PDA

View Full Version : Ollydbg => command line arguments Ax200


totofino
November 21st, 2006, 03:12
hi,
I would like to type this command "A"x200 (AAAAA....) in the command line arguments but its doesnt work ? i know in perl i can do that like that perl -e "print 'AAA'x200" . Can i do the same with ollydbg or there's a plugins command line make that ?

Sincerely totofino

LLXX
November 21st, 2006, 03:36
...what exactly are you doing that requires that?

I believe there is an F (fill) command...

totofino
November 21st, 2006, 11:35
i need to exploit a buffer overflow on application so i need copy this string "A"x500 but i would like to do that in the command line arguments ollydbg ? lame.exe AAAAAAAAAAAAAAAAAAAA (Ax500x)Do u know the commmand to do it automaticaly ? do u know my answer ?

blabberer
November 21st, 2006, 11:52
if you are willing to fill in the argument manually
you can use debug -> arguments type in aaaaaaaaaaaaaaaaaaaaaaaaaaaaa
500 times and restart the application

next time it runs ollydbg will do it with arguments

or go to start --> run --> cmd --> cd \ then in c:\ > type "path to ollydbg dir\ollydbg.exe "path to application directory\app.exe aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

ollydbg will start the applicaton with arguments

Code:

D:\>d:\odbg110\OLLYDBG.EXE d:\Borland\BCC55\Bin\kdtest\kdtest.exe aaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Log data
Address Message
OllyDbg v1.10
Command line: d:\Borland\BCC55\Bin\kdtest\kdtest.exe aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Console file 'd:\Borland\BCC55\Bin\kdtest\kdtest.exe'
Arguments 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
00401000 Program entry point

EAX 00000066
ECX 0012FA14 ASCII "aaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
EDX 7C90EB94 ntdll.KiFastSystemCallRet
EBX 7FFDF000
ESP 0012FF94 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
EBP 61616161
ESI 0040A0B8 kdtest.0040A0B8
EDI 00000000
EIP 61616161 <-------------------- pwned


totofino
November 21st, 2006, 12:15
but thanks blabberer but i d wouldnt type 500x the string A i would like to do automicaly you know ??,

blabberer
November 21st, 2006, 13:16
ollydbg != gdb
windows != linux

windows debuggers would normally not work with stdin redirections
like it works in linux

ollydbg will not take < operator as an argument at all and will not pass the input from file to the exe as argument
neither would windbg for that case unless you play with cmd /k blah foo crap
bs

so only way you could do that in windows debugger is to do it manually

if you have nix access use putty and access linux with echo -n e whatever and copy paste the string to ollydbg thats the closest you can get to automate typing string

there is an activeperl available for windows see if it could provide you some relief if active perl does what you want to do in simple examples
try looking for joe stewerts olly perl (beware it is buggy with overflows to boot and possibly completely discontinued by the authour as it was almost poc from start)

by the way if you had googled you could have noticed almost all buffer overflow tutorials are nix based and all examples sayin
cat foo | more | less < blah > foo | grep < perl > python | stdin you would notice there are almost few or almost nil examples for windows

also windows compilers are by default more stricter in stack usage
(that in no way means its ultimate but if you want to play with some examples find andrewgs pulltheplug vortex level 1 and try compiling it with bcc you will see the vector has completely been eliminated even in primitive bcc 5.5 compilers you simply cannot solve that level 1 compiled with bcc coz bcc simply doesnt use stack at all )

totofino
November 21st, 2006, 14:32
i do that now it funny it easy loll C:\Documents and Settings\bitch>perl -e "print 'A'x500" >> c:\string.txt

naides
November 21st, 2006, 16:38
Why don't you copy the 500 'A' from string.txt and paste the string into the Olly command line buffer?

LLXX
November 21st, 2006, 20:04
Quote:
[Originally Posted by totofino;62562]i need to exploit a buffer overflow on application so i need copy this string "A"x500 but i would like to do that in the command line arguments ollydbg ? lame.exe AAAAAAAAAAAAAAAAAAAA (Ax500x)Do u know the commmand to do it automaticaly ? do u know my answer ?
Why are you asking nearly the exact same thing when I already told you?