Thread: Question about analisys with olly

Hi,

I started learning ollyDbg and reversing but I'm still really confused about unpacking.
I'm trying to analyze the application of drakensang online [LINK], just to understand unpacking etc.

Since this I got 2 question:

1> If I want to analyze a software with ollydbg should I run the process and THEN attach olly to the process or should I open it with olly when the application isn't running?

2> I tried to attach olly to the running application and it opened a .dll in the same folder. Is it normal? Should I analyze the .dll insteal of the application?


Thanks in advice for your time.

Originally Posted by dkaitos

Hi,

I started learning ollyDbg and reversing but I'm still really confused about unpacking.
I'm trying to analyze the application of drakensang online [LINK], just to understand unpacking etc.

Since this I got 2 question:

1> If I want to analyze a software with ollydbg should I run the process and THEN attach olly to the process or should I open it with olly when the application isn't running?

2> I tried to attach olly to the running application and it opened a .dll in the same folder. Is it normal? Should I analyze the .dll insteal of the application?


Thanks in advice for your time.

Once you bypass there protections on the exe. it does not matter if you start or attach.
But most applications (games) does have protections against memory editor like ollydbg.
about dll, no you can just press ALT+E and look for the EXE process, this should describe the name of the program.

Originally Posted by rodoxfnx

most applications (games) does have protections against memory editor like ollydbg

This means that they don't allow me to open the exe?
or that I can open the exe but there is a sort of "missing code"?
Because I can actually open the .app and the .dll but I don't know if there is something missing...

This means that you can even open, but the program will cause some sort of error or problem, purposely.
You need to bypass those protections.

Ok thank you. I appreciate your help.