Jump to content
Tuts 4 You

Labelling on OllyDbg


Recommended Posts

As you know, OllyDbg provides labelling. When I see referenced address which assembly code has, I would get information(Label name) if referenced address is labeled.


But If labeled address would be referenced indirectly(e.g. mov eax, dword ptr[eax]) or labelled address is stack, OllyDbg cannot show label to reverser. (also, Status bar which is below CPU cannot show label too)


Is there other way to view label in OllyDbg? It's too hard to analyze obfuscated code because of this poooor behavior


Edited by pyutic
Link to comment

If a register is on the label address it should show the label in the registers view. However, you should use x64dbg.

Screenshot of what you want:

ghhP3oh.png

This obviously only works at runtime, since it is very hard or even impossible to predict an address without knowing the register context.

Edited by Mr. eXoDia
  • Like 2
Link to comment

If a register is on the label address it should show the label in the registers view. However, you should use x64dbg.

Screenshot of what you want:

ghhP3oh.png

This obviously only works at runtime, since it is very hard or even impossible to predict an address without knowing the register context.

Thanks for your answer.

Is no way to view indirectly referenced label in OllyDbg? It's too bad news ;(

Should that debugger provides implements for anti-anti-dbg technique?

Edited by pyutic
Link to comment

But If labeled address would be referenced indirectly(e.g. mov eax, dword ptr[eax]) or labelled address is stack, OllyDbg cannot show label to reverser.

Let me correct your sentence. Ollydbg or any other disassembler wont(cannot possibly ever) show the address.

Some indirect jumps can be deduced though 

Mov R32,#Addr

Call/JMP R32

Edited by Conquest
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...