From Collaborative RCE Tool Library

Jump to: navigation, search

OllyDbg Extensions


Tool name: CPU Initialization Patch
Rating: 5.0 (1 vote)
Author: blurcode                        
Website: http://www.woodmann.com/forum/showthread.php?t=11302
Current version: 1.0.0.1
Last updated: April 12, 2008
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: This is a plugin for OllyDbg 1.10, which hot-patches Olly's code to resolve the issue of OllyDbg taking 100% CPU time as soon as the debugged process is running (i.e. after having pressed F9 inside OllyDbg).

If nothing else, this problem causes any laptop that you might be reversing on to lose much more battery life than necessary, and also to sound like a jet plane due to constant maximum fan rotation, so this plugin will come in hand for any laptop reversers at least.

For more info, please see the following thread:
http://www.woodmann.com/forum/showthread.php?t=11302

Changelog:
Version 1.0.0.1
April 12, 2008
- keeps the last selected option after restart
Version
February 11, 2008
Version 1.0.0.0
- initial release
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: IDAFicator
Rating: 5.0 (1 vote)
Author: AT4RE                        
Website: http://www.at4re.com
Current version: 1.2.12
Last updated: May 6, 2008
Direct D/L link: http://www.at4re.com/tools/Releases/Zool@nder/IDAFicator/IDAFicator_1.2.12.zip
License type: Free
Description: This plugin tries to make the life of OllyDBG© users easier by bringing to him some fast and frequently used function. And here is the list of features brought by the plugin:
Versio, : 1.2.8
What's new:
- optimized assembling abilities (ONE.SHOT.ASSEMBLER)
- new breakpoints menu
- 3 new custom functions
- new mouse actions and shortcuts in disasm and dump windows

Version : 1.2.0
* 11 buttons added to the native toolbar:
1. The go back/forward button.
2. and finally The Reach beginning/End of procedures button
3. The search for all text string button.
4. Hardware Breakpoints Dialog box opener (In a non modal non child DB).
5. Multi-Commands assembler.
6. Target directory opener.
7. Customizable buttons.


* IDA-like mouse features:
1. The DISASSEMBLY WINDOW:
2. The DEFAULT DUMP WINDOW:
3. The STACK WINDOW:

* Dump and set a HWBP on [ESP].

* 'Universal' stolen code restoring

* Address Informer

* Direct Address Copier

And more.

What's new:
1. Adding support for asm like command in 'multicommand assembler'.
Added commands til now are:
1.1) PUSHSTR -> There'are 2 versions of this cmd:
1.1.1) First one, without argument
(ex: pushstr 'kernel32.dll' -> PUSH 3D0000 ; ASCII "kernel32.dll" )
1.1.2) Second one, accept one argument (The address where to assemble)
ex: pushstr 'kernel32.dll', 401000 -> PUSH 00401000

1.2) PUSHALL -> push several commands
(ex: pushall 0402000, @GWL_EXSTYLE
call GetWindowLongA

assembled to: ->
PUSH 00402000
CALL user32.GetWindowLongA)

+/- all constants in windows.inc (thanks hutch and iczelion for this
file) can be used just with the prefix '@'

1.3) INVOKE -> Works like its homologous asm command with an extra
Note that:
1.3.1 - The strings will be assembled in a 'rundom' address
allocated in debugee memory
1.3.2 - you can integrate string directly in the invoke macro
( ex1: invoke MessageBoxA, 'Text1 from invoke macro', 'Text2 from invoke macro', @MB_OK
-> PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
PUSH 1D0030 ; |Title = "Text2 from invoke macro"
PUSH 1D0048 ; |Text = "Text1 from invoke macro"
PUSH 00402000 ; |hOwner = 00402000
CALL DWORD PTR DS:[<&user32.MessageBoxA>> ; \MessageBoxA

ex1: And invoke GetPrivateProfileIntA, 'Section Name', 'Key', 0, 'B:\bla\bla\bla\bla.ini'
-> PUSH 1D0060 ; /IniFileName = "B:\bla\bla\bla\bla.ini"
PUSH 0 ; |Default = 0
PUSH 1D0077 ; |Key = "Key"
PUSH 1D007B ; |Section = "Section Name"
CALL DWORD PTR DS:[<&kernel32.GetPrivate> ; \GetPrivateProfileIntA
)

1.4) Note that the constants are located in 'BYTES.OEP' file provided
with this version (version of 06/05/ 2008) and you've to re^lace the old
one. Otherwise, all constants will return 0 and will assembled : push 0.


2- Position saving for most important and most used dialog boxes.
Please, consider to use the pushstr macro instead of invoke one if the
lenght of pushed text is > 40 chars Privacy note: The last entered piece
of text to assemble in MCasm is stored in registry
("HKEY_CURRENT_USER\Software\IDAFicator Plugin"), just in case.

3- MuCAsm now remembers last entered text even between debugging 2 sessions.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: PhantOm
Rating: 5.0 (2 votes)
Author: Hellsp@wn & Archer                        
Website: N/A
Current version: 1.26
Last updated: April 5, 2008
Direct D/L link: Locally archived copy
License type: Free
Description: Plugin (with driver) for hiding OllyDbg from following methods of detection:

// driver - extremehide.sys

[+] NtQueryInformationProcess.
[+] SetUnhandledExceptionFilter.
[+] OpenProcess.
[+] Invalid Handle.
[+] NtSetInformationThread.
[+] RDTSC.
[+] NtYieldExecution.
[+] NtQueryObject.
[+] NtQuerySystemInformation.
[+] Windows hide.
[+] GetProcessTimes.
[+] NtSetContextThread.

// plugin - PhantOm.dll

[+] PEB BeingDebugged.
[+] PEB NtGlobalFlag.
[+] GetStartupInfo.
[+] Process Heaps.
[+] GetTickCount.
[!] Protect DRx.
[!] Hide DRx.
[!] Fake Windows version.
[!] Custom Handler.
[+] BlockInput

What's new - 1.26
[*] Fixed bug with loading driver
[*] Fixed bug with memory breakpoints
(Now, when "custom handler exceptions" option is
checked - memory breapoints on access/write will work,
but break-on-access won't work)
[*] Fixed bug with updating plugin (after previous version)

What's new - 1.25
[*] Now you can manually set names of services (HIDENAME and RDTSCNAME)
[*] Fixed some minor bugs
[*] Fixed bug with memory breakpoints

What's new - 1.20
[*] Added own exception handler (C0000005)
[*] Added option to change caption of main OllyDbg window
[*] Added own exception handler (OUTPUT_DEBUG_STRING_EVENT)
[*] Impoved removing of int 3 breakpoint at EP, when pause is set to "system breakpoint"
[*] Added hook for BlockInput (only for Windows XP)
[*] Added own exception handler (C0000094)
[*] Added hide from GetStartupInfo
[*] Fixed bug with plugin options
[*] Added protection from detecting driver
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: ACProtect 2.0 OEP Finder + IAT Repair OllyScript
Rating: 0.0 (0 votes)
Author: ColdFever                        
Website: N/A
Current version:
Last updated: February 10, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: ACProtect 2.0 OEP Finder + IAT Repair
Also listed in: OEP Finders, OllyScript Scripts, IAT Restore Tools
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: API Help
Rating: 0.0 (0 votes)
Author: Phoenix                        
Website: N/A
Current version:
Last updated: June 26, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: Assists in finding API addresses and setting breakpoints, includes auto-completion feature. Supports ~120 DLL and ~14000 API.
For XPsp2 only! (place aphlp.ahd in main OllyDbg directory)
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: ASProtect 1.3x - 2.xx OEP Finder OllyScript
Rating: 0.0 (0 votes)
Author:                         
Website: N/A
Current version: 0.1
Last updated: September 26, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: ASProtect 1.3x - 2.xx OEP Finder
Also listed in: OEP Finders, OllyScript Scripts
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: AnalyzeThis!
Rating: 0.0 (0 votes)
Author: Joe Stewart                        
Website: http://www.joestewart.org
Current version:
Last updated: October 26, 2004
Direct D/L link: Locally archived copy
License type: Free
Description: This plugin allows the OllyDbg analysis function to operate outside of the standard code segment as defined by the PE header. Particularly useful for packed files.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Armadillo 4.30a Dumping Script
Rating: 0.0 (0 votes)
Author: Nieylana                        
Website: N/A
Current version: 1.0
Last updated: December 27, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: Run this script using the OllyScript plugin, will automatically patch the OutputDebugStringA exploit, the IsDebugger API, Prevents PE header destruction, Prevents IAT from being messed with, And dumps the file to 'C:\D_File_Unpacked.exe'

Note: I am not the original author, I simply took the Armadillo 4.30a script I had and added some features to it allowing it to produce a working dump by itself. Thanks to the original author.

Enjoy!
Also listed in: OllyScript Scripts, Memory Dumpers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Armadillo 5.xx OEP Finder OllyScript
Rating: 0.0 (0 votes)
Author: Fly                        
Website: N/A
Current version:
Last updated: September 20, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: Armadillo 5.xx OEP Finder (Standard Protection + Debug Blocker)
Also listed in: OEP Finders, OllyScript Scripts
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Asm2Clipboard
Rating: 0.0 (0 votes)
Author: fatmike                        
Website: N/A
Current version:
Last updated: April 8, 2005
Direct D/L link: Locally archived copy
License type: Free
Description: Copy asm code to clipboard.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: CLBPlus!
Rating: 0.0 (0 votes)
Author: Robert Ayrapetyan                        
Website: N/A
Current version: 1.0
Last updated: October 1, 2005
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Extends standard capabilities of conditional log breakpointing, utilizing OllyDbg feature which allows passing commands to plugins from "Set conditional log breakpoint window". Version only supports a DUMP command, but with included source this is great example for creating additional functions.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Cleanup Ex
Rating: 0.0 (0 votes)
Author: Gigapede                        
Website: N/A
Current version: 1.12
Last updated: March 11, 2003
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Deletes all .udd, .bak files. Plugin & udd dir support.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Code Ripper
Rating: 0.0 (0 votes)
Author: Ziggy                        
Website: N/A
Current version:
Last updated: April 19, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: Rips selected code from OllyDbg disassembler window and formats according to MASM, C/C++ (inline assembler) or Delphi (inline assembler). Customizable, supports labels, comments, detailed help.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: CommandBar
Rating: 0.0 (0 votes)
Author: Gigapede                        
Website: N/A
Current version: 3.20.110
Last updated: April 18, 2006
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: SoftICE commands in a small bar on the bottom. Macro function support.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Conditional Branch Logger
Rating: 0.0 (0 votes)
Author: Blabberer / dELTA / Kayaker                        
Website: N/A
Current version: 1.0
Last updated: June13, 2007
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Conditional Branch Logger is a plugin which gives control and logging capabilities for conditional branch instructions over the full user address space of a process. Useful for execution path analysis and finding differences in code flow as a result of changing inputs or conditions. It is also possible to log conditional jumps in system dlls before the Entry Point of the target is reached. Numerous options are available for fine tuning the logging ranges and manipulating breakpoints.
Also listed in: Code Coverage Tools, Profiler Tools, Tracers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Data Ripper
Rating: 0.0 (0 votes)
Author: Ziggy                        
Website: N/A
Current version: 1.2
Last updated: January 28,.2006
Direct D/L link: Locally archived copy
License type: Free
Description: Rips any kind of data from an app being debugged with OllyDbg. The ripped data can be formatted and "declared" in the syntax of MASM, C/C++ and Delphi. Data Ripper is useful whenever you need to rip data, tables, etc. out of an app so the data can be used in another compiled program.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: DeJunk
Rating: 0.0 (0 votes)
Author: flyfancy                        
Website: N/A
Current version:
Last updated: October 16, 2003
Direct D/L link: Locally archived copy
License type: Free
Description: Find/remove junkcode from packers, customizable.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: DebugPlugin
Rating: 0.0 (0 votes)
Author: TBD                        
Website: N/A
Current version: 1.0
Last updated: November 28, 2002
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Loads OllyDbg and breakpoints on load plugin routine.
For OllyDbg 1.08b ONLY.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Exception Counter
Rating: 0.0 (0 votes)
Author: ZeetreX                        
Website: N/A
Current version: 0.1
Last updated: August 25, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: A plugin to automate the process of unpacking with exceptions. (Count the number of exceptions before the app runs and then pass exceptions n-1 times in next restart)
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: ExtraCopy
Rating: 0.0 (0 votes)
Author: Regon                        
Website: N/A
Current version: 0.9
Last updated: July 1, 2003
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Copy portions of code inside OllyDbg and to clipboard.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: FullDisasm
Rating: 0.0 (0 votes)
Author: BeatriX                        
Website: N/A
Current version: 1.7
Last updated: October 25, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: This plugin replaces the default OllyDbg disassembly routine with an engine which supports MMX, FPU, SSE, SSE2, SSE3, SSSE3, SSE4.1 and SSE4.2 instructions. Displays processor support for these technologies. Allows disassembling globally or only on selected lines in Masm, Nasm or GoAsm syntax. Available as a plugin for OllyDbg or Immunity Debugger.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: GoDup
Rating: 0.0 (0 votes)
Author: godfather+                        
Website: N/A
Current version: 1.2
Last updated: August 9, 2004
Direct D/L link: Locally archived copy
License type: Free
Description: IDA signature loader/map loader/resource viewer/process info. View dialogs, version info and Delphi/BorlandC forms.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Hide Caption
Rating: 0.0 (0 votes)
Author: Gigapede                        
Website: N/A
Current version: 1.00
Last updated: November 21, 2002
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Hides MDI windows caption to get more space
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Hide Debugger
Rating: 0.0 (0 votes)
Author: Asterix                        
Website: N/A
Current version: 1.24
Last updated: April 19, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: This plugin hides OllyDbg from many debugger detection tricks.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Immunity Debugger
Rating: 0.0 (0 votes)
Author: Immunity Inc / Oleh Yuschuk                        
Website: http://debugger.immunityinc.com
Current version: 1.5
Last updated: March 27, 2008
Direct D/L link: N/A
License type: Free
Description: Immunity Debugger is based on OllyDbg.

Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility.

* A debugger with functionality designed specifically for the security industry
* Cuts exploit development time by 50%
* Simple, understandable interfaces
* Robust and powerful scripting language for automating intelligent debugging
* Lightweight and fast debugging to prevent corruption during complex analysis
* Connectivity to fuzzers and exploit development tools
Also listed in: OllyDbg Custom Versions, Ring 3 Debuggers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: IsDebuggerPresent
Rating: 0.0 (0 votes)
Author: SV                        
Website: N/A
Current version: 1.4
Last updated: June 30, 2003
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Hide debugger from IsDebuggerPresent Windows API.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: LCB Plugin
Rating: 0.0 (0 votes)
Author: scherzo                        
Website: N/A
Current version: 0.10
Last updated: December 30, 2006
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Plugin to export and import labels, comments and breakpoints. Functionally a combination of Labelmaster with improved abilities, and Olly Breakpoint Manager.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Labeler
Rating: 0.0 (0 votes)
Author: Gigapede                        
Website: N/A
Current version: 1.33
Last updated: October 31, 2004
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Creates label/structs. Plugin & udd dir support.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Labelmaster
Rating: 0.0 (0 votes)
Author: Joe Stewart                        
Website: http://www.joestewart.org
Current version:
Last updated: January 13, 2004
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Import/export user-defined labels and comments.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: LoadSome
Rating: 0.0 (0 votes)
Author: n1kto                        
Website: N/A
Current version: 0.1b
Last updated: August 13, 2006
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Plugin manager of sorts. Allows you to create separate folders for plugins and load/unload them to the Plugins menu.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: MapConv
Rating: 0.0 (0 votes)
Author: godfather+ / TBD / SHaG                        
Website: N/A
Current version: 1.4
Last updated: June 10, 2003
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Imports .map files from SoftICE or IDA.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Memory Watch
Rating: 0.0 (0 votes)
Author: Ziggy                        
Website: N/A
Current version: 1.0
Last updated: May 29, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: Memory Watch(MW) provides functions which allow a debugged app to be automatically stepped while watching for a particular memory value(s), register value(s) and/or string value(s). MW can pause when a watch value is found or log watch events to the Ollydbg log file.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: MemoryDump
Rating: 0.0 (0 votes)
Author: aeon                        
Website: N/A
Current version:
Last updated: September 6, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: Plugin allows convenient dumping of a selected number of bytes from Dump window. Available as a plugin for OllyDbg or Immunity Debugger.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: MemoryManage
Rating: 0.0 (0 votes)
Author: playar                        
Website: N/A
Current version:
Last updated: October 19, 2004
Direct D/L link: Locally archived copy
License type: Free
Description: Basic utility for adding Execute/Read/Write memory blocks to a process. Code injection anyone?
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Modified Command Line Plugin
Rating: 0.0 (0 votes)
Author: anonymouse                        
Website: N/A
Current version:
Last updated: April 23, 2007
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Useful new features added to default Cmdline.dll plugin:
LOADDLL - load a dll into the context of the debugee.
LOADPDB - load PDB symbol files into Olly directly from Microsoft server.
LOADPLUGIN - load a plugin dynamically without restarting Olly. Bypasses 32 plugin limit.
PRINT - allows multiple expressions to be output to log window per conditional breakpoint.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: NonaWrite
Rating: 0.0 (0 votes)
Author: Nonameo                        
Website: N/A
Current version: 1.2
Last updated: June 4, 2006
Direct D/L link: Locally archived copy
License type: Free
Description: Multiline assembler for code snippet injection, with string declarations and comment support. Includes Help file.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: NtGlobalFlag
Rating: 0.0 (0 votes)
Author: Stingduk         &