1 / 14

OllyDbg

OllyDbg. Debuger. What is OllyDbg.

joshwa
Télécharger la présentation

OllyDbg

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. OllyDbg Debuger

  2. What is OllyDbg OllyDbg is a debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries http://en.wikipedia.org/wiki/OllyDbg

  3. Versions • Version 1.10 is the final 1.x release. • Version 2.0 is in development and is being written from the ground up. • Note: The current version of OllyDbg cannot disassemble binaries compiled for 64 bit processors.

  4. Features • Executes program in a controlled environment. • Allows the flow of the program to be controlled. • Uses a convenient layout showing hexadecimal, assembly, CPU registers and stack. • Allows the program to be dumped from the memory onto the hard-disk. • Highlights recently changed values in memory/stack/CPU registers.

  5. Window Layouts • Window layouts are the various parts of the UI that contain pertinent information • Code window – Displays the executable machine code • Register window – Allows the user to watch the contents of each register during execution • Memory window – Allows the user to view the contents of various memory locations • Stack window – Displays the stack, including memory addresses and values

  6. Working in OllyDbg • Navigation • Moving • Searching • Commenting • Can be entered in the code window with the ; or : keys • Listing Names • The names window displays all functions or imported functions used in the program • Listing them is easy via the shortcut Ctrl + N • Showing Memory • Displaying memory can be useful when looking for strings or other important data • Displaying the memory map window can be achieved via Alt + M

  7. Working in OllyDbg Cont… • Breakpoints • Breakpoints allow the debugger to stop at a specified address or instruction • There are two types of breakpoints in general • Software breakpoints • Handled by the operating system • Set by navigating to the specified address and hitting F2 • Hardware breakpoints • Handled by the processor • Set by finding a place in memory you want to break on access and right clicking selecting the proper option • Olly also provides a way to view and turn on and off breakpoints via the breakpoints window with Alt + B

  8. Working in OllyDbg Cont… • Controlling Execution • Starting the process • Once the target program is either loaded or attached in Olly you can start execution. This will actually set up an initial breakpoint at the application entry point • There are several ways you can proceed from the entry point • Single stepping • Executes one instruction at a time and can be achieved by hitting F7 • Steps into every function • Tedious as fuck • Execute until return • Executes until the ret instuction is encoutered which can be achieved by hitting Ctrl + F9 • Executes all instructions in the current function • Faster than single stepping but not as comprehensive

  9. Working in OllyDbg Cont… • Watching execution • Registers • Handled in the register window • Red highlighting indicates a register has changed • Stack • Handled in the stack window • Display can be address or relative address from ebp • Call stack • Displays the functions the current function has been called from • Can be displayed with the shortcut Alt + K

  10. Demo • Cracking a program using buffer overflow • Rfile() function address: 0x004013B0 • Register address: 0x0013FB78 • Return address: 0x0040132C • Buffer address: 0x0013FB6C • Buffer length: 10 Bytes • Address length: 2 Bytes

  11. Tota Tota Story End… The End

More Related