[ollydbg-binary-execution-visualizer] New Tool for Visualizing Binaries With Ollydbg and Graphvis
Sometimes crackme’s or something you might be reversing will constantly bug you due to the excessive usage of f7 & f8. It will be quiet neat if you can see how the application is executing visually and set your break points accordingly.
Requirements:
o Ollyscript plugin
o Bunch of your favorite anti-‐debug plugins (phantom , ollyadvanced, …etc) o Pygraphviz
o Graphviz
o Python 2.7
Approach:
- Create an ollyscript that will do the followingo Log all EIP for main applicationo Disregard to log calls to kernel32 , ntdll & addresses which are above
7C000000 using step over not step into include more addresses toexclude if needed later for other system dll’s 77000000 … etc. o Save EIP Logs to file - Parse the log file
- Feed it into pygraphviz
- Export to png
- Visualize & note needed breakpoints.
- Re-‐run the app setting above breakpoints.
[ollydbg-binary-execution-visualizer] New Tool for Visualizing Binaries
With Ollydbg and Graphvis
![[ollydbg-binary-execution-visualizer] New Tool for Visualizing Binaries
With Ollydbg and Graphvis](//1.bp.blogspot.com/-ehfHwof275A/UjzejbzGwoI/AAAAAAAABBM/c-f7GhrPMdk/s72-c/OllyDbg2.gif)
Reviewed by 0x000216
on
Friday, September 20, 2013
Rating: 5
![[ollydbg-binary-execution-visualizer] New Tool for Visualizing Binaries
With Ollydbg and Graphvis](http://1.bp.blogspot.com/-ehfHwof275A/UjzejbzGwoI/AAAAAAAABBM/c-f7GhrPMdk/s72-c/OllyDbg2.gif)
Reviewed by 0x000216
on
Friday, September 20, 2013
Rating: 5