00401450 /$ 53 PUSH EBX ; Decoded as <StdFunc3>

set these breaks
Breakpoints
Address Module Active Disassembly Comment
00401135 MD5 Always RETN
00401450 MD5 Log "md5$string" PUSH EBX
00401451 MD5 Log "md5&context" PUSH EBP log [[esp+8]]
00401452 MD5 Log "md5&context" PUSH ESI log [[esp+0ch]+4]
00401453 MD5 Log "md5&context" MOV ESI,DWORD PTR SS:[ESP+10] log [[esp+10h]+8]
00401457 MD5 Log "md5&context" PUSH EDI log [[esp+10h]]+10h
[/i]

and recieved these dumped bytes of the context

Log data
Address Message
OllyDbg v1.10
Command line plugin v1.10
Written by Oleh Yuschuk
Bookmarks sample plugin v1.06 (plugin demo)
Copyright (C) 2001, 2002 Oleh Yuschuk

Console file 'C:\WINDOWS\Desktop\md5\md5.exe'
Arguments '-s"hello you xml this is how i would say you dump"'
New process with ID FFFCB789 created
004022FE Main thread with ID FFFAC035 created
00400000 Module C:\WINDOWS\DESKTOP\MD5\MD5.EXE
BFF70000 Module C:\WINDOWS\SYSTEM\KERNEL32.DLL
004022FE Program entry point
00401450 COND: md5$string = ???
00401450 CALL to Assumed StdFunc3 from MD5.004010F8
Arg1 = 0063FD8C
Arg2 = 00760DFD ASCII "hello you xml this is how i would say you dump"
Arg3 = 0000002E
00401451 COND: md5&context = 67452301
00401452 COND: md5&context = EFCDAB89
00401453 COND: md5&context = 98BADCFE
00401457 COND: md5&context = 67452311
00401450 COND: md5$string = €
00401450 CALL to Assumed StdFunc3 from MD5.0040153C
Arg1 = 0063FD8C
Arg2 = 0040A200
Arg3 = 0000000A
00401451 COND: md5&context = 67452301
00401452 COND: md5&context = EFCDAB89
00401453 COND: md5&context = 98BADCFE
00401457 COND: md5&context = 67452311
00401450 COND: md5$string = p
00401450 CALL to Assumed StdFunc3 from MD5.00401549
Arg1 = 0063FD8C
Arg2 = 0063FD50
Arg3 = 00000008
00401451 COND: md5&context = 67452301
00401452 COND: md5&context = EFCDAB89
00401453 COND: md5&context = 98BADCFE
00401457 COND: md5&context = 67452311
00401135 Breakpoint at MD5.00401135

now if you recompile the commandline plugin to addtolist() on function
Int Expression like i said in the link you can use
.? log [[esp+8]] etc to be logged
xml
12-22-2005, 12:57 PM
Thanks for all your help. I think you've given me enough info to be able to get what I want. Will give it a go for the next couple of days and see what I come up with. Incidentally cblp output the data in a log file (didn't read the documentation) and it looks like I could make a small mod to that to give me the data in the format I want too. Cheers.


How to set BP on clicking a button or reading the contents of a textbox?

RCE Messageboard's Regroupment > General > How to set BP on clicking a button or reading the contents of a textbox?
ActionMan
12-22-2005, 09:55 PM
Greetings!

How to set a breakpoint on clicking a button? I'd like Olly to break when I click a button in a window of a program.

And how to set a breakpoint on reading text from a textbox?

Thx!
ricnar456
12-23-2005, 12:14 AM
look the apis used by the program generally GetWindowTextA or so and put a BPin the api, or use messagebreakpoints (WM_LBUTTONUP is good)

Ricardo


Microsoft Visual C# / Basic .NET???

RCE Messageboard's Regroupment > General > Microsoft Visual C# / Basic .NET???
bazuka
12-25-2005, 11:39 AM
Is there a way to debug Microsoft Visual C# / Basic .NET application with ollydbg???

thanx
lackey
12-25-2005, 02:08 PM
I am new around here, i can not help you, but i'd like to ding to you.
miniC
12-25-2005, 03:15 PM
You can get the source code of programs writen in C#/VB .NET with Reflektor and its plugins VSDisassembler, Reflector.FileDisassembler... in C#, VB#, Delphi!

VEEEEEEEEEERY GOOD PROGY!

miniC
bazuka
12-25-2005, 07:31 PM
great 10x
arjuns
12-26-2005, 11:06 AM
Check this link
http://www.aisto.com/roeder/dotnet/
I think Retam has already published newbie tutorials regarding Dot net..
search it and have a fun with dot net reversing.
kind regards
arjuns
bazuka
12-26-2005, 09:36 PM
10x, but i cant find any good tutorial on dot net reversing!

can u post some links plz

10x again...
miniC
01-04-2006, 08:06 AM
I don't know where is the problem?? When you get source code in C# or VB or Delphi, all you need to do is to change code and recompile (rebuild) program in Visual Studio or Boralnd Delphi etc. If you know some of this languages, of course!

miniC

P.S. On this way, I made keygen for one program. I delete all source except code for registration. Than I change it to show right SN#, and rebuild program.
bazuka
01-07-2006, 10:45 AM
nice 10x, ill try that!


Newbie here

RCE Messageboard's Regroupment > General > Newbie here
tracenhit
12-26-2005, 08:41 AM
Hi all masterz,
I m newbie and really working hard, want some tutes on ollyDbg, can you all tell me. thankx in advance....
ricnar456
12-26-2005, 09:11 AM
http://www.ricnar456.dyndns.org/

in my http there are 1000 tutoalias, taking theorias, contests, and introduction but are in spanish, for english tut only in google you find some few (look arteam but are not for newbies)

Ricardo Narvaja
arjuns
12-27-2005, 09:18 AM
Ricardo , what is the password for the archives 14,15 and so on ..
hosiminh
12-27-2005, 01:59 PM
I dont see any password protected zip/rar archive in Ricardo ftp. (ftp://ftp.)
ugam
01-04-2006, 11:16 PM
yea
im try too but it's want password for login
somebody can help....? what pass for login...?
michelinok
01-05-2006, 08:17 AM
try

user: hola
password: hola


please about nsp pack

RCE Messageboard's Regroupment > General > please about nsp pack
milad
12-26-2005, 07:47 PM
If anybody have informantion about unpack nsp pack
Please answer me
mr haggar
12-26-2005, 09:05 PM
What version?

/////////////////////////////////////////////////////
/*
Script for unpacking NsPack v2.3 by haggar
*/
msg "Ignore ALL exceptions!"
var addr
sti
sti
mov addr,esp
bphws addr,"r"
esto
bphwc addr
sti
an eip
cmt eip,"This is the OEP."
ret
///////////////////////////////////////////////////

////////////////////////////////////////////////////
/*
Script for NsPAck 3.1 version
*/
msg "Ignore all exceptions!!!"
find eip,#E9????????8BB5??FEFFFF0BF60F84970000008B95??F EFFFF03F2833E00750E#
bp $RESULT
esto
bc eip
sti
an eip
cmt eip,"<-- OEP! Found by haggar :)"
ret
////////////////////////////////////////////////////////////////////
milad
12-27-2005, 09:13 AM
Thank you Mr hagger For your reply
in memory with olly onlly see nsp0 nsp1 nsp2
in pied nothing*

When press ITA AutoSearch in Imprec see Message
could not find anything good at this OEP! :-(
and can't unpack it Is there any tutorial about unpack nspack
I had try with script anthor script and the same message
If you can help me
milad
12-27-2005, 07:35 PM
Dear Mr Haggr I think it is nsp 1.4
can you help me with script or the to unpack it
thank's
Lord_Looser
12-27-2005, 07:53 PM
I have no idea of unpacking NsPack but perhaps you forgot to substract OEP with modules base address:
OEP in ImpRec = OEP in OllyDbg - 0x0400000 in most cases.
mr haggar
12-27-2005, 10:00 PM
I think that one of those two scripts ends on jump to OEP. So you need just to hit F7 once and then you are at the OEP. I cannot help you more because it is simple packer, more help would mean that I unpack it for you. You'll find way :)
milad
12-28-2005, 11:08 AM
Thank you mr haggar and Lord_Looser
I am beginner in crack, you and Gabril and ricardo and all in the forum
make me love the crack and love the assembly and Programmer

when use your script
0053D6FC F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>;

<-- OEP! Found by haggar :)
you must press shift+f7 when press it you arrive into nt.dll
I don't know what i can to do so ask you to help me
I wish to apply my thanks again
My mail is tannous70@hotmail.com If i can get your mail


WinAmp Freezes

RCE Messageboard's Regroupment > General > WinAmp Freezes
comrade
12-27-2005, 03:21 AM
I have WinAmp 2.91.

Everytime I am stepping through in OllyDbg (or hit a breakpoint), WinAmp becomes unresponsive.
If it is already playing a song, then the song plays fine (it doesn't stutter or anything), but I cannot interact with WinAmp (it does not respond to any keyboard/mouse input).

As soon as I hit F9 in Olly (to get out of single-step mode), WinAmp comes back to normal.

If I have been single-stepping especially a long time, then as soon as I come back to normal, WinAmp throws these "error transacting" msgboxes.

Has anyone else experienced that?
comrade
12-27-2005, 03:25 AM
It does not matter what priority class WinAmp is set to. It freezes no matter if it is on normal, high or real-time priority.
Lord_Looser
12-27-2005, 03:05 PM
For me it helps to uncheck "single-step break" at exceptions debuggion options and continue running only with F9 (not Shift-F9).
What is your exception code? 0x80000004 (single-step break)?
comrade
01-01-2006, 07:53 PM
There is no exception. As soon as I enter single-step mode (even if I stop doing anything for a while), WinAmp remains frozen.
hadicol
01-03-2006, 02:19 AM
Well when you aren't running the program (with F9) the current thread isn't executing. That current thread is probably what runs the GUI that handles mouse clicks, etc. Another thread will be running the sound playback.
comrade
01-03-2006, 08:06 PM
I am not debugging WinAmp.
comrade
02-15-2006, 01:54 AM
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=29 5&forum=1&page=-1 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=295&forum=1&page=-1)


No E-mail Notification

RCE Messageboard's Regroupment > The Heap > No E-mail Notification
comrade
12-27-2005, 03:22 AM
Why does this forum not have e-mail notification option for threads?
Wille
02-10-2006, 04:32 PM
becouse this is miniBB forum and it don't have a email notification function/command... u have to code ur own...


Search Does Not Work

RCE Messageboard's Regroupment > The Heap > Search Does Not Work
comrade
12-27-2005, 03:24 AM
Why doesn't Search return anything on these forums? It always comes back with blank results.
hosiminh
12-27-2005, 06:08 AM
Use google for searching ollydbg forum:
site:ollydbg.win32asmcommunity.net query_string_you_are_looking_for
comrade
12-27-2005, 01:45 PM
Thanks. Google indexes this site pretty often, I even managed to find my yesterday's post :)

Perhaps the Search link should be updated accordingly and redirect to Google search instead.
comrade
01-01-2006, 07:54 PM
Actually, never mind.
Google does not index this forum often. The posting I was talking about was from 2003!
comrade
01-01-2006, 07:57 PM
Actually, never mind.
Google does not index this forum often. The posting I was talking about was from 2003!


Stuph Broken Link

RCE Messageboard's Regroupment > The Heap > Stuph Broken Link
comrade
12-27-2005, 03:28 AM
There is a broken link to the first plug-in:

http://labs.idefense.com//labs-software.jsp#olly_heap_vis
oh me anon
12-27-2005, 01:02 PM
olly heap vis is also available here

http://www.openrce.org/downloads/details/1/Heap%20Vis
hadicol
01-03-2006, 02:27 AM
the ollyscript page is down too :(
i will check openrce


Help finding the correct api

RCE Messageboard's Regroupment > General > Help finding the correct api
michelinok
12-27-2005, 07:21 AM
Hi!
First of all sorry for my english :)
I'm trying to debug the "import account" procedure of Outlook Express.
I'm a total newbie, but i WAS a dos assembler expert (hope this will help me), so i've done this:
1) Run ollydbg
2) Loaded msimn.exe
3) Run msimn.exe inside ollydbg
4) gone to the import account dialog
5) Pressed Alt+F1 and entered:
bpx MessageBoxA
bpx GetDlgItemTextA
bpx GetWindowText
bpx GetDlgItemText

The problem is that Olly doesn't stop :(
I've no idea where the problem is :(
Can someone get a try?
mr haggar
12-27-2005, 08:49 AM
Try

bp MessageBoxA and not bpx.
michelinok
12-27-2005, 09:13 AM
"bp MessageBoxA" doesn't work :(
ricnar456
12-27-2005, 11:18 AM
doesn´work or doesn´t stop?

if doesn´t work you are in windows 98, change to XP, 2000 or NT now, ollydbg is a piece of shit in 98 with less possiblities and power.

If work but no stop try using BMSG or message breakpoints this work always.

Ricardo
oh me anon
12-27-2005, 01:23 PM
well ricardo wanted to say w98 is a piece of shit i think :) not ollydbg is a piece of shit

well in 98 just out of curiosity i loaded the c:\programfilesmsimn.exe

and hit ctrl+n (find all names in the module)

References in MSIMN:.text to USER32.MessageBoxA
Address Disassembly Comment
01002272 CALL DWORD PTR DS:[<&USER32.MessageBoxA> DS:[01001088]=83503B38, (Thunk to USER32.MessageBoxA)

and that is called only if FreeLibrary fails and that too on exiting from outlookexpress via file --> exit

so choose the right api for your work and better read some tutorials

here is the list of apis thats imported by msimn.exe
only breaks on this apis would work

or if you are sure you saw a message box popping up in msimn.exe
attach ollydbg while message box is still active and then backtrace looking at call stack

Names in MSIMN
Address Section Type ( Name Comment
01001070 .text Import SHLWAPI.#67
01001090 .text Import ( USER32.CharNextA
01001028 .text Import ( KERNEL32.CloseHandle
01001048 .text Import ( KERNEL32.CreateMutexA
01001010 .text Import ( KERNEL32.ExitProcess
01001034 .text Import ( KERNEL32.FreeLibrary
01001020 .text Import ( KERNEL32.GetCommandLineW
01001064 .text Import ( KERNEL32.GetEnvironmentVariableA
0100102C .text Import ( KERNEL32.GetFileAttributesA
01001030 .text Import ( KERNEL32.GetLastError
0100105C .text Import ( KERNEL32.GetModuleFileNameA
01001014 .text Import ( KERNEL32.GetModuleHandleA
01001038 .text Import ( KERNEL32.GetProcAddress
01001018 .text Import ( KERNEL32.GetStartupInfoA
01001068 .text Import ( KERNEL32.GetVersionExA
0100107C .text Import ( USER32.GetWindowThreadProcessId
0100104C .text Import ( KERNEL32.IsDBCSLeadByte
0100103C .text Import ( KERNEL32.LoadLibraryA
01001084 .text Import ( USER32.LoadStringA
01001050 .text Import ( KERNEL32.lstrcmpiA
01001060 .text Import ( KERNEL32.lstrcpyA
01001054 .text Import ( KERNEL32.lstrcpynA
01001058 .text Import ( KERNEL32.lstrlenA
01001040 .text Import ( KERNEL32.lstrlenW
01001088 .text Import ( USER32.MessageBoxA
01001F85 .text Export <ModuleEntryPoint>
01001008 .text Import ( ADVAPI32.RegCloseKey
01001004 .text Import ( ADVAPI32.RegOpenKeyExA
01001000 .text Import ( ADVAPI32.RegQueryValueExA
01001024 .text Import ( KERNEL32.ReleaseMutex
0100108C .text Import ( USER32.SendMessageTimeoutA
0100101C .text Import ( KERNEL32.SetErrorMode
01001080 .text Import ( USER32.SetForegroundWindow
01001074 .text Import ( SHLWAPI.StrCmpIW
01001044 .text Import ( KERNEL32.WaitForSingleObject
michelinok
12-27-2005, 06:51 PM
Sorry for the delayed post...got it working using
bp GetWindowText

Sorry again!
And many thanks!
ricnar456
12-27-2005, 08:49 PM
OLLYDBG in 98 is a piece of shit (is a form of explain is very limited in 98) and i don´t speak english very well i don´t know how tell in other form more elegant, and w98 too is for me a piece of shit, OLLYDBG have no real posibilities for cracking in 98, if any take a idea of serious cracking need change to NT, 2000 or XP, the limitations of OLLYDBG are very very big, only very easy crackmes can be cracked by OLLYDBG in 98, in nt 2000 or XP you can crack all RING3 crackmes or programs without limitation.

Sorry but i´m very limited speaking in english too.

Ricardo


NtReadFile API

RCE Messageboard's Regroupment > General > NtReadFile API
michelinok
12-27-2005, 06:56 PM
To check how my application read infos from a file, i've seen that it uses the NtReadFile API.
When i set "bp NtReadFile" ollydbg says "Unknown module".
What's wrong?
gabri3l
12-27-2005, 07:38 PM
NTReadFile and ZwReadFile are basically the same function. Try setting a BP on ZwReadFile.

Read this article for more information:

Nt vs. Zw - Clearing Confusion On The Native API
(i used google cache because you have to register to view article)
http://64.233.161.104/search?q=cache:e0zNVFXlsaMJ:www.osronline.com/ar (http://64.233.161.104/search?q=cache:e0zNVFXlsaMJ:www.osronline.com/article.cfm%3Farticle%3D257++Nt+vs.+Zw+-+Clearing+Confusion+On+The+Native+API+&hl=en&client=firefox-a) ticle.cfm%3Farticle%3D257++Nt+vs.+Zw+-+Clearing+Confusion+On+The+Nativ e+API+&hl=en&client=firefox-a
Lord_Looser
12-27-2005, 07:39 PM
I'm too late ;-)

Use ZwReadFile instead of NtReadFile.
NtReadFile links to ntdll.ZwReadFile, it's a forwarded function.


Searching for Hide Debugger plugin to download !!!!

RCE Messageboard's Regroupment > General > Searching for Hide Debugger plugin to download !!!!
tim mactroy
12-28-2005, 02:53 PM
Hey guys , if anyone know a download link for olly` Hide Debugger 1.2.3f , Plz me ..
Love
l8r
TIm
Lord_Looser
12-28-2005, 03:58 PM
first link works.
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2& topic=1257 (http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=2&topic=1257)
Asterix
12-29-2005, 01:57 AM
http://www.woodmann.com/forum/showthread.php?t=5474&page=2
tim mactroy
12-29-2005, 07:20 AM
Hey thax a lot man u saved my day !
l8r
TIm


Babylon v 5.0.6(r13) challenge ...

RCE Messageboard's Regroupment > General > Babylon v 5.0.6(r13) challenge ...
tim mactroy
12-29-2005, 01:23 PM
Hey champs ,
I had tried to crack this software but it seems to have a complex protection code and in PEid it shows " Microsoft Visual C++ 6.0 [Debug]" in the pack field ,but it doesnt seem to have a special pack routine .
I put every breakpoint at dialogBoxParamA and IsBadStringPtrA which are responsible for licence entry window . I think the second function will compare the strings .I traced but the result is not interesting
In the other hand it has a online fake registration check
If anyone of u guys unpacked this plz let me know instruction .
l8r
TIm
ps : the dictionary is english to english


yodas protector 1.03.1

RCE Messageboard's Regroupment > General > yodas protector 1.03.1
ypsuxx
12-30-2005, 05:53 AM
hi,

can someone unpack this file:

http://www.badongo.com/file.php?file=none__2005-12-29_push.dll

I have tried a long time with different yoda unpack scripts for this version. (Yodas protector 1.03.1/1.03.2) but i have still problems with the dll olly says "To many parameters"...
I'am reading always its soo easy to unpack yodas and its not a protector - its a packer ... if someone can unpack please do it!
thx!
regards,
ypsuxx
mr haggar
01-01-2006, 02:58 PM
Yoda is protector and it is good free one. I'll check it because I have never tried to unpack yoda dll.
mr haggar
01-01-2006, 04:22 PM
OEP = 1000E634 > $ 6A 0C PUSH 0C

Open Olly and go to expression, enter this 1000E634 value and place hardware bp on execution there. You will break there. Rest is your job, just dump and use ImpREC to rebuild IAT.

Btw, this is some game file?
yp suxx
01-02-2006, 03:08 AM
Open olly:

1.) loading the DLL
2.) No if it asks for analysing the compressed data
3.) CTRL+G for expression window with 1000E634

then i'am at:

1000E634 8AFA MOV BH,DL

5.)setting hardware bp on execution
6.) F9

then i'am at:

100249C1 8BEF MOV EBP,EDI
100249C3 33DB XOR EBX,EBX
100249C5 64:8F03 POP DWORD PTR FS:[EBX]
100249C8 83C4 04 ADD ESP,4

dumping the process, try to rebuild the iat with (1000E634)

IAT tells me it's not the correct OEP and:
100249C1 8BEF MOV EBP,EDI
seems to be wrong?
maybe u can help me up
mr haggar
01-02-2006, 06:19 PM
You have probably stopped on some exception or some breakpoint which you forgot. OEP is:

1000E634 6A 0C PUSH 0C
1000E636 68 68A30110 PUSH push.1001A368
1000E63B E8 801E0000 CALL push.100104C0
1000E640 33C0 XOR EAX,EAX
1000E642 40 INC EAX
1000E643 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
1000E646 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] ; push.10000000
1000E649 33FF XOR EDI,EDI
1000E64B 3BF7 CMP ESI,EDI
1000E64D 75 0C JNZ SHORT push.1000E65B
1000E64F 393D 68F80110 CMP DWORD PTR DS:[1001F868],EDI
1000E655 0F84 B3000000 JE push.1000E70E
1000E65B 897D FC MOV DWORD PTR SS:[EBP-4],EDI
1000E65E 3BF0 CMP ESI,EAX
1000E660 74 05 JE SHORT push.1000E667
1000E662 83FE 02 CMP ESI,2
1000E665 75 31 JNZ SHORT push.1000E698
1000E667 A1 44110210 MOV EAX,DWORD PTR DS:[10021144]
1000E66C 3BC7 CMP EAX,EDI
1000E66E 74 0C JE SHORT push.1000E67C

Remove all breakpoints (memory, software or hardware) before you place one at OEP. There will be encrypted code but bp will work when Yoda jumps to decrypted OEP.
mr haggar
01-02-2006, 06:20 PM
In short , keep pressing F9 untill you break on OEP.
yp suxx
01-03-2006, 03:34 PM
woah did you tried to fix the iat with imprec - (impRec OEP 0000E634) if i do "Get imports" and try to fixing the invalids my impREC is freezing & crashing.

I have removed all bps (hardware, memory,...)
what to do?
mr haggar
01-03-2006, 06:45 PM
You are probably don't know how to use ImpREC properly. There shouldn't be problems.

First you attach to lunchdll.exe , then click on "Pick dll" find push.dll and then enter for OEP=E634. Then "IAT Autosearch" and "Get Imports". There will be lot of invalid ones, you click "Show invalid" then rightclick and chose "Trace level1". All imports will be founded and you can fix dump.
yp suxx
01-04-2006, 08:13 AM
Thank you mr hagger for your help.

I have dumped the file & rebuild the IAT.

http://www.badongo.com/file.php?file=none__2006-01-04_dumped_.dll

But if i scan it with PEiD it does tell me "Nothing found *" and the Entrypoint section is empty.

(Dumped without rebuild import)

It's not working!
Did you got the same result?
mr haggar
01-04-2006, 05:42 PM
Gimme some mail and I'll send you my dump.
mr haggar
01-04-2006, 08:14 PM
Btw, I wrote tutorial how to unpack yoda 1.03.3, you can find it here

www.reversing.be
(http://www.reversing.be
)

under tutorials.
yp suxx
01-04-2006, 08:44 PM
send it here:
ypsuxx@web.de

btw;nice tutorial
yp suxx
01-05-2006, 08:48 PM
hi mr hagger,

unpacking DLL won't still work. Not with your tutorial / your oep (same method).
Try to pack a DLL from any program that requieres a DLL with yodas protector 1.03.3 and unpack it.
Unpack seems to work but if you start the program that requieres the DLL it will crash because the
dll is not more working after unpacking.

Is it working for you?
(if yes can you please send the dumped dll of the link to my email thanks)
mr haggar
01-06-2006, 09:47 AM
I have unpacked couple dll's but not with yoda. I think that your dump is OK. Maybe there is some check. What is exe that needs this dll? Is this some game file? Gimme the name of game (or send me an exe) and I will check, it's interesting me now.

Btw, I will try with some other file too.

See you.
yp suxx
01-06-2006, 10:03 AM
hi mr hagger,

gimme your mail i'll send you the files and some instruction for the file.

//btw unpacked a lot of files and they are working after unpacking (.exe)
if i unpack any dll the program is crashing.
mr haggar
01-06-2006, 10:14 AM
Listen, I will not give mail here (since this forum doesn't have PM). Go to BIW reversing (there where is tutorial) login as user and send me PM , and I'll give you email and also send you mine dump.

Btw, I have packed my Movie Maker along with two dll's. After unpacking dll's, program works normaly as it should. I think that you have made some mistake. We'll see ;)
yp suxx
01-06-2006, 10:40 AM
check BiW reversing pm.


ASProtect 2.0x problem

RCE Messageboard's Regroupment > General > ASProtect 2.0x problem
nick_name
12-31-2005, 09:43 AM
(*)peid says : ASProtect 2.0x Registered -> Alexey Solodovnikov
(*)i found the OEP at :

47DA1C PUSH 60
47DA1E PUSH The_Lost.004B2880
47DA23 CALL The_Lost.0047FE30
47DA28 MOV EDI,94
47DA2D MOV EAX,EDI
47DA2F CALL The_Lost.0047CC30
47DA34 MOV DWORD PTR SS:[EBP-18],ESP
47DA37 MOV ESI,ESP
47DA39 MOV DWORD PTR DS:[ESI],EDI
47DA3B PUSH ESI
47DA3C CALL DWORD PTR DS:[4A5098] | kernel32.GetVersionExA

(*)now i dump the file
(*)try to fix with ImpRec
(*)1 invalid import at : rva:000A0EC ptr:00F6D68
(*)after a short tracing, it's found as GetProcAddress

(*)now after FixDump the app wont run !!
(*)the dumped_.exe would try to jmp somewhere at 1140000

which is outside the memory of the exe ...
now could anyone suggest me wht to do next ??

THANK YOU
shERis
01-09-2006, 07:46 PM
Hi nick_name!
You found a new version of a s p r !
peid says somwthing wrong.
This version now leaves most API calls original, but some of them are redirected to an allocated memory block of a s p r and handled there. GetProcAddress is handled in an unusual way.
But the most worst thing is, that the new version removes some peaces of large code of the app (from the beginning=OEP or somewhere in it) and executes it in a very strange modified way. It is very, very hard to follow.
A s p r o t e c t cannot be unpacked now.
TresPasser
01-10-2006, 03:42 PM
Hi nick_name,
There are three cases which might cause what you described:
1. (easiest) The jump to the high memory location is another api emulation function which you did not fix (asprotect steals some code from apis and places them in high memory functions)
2. The jump is part of the stolen code of the program - you will probably have to dump (or redirect) the entire section and add to your dump.
3. (worst) The jump goes to the jump emulation system - in some asprotect versions, the protector converts some of the jumps in the original program to calls to its jump emulation system. This code executes the correct jump on the fly, and therefore, your dump cannot run before fixing this problem.

Hope this helps a little,
TresPasser
SKiLLa
01-20-2006, 05:36 PM
PS: It's probably not a real new version of ASPr, but likely just a 'fully armored' ASPr packed .exe. Just as with Arma, there are multiple protection options (depending on the version/build of ASPr, there are some private/custom versions), but most programmers don't use these extra options (which requires some extra effort integrating it into the original app).


Terminating Process/Kernel32

RCE Messageboard's Regroupment > General > Terminating Process/Kernel32
Tom Smith
01-01-2006, 05:05 AM
I have successfully debugged a number of programs with Ollydbg.

I am working in Windows 98 2nd Edition.

As far as I know, the Operating System is stable, and there are no viruses or spam or spies or whatever hindering the System, and no other programs interfering with Ollydbg.

I am working on a new program, let's call the program Scorpio, and when I attempt to debug it, I either start Ollydbg and run the program with the Run command in Ollydbg, or start Scorpio, then start Ollydbg, and attach Ollydbg to Scorpio.

In either case, after hitting Shift-F9 several times to have Ollydbg advance Scorpio, eventually, I get thrown into Kernel32, and get the message at the bottom right of the Ollydbg screen "Terminating Process", and Scorpio terminates.

Can anybody specifically tell me how to get around this premature termination?

In plain English, please, try to avoid too much computer speak.

-Thanks,
Tom.
ricnar456
01-01-2006, 10:26 AM
OLLYDBG is detected and the program JUMP to ExitProcess and end.

Ricardo Narvaja
hosiminh
01-02-2006, 01:05 PM
What about ZwTerminateProcess ?


I need something as "bpio"

RCE Messageboard's Regroupment > General > I need something as "bpio"
CZpCZ
01-01-2006, 09:18 PM
Hi.
I have one problem. I don't know, what I set breakpoint to in/out operations with paralel port.
In SoftIce is instruction "bpio", but i need an alternative in Olly...
Thx.
ricnar456
01-02-2006, 05:58 AM
there is not but you have port monitors, look in the page of the regmon, filemon, i think there is a portmon or so

Ricardo
CZpCZ
01-02-2006, 02:15 PM
I'll find portmon... Thx.
nick_name
01-02-2006, 02:39 PM
www.sysinternals.com ... this is the page if i'm not wrong !!
hosiminh
01-02-2006, 04:52 PM
Try DeviceIoControl


OLLYDBG WITH SCRIPT PLUGIN

RCE Messageboard's Regroupment > General > OLLYDBG WITH SCRIPT PLUGIN
hello123
01-02-2006, 12:01 PM
Where to download OLLYDBG WITH SCRIPT PLUGIN
hosiminh
01-02-2006, 01:11 PM
OllyScript v0.92
archie://tuts4you.com/ollyplugin/OllyScript%20v0.92/sh_osc09.zip
(replace archie with http)

You probably know where to DL Ollydbg...


trouble finding CALL ECX and hooking IAT in armadillo packed

RCE Messageboard's Regroupment > General > trouble finding CALL ECX and hooking IAT in armadillo packed
tim mactroy
01-03-2006, 07:47 AM
I will put bp o CreateThread and I will return to exe code but I get PUSH ECX instead Call ECX .
The other problem is after getting into oep by searchin ff25 in bynary I cant find the jmps to imports and I get stuck with some garbage code
Whats the solutions mates ?

MCTroy
good luck
arjuns
01-03-2006, 11:04 AM
Accroding to my practice over Armadillo, there are two return after breaking on CreateThread, finally you get Call EDI or Call ECX that leads you to the OEP of that application.Put a Bp on that Call EDI of Call ECX there you get what you want.
arjuns


newnie want ollydebug soft

RCE Messageboard's Regroupment > General > newnie want ollydebug soft
ugam
01-04-2006, 11:12 PM
I'm sorry
i'm newbie and i need olly debug soft for free
can somebody help me, where ican download olly debug for free...?
ricnar456
01-04-2006, 11:59 PM
ollydbg is free

http://www.ollydbg.de/

download from ollydbg page

Ricardo Narvaja
ugam
01-06-2006, 12:14 PM
Thank's
ricardo for your help


executable module names...

RCE Messageboard's Regroupment > General > executable module names...
MysTiCy
01-05-2006, 11:12 AM
So i think u know what i mean... in olly, "executable modules", theres "show names", and there is like:
Movewindow@CJTableblahblah
Hide@CTDDialogblahblah
4cjstring...
etc.

So is anywhere anything what those means?
Well some are clear, like hidedialog, it closes window, but rest, i dunno :D
oh me anon
01-05-2006, 02:20 PM
well movewindow etc wont have those demangling at least i have not seen them with clear win32apis
those are called demangled names mostly apply to vcl.bpl,and c++ codes
use options-->debugging options-->addresses check mark demangle symbolic names to get those names in plain english
like whatever::whatever::stringwhatever instead of what@cjtp@@@###123
MysTiCy
01-05-2006, 06:38 PM
Well, it's more readable now, thanks :)

But do u know is anywhere any list of those what they mean, for example, what means:
CwinCtrl
CTSplitString
CJcombobox
and alot more...

------
And without making another thread:

How to see what is done last in program? And how to find what program's user made last.


ASProtect 2.0x Manual Unpacking Scripts

RCE Messageboard's Regroupment > General > ASProtect 2.0x Manual Unpacking Scripts
nick_name
01-05-2006, 11:05 PM
it's been a hard time finding all the HIGHMEM calls 'n fixing them
so, i took some time 'n made these scripts. hope it'll be helpfull for
guys with ASProtect.

1. scripts are for ODBGScript 1.41 version
2. before running the scripts, at the beginning of the script source, define the values accordingly
3. when app is running 'n script has'nt shown SCRIPT FINISHED, abort the script manually

First Script - my_asprotect_HIGHMEM.txt
================================

this script logs all the highmem calls in log-HIGHMEM-calls.txt
log-HIGHMEM-calls-BIN.txt contains the BYTES in reverse order
for binary pasting in olly.

there's a prob here in log-HIGHMEM-calls-BIN.txt
sometimes addresses like 401204 will get reversed and
log-HIGHMEM-calls-BIN.txt file will contain corresponding
41240 not 041240 ... so edit the BIN file manually b4 binary
pasting and put an extra 0 before addresses like 41240

this script requires only 2 things to be defined

1. code_section
2. code_section_size

just control+m , have a look at the code section 'n put the values here.

***********************************
DEFINE_BEFORE_EXECUTION:
mov code_section,401000
mov code_section_size,33000

SCRIPT_START:
mov path1,".\log-HIGHMEM-calls.txt"
mov path2,".\log-HIGHMEM-calls-BIN.txt"

FIND_HIGHMEM_CALLS:
lc
mov counter,0
run

BINARY_SEARCH:
find eip,#807B20000F85????00003C01#
cmp $RESULT,0
je NOT_FOUND
mov bp_addr,$RESULT
bp bp_addr
L1:
eob LOG
esto
jmp L1
jmp NOT_FOUND

LOG:
cmp ebp,code_section
jb L1
cmp ebp,code_section + code_section_size
ja L1
add counter,1
eval "{counter}. {ebp}"
log $RESULT,""

wrta path1, $RESULT
wrta path1, "\r\n"

rev ebp
wrta path2, $RESULT
wrta path2, "\r\n"

eob LOG
esto
jmp L1

NOT_FOUND:
ret
***********************************

second script - my_asprotect_ESTO.txt
==============================

this script does nothing but takes the amount of time you want
to do that shift+f9 thing for ASProtect targets and does tht shift+f9
throught ESTO command in script.

remember the input is in HEX, so if u want to shift+f9 38 times,
enter 26

currently ODBGScript 1.41 has some problem, some times mistakenly
it fails to catch the right input 'n rather takes a ZERO as input
tht's why i made a loop and if u want to exit without inputing anything
put a ` <-- the key right below escape key

***********************************
ASK:
ASK "shift+F9 --> how many (HEX) times ??"
cmp $RESULT,"`"
je FINISH
cmp $RESULT,0
jbe ASK

mov how_many,$RESULT
run
dec how_many

TIME:
esto
dec how_many
cmp how_many, 0
jbe FINISH
jmp TIME

FINISH:
ret
***********************************

Third Script - my_asprotect_RESOLVE.txt
===============================

this script does a cruicial job, it finds all the correct API's corresponding
to the HIGHMEM calls. like i said befor, the log-HIGHMEM-calls-BIN.txt
file will contain all the highmem call address ready to be BINARY-PASTED
in olly (just a little fix needed as mentioned above)

to use this script what you need to do is to know

1. where to binary paste all the values from log-HIGHMEM-calls-BIN.txt
2. the address where the script should put hardware bp and log the eax values

the first job is easy, normaly with the targets i worked ADATA section
contained all places you need , filled up all with zero. but u can chose any
non-destructive place to put them, as u want. just set the address to
the variable binary_paste in the script

the second job is a little tough, u gotta find the right addr where to set the
hardware bp ... okey, follow the instructions

load the app
F9 once ... now you r in ASPR code

binary search for binary search of : 8945FCA1??????008B008B15??????008B1233028B15?????? 002B02
you will land in some place like this :

D73409 MOV DWORD PTR SS:[EBP-4],EAX
D7340C MOV EAX,DWORD PTR DS:[D77824]
D73411 MOV EAX,DWORD PTR DS:[EAX]
D73413 MOV EDX,DWORD PTR DS:[D77824]
D73419 MOV EDX,DWORD PTR DS:[EDX]
D7341B XOR EAX,DWORD PTR DS:[EDX]
D7341D MOV EDX,DWORD PTR DS:[D77680]
D73423 SUB EAX,DWORD PTR DS:[EDX]

so, D73409 will be addr_hwbp in the script

******************************************
DEFINE_BEFORE_EXECUTION:

mov binary_paste,491000
mov addr_hwbp,00A850A7

SCRIPT_START:

mov path1,".\log-RESOLVE calls.txt"
mov path2,".\log-RESOLVE calls-BIN.txt"

mov manual,0

msgyn "MANUAL process ??"
cmp $RESULT,1
jne ANALYZE_CALLS
mov manual,1

ANALYZE_CALLS:

lc
bphws addr_hwbp,"x"

LOOP:

exec
pushad
pushfd
ende

mov save_ebp,ebp
mov save_esp,esp

cmp manual,1
je LBL
mov eip,
mov call_addr,[binary_paste]
jmp COMMON

LBL:
ask "set EIP :-"
cmp $RESULT,"`"
je END
cmp $RESULT,0
jbe LBL

mov eip, $RESULT
mov call_addr,$RESULT

COMMON:
run
cmp eip,addr_hwbp
je LOG
jmp ERR

LOG:
mov tmp, esp
add tmp,20
mov tmp2,[tmp]
gn eax
eval "{tmp2} :: {eax}={$RESULT}"
log $RESULT, ""
wrta path1, $RESULT
wrta path1, "\r\n"

rev tmp2

wrta path2, $RESULT
wrta path2, " "

mov tmp_eax, eax
rev tmp_eax

wrta path2, $RESULT
wrta path2, "\r\n"

add binary_paste,4

mov ebp,save_ebp
mov esp,save_esp

exec
popfd
popad
ende

cmp manual,1
je LOOP

cmp [binary_paste],00000000
jne LOOP

jmp END

ERR:
mov tempo,[binary_paste]
log tempo
eval "{tempo} : EIP does'nt match with HWBP-EIP"
msg $RESULT

mov ebp, save_ebp
mov esp, save_esp
exec
popfd
popad
ende

END:
bphwc addr_hwbp
ret
******************************************

[b]
Fourth Script - my_asprotect_PATCH.txt
==============================

this script will require you to define iat_start and iat_end
look into different sections of the exe for them

binary_paste will require a value just like the previous script

there are 2 lines like :

mov patch_with,"call dword ptr [{tmp_start}]"
//mov patch_with,"jmp dword ptr [{tmp_start}]"

if you want to patch with a JMP then comment the CALL line with a //

****************************************

DEFINE_BEFORE_EXECUTION:

mov iat_start,434000
mov iat_end,4342bc
mov binary_paste,491000
mov patch_with,"call dword ptr [{tmp_start}]"
//mov patch_with,"jmp dword ptr [{tmp_start}]"

SCRIPT_START:
lc
LOOP:
mov tmp_start,iat_start
mov call_addr, [binary_paste]
add binary_paste,4
mov api_addr, [binary_paste]

START_FIND:
mov abc,[tmp_start]
cmp abc,api_addr
je PATCH
add tmp_start,4
cmp tmp_start,iat_end
je LOG
jmp START_FIND

PATCH:
eval patch_with
asm call_addr,$RESULT
mov tempo1,[binary_paste-4]
mov tempo2,[binary_paste]
gn [binary_paste]
cmp $RESULT,0
je LOG
eval "{tempo1} :: {tempo2}={$RESULT}"
log $RESULT, ""
HERE:
add binary_paste,4
cmp [binary_paste],0
jne LOOP

EXIT_PATCH:
ret

LOG:
mov tempo,[binary_paste-4]
eval "\r\n{tempo} :: ................................... <<---------NOT FOUND------\r\n"
log $RESULT, ""
jmp HERE

****************************************
nick_name
01-06-2006, 10:47 AM
all-in-one
http://rapidshare.de/files/10503064/nick_name_ASProtect_scripts.zip.ht ml (http://rapidshare.de/files/10503064/nick_name_ASProtect_scripts.zip.html)
shERis
01-09-2006, 08:31 PM
I worked on a s p r too and wrote a script, that does all the things at once. But the script is not finished.
And this is not the only problem: there is much stolen code, which cannot be processed by a script.
nick_name
01-12-2006, 03:45 AM
shERis ... could u attach the target ... i would like to have a look into it ...
shERis
01-12-2006, 04:44 AM
nick_name: could you give me your app, that I could verify my script? Is it downloadable from the net?
nick_name
01-12-2006, 05:22 AM
shERis ... try them with any soft of hxxp://www.3planesoft.com/index.html
nick_name
01-12-2006, 05:23 AM
shERis ... my script wont take care of STOLEN CODE

but it will come in handy when u r stuck with HIGHMEM calls in your dump

the ESTO script is for reaching the oep

the HIGHMEM script will locate the addrs of HIGHMEM calls
like if a calls goes like 401122 call 1160000 it will log 401122

the RESOLVE script will resolve the calls to their corresponding api's
like 401122 call 1160000 --> kernel32.GetModuleHandleA

the PATCH script will patch the app in olly and make is ready to dump
and IMPRECed.

there r sections in the script DEFINE_BEFORE_EXECUTION:
u should define ur values accordingly there. they r all very self
explanatory
magscy
02-15-2006, 04:17 AM
nick_name,

do you have a tutorial on actual process of unpacking using your script? please share some..
nick_name
02-15-2006, 06:15 AM
i dont have any tutorial ... nor wish to write any
if you have any query you can post it in this thread or in exetools
i'll reply to them ...
magscy
02-16-2006, 10:02 PM
is it still possible today to unpack asprotected appz? i have'nt seen any tutorial on unpacking appz protected with asprotect v2.xx ske if there are any please refer me to this tutorial.
nick_name
02-17-2006, 08:18 PM
magscy, it's possible
but sometimez it's just less time consuming to
inline them or make a loader.


I set breakpoint on ALL commands in Intermodular calls, but nothing happens! help?

RCE Messageboard's Regroupment > General > I set breakpoint on ALL commands in Intermodular calls, but nothing happens! help?
HyppeR
01-06-2006, 05:28 AM
Hello, first i wanna say that im not a pro cracker, im always trying to learn.
I have a delphi 6-7 app here, a bot for a game called Tibia. (www.tibiabot.com).
The trial limit has expired so im trying to crack the key check, but i cant do it with olly, i set breakpoints everywhere, hit Run, olly finds nothing... what is happening? I also tried to open the file with DeDe(delphi decompiler) but somehow it detects nothing.
Thanks in advance!
HyppeR
01-06-2006, 06:07 AM
i just noticed the program hooks a dll called hook.dll which is protected by armadillo, thats why olly didnt find answer to my bps.
I downloaded a software called Trial-Reset thats able to remove Armadillo key licenses from registry.
Problem solved.


Exception handling

RCE Messageboard's Regroupment > General > Exception handling
Tapani
01-08-2006, 06:50 PM
Hi all,

I am debugging an old game and have problems that on some machines the program (presumably) receives an exception from kernel32 and dies.

However, running inside OllyDbg the game works on all machines, maybe since Olly by default intercepts exceptions from kernel32.

Is there any way I can mod/patch the game to have a similar exception behaviour as it has under Olly? I do not have access to a machine where a crash can be reproduced.

Any comments, advice, thoughts etc are welcome. :-)

//Tapani
comrade
01-08-2006, 08:04 PM
Go to Debugging options and set it to pass all exceptions to the program, except int3 breaks (cause you still want to set breakpoints).
Tapani
01-08-2006, 10:41 PM
Thanks mate, but I know how to receive the exceptions inside Olly. I want the other way around :-)

I would want the game to survive even if it receives an exception, just as if Olly had ignored the exception. Also, another of my pleasures is that the people having problems are non-techies and unwilling (unable) to do debugging for me, so I cannot really do proper debugging.

Yeah, I know, it sucks to be me :-)

//Tapani
comrade
01-09-2006, 06:03 AM
Oh sorry, I haven't read your post completely before I replied.

Are you sure the game breaks only from exceptions inside kernel32? It must be doing something funny with exception handling, because usually kernel32/ntdll exceptions are handled by kernel32/ntdll itself, and the exception is never seen by the game.

Can you post the crash log that you get with Dr Watson?
Lord_Looser
01-09-2006, 07:59 AM
First you should search for the calling function that leads to the exception. Perhaps sometimes there is a not allowed paramter (e.g. pointer NULL) handing over to the kernel32 function.
If not you can
1. write your own little loader/debugger or
2. insert a DLL and use SetUnhandledExceptionFilter or
3. insert a DLL and manipulate alls threads SEHs
...

I think if the game is not protected you should think about it from top to bottom.
Tapani
01-11-2006, 03:20 AM
lord_looser:

thank you for your advice, unfortunately I do not have access to any machine where I can reproduce the crash. I am solely dependant on less computer literate users patient enough to do debug tests.

The capture all exceptions Olly-style was a fix-all solution without having to figure out why it crashed.

comrade:

I am not 100% sure it is from kernel32/ntdll. One user of mine has used purify on the exe, and for him it crashed in HeapFree .

Another of my users sent me the following drwatson log. I have never deciphered one these before, but to me it seems like it crashes in ntdll (InitializeCriticalSection)

Any advice is very, very welcome,

//Tapani (I am sortof a windows newbie (been on linux way too long), so sorry if I have missed something obvious..)

Application exception occurred:
App: C:\Program Files\Championship Manager 01-02\cm0102.exe (pid=2204)
When: 10/01/2006 @ 20:21:00.756
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: CPQXXXXXXXXXXX
User Name:
Terminal Session Id: 0
Number of Processors: 1
Processor Type: x86 Family 6 Model 10 Stepping 0
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner:

*----> Task List <----*
0 System Process
4 System
500 smss.exe
576 csrss.exe
600 winlogon.exe
644 services.exe
656 lsass.exe
796 svchost.exe
860 svchost.exe
900 svchost.exe
960 svchost.exe
1028 svchost.exe
1288 spoolsv.exe
1308 Explorer.EXE
1392 Ati2evxx.exe
1432 HPConfig.exe
1472 HPWirelessMgr.exe
1548 navapsvc.exe
1720 SymWSC.exe
152 alg.exe
356 carpserv.exe
444 OneTouch.EXE
460 SynTPLpr.exe
520 SynTPEnh.exe
556 navapw32.exe
752 Dragdiag.exe
920 jusched.exe
1056 MSMSGS.EXE
1172 E_AICN03.EXE
1632 NMBgMonitor.exe
2676 ntvdm.exe
2204 cm0102.exe
3688 drwtsn32.exe
3304 drwtsn32.exe

*----> Module List <----*
(0000000000400000 - 0000000000de7000: C:\Program Files\Championship Manager 01-02\cm0102.exe
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
(000000005b0a0000 - 000000005b0a7000: C:\WINDOWS\system32\umdmxfrm.dll
(000000005cd70000 - 000000005cd77000: C:\WINDOWS\system32\serwvdrv.dll
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\COMCTL32.dll
(00000000629c0000 - 00000000629c9000: C:\WINDOWS\system32\LPK.DLL
(0000000063000000 - 0000000063014000: C:\WINDOWS\system32\SynTPFcs.dll
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK32.dll
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPOOL.DRV
(0000000073760000 - 00000000737a9000: C:\WINDOWS\system32\DDRAW.dll
(0000000073bc0000 - 0000000073bc6000: C:\WINDOWS\system32\DCIMAN32.dll
(0000000073f10000 - 0000000073f6c000: C:\WINDOWS\system32\DSOUND.dll
(0000000074d90000 - 0000000074dfb000: C:\WINDOWS\system32\USP10.dll
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg32.dll
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.dll
(00000000773d0000 - 00000000774d2000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1 df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
(000000007c9c0000 - 000000007d1d5000: C:\WINDOWS\system32\SHELL32.dll

*----> State Dump for Thread Id 0x4e4 <----*

eax=0be54ad0 ebx=01400000 ecx=00000048 edx=00000146 esi=0be54ac8 edi=0be54b20
eip=7c911e58 esp=0012fa08 ebp=0012fa14 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
function: ntdll!RtlInitializeCriticalSection
7c911e3c 000f add [edi],cl
7c911e3e 87ee xchg esi,ebp
7c911e40 ed in eax,dx
7c911e41 ffff ???
7c911e43 807d1400 cmp byte ptr [ebp+0x14],0x0
7c911e47 0f85977a0300 jne ntdll!RtlInitializeSListHead+0x108d4 (7c9498e4)
7c911e4d 8b4e0c mov ecx,[esi+0xc]
7c911e50 8d4608 lea eax,[esi+0x8]
7c911e53 8b10 mov edx,[eax]
7c911e55 894d08 mov [ebp+0x8],ecx
FAULT ->7c911e58 8b09 mov ecx,[ecx] ds:0023:00000048=????????
7c911e5a 3b4a04 cmp ecx,[edx+0x4]
7c911e5d 89550c mov [ebp+0xc],edx
7c911e60 0f859d000000 jne ntdll!RtlInitializeCriticalSection+0x3d6 (7c911f03)
7c911e66 3bc8 cmp ecx,eax
7c911e68 0f8595000000 jne ntdll!RtlInitializeCriticalSection+0x3d6 (7c911f03)
7c911e6e 56 push esi
7c911e6f 53 push ebx
7c911e70 e81fedffff call ntdll!wcsncpy+0x105 (7c910b94)
7c911e75 8b450c mov eax,[ebp+0xc]
7c911e78 8b4d08 mov ecx,[ebp+0x8]

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** WARNING: Unable to verify checksum for C:\Program Files\Championship Manager 01-02\cm0102.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Championship Manager 01-02\cm0102.exe
ChildEBP RetAddr Args to Child
0012fa14 7c910d5c 00000048 0be54b20 0012facc ntdll!RtlInitializeCriticalSection+0x32b
0012fae8 00945330 01400000 00000000 0be54b28 ntdll!wcsncpy+0x2cd
0012fb04 00777564 0be54b28 00000118 00ae2c90 cm0102+0x545330
0be8d02d 00000000 61117401 61206120 61206120 cm0102+0x377564

*----> Raw Stack Dump <----*
000000000012fa08 00 00 40 01 20 4b e5 0b - 01 00 00 00 e8 fa 12 00 ..@. K..........
000000000012fa18 5c 0d 91 7c 48 00 00 00 - 20 4b e5 0b cc fa 12 00 \..|H... K......
000000000012fa28 00 00 00 00 56 e2 e9 0b - 28 4b e5 0b 03 00 00 00 ....V...(K......
000000000012fa38 00 00 b6 01 ca 0e 91 7c - 00 24 50 01 78 01 40 01 .......|.$P.x.@.
000000000012fa48 6d 05 91 7c 60 52 7f 11 - e0 6d 6d 11 08 24 50 01 m..|`R...mm..$P.
000000000012fa58 00 00 b6 01 a0 2a 4d 01 - d8 6d 6d 11 90 69 73 11 .....*M..mm..is.
000000000012fa68 01 00 00 00 e8 d6 4c 01 - 2a 72 00 00 03 2f c3 0d ......L.*r.../..
000000000012fa78 00 00 00 00 00 00 00 00 - a8 01 40 01 98 69 73 11 ..........@..is.
000000000012fa88 30 00 00 00 00 00 00 00 - 38 d1 ed 0b 50 82 e9 0b 0.......8...P...
000000000012fa98 d0 01 40 01 a8 83 f4 0b - 08 00 00 00 a8 61 e7 0b ..@..........a..
000000000012faa8 68 11 00 00 d0 01 40 01 - 00 00 40 01 48 ca ea 0b h.....@...@.H...
000000000012fab8 50 fb 12 00 00 00 00 00 - 00 00 00 00 00 00 00 00 P...............
000000000012fac8 98 a3 01 00 06 00 00 00 - 2c fa 12 00 2c f6 12 00 ........,...,...
000000000012fad8 88 fb 12 00 18 ee 90 7c - 70 05 91 7c 01 00 00 00 .......|p..|....
000000000012fae8 04 fb 12 00 30 53 94 00 - 00 00 40 01 00 00 00 00 ....0S....@.....
000000000012faf8 28 4b e5 0b 5b e2 e9 0b - 00 4b e5 0b 2d d0 e8 0b (K..[....K..-...
000000000012fb08 64 75 77 00 28 4b e5 0b - 18 01 00 00 90 2c ae 00 duw.(K.......,..
000000000012fb18 00 00 00 00 48 ca ea 0b - 98 df 95 03 50 06 00 00 ....H.......P...
000000000012fb28 0a 00 00 00 da b5 76 00 - 40 b5 d6 0c 2a 72 00 00 ......v.@...*r..
000000000012fb38 03 2f c3 0d 00 00 00 00 - 03 00 d5 07 00 00 00 00 ./..............
Lord_Looser
01-11-2006, 08:49 AM
Your exception occurs at eip=7c911e58. It's a memory access violation within
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll.
The most important suff are the satck back trace entries:
ChildEBP RetAddr Args to Child
0012fa14 7c910d5c 00000048 0be54b20 0012facc ntdll!RtlInitializeCriticalSection+0x32b
0012fae8 00945330 01400000 00000000 0be54b28 ntdll!wcsncpy+0x2cd
0012fb04 00777564 0be54b28 00000118 00ae2c90 cm0102+0x545330
0be8d02d 00000000 61117401 61206120 61206120 cm0102+0x377564

http://msdn.microsoft.com/library/en-us/vccore98/HTML/_crt_strncpy.2c_ .wcsncpy.2c_._mbsncpy.asp?frame=true
(http://msdn.microsoft.com/library/en-us/vccore98/HTML/_crt_strncpy.2c_.wcsncpy.2c_._mbsncpy.asp?frame=tr ue
)

Check the parameters of this function within your programm above eip=00945330 and others before calling these.

ChildEBP=0012fae8
RetAddr=00945330
*strDest=01400000
*strSource=00000000
count=0be54b28
ntdll!wcsncpy+0x2cd
Lord_Looser
01-11-2006, 09:26 AM
hm, if I see it correct it isn't involve in the function ntdll!wcsncpy.
Ollydbg calls it ntdll.RtlpDeCommitFreeBlock + 0x1A8 with my installed symbols.

https://www.xfocus.net/bbs/index.php?act=ST&f=2&t=34352&page=2
RtlFreeHeap calls RtlpDeCommitFreeBlock( Heap, (PHEAP_FREE_ENTRY)BusyBlock, FreeSize );
Tapani
01-11-2006, 08:47 PM
Thank you very much!

Things start to falling in place:
0012fb04 00777564 0be54b28 00000118 00ae2c90 cm0102+0x545330
0be8d02d 00000000 61117401 61206120 61206120 cm0102+0x377564

The addresses there correspond to a call from the memory deallocation wrapper the game uses. (Using HeapFree). Unfortunately, this wrapper is used all the time by the game so I'll have to try to see what I find in the raw stack dump. It seems clear now that the game is freeing some memory it shouldn't free and that's the reason to all the evil.

Once more, thank you very much for your help.

//Tapani
Lord_Looser
01-12-2006, 09:59 PM
Have you installed the last game updates? Version 3.968 (only german?)
http://www.champmaniacs.de/gdoffi.html
Tapani
01-13-2006, 05:45 PM
Thanks for the patch link, but I already have the last official 3.9.68 update.

The problem seems more deep-going than I thought. It seems that after some point any call to HeapFree will crash, so it seems like something that has corrupted the memory allocator (maybe a bad free?).

Is anyone aware of a tool for Windows that can debug memory allocation cerrors similar to Valgrind on Linux? I have already tried purify (the free two-week trial) and purify crashes with an "internal error" saying the compiler used is to create the .exe is not supported.

Lord_Looser, apparently you know the game - what I am up to is creating a mod that updates the start year, leagues and does other improvements/bugfixes. I would be happy to hand out the beta version of this mod to anyone interested... ;-)

//Tapani
Lord_Looser
01-14-2006, 04:53 PM
Sorry, but I don't know this game. I only google for this and found this too: http://www.sigames.com/downloads.php?type=game&id=9&filterBy=


2 new plugins

RCE Messageboard's Regroupment > Plugins > 2 new plugins
bobbyus
01-09-2006, 08:06 AM
1st one is a the modified bookmark example from ollydbg pdk.
you can use this plugin to set up to 256 bookmarks. This version of the plugin saves the original asm code when the bookmark is set, when the code at that position changes it will show in the bookmark window, making selfmodifying code management easier.

for more info see the documentation in the archive :)

the 2nd plugin helps with numeric conversion, that it will convert hex number to decimal and binary formats, so you wont have to use calculator everytime to convert, you just right-click what you want to see, and in the menu go to "extra" and you will get the values converted

These are my first plugins sorry if there are any bugs and missing functionality and for the lame documentation (writen in word 2003 - get a wordviewer 2003 from www.microsoft.com), (http://www.microsoft.com),) i wrote them in 2 nights, but if you'll notice any bugs or have any suggestions/questions please report them to me pls, at bobby@liber.ro and i'll be glad to fix them.

here is the link for both of them
http://www.liber.ro/ollydbg/ollydbg_plugins.rar

have fun, and i hope you'll find them usefull
TBD
01-10-2006, 09:55 AM
extra plugin is quite handy. nice work.
REQ: can you remove cw3230mt.dll dependency ?

ps. glad to see some .ro around ;)


OllyDbg memory breakpoint management

RCE Messageboard's Regroupment > General > OllyDbg memory breakpoint management
shERis
01-09-2006, 07:26 PM
Hi!
OllyDbg only has 2 ways to handle a memory exception:
1. memory on access
2. memory on write

but there is no
3. memory on execution

I read, that there is a patched olly for point 3.
Can anybody help me to get that patched version ?
Newbie_Cracker
01-09-2006, 09:23 PM
Mem on access is similar to mem on execute...
ricnar456
01-10-2006, 12:12 AM
Are you wrong, is not similar, BPM on access stop in execute and stop in read, and he need only stop in execute only, not read is very very different.

In a packer you put a BPM ON ACCESS in the code section and OLLY stop each time write a value in the section (can stop 1000 or 2000 times before reach OEP), and with a BPM ON EXECUTE only OLLY stop in the OEP or the first line of the section executed is very different.

I patch a olly for non stop in read and only on execute the problem in each time the program skip a possible stop for read take a little time, and for a complete unpacking can take 5 or 10 minutes for reach the oep, but you can take a coffe and return and OLLY will be waiting sttoped in OEP.

Ah you need put all marks in debugging options-exceptions, and try in a previous RUN, the program skip all exceptions, for OLLY don´t stop in exceptions, and only in the BPM on EXECUTION.

http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-Ñ-O-P/OLLY%20PARCH EADO%20PARA%20BUSCAR%20OEPs.rar
(http://www.ricnar456.dyndns.org/HERRAMIENTAS/L-M-N-Ñ-O-P/OLLY%20PARCHEADO%20PARA%20BUSCAR%20OEPs.rar
)

user and pass:hola

And this OLLY never stop in BPM reads, for this use a common OLLY.

This can be useful for VB programs you put a BPM on ACCESS in code and stop only when execute program and not the VB dll, jeje.

Ricardo Narvaja
shERis
01-10-2006, 05:40 PM
Hi Ricardo!
Thank you for your patched OllyDbg and for giving the link to me.
It´s a great improvement!
Do you have an idea why Olly didn´t implement a command "Memory Breakpoint on Execution" ?
shERis
ricnar456
01-10-2006, 11:12 PM
is not possible in RING3 always you have permission for execute, the read permision work togheter, only in RING 0 is possible separate BPM ON EXECUTION fron BPM ON READ.

In my patched,if OLLY stop in read in BPM ON ACCESS, i patch to force to continue running, the effect is the same but only more slow, but works.

Ricardo
shERis
01-12-2006, 03:38 PM
I assume that Olly didn´t want to implement that command, because your way of solving the problem is wasting much execution time and so OllyDbg would be very slowly. But it is good that you made it working.
Thanx Ricardo!
It´s fascinating for me what you know.


Neolite 2.0 unpacking using olly

RCE Messageboard's Regroupment > General > Neolite 2.0 unpacking using olly
soda
01-11-2006, 01:24 PM
hi friends
i want to manually unpack a dll / ocx that packed with neolite 2.0
very easy to find oep . but after dump and successfull rebuilding imports the unpacked file not work .
please help me how i can unpack this doo /ocx using olly in other method ?
thanks
mr haggar
01-11-2006, 07:24 PM
You can download Neolite 2 itself because it has unpacking feature similar like UPX. Neolite has 2 kinds of compression; usuall and maximum. Usual can be restored but maximum not (by neolite itself ofcourse).
soda
01-14-2006, 03:23 PM
max protection
plz another help
thanks mr haggar
mr haggar
01-15-2006, 12:46 PM
I don't know I didn't try. I have couple dll's packed with neolite so maybe I'll try if I find time.
soda
01-15-2006, 01:26 PM
ok . thanks mr hagger
shERis
02-09-2006, 06:46 PM
Hi soda!
Had the same problem with an exe.
With PE Editor I found some errors:
1. File Alignment was dumped false
2. Subsystem Windows GUI was not set (had to be 2)
3. Base Relocation Table was set with false data (not necessary on 32 Bit systems, must be deleted)
After correction of all errors, exe did run fine.


[RicardoNarvaja] 2 preguntas sobre ollydbg

RCE Messageboard's Regroupment > General > [RicardoNarvaja] 2 preguntas sobre ollydbg
matthews_30
01-12-2006, 01:01 PM
Hola Ricardo, que gusto verte por estos lares!

Quzias no me recuerdes, pues en Cracklatinos habia bastante gente y ademas yo enviaba pocos mensajes, aunq me lei bastantes cursos en ASM.

Yo soy de Chile y una vez intercambiamos correos de manera personal, hace años atrás.

bueno esta vez tengo 2 preguntas:

1. como recompilo una DLL que he cargado con ollydbg y la modique, pero no creo que sea "copiar a ejecutable", pues es una libreria nativamente hecha con visual c++ 6.0.

2. tengo un ejecutable que en la partida me gustaria que ejecutara un archivo ejecutable y luego volviera el control al programa original (el primer ejecutable)

espero que se entienda.

puedo postear en ingles, pero es mas facil de explicar en español.

Gracias por todo, una vez mas!

matt.
matthews_30
01-12-2006, 05:50 PM
:(
ricnar456
01-12-2006, 11:29 PM
si no esta empacada marcas lo cambiado, click derecho copy to executable y en la ventana que se abre click derecho save file, sirve para cualquier exe que no este empacado, y para empacados tambien siempre que modifiques en el codigo inicial.

no explicas ccuando vuelve el control, cuando se cierra o finaliza el segundo proceso?

pues vos podes lanzar un proceso y a partir de que arranca este es independiente asi que el control lo tenes en el programa de nuevo, ahora si queres detectar cuando finaliza y controlar mejor las cosas, debes hacer un loader debugger, mira en las teorias, las que escribi de como hacer un loader debugger yo no soy programador ni medio, pero me alcanza para escribir un pequeño loader debugger en el mismo OLLYDBG aprovechando la posibilidad de guardar alli lo que escribes, y asi expplique como hacerlo en el mismo OLLY seran 30 o 40 instrucciones tampoco es para matarse, tambien hay despues mas tutes sobre el tema que hicieron NCR y algun otro creo que hizo el codigo en C o algo asi, yo me conformo con que tengo mi loader debugger hecho le modifico tres o cuatro lineas en el mismo olly y ya lo adapto para cualquier caso.

Ricardo
matthews_30
01-18-2006, 08:26 PM
la primera respuesta está excelente!

ahora, la segunda, dime, de donde me bajo el tutorial?

me gusto mucho lo que dices "ahora si queres detectar cuando finaliza y controlar mejor las cosas, debes hacer un loader debugger..."

dime, en cual de todos los sitios lo busco? en Cracklatinos, Hispa, el hacker, etc??

gracias.
ricnar456
01-19-2006, 09:42 AM
http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS %20NUMERADAS/
(http://www.ricnar456.dyndns.org/CRACKING/NUEVO%20CURSO/TEORIAS/TEORIAS%20NUMERADAS/
)

user:hola
pass:hola

mira alli de la 349 en adelante hay 5 partes que son las mias de loader debugger y mas adelante estan las de NCR que es una pasada en limpio e la idea, pues yo lo escribi a medida que se me ocurria, y el le hizo una pasada en limpio

349-COMO HACER UN LOADER DEBUGGER P 535'300 Fri Jun 17 19:32:38 GMT-03:00 2005

350-COMO HACER UN LOADER DEBUGGER P 410'288 Fri Jun 17 19:33:18 GMT-03:00 2005

351-COMO HACER UN LOADER DEBUGGER P 438'097 Fri Jun 17 19:33:40 GMT-03:00 2005

352-COMO HACER UN LOADER DEBUGGER P 455'112 Fri Jun 17 19:34:02 GMT-03:00 2005

353-COMO HACER UN LOADER DEBUGGER P

los de NCR

370-LoaderDbg_I_by_+NCR.rar 290'584 Fri Jun 17 19:45:40 GMT-03:00 2005

371-LoadeDbg_II_by_+NCR.rar

Esos son los tutes

Ricardo
matthews_30
01-19-2006, 06:42 PM
leyendo!

muchas gracias!

matt.


Ollydbg and Console mode

RCE Messageboard's Regroupment > General > Ollydbg and Console mode
Fuzzy
01-15-2006, 04:30 AM
Hi everybody. I have problems for debug Warcraft II Battle.net Edition. (my son likes this game) :) . It's run only in Windows, so it's a PE file. But run in a DOS window, in full screen mode. I can open it perfectly with Olly, put it in pause and running it. But I have problems when i use Breakpoints. For example, I put a Breakpoint in the adress of memory the XXXXX. I back to the game. I do the necessary things in order that Olly jumps and it does it. It returns to Windows but I can't see any window, i have all the background in black . I see only the "start bar", and i can change tasks using Alt+tab. Also I can use the mouse, but without seeing any window. I changed the start resolution mode of the Executable, i put compatibility with Win98, etc, but it didn't work.

What can i do?

PD: Excuse me my english, it's not my first language.
oh me anon
01-16-2006, 03:12 PM
debuggin full screen application is a tedious task as the game has full control over the screen try running it in windowed mode if it is possible
otherwise you have to rely mostly on log breakpoints
and debug without pausing the application
so that you can alt tab and to ollydbg window and look at logged data

other wise using remote debugging feautures of windbg with two machine setup is the best way to deal with full screen applications

if you have visual studio or if you are comfortable with
ms debugging tools aka windbg,cdb.ntsd,and kd and have two machines you can check this out
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsdeb ug/html/vxoriremotedebuggingsetup.asp (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsdebug/html/vxoriremotedebuggingsetup.asp)
ramguru
01-17-2006, 05:09 PM
try to set "Always on top", it worked for me...


Asm2Clipboard v0.3 available

RCE Messageboard's Regroupment > Plugins > Asm2Clipboard v0.3 available
Fatmike
01-15-2006, 04:38 PM
Asm2Clipboard v0.4 available

All bugs are fixed (or: I havent found any until now)
Download:
http://rapidshare.de/files/11125265/Asm2Clipboard_v_0_4.zip.html

You can add it to stuph page if you want.

Greetings Fatmike
nick_name
01-20-2006, 03:01 PM
is this a BUG ??

1039E001 PUSHAD
1039E002 CALL bsmpg.1039E00A
1039E007 JMP 5596E4F7
1039E00C PUSH EBP
1039E00D RETN
1039E00E CALL bsmpg.1039E014
1039E013 JMP SHORT bsmpg.1039E072
1039E015 MOV EBX,-13
1039E01A ADD EBX,EBP

now when i copy inline / MASM , i get something like

L000:
PUSHAD
CALL L000
JMP 5596E4F7h
PUSH EBP
RETN
CALL L000
JMP 1039E072h
MOV EBX,-13h
ADD EBX,EBP

the call is pointing to wrong place after copying, is tht not ??


armadillo 3.75c script

RCE Messageboard's Regroupment > OllyScript > armadillo 3.75c script
Eugene123
01-15-2006, 07:26 PM
anyone know where i can get it.


Data Ripper 1.1 plugin

RCE Messageboard's Regroupment > Plugins > Data Ripper 1.1 plugin
Ziggy
01-18-2006, 06:16 AM
Here is a "Data Ripper" Olly plugin which can rip data directly out of an app being debugged. Just select the data in any Olly data window, right click to select Data Ripper and rip the data into the format you need. Data Ripper also has some basic editing and file merge functions so the ripped data can be copied easily into your code.

This is the first general release of Data Ripper 1.1. This release supports ASM, C/C++, Delphi, comma separated values and data string formats. The Readme has info about how to use it.

If you have any suggestion for improvements post them here. There are a few plugins around which can rip data but no one plugin has a full range of the functions needed.

http://rapidshare.de/files/11270568/DataRipper1.1ollydbgplugin.zip.ht m l

Add it to stuph page if you want

Ziggy
nick_name
01-18-2006, 07:05 AM
DataRipper is crashing olly !!

1. start olly
2. select some code
3. right click - data ripper ( using c/c++)
4. now dont save the code ... selecting NO in the prompt box
5. close olly ....
IT WILL CRASH !!!
Ziggy
01-18-2006, 08:40 AM
nick_name,
I can't reproduce the problem? I've tried a few variations but no crash.

I had one crash reported during beta testing but it turned out to be because the Olly plugin limit had been reached!

Can you give me more details please.

Thanks
Z
nick_name
01-18-2006, 10:07 AM
ziggy i'm using shadow's olly with the follwoing plugin ...

olly advanced
analyzeThis
asm2clipboard
bookmarks v2
cleanupEx
CommandBar
Extras
GODUP plugin
hide caption
hide ollydbg
IsDebugPresent
NonaWrite
ODBGScript
OllyDump
OllyPad
Breakpoint Manager
Puntos Magicos
WindowInfos

the 1st exception is :

modname : unknown
code : 0xc0000005
flags: 0x00000000
Addr: 0x00000000027b296e

the 2nd exception is :

modname : unknown
code : 0xc0000005
flags: 0x00000000
Addr: 0x00000000027b296e

the 3rd exception is :

modname : kernel32.dll
offset: 0000e0b9
Ziggy
01-18-2006, 06:37 PM
The crash happens only with Shadow Olly. I don't know why yet.

Z
nick_name
01-19-2006, 06:28 AM
this is olly shadow ...
http://tuts4you.com/ollyextra/Olly Custom Engines/odbg110 Shadow.zip

check out this place for other variations :

http://tuts4you.com/ollyextra/index.php?path=Olly+Custom+Engines/


OllyScript/ODbgScript: great GPA bug !

RCE Messageboard's Regroupment > OllyScript > OllyScript/ODbgScript: great GPA bug !
shERis
01-18-2006, 11:33 AM
BUG in GPA !
There is a great bug in GPA, but I don´t know why.
If you have a command GPA "Any_Proc","COMCTL32.DLL", you´ll get a wrong (non existing) address of this "Any_Proc".
Why ?
I tried the following:
1. I loaded notepad.exe in a first instance of Olly (could be another app using COMCTL32.DLL)
2. I made a little script with gpa "CreateToolbar","COMCTL32.DLL" and loaded it
3. I started another instance of Olly, attached first instance of Olly and run it
4. I set a BP on CALL near kernel32.LoadLibraryA in GPA command in ODbgScript-section in second instance of Olly
5. I singlestepped the script in first instance of Olly with S
6. Olly stopps in second instance at that CALL
7. Wonder !?!

I found the following:
In second instance of Olly there are all plugins in shown memory, in first instance not.
In first instance there is COMCTL32 in a high memory space. But in second instance of Olly there is at the same place a DLL called COMCTL_1. And there is at another place COMCTL32!!! At this address there is nothing in first instance of Olly! GPA now examines the address of CreateToolbar in COMCTL32 in second instance in a lower space and gives it to $RESULT. But in first instance of Olly this address is invalid!!!

Does anybody know this behaviour and how to eliminate it, so that GPA results the right address of COMCTL32 procs ???
shERis
01-19-2006, 12:07 PM
I think, that GPA now results the proc addresses of the named proc in OllyDbg process and NOT in the app process.
All other commands seem to be executed in app process.
Does anybody know how to get proc addresses in another loaded process (it is the loaded app process, here in the example notepad.exe) ?
nick_name
01-19-2006, 12:49 PM
the GPA code for ODBGscript is like the following :

======================================
bool OllyLang::DoGPA(string args)
{
string ops[2];

if(!CreateOperands(args, ops, 2))
return false;

string proc, lib;

if(GetSTROpValue(ops[0], proc) && GetSTROpValue(ops[1], lib))
{
HMODULE hMod = LoadLibrary(lib.c_str());
if(hMod == 0)
{
//errorstr = "No such library: " + lib;
variables["$RESULT"] = 0;
variables["$RESULT_1"] = "";
variables["$RESULT_2"] = "";
return true;
}
variables["$RESULT_1"] = lib;

FARPROC p = GetProcAddress(hMod, proc.c_str());
FreeLibrary(hMod);

if(p == 0)
{
//errorstr = "No such procedure: " + proc;
variables["$RESULT"] = 0;
return true;
}
variables["$RESULT"] = (DWORD) p;
variables["$RESULT_2"] = proc;
return true;
}

variables["$RESULT"] = 0;
return false;
}
======================================

in the 2nd instance of olly, it breaks on LoadLibraryA becoz GPA
has a LoadLibraryA call inside it's code ... pretty obvious

ODBGscript.dll is loaded under olly ... so in 2nd olly, putting a bp on
LoadLibraryA means from the 1st intance, every call for LoadLibrary would
break on that bp of 2nd instance ... which had just happened

in both instances, i loaded the following script ...

===========================
gpa "CreateToolbar","COMCTL32.DLL"
msg $RESULT
===========================

both msgbox popped up with the same address : 5D0C8FA3
shERis
01-19-2006, 06:09 PM
Hi nick_name!
I myself know code of GPA and what it does.

Let me tell more:
1st instance of Olly debugs app (notepad.exe).
2nd instance of Olly debugs Olly of 1st instance.
ODbgScript is loaded by Olly - it´s loaded in both instances! But only in 2nd instance you can debug ODbgScript and set a BP on CALL kernel32.LoadLibraryA in ODbgScript code.
When you run a script with GPA then 2nd Olly breaks at LoadLibraryA.

But when you look at memory map window in both Olly´s, you´ll find the following (address could vary for you):

1st instance:
71950000 COMCTL32

2nd instance:
71950000 COMCTL_1
77310000 COMCTL32

When you execute GPA, then it results addresses of COMCTL32 in 2nd instance, it doesn´t matter in what instance of Olly you do. You´ll always get 77310000. But this is wrong!
It seems that Olly (1st instance) loads COMCTL32 twice in its process. One for the app and one for Olly itself.
But the right version of COMCTL32 is renamed to COMCTL_1, which has the same address. Therefore you´ll always get the wrong address of 2nd COMCTL32, which does not exist in app process.
So it is necessary to get proc address in app process and not in Olly process.

You can make a little test:
========================
gpa "CreateToolbar","COMCTL32.DLL"
mov addr,$RESULT
gn addr
msg $RESULT
========================
and now you can guess, what you will see.
shERis
shERis
01-19-2006, 06:22 PM
What I forgot to say:
This ugly behaviour is only with COMCTL32.DLL. All other libs are at the same memory location in 1st and 2nd instance of Olly, therefore reading app process or Olly process doesn´t matter. But GPA always should result app process !!!
nick_name
01-19-2006, 09:15 PM
shERis i'm getting a little deviations from ur situation

in both instances i'm getting
gpa "CreateToolbar","COMCTL32.DLL"
msg $RESULT -------> 5D0C8FA3

but with gn this is returning ZERO !!!

in 1st instance, my comctl32 is loaded at

=========================
Address=773D0000
Size=00001000 (4096.)
Owner=COMCTL32 773D0000 (itself)
Section=
Contains=PE header
Type=Imag 01001002
Access=R
Initial access=RWE
=========================

**************************************
**************************************

now i tried this ...

opened 1st instance of olly(debugger)
loaded another olly (2nd instance - debugee) into it ... ( not attaching )

now in the mem.map :

============================
Memory map, item 35
Address=5D090000
Size=00001000 (4096.)
Owner=COMCTL32 5D090000 (itself)
Section=
Contains=PE header
Type=Imag 01001002
Access=R
Initial access=RWE
============================

now i press f9 under the 1st instance (debugger) ....
the 2nd instance (debugee) runs ...

just after that ... in the 1st instance(debugger), the mem.map shows
wht u said ...

===========================
Memory map, item 331
Address=773D0000
Size=00001000 (4096.)
Owner=comctl_1 773D0000 (itself)
Section=
Contains=PE header
Type=Imag 01001002
Access=R
Initial access=RWE
===========================

now here is the problem ...

==========================================
The LoadLibrary function maps the specified executable
module into the address space of the calling process.

HINSTANCE LoadLibrary(

LPCTSTR lpLibFileName // address of filename of executable module
);

.... ..... .....

The first directory searched is the one directory containing the
image file used to create the calling process (for more information,
see the CreateProcess function). Doing this allows private
dynamic-link library (DLL) files associated with a process to be found
without adding the process's installed directory to the PATH environment
variable.

Once the function obtains a fully qualified path to a library module
file, the path is compared (case independently) to the full paths of
library modules currently loaded into the calling process. These
libraries include those loaded when the process was starting up as well
as those previously loaded by LoadLibrary but not unloaded by
FreeLibrary. If the path matches the path of an already loaded module,
the function just increments the reference count for the module and
returns the module handle for that library.
==========================================

with sysinternal's process explorer ... my 1st instance ( debugger ) shows

1. D:\WINDOWS\system32\comctl32.dll [version : 5.82]
2. D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2649_x-ww_aac16c8b\comctl32.dll
[version : 6.0 (xpsp.050406-1732)]

2nd instance only loads :

D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2649_x-ww_aac16c8b\comctl32.dll[version : 6.0 (xpsp.050406-1732)]

**************************************
**************************************

now , from MSDN
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp /html/xptheming.asp
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp/html/xptheming.asp
)

ComCtl32.dll Version 6

All applications running on the Windows XP operating system have a non-client area, which includes the window frame and non-client scrollbars. A visual style is applied to the non-client area by default. This means that the appearance of the non-client area is specified by the visual style that is currently installed. To apply a visual style to common controls in the client area, you must use ComCtl32.dll version 6 or later. Unlike earlier versions of ComCtl32.dll, version 6 is not redistributable. The only way you can use version 6 of the dynamic-link library (DLL) is to use an operating system that contains it. Windows XP ships with both version 5 and version 6. ComCtl32.dll version 6 contains both the user controls and the common controls. By default, applications use the user controls defined in User32.dll and the common controls defined in ComCtl32.dll version 5.

If you want your application to use visual styles, you must add an application manifest that indicates that ComCtl32.dll version 6 should be used if it is available. Version 6 includes some new controls and new options for other controls, but the biggest change is support for changing the appearance of controls in a window.

now i think, this is a problem with WINDOWS itself tht it is loading both
version 5 and 6

and a possible solution could be to determine which version is loaded and
which version of comctl32.dll function user wants to be resolved by GPA
nick_name
01-19-2006, 09:35 PM
http://addressof.com/blog/archive/2004/02/13/384.aspx

I can use IsThemeActive from uxtheme.dll that would tell me whether or not visual styles is enabled. But prior to that, I need to test that the OS version is greater than 5.1 and do a LoadLibrary to test that the uxtheme.dll exists. Not a problem; pretty simple really. So great, I can determine if Windows is themed. But, what if I didn't use EnableVisualStyles()? My application is still using the previous common control library. Then comes in the IsAppThemed() method in uxtheme.dll. Sounds like it's the one I want... but it appears to always return true when testing under WindowsXP that has themes enabled and no EnableVisualStyles() being used. If the application is not using visual styles, why does this function return true? Grrrr.
Epsylon3
01-20-2006, 01:09 PM
wow no comments :p
shERis
01-21-2006, 01:34 AM
Hi nick_name!
I played a little bit with OllyDbg and found the following:
When Olly is loaded, COMCTL32 from windows system32 directory is loaded into memory. It is shown as COMCTL32 in memory map window.
When Olly begins to run, it loads COMCTL32 from windows WinSxS\x86_Microsoft.Windows.Common-Controls..... directory using kernel32.LoadLibraryW/kernel32.LoadLibraryExW/ntdll.LdrLoadDll. With ntdll.RtlDosApplyFileIsolationRedirection_Ustr the WinSxS path is added to filename.
COMCTL32 therefore is loaded twice. The both versions are not identical. (Process Explorer shows it very well.)
To make a difference between the two instances windows changes the owner name to COMCTL_1 of the second COMCTL32.
I don´t know why Olly does this and I think it doesn´t matter for our problem.

I think there must be a simple possibility to get the proc addresses of the loaded modules in the debugged process using
VAL_HPROCESS (HANDLE) Handle of debugged process
VAL_PROCESSID Process ID of debugged process
VAL_HMAINTHREAD (HANDLE) Handle of main thread of debugged process
VAL_MAINTHREADID Thread ID of main thread of debugged process
information of Plugingetvalue(int type).
Sysinternals Process Explorer shows it in a very effective way.

But I am no windows programmer. Please help me and Epsylon3 if you know the necessary code.
shERis
nick_name
01-21-2006, 06:52 AM
a possible solution is to use LoadLibraryEx instead of LoadLibrary in OllyLang::DoGPA

HINSTANCE LoadLibraryEx(

LPCTSTR lpLibFileName, // points to name of executable module
HANDLE hFile, // reserved, must be NULL
DWORD dwFlags // entry-point execution flag
);

Flag = LOAD_WITH_ALTERED_SEARCH_PATH
..........If this value is given, and lpLibFileName specifies a path, the function uses the alternate file search strategy

Thank you shERis n' epsylon3


hmemcpy questions

RCE Messageboard's Regroupment > General > hmemcpy questions
hikmatic
01-20-2006, 01:20 AM
How can I breakpoint on hmemcpy or rtlmemorymove, like the way IDA does. My main goal is to breakpoint right after I press a button or when something enters memory.

P.S. I dont know if this is a stupid question, I'm still learning about dissassembling.
nick_name
01-20-2006, 03:59 AM
this topic has been discusses several times in the forum ... use the search option


Safedisc antidebug trick

RCE Messageboard's Regroupment > General > Safedisc antidebug trick
cps530
01-21-2006, 12:39 AM
I'm working on a application protected by Safedisc 2.65.010 (PEiD). It's not a game on a CD. I downloaded it from internet. I'm searching over and over again about this kind of protection and the only thing I get is: that's really really hard!!. Not a tutorial or any comment. Actually I can't even bypass antidebug tricks: during a CreateProcess appears an error (in Olly, no messagebox!) and I got a terminate process. No Olly, no problem: the application runs beautifully. For version 2.50 I found Safedisc 2 cleaner that supposedly beats Safedisc, but nothing for 2.65.010. Any suggestion or indication where to start from? Thx for any help.


ASProtect v1.3x

RCE Messageboard's Regroupment > General > ASProtect v1.3x
trnc
01-22-2006, 06:22 AM
Hi all, well, y downloaded AD Pic Viewer, its packed wit ASProtect 1.3x, well PEiD tell me this:

ASProtect 1.2x - 1.3x [Registered] -> Alexey Solodovnikov

my problem is, i cant find the OEP with the exceptions method, just like Ricardo Narvaja did in a tutorial, well my question is, does anybodie know how to unpack this ASProtect version?
ricnar456
01-22-2006, 09:43 AM
in the new versions, there are some asprotects than hide the oep in the asprotect code, for avoid the exceptions trick.

Ricardo Narvaja
miniC
01-22-2006, 09:48 PM
Try this one!!
http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1. php?file=Unpacking_And_Dumping_ExeCryptor_and_Codi ng_Loader_by_deroko. rar
(http://intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Unpacking_And_Dumping_ExeCrypto r_and_Coding_Loader_by_deroko.rar
)

In that tutorial you have OEP FINDER by deroko!!! Veeeeeeeeeeery good progy!!!
scherzo
02-06-2006, 05:53 PM
I don't know, but the link is broken!
The exceptions method to find the oep don't work if there is stolen code in new versions of Aspr.
Anyway, this script is perfect and very simple!!! (except for Asprotect 2.2 SKE and 1.35 too):

// ASProtect 1.32 and greater (except ASProtect 2.0 alpha) OEP finder by sanniassin::REVENGE Crew

// Ignore all exceptions

// Clear all breakpoints

// Tested on WinXP only
var x

var y

var is_DLL
mov x,esp

sub x,48

bphws x,"r"

mov y,[eip]

and y,000000FF

cmp y,60

jne zzz

mov is_DLL,1
zzz:

run

mov y,[eip]

cmp y,01B80875

jne zzz

bphwc x

find edi,#83C404010424C3#

mov x,$RESULT

add x,6

bp x

run

bc x

sto

mov x,eip
findcall:

dec x

mov y,[x]

cmp y,5B5E5F5D

jne findcall

sub x,8

go x

sti

rtr

sto

mov x,eip

and x,0000FFFF

cmp x,0

je no_VM_on_OEP
VM_on_OEP:

msg "OEP found! OEP stolen."

jmp pause
no_VM_on_OEP:

mov x,esp

cmp is_DLL,1

jne is_exe

add x,10

jmp label_9

is_exe:

add x,8

label_9:

bphws x,"r"

run

mov y,eip

dec y

mov y,[y]

and y,000000FF

cmp y,5C

jne label_9

bphwc x

cmp is_DLL,1

jne is_exe2

find eip,#8944241C61FFE0#

add $RESULT,5

bp $RESULT

run

bc $RESULT

sto

jmp msg

is_exe2:

mov x,eax

go x

msg:

msg "OEP found! OEP not stolen."
pause:

pause

scherzo
miniC
02-07-2006, 02:25 PM
http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/down load1.php?file=Unpacking_And_Dumping_ExeCryptor_an d_Coding_Loader_by_d eroko.rar
(http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Unpacking_And_Dumping_ExeCrypto r_and_Coding_Loader_by_deroko.rar
)

Try now!!
miniC


Insert new opcodes in code caves from any PE file with Ollydbg

RCE Messageboard's Regroupment > General > Insert new opcodes in code caves from any PE file with Ollydbg
herman2k
01-30-2006, 12:14 PM
Hi, we all know that the most unpacked PE-file does have codes caves!

Now i want like use the code cave from any executable file to insert there new opcodes (for my job).

The new opcodes should be able:
1. to find a defined file on HDD path
2. make a copy --> renamed it --> paste it (if possible in same path)

Ok the programm shoul do this for better understanding:
1. Find calc.exe in path c:\windows\system32
2. make a copy from calc.exe but with new name (renamed.exe)

The sub programm should be run in the code caves from calc.exe (for example)

please help me :)

best regards,
herman2k


This forum back again !

RCE Messageboard's Regroupment > The Heap > This forum back again !
shERis
02-06-2006, 08:24 AM
I am very glad (and I assume all other users are it too), that this forum is back again!

Great thanks for all people who made this!
TBD
02-06-2006, 02:08 PM
my host had some DNS attacks and I am glad too that we have a solution to get the forum back online
oh me anon
02-06-2006, 04:03 PM
welcome back


Exception Probs

RCE Messageboard's Regroupment > General > Exception Probs
seanlim1
02-06-2006, 12:24 PM
I tried Attaching Olly on to a game.
After its attached for about 10-20 secs, Olly will pause and not allow me to unpause. there will be "Exception E06d7363 - Use Shift+F7/F8/F9 to pass exception to program" I have to pass it a few times and then it will teminate. May i know how to solve this problem ? I guess its due to the configuration of my Olly. Thanks.
ricnar456
02-06-2006, 09:38 PM
when this exceptions are triggered, is for a OLLYDBG detecion, and next go to create this exception, try to look before the creation of the exception, the detection of OLLYDBG.

Ricardo


Unpack UPX

RCE Messageboard's Regroupment > General > Unpack UPX
servicenick
02-06-2006, 09:45 PM
Hi all,
I unpacked a upx packed proggy with upx -d , it seems it worked well, I can access all the resource and the strings with a debugger or resource editor, but the program doesn't run anymore.

I tried to figure out what went wrong with ollydbg, but I'm a newbie ... :)
The proggy is KlaimSMS you can google for it or ask me, I'll be glad to send you a copy. It's a freeware prog, I'm trying to reverse it, not crack it.

Bye
Thank you in advance for support
arjuns
02-07-2006, 04:11 AM
I think, there is problem with Import Table,Try unpacking using olly and use plugin ollydump because I'd a problem with ImportRec While rebuilding Import table.Finlly you are done..........

kind regards
arjuns..........
servicenick
02-07-2006, 08:58 AM
Shouldn't "upx -d" work better (when it works) than ollydump? With IDA I can access all the imported functions in the unpacked prog, It doesn't look like it has a wrong import table. If I run the program simply nothing happens, no errors, but the program terminates.

Anyway, I tried both ways upx -d and ollydump.
I found OEP and I dumped the process with ollydump, but how how do I rebuild Import table?
Is there some suitable tool?

Thank you.
arjuns
02-07-2006, 10:30 AM
just check on the Rebuid Import.
servicenick
02-07-2006, 10:36 PM
done, nothing to do, the import table is ok, but the prog doesn't work.!

Please help!
Maybe some protection from the author ? ( but it's a freeware prog)

Could you take a look to the program?
You can find KlaimSMS 1.55 beta at http://www.klaimsoft.com/

bye
thanks
arjuns
02-08-2006, 04:31 AM
Couldn't found it , Can you please send exct link?
servicenick
02-09-2006, 08:10 PM
OK, here you are!
Exact link:
http://www.klaimsoft.com/klaimsms/klaimsms.exe
servicenick
02-11-2006, 07:20 AM
Dear arjuns, I'm still stuck with this problem,
did you understand something about the program?

Bye


ExecuteNInstructions()?

RCE Messageboard's Regroupment > General > ExecuteNInstructions()?
murph
02-07-2006, 03:22 AM
Is there a plugin API for Ollydbg to execute, say, 10 instructions, then break?
arjuns
02-07-2006, 04:13 AM
use ollyScript instead of searching for particular plugin
arjuns
02-07-2006, 04:17 AM
Latest Ollyscript can be called from any plugin
oh me anon
02-08-2006, 02:50 PM
well to execute 10 instruction and break use
ctrl+t --> check mark command count is box enter the number of commands you want to trace and break viz 10
hit ok and use trace in ctrl+f11 olly will stop on the 10th command
that is executed

and would say some thing like

Log data, item 0
Address=0040100C
Message=Conditional pause: 3. commands traced
murph
02-20-2006, 12:30 AM
Arjuns, thank you. I had seen the ollyscript forum before but didn't pay it much attention because I never thought it would be what it is. Oh me anon, I didn't know you could even do it that way in regular ollydbg. Thanks for the tip, although I think I'll be using ollyscript.


Word .dot decompile

RCE Messageboard's Regroupment > General > Word .dot decompile
holyman
02-07-2006, 03:38 AM
Hello,

I would like to know if it is possible to use Olly to get around the "Project locked" on Word templates. Any suggestions on how to go about it would be greatly appreciated. For example, how do I catch the Alert window that comes up?

Thanks

Mia


Crocodile-clips

RCE Messageboard's Regroupment > General > Crocodile-clips
Wille
02-07-2006, 06:51 PM
Hi, do u know a link for (or do u can write) a tut for getting the serial for crocodile-clips chemistry program?
srry for BaD3nglish! (if it is bad...)
Wille
02-09-2006, 06:41 PM
or can u just give a serial and username for it or crack?
plz, I really want full version of it!
nick_name
02-10-2006, 01:27 PM
wille, this is NOT a crack request forum
you are in the wrong section
Wille
02-11-2006, 02:59 PM
ok, but I think that I found the key calculation area, so can u tell me if this is the right place or not and if it is then plz give me a calculation formula to calculate the key if u have time but that is enough if u tell that is it the right place!

100E79C6 /$ 6A 0C PUSH 0C
100E79C8 |. 68 F0491310 PUSH cceditor.101349F0
100E79CD |. E8 CA030000 CALL cceditor.100E7D9C
100E79D2 |. 8365 E4 00 AND [LOCAL.7],0
100E79D6 |. 8B75 0C MOV ESI,[ARG.2] ; cceditor.10000000
100E79D9 |. 8BC6 MOV EAX,ESI
100E79DB |. 0FAF45 10 IMUL EAX,[ARG.3]
100E79DF |. 0145 08 ADD [ARG.1],EAX
100E79E2 |. 8365 FC 00 AND [LOCAL.1],0
100E79E6 |> FF4D 10 /DEC [ARG.3]
100E79E9 |. 78 0B |JS SHORT cceditor.100E79F6
100E79EB |. 2975 08 |SUB [ARG.1],ESI
100E79EE |. 8B4D 08 |MOV ECX,[ARG.1] ; cceditor.<ModuleEntryPoint>
100E79F1 |. FF55 14 |CALL [ARG.4]
100E79F4 |.^ EB F0 \JMP SHORT cceditor.100E79E6
100E79F6 |> C745 E4 010000>MOV [LOCAL.7],1
100E79FD |. 834D FC FF OR [LOCAL.1],FFFFFFFF
100E7A01 |. E8 08000000 CALL cceditor.100E7A0E
100E7A06 |. E8 CC030000 CALL cceditor.100E7DD7
100E7A0B \. C2 1000 RETN 10
100E7A0E /$ 837D E4 00 CMP [LOCAL.7],0
100E7A12 |. 75 11 JNZ SHORT cceditor.100E7A25
100E7A14 |. FF75 14 PUSH [ARG.4]
100E7A17 |. FF75 10 PUSH [ARG.3]
100E7A1A |. FF75 0C PUSH [ARG.2] ; cceditor.10000000
100E7A1D |. FF75 08 PUSH [ARG.1] ; cceditor.<ModuleEntryPoint>
100E7A20 |. E8 43FFFFFF CALL cceditor.100E7968
100E7A25 \> C3 RETN
100E7A26 .- FF25 38541810 JMP DWORD PTR DS:[<&MSVCR71.abort>] ; MSVCR71.abort
100E7A2C /$ 833D 20081810 >CMP DWORD PTR DS:[10180820],-1
100E7A33 |. 75 06 JNZ SHORT cceditor.100E7A3B
100E7A35 |.- FF25 B0541810 JMP DWORD PTR DS:[<&MSVCR71._onexit>] ; MSVCR71._onexit
100E7A3B |> 68 10081810 PUSH cceditor.10180810
100E7A40 |. 68 20081810 PUSH cceditor.10180820
100E7A45 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
100E7A49 |. E8 A0030000 CALL <JMP.&MSVCR71.__dllonexit>
100E7A4E |. 83C4 0C ADD ESP,0C
100E7A51 \. C3 RETN
100E7A52 /$ FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; cceditor.10000000
100E7A56 |. E8 D1FFFFFF CALL cceditor.100E7A2C
100E7A5B |. F7D8 NEG EAX
100E7A5D |. 1BC0 SBB EAX,EAX
100E7A5F |. F7D8 NEG EAX
100E7A61 |. 59 POP ECX ; ntdll.7C9011A7
100E7A62 |. 48 DEC EAX
100E7A63 \. C3 RETN


setting a memory breakpoint on priv

RCE Messageboard's Regroupment > General > setting a memory breakpoint on priv
clafrieda
02-09-2006, 03:20 AM
Is there anyway to set a memory breakpoint on Priv memory? Everytime I try ollydbg say it's unable to set a breakpoint on that memory location. I tried setting a hardware breakpoint on that memory, but it didn't seem to have any effect (unless there were no accesses).
shERis
02-09-2006, 09:55 AM
Change to memory map window, select PRIV memory, right click, select Set Access/Full Access - and you are done!

But if memory block has no access privilege - what it is good for ???
clafrieda
02-09-2006, 12:36 PM
I remembered trying that before, and I just double checked... it doesn't work. Still can't apply the memory breakpoint.

After changing access fo full->

Access goes from RW to RWE, but still get the error:

"Ollydbg is unable to activate memory breakpoint on address range ... Breakpoint is completely removed."


Password fishing protected files

RCE Messageboard's Regroupment > General > Password fishing protected files
tim mctroy
02-10-2006, 10:34 AM
Hey all !

I have some experience with cracking but I tried to find the password for a zip file packed with a masker proggy . I couldnt find or hook the real serial but I patched the program to bypas pass check and just decrypt file , it gave a crc checksum error ! I tried to open decompressed zip file but file was corrupted . but with real password decrypted file is OK .
plz share ur ideas about fishihng passwords .

Love and cheers .
Dan
ps the packer proggy is bmpPacker . it hides files into bmp format and encrypts them /
kittmaster
02-19-2006, 04:51 PM
As far as I know, you can't fish zip masked password files........the file password is part of the CRC check sequence of the mask. This is also my understanding as to why zip files are never corrupted because of this types of mechanism.

Others may chime in to correct me if I'm in error


Upolyx 0.5 OEP finder&Dumper

RCE Messageboard's Regroupment > OllyScript > Upolyx 0.5 OEP finder&Dumper
Locu
02-10-2006, 01:14 PM
I have mde this script but the animate into doesn't stop at eip, #60??EB??# could someone help me?

// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/*

Upolyx 0.5 Generic OEP finder Powered By Locu/06
*/

START:
ao //animate into
find eip, #EB??# // <---the script doesn't stop here
cmp $RESULT, 0
jne OEP
msg "Script failed."
ret

OEP:
go $RESULT
bphws esp, "r"
run
sti
cmt eip,"<- OEP"
msgyn "Dump file?"
cmp $RESULT, 0
jne DUMP
msg "You're at the OEP, now dump'n'fix the IAT with ImpRec. Locu/06"
ret

DUMP:
dpe "c:\dumped.exe", eip
msg "C:\Dumped.exe SAVED!!! Now fix the IAT whit ImpRec. Locu/06"
ret

thanks

Regards


"Manager" for PluginLoader

RCE Messageboard's Regroupment > Plugins > "Manager" for PluginLoader
Leon2006
02-10-2006, 09:51 PM
Now i put to

http://rapidshare.de/files/12985062/plugmng.zip.html

extension for old olly plugin - PluginLoader. This manager
has target to simplify editing of plugin ini-file, and both of them
partitialy solve problem with 32 plugin limitation.

wbr, Leon
ps. pluginloader i put to zip also.


how to you save comments

RCE Messageboard's Regroupment > General > how to you save comments
clafrieda
02-10-2006, 11:21 PM
I spent 6 hours commenting code and lost it all when the app terminated. I restarted the app again thru olly, and all my comments were gone. Is there any way to save them?
oh me anon
02-11-2006, 02:53 PM
alt+e alt+u should update the udd file as and when you need
alt+e == view executable file
alt+u on that window is updated udd file

but normally comments should not go ollydbg writes it back even if the
application is terminated

you sure the application isnt self modifiying invalidating the crc check of code section

did you look in log windows did olly say udd discarded due to invalid crc

if yes then you can force ollydbg to load the old udd file
if you check mark
options --> debugging options (alt+o) security --> ignore crc of code section


setting function arguments

RCE Messageboard's Regroupment > General > setting function arguments
clafrieda
02-10-2006, 11:52 PM
I want to set function arguments for a function that looks like:

int cdecl func(void*, int, void*, int*);

Is there any way to do this? In the drop down box there is a limited number of chices. Is there a way to add more? I could just add a comment with this info, all I really need is to add the text so I know what's going on.


ClickFix301.xfm Cool Edit Plugin Asprotected v1.23

RCE Messageboard's Regroupment > General > ClickFix301.xfm Cool Edit Plugin Asprotected v1.23
InsideDaCode
02-11-2006, 03:51 AM
Hi Everybody, I need help:

I don't have any experience in reversing but I want to learn. My deal is music and I have a great plugin for Cool Edit (ClickFix v3.01) that is Asprotect v1.23 packed. I've read a lot about Olly (.EXE extensions unpacking) but nothing about a program that is executed through another application (in this case Cool Edit is the one that executes ClickFix) especially programs such as ClickFix301 that has a (.XFM) extension... I can load it in Olly hiding the debugger but I get lost 'InsideDaCode'... else it detects the debugger and terminates the application. I've tried SoftIce as well, but the plugin can't even be loaded... Asprotect detects debugging instantly!!! So, I need your help! I'm running Cool Edit Pro 2.0 and ClickFix v3.01 and you can find them on the net.


Extreme newbie question, CTRL+F7 or F8

RCE Messageboard's Regroupment > General > Extreme newbie question, CTRL+F7 or F8
snickered
02-11-2006, 03:47 PM
I open up a program (simple gui app with a couple of text boxes and a couple of buttons) in Olly and it says paused. I then try to run CTRL+F7 and it seems to go crazy looking in all the places of my computer other than the program I have just opened and the program never seems to open the traditional way (showing the gui app and allowing me to enter information in the text boxes). I tried this with CTRL+F8 next and the program opens immediately. The problem I have now is that nothing happens in Olly when I click one of the buttons in the gui app. I figured it would bounce around perhaps to what is being processed when I click on one of the buttons. My basic question is how can I run this program and have Olly show me what is going on as I click buttons and such. TIA and please go easy on me.


comments from sources

RCE Messageboard's Regroupment > General > comments from sources
t4b
02-13-2006, 04:07 PM
Is it possible to load sources and see comments in OllyDbg?

i have written some code in asm and commented it. But then i need to debug it and i use OllyDbg. But without comments it's very difficult to understand my own code.
oh me anon
02-14-2006, 01:11 PM
assemble it with debug info /zi or some switch search this board with google site search viz site:ollydbg.win32asmcommunity.net /zi debug info
and then use ctrl+f5 or view source
t4b
02-14-2006, 04:47 PM
many many thanks!!! It works fine!! I had just deleted all the info-files))
and now i ran the compilation without to delete all the info-files.

thanks!!


Plugin Watches Expression print Value to file c:\logfile.txt

RCE Messageboard's Regroupment > Plugins > Plugin Watches Expression print Value to file c:\logfile.txt
David Rapisarda
02-13-2006, 07:24 PM
Watches
Watch expressions | Value
EIP > 12345678 | 00000001

I need a Plugin that will print Value 00000001 to file c:\logfile.txt


IMUL

RCE Messageboard's Regroupment > The Heap > IMUL
Wille
02-15-2006, 03:36 PM
what's that?
is IMUL EAX,EAX,666 == EAX = EAX * 666?
how I can do imul thingy in vb (or/and in vb.net)
oh me anon
02-15-2006, 05:42 PM
get some asm opcode referance :) thats an assembly instruction

integer multiplication
IMUL Integer Multiply, Signed

IMUL - Signed Multiply
Usage: IMUL src
IMUL src,immed (286+)
IMUL dest,src,immed8 (286+)
IMUL dest,src (386+)
Modifies flags: CF OF (AF,PF,SF,ZF undefined)

it multiplies the src == eax
and sets the result in destination == eax
by the immediate == 666

so if eax was 0 before the result will be 666 in eax

and so on

as to vb able to do it i dont think vb supports inline asmming

its some thing like a = a*666

and btw what has this topic got to do with ollydbg :)


access memory via segment:[offset]

RCE Messageboard's Regroupment > General > access memory via segment:[offset]
Smith Goga
02-16-2006, 07:41 AM
I'd like to see some hex dump data based on segmet:[offset] schema but when i "Go to" "Expession" in "Hex Dump" window and type for ex. DS:[ESI] or DS:[EAX+2] or ES:[EDI] i have the message "No memory on the specified address" but i have deffenetly valid addresses there. Is it possible to access memory in this way and if yes then how?
gabri3l
02-17-2006, 05:00 AM
hmm works for me... odd that it isn't working for you.

Well, You can try using the commandline plugin included with Olly, but I recommend the commandbar plugin though. It sits at the bottom of the Olly window making it always accessible. I'm sure you can find it on the stuph page

in the command line type:
"d ds:[ecx]" without the quotes of course.

That will show address located at ds:[ecx] in dump window.
works for the others as well
milad
02-17-2006, 06:41 AM
Thanks Gabril
it is good to hear from you again


NotePad topmost : plugin (asm only)

RCE Messageboard's Regroupment > Plugins > NotePad topmost : plugin (asm only)
BeatriX
02-16-2006, 09:04 AM
Hi,

I wrote this small plugin for Olly 1.10 just to see if it is easy to code it in ASM.It is just for educational purpose.

I have coded NotePad Topmost with masm32. It allows us to run NotePad with topmost property. So you can use it during an analyse with Olly (to note what you want) , NotePad stay on top. I added an option to control the opacity of the window too.

With the source code, you can see how to send logs to the Log data window of ollyDbg without using the Olly internal functions. (Addtolist for example).
You can see also how to send logs to Notepad using the Clipboard. (with the Copy2Clipboard procedure)

Sources + plugin :

http://reverseengineering.online.fr/spip/IMG/zip/NotePadEng.zip

for french lovers :

http://reverseengineering.online.fr/spip/article.php3?id_article=58

BeatriX (FRET)
gabri3l
02-17-2006, 04:28 AM
Useful plugin BeatriX!
And very clean and simple source too. Thank you very much for sharing.

I actually modified it a bit so that after you open notepad, all subsequent times you choose "Run Notepad" the text in your clipboard is copied directly to notepad.
Wondering though if it is possible to register a new right-click menu option in Olly that will copy selected code directly to notepad?
BeatriX
02-17-2006, 08:28 AM
Happy you like it :) can you explain what is your small modification ?
Yes, good question for the right click. Let's see...
gabri3l
02-17-2006, 02:36 PM
It's kind of lame, :/

But I just commented copy2clipboard:

---------------------------------------------------------------------- -------
;call Copy2Clipboard ; copy in the clipboard
push 0
push 0
push WM_PASTE
push hEdit
call SendMessage ; paste in the NotePad

push offset ClipEnd
;call Copy2Clipboard ; copy in the clipboard just for beauty :)
---------------------------------------------------------------------- --

Now when WM_PASTE is called it will paste whatever is in the clipboard. If I get ambitious I was thinking of adding a couple carriage commands in there to add spaces between each time the clipboard is pasted.
But all I'm really doing is bastardizing your code. :) Without it I wouldn't have even known where to start.
BeatriX
02-17-2006, 03:35 PM
ok, I see :) Maybe I have a solution. Here is the 1.1 version. I added a "Copy/paste to NotePad" function in the contextual menu of the Disasm window.

To do such a function, I just synthesize CTRL+C (using the Olly internal function which do it yet ) and then PASTE in the NotePad.

Sources+ Plugin 1.1 (same address):

http://reverseengineering.online.fr/spip/IMG/zip/NotePadEng.zip
gabri3l
02-17-2006, 05:38 PM
wow, it was that easy to register a submenu. :) This has just become one of my favorite plugins. :D
Thanks again BeatriX


ollydbg plugin list

RCE Messageboard's Regroupment > Plugins > ollydbg plugin list
muxum
02-18-2006, 05:23 PM
is there anywhere a plugin list with links where to DL and maybe some description?

im looking for a plugin which lets me save the changes i did in olly to the exe file. search doesnt work for this forum and looking through the posts i cound not find anything like that.
oh me anon
02-18-2006, 05:27 PM
well to search this site use google site search

like site:ollydbg.win32asmcommunity.net save modifications

and why do you need a plugin

whats the problem with native functionality

right click-->copy to executable--->save file in the new window that pops up
muxum
02-18-2006, 08:45 PM
ha okay i didnt see that only saw copy > one
but still a list of all plugins would be nice hope someone makes a website maybe it will be me if i cant find one soon
Lord_Looser
02-19-2006, 09:09 AM
Olly Advanced v1.23
AJunk v1.00
Analyze This! plugin v0.1
Nonameo's ApiBreak
Asm2Clipboard plugin v0.4
AttachAnyway plugin v0.3
Bookmarks sample plugin v1.06
Borland Map File Importer Ver 1.0
BreakOnLoad
CLBPlus! v1.0
CleanupEx v1.12.108
CommandBar v3.10.109c
Command line plugin v1.10
Code Ripper plugin v1.1
CWJOWL plugin v1.10
Data Ripper plugin v1.2
DebugActiveProcessStop
Debuggee Detach
DeJunk plugin v0.12
DllBreakEx plugin v2.2
dUP 2 plugin v1.10
ExtraCopy plugin v0.90
GODUP ver 1.2
Hide Caption v1.00
Hide OllyDBG plugin v1.01
Hide Debugger v1.2.3f
HideOD
Olly Invisible Plugin 0.9
olly_findcrypt
IsDebugPresent plugin v1.4
Labeler v1.32.108
Labelmaster plugin v0.1
LoadMap version 0.1
MapConv ver 1.4
MemoryBackup
MemoryManage beta
Nonameo's NonaWrite 1.1
NotePad 1.1
NtGlobalFlag Plugin v1.10
ODbgScript v1.46
OllyDump v3.00.110
OllyFlow plugin v0.71
OllyGraph plugin v0.1
OllyHelper v1.3
OllyMachine v0.20
OllyPad v1.10
OllyScript v0.92
Olly Hit Snake
OllyUni plugin v0.07
OllyVBHelper plugin v0.1
Breakpoint Manager
Anti Anti Hardware Breakpoint
Heap Vis
PolyMorphic Breakpoint
PushTracer
olly_sync v0.2
OllyDbg PE Dumper v3.04
Puntos Magicos v1.10
Sleepp
Stay on top v1.0
prince's TracKit plugin V1.10 (beta)
Turbo Debug
Handle UnhandledExceptionFilter
Ultra String Reference v0.11
WatchMan v1.00
WindowInfo
WindowJuggler v0.06 BETA
j10n v1.40.106
... and many more
muxum
02-19-2006, 11:28 PM
ahaha nice but how about link and description?
but nvm i found such a list
http://ollydbg.win32asmcommunity.net/stuph/


Dump debugged code in textfile

RCE Messageboard's Regroupment > Plugins > Dump debugged code in textfile
Devoney
02-19-2006, 09:37 AM
Hi people,
While searching the internet I ran into this forum. I am really impressed by how easily all you guys code plugins for olly. Thats one thing I need to learn for sure ;)

But that comes later :)

My question is, I was wondering if there is a plugin which dumps the code where olly runs over. Like if a call is made that it goes into the call and copys every line it runs over into a text file. So you actually have the code (in the nice order) which is used in the program before some event or breakpoint.

If this doesn't exist I really like to have some information about how to program some plugin or what the basics are.

I got to the idea of this plugin because I have a time trial program I want to reverse. It will give me a other screen when the time is over so I want to know the differences of the code now and then.

Great thanks already, I hope I made sence,

Devoney
kittmaster
02-19-2006, 04:41 PM
Sounds like your looking for a dynamic code ripper. As far as I know this doesn't exist yet, however, there is a cope ripper plugin asm2clipboard that can correct highlighted code and be ripped from the app for say..........keyg.........

Chris
Lord_Looser
02-19-2006, 04:55 PM
You can use 'run trace' und save it to a log file.
Devoney
02-19-2006, 09:00 PM
yeah? gonna check that right away!

Edit:
I have tried to do copy the code where olly runs over but I do not understand is 100%. What do I have to set or do exactly?

Thanks for the replys already!

Can you maybe give some basic knowledge how to build plugins? I know how to program in vb, and a little in assembly (but not the visual parts in assembly :P thats kinda hard for me yet)

Grtz Devoney