Location:
Search - olly
Search list
Description: ring0--hook NtContinue+source_code
ring0下面hookNtContinue 使用drx7寄存器实现的hook
this code hooks ntoskrnl!NtContinue to set dr7 to 0 (no updating of dr7)
so NtContinue called from ring3 cannot alter drX registers...
This hook will only PREVENT drX clearing from SEH (kiuser->ntcontinue)
and will not alter debugging using ring3 debuggers (olly->SetThreadContext)
mainly developed for personal reasearch and as anti-bpm...
Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll.dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =)
Its use for some targets such as armadillo... but never posted code...
by deroko
Platform: |
Size: 6421 |
Author: 张京 |
Hits:
Description: 逆向一个基于驱动的保护方案，非常好的翻译著作，使用Olly和IDA，发挥二者优势 ，分析并保护驱动。
Platform: |
Size: 2525221 |
Author: 王军 |
Hits:
Description: 我的原创破解教程，我用两种工具ollydbg,smarkcheck分别对这个软件做了破解，动画里讲明了，我的破解过程，让初学破解 朋友学习研究- My 鍘熷垱 explains the course, I used two kind of tools
ollydbg, smarkcheck separately to do to this software have explained,
in the animation clarified, I explained the process, let begin studies
explains the friend to study studies
Platform: |
Size: 1381376 |
Author: 冷寒 |
Hits:
Description: 最近闲暇时间迷上了扫雷,有的时候经常遇到模棱两可的地方,很容易死到.于是就在想,要是我一开始就知道哪个地方有雷就好了.遂打开OllyDBG,对扫雷程序(WinMine.exe),进行了一番跟踪.好在WinMine.exe没有加壳,直接看它的IMPORT TABLE,在两个可疑的API上下断点,一个就是GDI.BitBlt,这个是程序来画地图的,另一个就是User32.GetDlgItemInt,这个用来获得扫雷地图大小,和雷的个数的.
-recent spell of the mine, some of the frequently encountered when the ambiguity, it is easy to die. So just think, if I started to know where the minefields are not alone. OllyDBG was open to mine (WinMine.exe) performed a track. Fortunately, WinMine.exe no shell, direct look at its IMPORT TABLE, the two suspicious API next breakpoints, is a GDI.BitBlt, this is a procedure to draw the map and the other is the User32.GetDlgItemInt, the mine was used to map the size and the number of the mine.
Platform: |
Size: 11264 |
Author: 黄河 |
Hits:
Description: 最近玩热血江湖，想在游戏屏幕上显示自已的字符串。比如我做的江湖MM，想让她按F12时在屏幕上显示：“技能开启”字样。一般来说，在游戏中写屏是可以通过OD跟踪程序找到写屏函数的。不过，偶刚学OD啦，跟了头大也找不到。。。。。呵呵，那位大哥知道技巧告诉我啊。
只好换个容易的，利用屏幕上本身就有的字符串加入自已的东东。分析屏幕，发现显示地图坐标的字符串可以利用，嘿嘿，就拿它开刀。
我们知道，屏幕上坐标的显示格式是 [ x . y ] ，因为x、y是数值型。在内存中的调用就是[%d.%d] 。OK，废话不说，下回进入正题。
用OllyDb加载游戏执行文件，Client.exe。点插件莱单的Ultra String Refernce ，选Find ASCII 功能。开始搜索字符串（没有这个插件，请去下载）。。。。。
搜索完毕，出现一大堆字符串地址，按Ctrl + F ,填入[%d.%d] 。呵呵，一下就找到啦-Yulgang recent play, the game screen to show its own string. For example, I do quack MM, wanted by F12 when she displayed on the screen : "skills to open up" words. Generally speaking, the game was made through the screen can be found OD tracking procedures to write screen function. However, even just learning OD-- with a large head found. . . . . Oh, who knows big brother told me ah skills. But change easily, and the use of screen itself string accession own saucepan. Analysis screen, finding the map coordinates of the string can be used, laughter, Take It surgery. We know that on the screen coordinates of the display format is [x. Y], x, y is numerical. In memory of the call is [% d.% d]. OK, rubbish not being dragged into the topic. OllyDb loaded with the implementation of th
Platform: |
Size: 36864 |
Author: 高碳钢 |
Hits:
Description: 这是看雪论坛的Ollydbg的新手入门教程，很值得一看。-This is the look of snow Forum Ollydbg beginners tutorial, it is worth a visit.
Platform: |
Size: 1441792 |
Author: ouminliang |
Hits:
Description: ollydbg完全教程。OllyDbg 是一种具有可视化界面的 32 位汇编-分析调试器。它的特别之处在于可以在没有源代码时解决问题，并且可以处理其它编译器无法解决的难题。
一，什么是 OllyDbg？
二，一般原理［General principles］
三，反汇编器［Disassembler］
四，分析器［Analysis］
五，Object扫描器［Object scanner］
六，Implib扫描器 ［Implib scanner］
七，如何开始调试［How to start debugging session］
八，CPU 窗口［CPU window］
九，断点［Breakpoints］
十，内存映射窗口［Memory map window］
十一、十二，监视与监察器［Watches and inspectors］
十三，线程［Threads］
十四，复制到剪切板［Copy to clipboard］
十五，调用栈［Call stack］
十六，调用树［Call tree］
十七，选项［Options］
十八，搜索［Search］
十九，自解压文件［Self-extracting (SFX) files］
二十，单步执行与自动执行［Step-by-step execution and animation］
二一，Hit跟踪［Hit trace］
Platform: |
Size: 168960 |
Author: 沈浪 |
Hits:
Description: ring0--hook NtContinue+source_code
ring0下面hookNtContinue 使用drx7寄存器实现的hook
this code hooks ntoskrnl!NtContinue to set dr7 to 0 (no updating of dr7)
so NtContinue called from ring3 cannot alter drX registers...
This hook will only PREVENT drX clearing from SEH (kiuser->ntcontinue)
and will not alter debugging using ring3 debuggers (olly->SetThreadContext)
mainly developed for personal reasearch and as anti-bpm...
Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll.dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =)
Its use for some targets such as armadillo... but never posted code...
by deroko-ring0- hook NtContinue+ source_codering0 use the following hookNtContinue register drx7 realize the hook this code hooks ntoskrnl! NtContinue to set dr7 to 0 (no updating of dr7) so NtContinue called from ring3 cannot alter drX registers ... This hook will only PREVENT drX clearing from SEH (kiuser-> ntcontinue) and will not alter debugging using ring3 debuggers (olly-> SetThreadContext) mainly developed for personal reasearch and as anti-bpm ... Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll. dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =) Its use for some targets such as armadillo ... but never posted code ... by deroko
Platform: |
Size: 6144 |
Author: 张京 |
Hits:
Description: 看雪人自己整理的OD入门教程,搞解密的新手入门辅助!-Look at their own finishing OD Snowman Tutorial, beginners learn to engage auxiliary declassified!
Platform: |
Size: 1485824 |
Author: しょさん |
Hits:
Description: 逆向一个基于驱动的保护方案，非常好的翻译著作，使用Olly和IDA，发挥二者优势 ，分析并保护驱动。-A reverse protection program based on the drive, very good translation of writings, the use of Olly and IDA, play the two advantages, to analyze and protect the driver.
Platform: |
Size: 2525184 |
Author: 王军 |
Hits:
Description: 反汇编工具ollydbg的一个初级教程- --Disassemble a primary tool for ollydbg tutorial---
Platform: |
Size: 812032 |
Author: ysh |
Hits:
Description: 绝对有用的olly插件。在asm里跟踪到了关键call，但里面的函数太太太复杂，完全无法分析，要做注册机必须实现其算法。怎么办？全部ripper出来！跳转等都自动帮你设好了标签。赞！-Olly absolutely useful plug-ins. Asm-ri in track at a crucial call, but his wife inside a function is too complex to analyze completely unable to do Zhuceji must realize its algorithm. How do? All ripper out! Jump are automatically set up to help you better tag. Chan!
Platform: |
Size: 43008 |
Author: evilight |
Hits:
Description: 700个脱壳脚本,
可以放在在OD的ollyscript Plugin中.-Shell script 700
Platform: |
Size: 657408 |
Author: Laona |
Hits:
Description: This source can bypass Olly Debugger
Platform: |
Size: 1024 |
Author: vxhunter |
Hits:
Description: Olly dbg component code from console
Platform: |
Size: 214016 |
Author: dan |
Hits:
Description: Olly Tutorial for beginner, see this-Olly Tutorial for beginner, see this...
Platform: |
Size: 1441792 |
Author: jendhil |
Hits:
Description: GameServer 1.00.18 e 19 hook VIa Olly
Platform: |
Size: 1841152 |
Author: Jonathan |
Hits:
Description: 很棒的spline书籍 介绍B样条的书籍-this book is a reflection of my limited experience with calculations in volving polynomial splines. It stresses the representation of splines as linear combinations ogf bsplines, provides proofs for olly some of the results
Platform: |
Size: 3724288 |
Author: cax |
Hits:
Description: olly debug s callstack view tool -olly debug s callstack view tool
Platform: |
Size: 11264 |
Author: phoenix |
Hits:
Description: Plugin for Olly Debugger
Platform: |
Size: 75776 |
Author: alex |
Hits: