PDA

View Full Version : how to force ollydbg to load a specific udd file ?


Roko
February 19th, 2010, 08:39
Hello,
I am trying to analyze a module loaded at start of an application.
The module is loaded by a loader.

The problem is that each time the module get a new name. So i am loosing my previous user comments.

Since the new name is predictable i tried that :
in debugger options/security i set:
+ignore path/extension
+ignore timestamp
+ignore crc of code section (though data section get modified)

changed udd name file, and path to module that is set in udd file.

Well thats not enough, on attaching, ollydbg ignore the udd and backup it before "updating" it.
Is there a way to change this behaviour.

Roko
February 19th, 2010, 08:44
ok i found a solution i will apply
thanks to http://www.woodmann.com/forum/showthread.php?p=61076&postcount=3

but i will use labelmaster plugin in future... for that module, at least.

Roko
February 19th, 2010, 09:08
well, doesn't work, probably bcse of crc or tst value in udd...

TempoMat
February 19th, 2010, 16:42
Quote:
[Originally Posted by Roko;85324]
The problem is that each time the module get a new name. So i am loosing my previous user comments.


The file name in the old UDD will not be same as soon as the module gets a new name, which will result in a new UDD being generated by Olly.

You can at least try to use the Breakpoint Manager plugin to remember your breakpoints.

Regards

Darkelf
February 20th, 2010, 08:14
The Breakpoint Manager Plugin can even remember your comments, so I'd also go this way

http://www.woodmann.com/collaborative/tools/Olly_Breakpoint_Manager

TempoMat
February 20th, 2010, 12:47
Quote:
[Originally Posted by Darkelf;85355]The Breakpoint Manager Plugin can even remember your comments, so I'd also go this way

http://www.woodmann.com/collaborative/tools/Olly_Breakpoint_Manager


Yes it does but it might be necessary to modify the saved *.obp file too.
The BP Manager also saves the name of the program here an example of the same program that was loaded with different names.

1. Program loaded as AF17BAF4.exe


AF17BAF4:0000f685:#:#
AF17BAF4:0000f701:#:#
AF17BAF4:0000f726:#:#
AF17BAF4:0000f782:#:#
AF17BAF4:0000f795:#:#
AF17BAF4:0000f7aa:#:#

2. Same Program loaded by its loader as 0E27E38F.exe


E27E38F:0000f685:#:#
E27E38F:0000f701:#:#
E27E38F:0000f706:#:#
E27E38F:0000f75e:#:#
E27E38F:0000f7b1:#:#


At least with the version I have I always load the program in Olly first and then edit the saved .obp file to reflect the new name of the loaded exe before importing it with BP Manager.

Regards