Log in

View Full Version : ASM/OllyDBG assistance needed


openwdb
November 7th, 2009, 06:34
I need to execute the following asm code using ollydb on an executable

MOV BYTE PTR DS:[6C4D56],1
MOV BYTE PTR DS:[6C4D5A],1

MOV BYTE PTR DS:[7151A0],2
MOV DWORD PTR DS:[7151A2],C4B0DBB8
MOV DWORD PTR DS:[7151A6],0
MOV DWORD PTR DS:[7151AC],FCC8ACCE
MOV DWORD PTR DS:[7151B0],0D8CC

Can anyone tell me what to do with this lines of code?
Screenshot guidance would be much appreciated

disavowed
November 7th, 2009, 18:43
open any exe in ollydbg, select the current (highlighted) instruction, and just start typing "mov byte ptr ds:..." etc... olly will assemble in your changes as you type. then once it's all in there, you can just f7 to step through it.
honestly though, what you're asking for is probably not what you want

openwdb
November 8th, 2009, 00:17
Correct me if I'm wrong, the code shown above doesn't consist of which line(virtual address) I need to assemble the code? Which means I need to know exactly at which virtual address am I going to run the code?

naides
November 8th, 2009, 00:41
The addresses pointed by, for instance, PTR DS:[6C4D56] are "absolute" within the memory space of the program. They are the same regardless the place that the code using them is located in memory. What in a high level program would be called a global variable.
So yes, for these code constructs you provide, you do not need to know in advance the relative location of the target data in memory, absolute addresses will do just fine.

On the other hand, stack variables (Local variables), jumps and certain calls need to be in a pre-determined, known location in the code for them to "work" in code injection.

openwdb
November 8th, 2009, 02:11
Hi there,

Thanks for the detailed explaination. How do I inject those code above? Any virtual address will do ? Would it be possible if you can take a screenshot of where do I input the above code using ollydbg.

Thanks!

naides
November 8th, 2009, 02:45
Well, it all depends on what your objectives are. For starters, do it manually, and see if it works.
Let me explain myself:
Open the program in Olly, either at the entry point, or if the program happens to be packed or encrypted, at a later, point, when the unpacking or encryption already happened. (How do you know if and when? a whole other story. ) Find "code caves": areas in the code segment filled with zeroes or other alignment bytes that guarantee you that modifying them is not going to fuck up any thing else. . .
Assemble your code there. Place breaking points within new your code so you can test and debug to make sure that your modification has the intended consequences, and no side effects. You also have to make sure that your injected code is executed, at least once, and before variables you are changing are read/used. So the flow of the program has to "jump" to your injected code, do your dubious deed and jump back to the next instruction in the original code seamlessly. Such procedure is known as "hooking".

If that fullfills your objectives, you are done. Problem is, every time you want to run such program, you have to repeat the manual process, which is doable, but boring.

In that case you would want to inject code "programatically". Either code a small program that acts as a single purpose debugger, which in turns opens your program, stops it at the right moment, writes the injected code at the right place and then lets the target program run. Such application is called a "loader". There are some already made loaders in the tools repository or available in the net, OR if the program is not packed or encrypted or protected by code integrity detection tricks, write the modification permanently in the file, disk version of the program, using olly right click->wirte modifications to file-> save file. . .

Here is your screenshot: