Question about analisys with olly

Printable View

2012-01-31, 02:13 PM
dkaitos

Question about analisys with olly

Hi,

I started learning ollyDbg and reversing but I'm still really confused about unpacking.
I'm trying to analyze the application of drakensang online [[Only registered and activated users can see links. Click Here To Register...]], just to understand unpacking etc.

Since this I got 2 question:

1> If I want to analyze a software with ollydbg should I run the process and THEN attach olly to the process or should I open it with olly when the application isn't running?

2> I tried to attach olly to the running application and it opened a .dll in the same folder. Is it normal? Should I analyze the .dll insteal of the application?

Thanks in advice for your time.
2012-01-31, 02:36 PM
rodoxfnx

Quote:

Originally Posted by dkaitos [Only registered and activated users can see links. Click Here To Register...]

Hi,

I started learning ollyDbg and reversing but I'm still really confused about unpacking.
I'm trying to analyze the application of drakensang online [[Only registered and activated users can see links. Click Here To Register...]], just to understand unpacking etc.

Since this I got 2 question:

1> If I want to analyze a software with ollydbg should I run the process and THEN attach olly to the process or should I open it with olly when the application isn't running?

2> I tried to attach olly to the running application and it opened a .dll in the same folder. Is it normal? Should I analyze the .dll insteal of the application?

Thanks in advice for your time.

Once you bypass there protections on the exe. it does not matter if you start or attach.
But most applications (games) does have protections against memory editor like ollydbg.
about dll, no you can just press ALT+E and look for the EXE process, this should describe the name of the program.
2012-01-31, 03:19 PM
dkaitos

Quote:

Originally Posted by rodoxfnx [Only registered and activated users can see links. Click Here To Register...]

most applications (games) does have protections against memory editor like ollydbg

This means that they don't allow me to open the exe?
or that I can open the exe but there is a sort of "missing code"?
Because I can actually open the .app and the .dll but I don't know if there is something missing...
2012-02-01, 02:10 AM
The_USDL

This means that you can even open, but the program will cause some sort of error or problem, purposely.
You need to bypass those protections.
2012-02-03, 07:46 PM
dkaitos

Ok thank you. I appreciate your help.