Contents
What can OllyDbg be used for in reverse engineering?
OllyDbg is a 32-bit disassembler/debugger for Microsoft Windows binary files. It is shareware and it is available here . The goal today is to provide a tour of OllyDbg and how the tool can be used in reverse engineering software or malware.
How to Interpet the EFL in OllyDbg?
Olly slightly expands the register by separating out the booleans for common control status bits above EFL (the singular bits named ‘C P A Z S T D O’). The abbreviations in brackets next to EFL’s value the correlate to what can/cannot pass under the current EFLAGS, ie: NO stands for No-Overflow, toggling the OF bit will switch it to O for overflow.
What are the hotkeys in OllyDbg for debugging?
There are several hotkeys that you will find useful during your debugging session. They are: F7 – the Step Into command. This key single-step traces one instruction at a time F8 – the Step Over command. This key single-step traces one instruction except for CALL instructions.
How does OllyDbg help in a penetration test?
Gives context-sensitive help on API functions from external help file Sets conditional, logging, memory and hardware breakpoints Traces program execution, logs arguments of known functions Searches for imprecise commands and masked binary sequences Examines and modifies memory, sets breakpoints and pauses program on-the-fly
How to decompile binary file in OllyDbg IDE?
Now open the SoftwareExpiration.exe program in OllyDbg IDE from File à open menu and it will decompile that binary file. Don’t be afraid of the bizarre assembly code, because all the modifications are performed in the native assembly code.
Why is there a loading error on OllyDbg?
Any plug-in loading errors can usually be attributed to placing the plug-in in a directory other than Olly’s default plug-ins directory. Two recommended plug-ins you should get are OllyDump to dump a process’ memory and Olly Advanced to get around any anti-debugging a malware sample may throw against you.
Where do I find the log window in OllyDbg?
You may also call up many of the view menu options by clicking on the corresponding blue buttons (L, E, M, T, etc). Clicking on the Log (Alt+L) option will bring up the Log Window. This window displays all debugging events such as module loads, thread creations, breakpoint hits, and errors.