Log in

View Full Version : Ctrl+A in Olly Debugger


tydit
July 15th, 2004, 07:17
I analyze packed EXE files and I can't use this function - Ctrl+A.
Can I do something to work this?

Analyze is a usefull function...

Can you help me? Thank's

psyCK0
July 15th, 2004, 09:24
Clarify your question or RTFM

tydit
July 15th, 2004, 23:48
I have packed EXE file, Entry Point is 401000, BaseOfCode is 1000
I can use Ctrl+A (Analyse Code)
I'm tracing and I see JMP 405000 - to other sections
and there (405000) at popup menu Analysis is only 'Scan object files'

Function Analyse Code is disabled

I'd like use this function but I don't know how (at 405000)

I'm sorry, I don't speak english well.

Lord_Looser
July 16th, 2004, 00:52
OllyDbg isn’t able to analyse memory sections which haven’t a module(!) owner inside the “memory map” window.

tydit
July 16th, 2004, 02:40
I tested it and it isn't complete.

I use program packed UPX. I can use Ctrl+A to UPX code but when I'm at OEP original program I can't use Ctrl+A.

psyCK0
July 16th, 2004, 03:42
Tested and confirmed - cant analyze at UPX OEP. Humm, I wonder why?

blabberer
July 18th, 2004, 02:03
psycko
may be i should now tell you to "RTFM" HAHAHA
any way see this
Extend code section to include extractor

Many OllyDbg's goodies, like analysis, are available only for the code section of executable module. If this option is active and module is self-extractable, OllyDbg formally extends code section so that it covers self-extractor.

psyCK0
July 18th, 2004, 02:41
hehe oh me anon I usually DO read the manual before posting. =)
Even with that option the analysis does not work on the OEP of a UPXed target. Do you mean it works for you?

Kharneth
July 30th, 2004, 07:56
Hello!
It seems you just have to change the base of code of the program to its original value while the option is active or not.
I tested and it works.