Ollydbg Cracking Tutorial
Ollydbg Cracking Tutorial Average ratng: 4,8/5 4128 votes
OllyDbg has many context menus. You can right-click on almost anything in OllyDbg to get a context menu to examine your many debugging options. Reversing with Olly. With our tour of Olly behind us, we are now ready to start doing some real work: reversing and cracking a “trial” piece of software. OllyDbg is a 32-bit assembler level analysing debugger for Microsoft ® Windows ®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg is a shareware, but you can download and use it for free.
- Ollydbg Cracking Tutorial 2017
- Ollydbg Download
- Ollydbg Tutorial Pdf
- Ollydbg Tutorial Beginners
- Ollydbg Cracking Tutorial
- Ollydbg Cracking Tutorial 64bit
- Ollydbg Cracking Tutorial Pdf
Edit: Added three more 'Crack Me' applications for you guys to mess with/learn with. Check attachments for extra_crackmes.rar
Edit 2: Added a quick video on solving 'Crack Me's 3, 4, and 5. Check the bottom of the post.
First of all, a question many people ask is: What is Olly? The answer is simple, really. Olly is an x86, 32bit debugger originally intended for developers who had problematic errors in their applications. It allowed them to go through their application step-by-step, monitoring most every action that the application took. And by doing so, this allowed them to find where the error actually happened in real-time, and made it much easier for them to fix it. Now you may be wondering, what does Olly have to do with you, then? Well, it has quite a lot to do with you, actually. Aside from the basics of the debugger, it is more widely used for the purposes of reverse engineering. The act of being able to walk through a program step-by-step makes it enormously easier to find things that normally you couldn’t (or rather, had a very hard time finding.) And at the same time, it allows us to go to things like conditional statements, and either change the condition, or change the whole statement, all in real-time without even having to recompile or restart the application.
So, first things first, let’s take a look at the interface, keeping in mind that I am using OllyDBG v2.01 Alpha 4. At the top portion of Olly, we have a long line of horizontal buttons that will save us having to even use the menus for the majority of the time. Let’s go ahead and take a second to give a brief explanation as to what each of these buttons does.
1. This is the Open button. As you’ve probably already guessed, it opens a file into Olly.
2. This is the Restart button. Fairly obvious, it restarts our executable.
3. This is the Close button. It closes down the executable we’re working with so we can load a new one.
4. This is the Run button. It starts our executable, so we can begin stepping through/analyzing it.
5. This is the Run Thread button. It does the same as above, but only runs the current thread.
6. This is the Pause button. It pauses out executable so we can look around or do other things.
7. This is the Step Into
Ollydbg Cracking Tutorial 2017
button. It steps down into the next line, or enters the current function.8. This is the Step Over button. It does the same as above, but executes the function all at once, instead of going into it and stepping through each action.
9. This is the Trace Into button. Same premise as the Step Into button, but works with our run trace.
10. This is the Trace Over button. Same premise as the Step Over button, but works with our run trace.
11. This is the Execute Until Return button. It will keep stepping into the application until it hits a return, either from a function, or the application itself.
12. This is the Execute Until User Code button. It will keep stepping into the application until it hits code that is not part of the system functions.
(The following are windows.)
13. This is the Logger window. Pretty self-explanatory.
14. This is the Executable Modules window. This is very useful for switching to which portion of the application and/or its extensions/libraries you want to look through.
15. This is the Memory Map window. We can use this to find something specific in the memory space of the application. This is a good way to find the un-packed data inside a packed application.
16. This is the Window List. It usually shows us a list of window handles owned by our application. Also very useful.
17. This is the Threads window. This allows us to see and select which thread we want to work with, amongst other things.
18. This is the CPU window. This is where the core of the application is shown: the code. This is usually shown in Assembly code, and this is where we will do most of our work. In this window we can do anything from monitor the actions the application takes, to changing what the application will do next in real-time.
19. This is the Search Results window. Pretty self-explanatory.
20. This is the Run Trace window. This will be more useful later on, and is very helpful for tracing changed in certain things.
21. This is the Breakpoints window. This gives us a list of the breakpoints we currently have set, so we can just double click then to jump straight to that location in the memory. Very useful.
22. This is the Memory Breakpoints window. Pretty self-explanatory.
23. This is the Hardware Breakpoints window. Pretty self-explanatory.
24. This is the Options window. We can change lots of things related to Olly in here, including colors.
That’s it for our basic run-down of the buttons, and those will likely be the only buttons you need for now. So, let’s take a look at actually using Olly. With this thread, I have included two very simple “Crack Me” applications, which were coded in C++ (So they’re very easy to step through.) What I will do now is walk you through how to solve each of the three applications. So, let’s start with the first one. Granted you downloaded the archive and unpacked it already, go ahead and open up crackme01.exe in Olly. You should get something like this once it is done loading: (Ignoring the fact my colors are different.)
Notice that in the bottom right corner, our status indicator says that the application is Paused? That’s the default for when you open an application in Olly. It will not run automatically, but rather pause and wait for input. That’s okay most of the time, since we don’t always need to run it yet.
However, let’s take a shot at it first. Go ahead and click your Run button to run the application, and once it is done loading, the application’s window should look like this:
As with most “Crack Me” applications, it is requesting a password. Let’s go ahead and type a random password, testing should work for now.
Looks like that wasn’t the password, right? So now you’re probably wondering how we go about finding the right password. That’s one of the simplest things to do with Olly, so let’s go ahead and try. First things first, use the Restart button to restart the application. Once it is done loading again, look at your CPU window. One of the first things we always want to do to make sure things are accurate, is make sure that the code has been re-analyzed. To do so, we right click our CPU window (inner top-left pane) and go to Analysis > Analyze code (or you can press CTRL + A.) Once you’ve done that, right click again, but this time go to Search for > All referenced strings. (In older versions, it should be All referenced text strings.) You should get a window that looks like this:
Now, we can ignore those strings up top, because those are just part of the internals. (I compiled the “Crack Me” applications in a CygWin environment.) But look at the strings on the bottom, aren’t those the same as what is shown in the console window? Right, that means that these are the strings stored inside the application. Note that a string does not have to be stored in a variable for it to show up here, so even if you had something like The string TheRealDeal would still show up in this window, because these are referenced strings, meaning any explicit string that is accessed inside our application (they’re stored in the memory.)
Anyway, let’s take a look at this list. Doesn’t something stick out to you? There’s one line that is not output to the console, and it’s all by itself. That line is ASCII “elitepvpers”. The fact that it’s alone by itself means that it is either stored in its own variable, or is accessed in a comparison or the likes. So, if we’re thinking the way we should be, we should know that that is a likely candidate for the password! Let’s go ahead and try and use elitepvpers as the password.
Wow, looks like we solved it! That wasn’t so hard, was it? It’s not often that things are that simple, but it’s not completely out of the equation either. More often than not, the information that we need to continue is right in front of our faces. So, let’s take a look at another method of bypassing simple checks. Let’s go ahead and Close this one and load up the second “Crack Me”, by loading crackme02.exe into Olly. Once we’ve loaded it up, let’s go ahead and Run it.
It looks like this one is going to be slightly more difficult. Not only does it say it has two checks, but it also states that it will not work the same way. By taking a look at the console, we see that this time it is asking us for a username and not a password. Now, if you’re thinking like you should be, you should think that this means given the fact there are supposedly two checks, it wants a username and password. Let’s go ahead and try a random username.
Wow, that didn’t go very far, did it. So we know that if there really are two checks, it checks the username before even taking us to the password, which is slightly more difficult. But not only that, there was mention that it did not work in the same way as the first one. So, let’s go ahead and restart the application, and once it is done, make sure we analyze the code with CTRL + A, and go to Search for > All referenced strings. As the window comes up, we have a little more data than last time.
Now the first things you should see are Administrator and HardToGuessPassword. These very well could be the username and password, but above them we see “You’re looking in the wrong place.” Seems like that’s a hint left for us, doesn’t it. In any case, let’s go ahead and try the username and password anyway.
Obviously it wasn’t a bluff. So, what do we do now? Well, first let’s restart the application. Now, let’s go ahead and learn a second method for bypassing things like this. Go ahead and go back to Search for > All referenced strings. Notice that first of all, there are two “Sorry, you failed.” strings, but only one “Congratulations, you passed!” string. This confirms that: there are two checks, and; you can only pass if you get both right. So, go ahead and double click the first “Sorry, you failed.” string. This will take us to the address that it is referenced at.
Well now, look at that. Right above our failure message we have a jump. What a jump does is it jumps to a certain address in the memory, going right over and ignoring any code in-between the two points. In this case it’s a JE SHORT. First, we look at the JE, what does that mean? Basically, it translates to Jump if Equal. (The opposite being JNE: Jump if Not Equal) So, if the condition in the line before (above) the jump is met, we will take the jump to the address of 0x0040135C, and if not, we will go to the line after (below) the jump. The SHORT simply means that the jump address (target) is within the range of -128 to 127, meaning that it’s either within 128 addresses backwards (up), or 127 addresses forwards (down).
So, let’s take a look at the condition above the jump: TEST BL,BL. That’s basically another way of saying CMP BL,0 (or in other words, Compare BL with 0, or if (BL 0)). Let’s go ahead and click the line TEST BL,BL and hit the F2 key to set a breakpoint at that address. Doing so will cause the application to pause and notify us when it gets to that point. So, once our breakpoint is set, let’s run our application and enter a random username. We should now be at this point after entering the username.
Notice in the small box in the middle (vertically) we see BL=01, which tells us that BL equals 1. Knowing that TEST BL,BL basically tests to see if BL equals 0, we know that the jump will not be taken. This means that instead, we will go over it, and land on the message “Sorry, you failed.” So, what can we do? We can actually do many things: NOP the test line; change it to something like CMP BL,1; change the address of the jump to the address of the success message or the password check; or we can simply change the value of BL. Let’s go with that method, and go over to the top-right box. We see the register list, which looks like this.
Right now we only need to pay attention to our main registers: EAX, EBX, ECX, EDX. EAX contains the registers AL (A Lower), AH
Ollydbg Download
(A higher), and AX (A Lower & A Higher). AL and AH are both 4 bit registers (two bytes.) AX, the combination of AH and AL is an 8bit register (four bytes.) The same applies to EBX ,ECX, and EDX, but it’s B, C, or D instead of A. So with this in mind, let’s go ahead andOllydbg Tutorial Pdf
double click the EBX register (double click the numbers, in this case: 00000001). We should now see this.We know that we want to change the value of BL, so let’s go ahead and change the 01 to 00. This will apply the changes to the other boxes, so don’t worry about them. Now, go ahead and click OK, and then Run
Ollydbg Tutorial Beginners
the application. We should know be prompted for the password. Go ahead and enter anything.Ollydbg Cracking Tutorial
Well, would you look at that, we passed! Wasn’t that hard either, was it? This is yet another example of just how useful Olly can be, and yet these are just the basics of what it can truly do.Ollydbg Cracking Tutorial 64bit
I hope that you’ve learned something from this, and I hope that you now feel more confident in learning to use Olly. You should feel comfortable welcoming Olly into your reservoir of tools, as now you know just how useful it really is. I hope that you continue to learn to use it better, as it really will benefit you down the road.
Ollydbg Cracking Tutorial Pdf
Edit: Here's a quick video walkthrough for solving 'Crack Me' applications 3, 4, and 5. (I got an email asking if they were solvable at all, when they're bloody easy.)Make sure to watch it in HD and FULLSCREEN
I may or may not write more “Crack Me” applications down the road for you to mess with, but for now my time is limited. In any case, I hope you liked the short tutorial.