Exetools - OllyDBG v2.xx plugin

Page 1 of 2

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - OllyDBG v2.xx plugin - OllyExt (https://forum.exetools.com/showthread.php?t=15258)

ferrit.rce

09-20-2013 20:35

OllyDBG v2.xx plugin - OllyExt

1 Attachment(s)

OllyExt is a plugin for Olly 2.xx debugger.

The main intention of this plugin is to provide the biggest anti-anti debugging features and bugfixes for Olly 2.xx. Updates will come... :)

VMProtect support!

The currently available commands are the following:
- Code Rip to Clipboard

The currently supported protections are the following:
- IsDebuggerPresent
- NtGlobalFlag
- HeapFlag
- ForceFlag
- CheckRemoteDebuggerPresent
- OutputDebugString
- CloseHandle
- SeDebugPrivilege
- BlockInput
- ProcessDebugFlags
- ProcessDebugObjectHandle
- TerminateProcess
- NtSetInformationThread
- NtQueryObject
- FindWindow
- NtOpenProcess
- Process32First
- Process32Next
- ParentProcess
- GetTickCount
- timeGetTime
- QueryPerformanceCounter
- ZwGetContextThread
- NtSetContextThread
- KdDebuggerNotPresent
- KdDebuggerEnabled
- NtSetDebugFilterState
- ProtectDRX
- HideDRX
- DbgPrompt

The currently supported bugfixes are the following:
- Caption change
- Kill Anti-Attach ( dll integrity check )

Requirements:
- Microsoft Visual C++ 2010 Redistributable Package (x86)

OS support:
- WinXP x32
- WinXP WoW64
- Win7 x32
- Win7 WoW64

Limitations:
-

If you have any problem just notify me.

About the author:

Created by Ferrit
Send your bugreports/comments to ferrit.rce@gmail.com

Enjoy :P

Additional download page

sendersu

09-21-2013 02:37

was it tested @Win8, 8.1?
thanks

ferrit.rce

09-21-2013 16:48

Never tested with 8.

ferrit.rce

09-24-2013 02:22

v1.4 is out

1 Attachment(s)

New v1.4 is out. Changes:

Code:

        - Disassembler changed

        - Configurable ripping syntax

        - Recursive code ripping

ferrit.rce

09-28-2013 05:00

1 Attachment(s)

New v1.5 is out. Changes:

Code:

- Data ripping( because of missing PDK function ONLY 2.01 latest supported )

ferrit.rce

09-30-2013 01:00

1 Attachment(s)

New v1.5.1 is out. Changes:

Code:

- Code ripping newline fix

- Data ripping VERSION 2.01  (27-Sep-2013) support

- Data ripping relocation fix

Newbie_Cracker

10-03-2013 03:36

Why you don't write this plugin for OllyDbg v1.10?
Phantom and OllyAdvanced are incompatible with x64 OS.

ferrit.rce

10-03-2013 05:36

I've debugged thousands of hours with 1.1 and that was the reason why I've decided to use the new version :)
Even if it has also some bugs it has 2 advantages for me:
1. It's not crashing so much
2. Oleh will fix these problems

Newbie_Cracker

10-03-2013 15:43

Quote:

Originally Posted by ferrit.rce (Post 87178)

I agree with you, but lack of some features pushes me to use v1.10, specially for unpacking. But because of lack of comprehensive workable anti-anti plugin, I'm in trouble :(

I think you need do some modification in you code for OD1.1 PDK, API patching is the same. Isn't it?

ferrit.rce

10-03-2013 18:38

API patching is exactly the same but the PDK interface and feature set is really different. A lot of used new features doesn't exist on 1.1. I can take a look at once again but can't promise anything...
BTW what is missing from 2.x?

Quote:

Originally Posted by Newbie_Cracker (Post 87184)

Newbie_Cracker

10-04-2013 01:27

Quote:

Originally Posted by ferrit.rce (Post 87190)

Thanks for checking the possibility.

For the features, it's not the right topic to discuss about the features missing but small things that I use heavily:

- Mem BP on Write on PE sections,memory regions (very handy for unpacking, reversing)
- Handles window button (I hate extra clicks)
- Patches window (not critical, but comes handy sometimes)

I've found some bugs but now remember these:

- Show Symbolic address is too stupid in OD2.x for CALL DWORD[adr]. If you press space on such codes OD shows

CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] instead of CALL DWORD PTR DS:[4080AC].

I really hate it !

- Some unknown exception while loading packed files.
- OD2.x fails to show pe sections seperately in Execryptor packed files, even in unpacked files (interesting bug)

and all plugins which exist for OD 1.1 ;)

So I still use OD1.10 :cool:

Newbie_Cracker

10-04-2013 02:00

Quote:

Patches window (not critical, but comes handy sometimes)

I mean patches window button

I forgot to say... there is no Copy to clipboard in Pane window.

Why?

sendersu

10-12-2013 05:31

Regarding hiding from VMProtect
whats is the set of options need to be used?
here is a sample app protected nicely by vmp and I fail to get the correct set of options on OllyExt using 2.01 release of Olly
it is either file corrupted or debugger detected
http://www.sendspace.com/file/cdq1ga

thanks

ferrit.rce

10-13-2013 03:55

I've just tried the binary and it's running without getting detected. You need the following protections:
- IsDebuggerPresent
- CheckRemoteDebuggerPresent
- CloseHandle
- ProcessDebugFlags
- NtSetContextThread
- Caption Change
Please check that no other debugger is installed, and the only plugin is OllyExt. Some plugins are interfering with my one.

Quote:

Originally Posted by sendersu (Post 87340)

sendersu

10-13-2013 18:09

Hi, thanks for details
most strange thing is that ...... it works just 1 time!
the second time and the rest the app under test is just crashing!
do you see the same behaviour?

2) I've ida/etc SW installed, but not running - does it matter?
3) what OS are you working on

P.S> here is my olly setings http://prntscr.com/1x0ldg
are you using the same?

ferrit.rce

10-13-2013 22:04

Just take the last original Olly, install my plugin, turn on the mentioned protections and it should work. I'm using Win7 Pro. Related the exceptions I have the exact same settings.

Quote:

Originally Posted by sendersu (Post 87355)

ferrit.rce

10-14-2013 17:07

Hey, I've just found the problem :) It's an olly config issue. You have to turn off SFX -> Unpack SFX modules automatically and will work like a charm. Per default it's enabled but it should be off...

quygia128

10-22-2013 13:55

Quote:

Originally Posted by Newbie_Cracker (Post 87192)

I've found some bugs but now remember these:

- Show Symbolic address is too stupid in OD2.x for CALL DWORD[adr]. If you press space on such codes OD shows

CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] instead of CALL DWORD PTR DS:[4080AC].

I really hate it !

I will code a plugin to Fix this problem automatic way when you run OllyDbg, please wait.

BR,
quygia128

ferrit.rce

10-23-2013 14:25

1 Attachment(s)

New v1.6 is out. Changes:

Code:

- CreateThread

- Version information resource added

nikre

10-23-2013 19:08

get error when try rip recursive
Unable to find target jump address at 00000000
File: OllyExtCodeRip.cpp Line: 191
Result of GetLastError: 00000000

ferrit.rce

10-23-2013 23:25

Please send me an example binary and the range what you wanted to rip.

Quote:

Originally Posted by nikre (Post 87539)

get error when try rip recursive
Unable to find target jump address at 00000000
File: OllyExtCodeRip.cpp Line: 191
Result of GetLastError: 00000000

quygia128

10-23-2013 23:47

@ferrit.rce:

Inside the function, i think you should use GetProclimits to get End address of function(RET) (must analysis code)

Get point of Jump command (jump XXX), calc byte lenght from XXX To End of function and copy data to clipboard.

sendersu

10-24-2013 01:47

@author
have you seen this interesting piece of code?
http://pastebin.com/6kbt1Vka

did you already have it inside the Ext the tool? :)

memcpy

10-24-2013 02:36

This pastebin is irrelevant, it's for Kernel debugger detection. Olly is usermode debugger. You don't have to add this mate.

ferrit.rce

10-24-2013 19:49

1. The feature must go without code analysis
2. I'm doing that what you've described but we have a possible problem with the recursive feature

Quote:

Originally Posted by quygia128 (Post 87549)

nikre

10-25-2013 12:33

1 Attachment(s)

@ferrit.rce

here example
I found one were work recursive

Code:

CALL 004053DC ;//00403D90:

ferrit.rce

10-25-2013 17:59

OK, I'll take a look at it...

Quote:

Originally Posted by nikre (Post 87579)

@ferrit.rce

here example
I found one were work recursive

Code:

CALL 004053DC ;//00403D90:

ferrit.rce

10-26-2013 17:57

1 Attachment(s)

New v1.6.1 is out. Changes:

Code:

- Recursive code ripping fix

sendersu

12-06-2013 08:09

@ferrit.rce
the OllyExt 1.6.1 does not run at all @Win2k3 server x32...
not even any line in log window of Olly201... :(
http://prntscr.com/290fap
http://prntscr.com/290fih
http://prntscr.com/290g8l
P.S. another v2 plugin OllyDumpEx v1.30 was successfully loaded

any ideas?

s0me0n3

12-07-2013 18:12

Quote:

Originally Posted by sendersu (Post 87550)

@author
have you seen this interesting piece of code?
http://pastebin.com/6kbt1Vka

did you already have it inside the Ext the tool? :)

Quote:

Originally Posted by memcpy (Post 87552)

This pastebin is irrelevant, it's for Kernel debugger detection. Olly is usermode debugger. You don't have to add this mate.

I have to disagree from what I can see on the pastebin stuff:

Quote:

//On the other hand, if KdPitchDebugger is set to false, a check for the "SeDebugPrivilege"
//privilege is conducted, a sign of presence of Kernel and/or UserMode debugger(s).

and

Quote:

else
{
printf("Kernel Debugger present\r\n");
if(retValue != 0xC0000022) printf("UserMode Debugger present as well\r\n");
}
}

Tell me where I am wrong.

ferrit.rce

12-09-2013 03:30

First of all win2k3 is not supported at all! Maybe it's working but absolutely no guarantee. See readme.txt...

Quote:

OS support:
- WinXP x32
- WinXP WoW64
- Win7 x32
- Win7 WoW64

Other question: Have you installed the necessary libraries? Without that it's 100% sure not gonna do anything...

Quote:

Requirements:
- Microsoft Visual C++ 2010 Redistributable Package (x86)

Quote:

Originally Posted by sendersu (Post 88533)

ferrit.rce

12-09-2013 03:52

I've a test code for this and it's relevant only in some rare circumstances. The user mode debugger can be detected only if a kernel mode debugger is installed, running and the program debugged under the user mode debugger. I've never seen this protection in any protector but I can implement it in no time :) This will be done in the next release...

Quote:

Originally Posted by s0me0n3 (Post 88561)

I have to disagree from what I can see on the pastebin stuff:

and

Tell me where I am wrong.

ferrit.rce

12-09-2013 07:08

1 Attachment(s)

@sendersu: If you want win2k3 support do the steps in the attached file.

sendersu

12-12-2013 05:56

@ferrit.rce
Info carefully collected & sent by PM
pls review

qkumba

12-14-2013 03:59

Quote:

Originally Posted by ferrit.rce (Post 88600)

That's not even quite true. It's not detecting any user-mode debugger. It's detecting that a kernel debugger is running and that the process has the SeDebugPrivilege, which is completely independent of any user-mode debugger.

It's not a reliable detection method.

GarfieldPower

01-02-2014 22:29

Great job as always!

ferrit.rce

02-04-2014 02:44

1 Attachment(s)

New v1.7 is out. Changes:

Code:

13.01.2014

        - Ini file handling reimplemented( OllyDbg dependecy reduction )



12.01.2014

        - OS detection is completely rewritten because on 8.1 GetVersionEx is deprecated



12.01.2014

        - XED library added as JIT compiler( OllyDbg dependecy reduction )

        - Centralized debugger dependent functionalities



08.01.2014

        - Windows 8 support

        - Windows 8.1 support



07.01.2014

        - Windows Server 2012 support



06.01.2014

        - ProcessDebugObjectHandle and DebugProcessFlags was mixed up in the GUI :)



05.01.2014

        - Windows Server 2008 R2 support

        - Windows Server 2012 R2 support



02.01.2014

        - Target process memory read and write fix



12.12.2013

        - Windows Server 2003 R2 support



08.12.2013

        - NtSystemDebugControl

PLEASE NOTE that there were major changes inside the code! This could break features which were working previously. Please send reports as usual...

ferrit.rce

02-10-2014 05:47

1 Attachment(s)

New v1.71 is out to solve some annoying problems. Changes:

Code:

09.02.2014

        - No active debugge in case of protection changes fix

        - Closehandle hook moved to NtClose

        - Lot of internal changes

Computer_Angel

02-11-2014 17:16

Quote:

Originally Posted by ferrit.rce (Post 89881)

New v1.71 is out to solve some annoying problems. Changes:

Code:

09.02.2014

        - No active debugge in case of protection changes fix

        - Closehandle hook moved to NtClose

        - Lot of internal changes

The protectDRX seem broken in this version, my target is in inf loop if this option is checked. Not happen in the prev version (1.6x).
My OS: Win 8.1 x 64

ferrit.rce

02-11-2014 17:35

OK, I'll fix it ASAP...

All times are GMT +8. The time now is 23:06.

Page 1 of 2

Show 40 post(s) from this thread on one page