Ollydbg full tutorial option [Options] search for [Search] self-extracting files [Self-extracting (SFX) files]

17. Option [Options]

Appearance options [appearance options]

General [general]
Default Value: [defaults]
Dialog Box [dialogs]
Directory [directories]
Font [fonts]
Color [colours]
Code highlight [Code highlighting]

Debugging options [debugging options] (Alt + O)

Security [security]
Debug [debug]
Event [events]
Exception [exceptions]
Trace [trace]
Self-extracting [SFX]
String [Strings]
Address [addresses]
Command [Commands]
Disassembly [disasm]
CPU
Register [registers]
Stack [Stack]

Analysis 1 [Analysis 1]
Analysis 2 [Analysis 2]
Analysis 3 [Analysis 3]

Instant debugging [just-in-time debugging]

Add to resource manager [add to Explorer]

 

 

18. Search for [Search]

Ollydbg allows you to use the following search methods:

Symbol name (Label) [symbolic name (Label)]
Binary string [binary string]
Constant [constant]
Command [command]
Command sequence [sequence of commands]
Inter-module call [intermodular cballs]
Modified command or data [modified command or Data]
Custom Label [user-defined label]

Custom comment [user-defined comment
Text string [text string]
Run trace record [record in run trace]
Refer to the Command [Referencing commands]

 

 

Nineteen, self-decompressed file [Self-extracting (SFX) files]

The self-extracting file consists of the extraction program and the compressed original program. When you encounter a self-extracting file (SFX), we usually want to skip the decompression part and directly jump to the original program entry (real entry ).
The ollydbg contains several functions to facilitate the completion of this task.

The load address of the extraction program is usually out of the Execution Code. In this case, ollydbg regards these files as self-extracting files (SFX ).

When the self-extracting option [SFX Options] requires a real entry tracing, ollydbg sets a memory breakpoint in the [code section] of the entire code section. It is empty or contains only compressed data. When the program tries to execute commands in this protected area that are not RET and JMP, ollydbg will report the real entry. This is how extraction works.

The above method is very slow. There is another fast method. When an exception occurs during data reading, the ollydbg changes the 4 K memory area to readable, and the previously readable area to invalid. When a Data Writing exception occurs,
The ollydbg changes the region to writable, and the previously writable region to invalid. Ollydbg reports the real entry when the program executes commands in the retained protection area. However, when the real entry point is inside the readable or writable area, the reported address may be incorrect.

You can correct the portal location, select a new portal, and select "breakpoint [breakpoint] | set the real self-extracting portal [set real SFX entry here] From the shortcut menu of the Disassembly window. If the SFX option is enabled, ollydbg can quickly and reliably skip the self-extraction program next time.

Note: The ollydbg will often fail when tracking unzipping programs that adopt protection or anti-Debugging techniques.