How to find a function of application with ollydbg?

问题

Let's say i released the application below.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;

namespace WindowsFormsApplication2
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            MessageBox.Show("Hello World!","Message Box");
        }
    }
}

Now here is my questions:

How to find the function of button which is responsible to show message box after pressing the button with ollydbg?
How to disable the button click ?

Notes:this must be done with ollydbg only. Assume that i don't have access to the code.

A step-by-step example would be greatly appreciated.

回答1:

Using Olly or IDA is a lot of work for nothing.

Use .NET Reflector for decompilation(there is 14-day trial) and download Reflexil plugin to be able to modify code.

Finding the place should not be too hard since you have decompiled sourcecode.

If you cannot find the place you can try one of these:

Connect reflector to Visual studio
Export source code and just run it from Visual studio

If code is obfuscated I cannot help you there, you just must start playing with it till you defeat obfuscation

With Reflexil addon you can simply delete/modify the function

回答2:

Why not use IDA? You can "easily" nop out the function.

来源：https://stackoverflow.com/questions/24148651/how-to-find-a-function-of-application-with-ollydbg

标签

disassembly

ollydbg