Log in

View Full Version : How to get the real entry with ollydbg?


cryingfox
December 20th, 2002, 16:13
I read the help file several times about the Self-extracting file. I choice "Trace real entry bytewise (very slow)" option,but the application runs as usual. I dont know how to get the entry from ollydbg. Does anybody have some idea about this?

Anonymous
December 21st, 2002, 02:44
Sure the application is not using some kind of anti-debugger tactics to fool ollydbg ? All that would really be needed is some kind of SEH fiddler...

Find out the packer using PEID, then read up on how to upack it.

luucorp
December 21st, 2002, 03:17
best way is attach.

cryingfox
December 22nd, 2002, 13:06
I find it works when with PECompact and aspack(low version).
But not working for upx case.

Anonymous
December 22nd, 2002, 13:36
For UPX just download UPX itself and tell it to decompress the file. If that fails (because header is modified) then use ollydbg to find the upx oep signature, set a breakpoint there, run and when the breakpoint is hit, dump it with LordPE to have a working image. You'd be suprised the number of shareware apps compressed with UPX but not protected, so can decompressed by the packer itself...

luucorp
December 22nd, 2002, 19:22
if program compress by UPX any version, you eseay find OEP as:
>Ctrl+S
>type 'popa'
and breakpoint at there(by F2).
>run (F9)
>press F8 (times)
----> will to OEP.

thx, luucorp

mfn
December 23rd, 2002, 07:23
Fix BaseOfCode of packed exe to correct value(1000h or such ..).
Then, Olly's SFX analysis works fine.