If you look at the first line of Figure 2, you will see 00401000 (memory address), 6A 00 (opcode), PUSH 0 (disassembly of opcode 6A 00, i.e. Each line contains several columns – memory address, opcodes, opcodes translated into assembly language, additional information added by debugger (in case of API calls you can see parameter values and their types). The Disassembly sub-window shows the disassembly of the program. Now you are ready to follow the rest of this tutorial.

You also need two target programs (crackmes) – crackme1.zip and crackme2.zip. From this page, download version 2 of the debugger, unpack archive and execute ollydbg.exe. When you search (on the Internet) ollydbg, you quickly discover the project’s main webpage ollydbg. If necessary, you should be able to make your own patch or reverse simple algorithms.īefore you continue reading this article, make sure you have Olly debugger downloaded and installed. In the first program, we will use program patching to change its functionality, in the second program we will try to reverse the algorithm behind its password checking routine.Īfter reading the article, you should be able to open a program in Olly debugger and start analyzing it. As reverse engineering of commercial applications may violate some laws, we will stay with crackmes during this article. “Crackme” is a program that is used for practicing your reverse engineering skills. While reading this article, I will introduce Olly debugger, explain the basic features and functions and ways of using them, and later we will analyze two programs (crackmes). In this article, I would like to introduce you the one of the most important tools for reverse engineers – Olly debugger. The process of analyzing a computer program’s structure, functions and operations without having source code available is called reverse engineering. How to Analyze Applications With Olly Debugger?

Ollydbg how to search for string