Log in

View Full Version : Forcing code sections


Aaerox
April 4th, 2004, 15:58
In a certain application I have been debugging, due to the aftermath of a packer, I'm rendered unable to have ollydbg analyse the code as the section it's in isn't labeled as code.
Is there anyway to force ollydbg to recognize this area as a code section, or possibly even force olly to analyse the code?

sgdt
April 4th, 2004, 17:27
You could load the EXE into PE Tools or the like and set the PE header to point at the correct code section and size. Then tools like Olly, IDA, and PE Explorer will be able to correctly identify it as code.

Aaerox
April 4th, 2004, 17:36
Can PE Tools edit it as it's running?

I remember trying something like this before, I think ollydbg just ignored it. Perhaps it only updates when a significant event takes place.

sgdt
April 5th, 2004, 14:44
Apparently, Olly won't look at what is BaseOfCode or SizeOfCode anytime after restart, so you can't just modify it in OllyDbg and click Analyze. Maybe version 2?

Anyway, it's only 2 DWORDs (BaseOfCode and SizeOfCode) in the PE Header. Modify the EXE to have these values point to the propper section, and load into OllyDbg.

Is there a reason (checksums or what not) that is a problem?