Log in

View Full Version : Ollydbg Help


ViciousRiceX
September 22nd, 2012, 19:12
Well.....

I'll show it to you guys...

Too lazy to change dimensions but here's a direct link

http://i1052.photobucket.com/albums/s458/PimpinRiceX/WirdNumbers_zps6909f230.png

It's small and you might not see it well, just enlarge it and you can barely see the numbers, its visible.

OK now onto the problem...

The numbers are in the 60000000 range.

Where as when people edit their stuff in olly dbg it usually have the double 00's and then the numbers like in this video.

http://www.youtube.com/watch?v=Zf7xBia9yts

I don't why my ollydbg show me these huge numbers whenever I "attach" a running program/game, but the funny thing is that it doesn't show me the big numbers when I manually open the exe file, not attaching it..

I want to be able to edit as I play the game at the same time, but somehow I don't know why it show me huge numbers...

I think it has something to do with my computer...

Running Win 7 x64 bit and Ollydbg 2


If there is anyway to turn this around I would greatly appreciate it.

hfm
September 23rd, 2012, 02:56
When your attaching the the exe your ending up in the middle of a dll, (SDL) in this case, not the exe's code.

Where to go from here depends on what you are trying to achive.

If you just want to view the programs code and set break points. Open the Memory map window then right click on the code section of your program and select "View in CPU Disassembler".

If you want to find the current place of the program you can try "Execute to user code", failing that "execute til return" then single step till you get where you want.

ViciousRiceX
September 23rd, 2012, 10:56
Hmmm that's weird... Even though I don't know where to go from what you've said because I'm fairly new to this program, somehow I've restarted my computer and re-attach my running software and this time it showed the exe's memory. There's only one thing I need to know now, how do I find the memory's code automatically? I mean I press ctrl+f it pops up "Specify assembler search model" and only wants me to input the memory commands, but I want to search the exact address as I already have and got it manually. Sorry, really noobish

EDIT - Nevermind it reverted back to the same old high number again... How do I open up Memory map window?

EDIT 2 - Managed to open Memory map... Right clicked and can't seem to find the option "View in CPU Disassembler"

EDIT 3 - Know how to find expressions now, still don't know how to view in cpu disassembler.

hfm
September 23rd, 2012, 11:53
When you attach to a program it will break at the point it's currently executing so this will often be different each time.

If your just trying to look at an exact address try ctrl+g (or right click "Go to"->"Expression" and type in the address and it should take you there.

The "View in CPU Disassembler" is only shown if the section sellected in the Memory Map window actually contains code, as shown in the "contains" column.

Hope this helps.

ViciousRiceX
September 23rd, 2012, 13:38
I'm not understanding you

http://s1052.photobucket.com/albums/s458/PimpinRiceX/?action=view&current=NoOptions_zps7b85c695.png

I don't have any option, and logically it's showing memory of course.... No "View in CPU Disassembler"

hfm
September 24th, 2012, 02:17
Select the line bellow the one you have selected in the picture, the .text section of the exe not its PE Header.