OpenRCE: Blog

OllyDbg NumberOfSections Crash

Fri, 20 Apr 2012 15:56:34 -0500

http://waleedassar.blogspot.com/2012/04/ollydbg-numberofsections-crash.html

GetModuleFileNameEx And Infinite Loops

Sat, 31 Mar 2012 19:23:26 -0500

http://waleedassar.blogspot.com/2012/03/getmodulefilenameex-and-infinite-loops.html

OllyDbg v1.10 And Wow64

Sat, 31 Mar 2012 18:47:42 -0500

If you have ever used OllyDbg v1.10 on Window 7 64-bit version (Wow64), then you must have seen the annoying single-step breaks that frequently interrupt your debug session. I spent a couple of hours to find the reason behind this and finally came out with this small plugin, "OllyWow64", to fix this bug.

You can find OllyWow64 here.
http://ollytlscatch.googlecode.com/files/OllyWow64.dll
The fix is as easy as what you see in the image below.

Here you can find the source code.
http://ollytlscatch.googlecode.com/files/OllyWow64.rar

OllyDbg Resource Table Parsing Integer Overflow

Thu, 29 Mar 2012 14:06:52 -0500

In this post i will quickly show you an integer overflow found in OllyDbg v1.10. This leads to a buffer overflow, which can be exploited to execute code arbitrarily.

In brief, all you have to do is set the size of Resource table to 0xFFFFFFF7.

Olly adds 0x9 to 0xFFFFFFF7, which sums up to Zero due to an integer overflow. Zero byte is then allocated by calling the "GlobalAlloc" function. Finally the "_Readmemory" function is called to copy 0xFFFFFFF7 bytes to the newly allocated memory causing a buffer overflow. See the image below.

But wait, there is a minor issue that i need to shed some light on. The "_Readmemory" function, as its name implies, is a wrapper of the kernel32.dll "ReadProcessMemory" function. So why did this call succeed if the number of bytes to copy is that huge? the reason behind this is that the "_Readmemory" function checks to see if data at the target address is cached. If it is cached, the "memcpy" function is directly called and this is where the buffer overflow occurs.

Here you can find the demo.
http://ollybugs.googlecode.com/files/you.exe

Anti-Dumping

Sat, 24 Mar 2012 08:56:06 -0500

Part - 1:
http://waleedassar.blogspot.com/2012/01/anti-dumping.html

Part - 2:
http://waleedassar.blogspot.com/2012/03/anti-dumping-part-2.html