PDA

View Full Version : A problem about Ollydbg


MathewMickle
November 19th, 2008, 08:04
A PE header includes some incorrect data,for example,

NumberOfRvaAndSizes=1000

I use Ollydbg to modify the datum(00 10 00 00->10 00 00 00),but I got an error message "Unable to locate data in executable file" when I saved the modified file.

However,I am surprised someone ever saved successfully.

Could someone explain it to me ?
thanks!

esther
November 19th, 2008, 08:07
use the right tools hex editor

MathewMickle
November 19th, 2008, 08:16
I know your meaning.
I followed a tutorial(Lena151) to modify the file,so I hope I can use OD to patch it.
Thanks!

esther
November 19th, 2008, 10:40
you can only move 4bytes ahead,it doesn't works YOUR WAY

MathewMickle
November 19th, 2008, 22:00
Would you explain it in detail?
I can't grasp your idea.
I didn't change the file size ,just edit it.

Ricardo Narvaja
November 20th, 2008, 03:29
use an unpatched and original ollydbg 1.10 downloaded from oLLYDBG page, and don't use any plugin, and try again, if you can save, add ONE plugin and try again etc,
With this action you can know, what is the problematic plugin, or if is a patch to olly the problem.

ricnar

blabberer
November 20th, 2008, 14:39
never had any problem patching and saving peheader details with ollydbg

from your 00 00 format i think you are using ctrl+e (binary edit dialog)

try doing alt+m -> your file -> peheader -> dump in cpu scroll to the line you want to modify
right clik -> modify integer

right click -> copy to executable

and save the file