ollydbgdbg

Why my start address in Ollydbg is different than other people


Why my first start address in Ollydbg is different than other people?

(window7 64bit)

My Ollydbg start address is 777000000, 77777777, etc. I think this is system address.

Other people and other windows(xp,window7 32bit) Ollydbg start address is like 4000000 44000000. I think other people's dbg starts main function or thread.

please fix my Ollydbg thank you


Solution

  • Ollydbg can only debug 32-bit samples. Even if you are using 64-bit windows, it dosen't matter, 32-bit processes run under SysWoW64. You cannot debug 64-bit samples with ollydbg (try x64dbg instead).

    As for your question: When you load a PE into ollydbg, press ALT+F9 to get to the entry point of the main module (return to user code) what you saw is an address inside ntdll.dll, before the actual code of the sample you are examining. this dll is loaded at higher address.

    Note that at the window title of ollydbg, you can see which module you are currently debugging. Usually (not always), the Base Address of a PE you would like to load (in 32-bit PE) is at 0x0400000