PDA

View Full Version : Missing user defined comments?


5aLIVE
January 17th, 2009, 05:18
I have a program that I having been analysing on and off for some time now.
During this time I have been adding user comments to the disassembly.

Yesterday, when playing around with context menus and trying to make sense of run trace and the profiling options I <think> after I using one of these features or possibly analyseing code (Ctrl-A) I appear to have lost all my user defined comments.

Doing a search for user-defined comments shows only one entry (Initial CPU selection).

I tried removing analysis but this doesn't change anything. So I thought I could just copy over the .bak file of the .udd to restore things and that didn't work either.

Fortunately I have most if not all these comments with code in a notepad file so I can at the ver last resort recreate my work from scratch.

Can anyone suggest what may have caused this and any way to recover from it please?

I think Olly is a fantastic program, I just wish the help file doesn't do the capabilities of the debugger justice. Here hoping that the much anticipated version 2.0 addresses this.

Of course my my relative inexperience with debuggers won't help me realise it full potetial at this point. Time and experimenting will change that.

Some of the answers given on here on its use really shows how capable it is.

Thanks for any help.

blabberer
January 19th, 2009, 12:16
reanalysing does not erase user defined comments
user comments dissappear only if the user is commenting areas that are dynamically alloted with alloc virtual and thier relatives
there are quiet a few plugins with which you can save your labels comments , breakpoints etc to a seperate file and then reapply with few clicks
iirc named something liked label manager
take a look at ollydbg plugin section in tool library

5aLIVE
January 24th, 2009, 12:00
Thank you, I didn't think it would be likely to have comments erased when analysing the code. I have no idea what I did for this to happen

All the labels were at non dynamically allocated addresses as I have been returning to this DLL from time to time without any trouble until recently. That'll teach me for playing around with the options.

I'll take a look at these Olly label management plugins you suggest.

dELTA
January 29th, 2009, 17:23
Now when you mention that it's a DLL, could it be that at this particular instance the DLL was relocated from its "normal" address range (which is completely normal for DLLs), if you e.g. just did something that affected the DLL loading order of the host program?

This scenario would result in similar problems as code in "a dynamically allocated memory area", in the aspect of all memory addresses for the code changing anyway.

I don't know for a fact how Olly handles this though. Do you know Blabberer?