Log in

View Full Version : Unable To Locate Data In Executable File


Perkele
June 24th, 2006, 05:40
The topic's name was the error I got when I was trying to patch a simple application and tried to copy my modifications to the executable file. I was wondering if there is any way to get it working even though this error seems to be hard to avoid.

blabberer
June 24th, 2006, 09:02
who is reporting that error ? windows, billgates's seceratary ? your cat ?

if it was ollydbg reporting that error then that means you are modifying your executable over and above your raw size

raw size will be in installments of 0x200 bytes while virtual size will be in installments of 0x1000 bytes
while mapping the windows loader will map all sections to the size of 0x1000
so there will be lot of space available to modify in memory
but when writing back there isnt enough space

so ollydbg will report that error try dumping your memory with ollydump with all the changes intact
or try adding a section at the end big enough to hold your modifications
and trampoline there

btw you could have searched this forum and could have found out all of this by yourself there are atleast 4 posts that return back if you tried searching
"unable to locate data"

of course google returns > 20,000 hits

Results 1 - 10 of about 25,200 for unable to locate data ollydbg. (0.37 seconds

Perkele
June 25th, 2006, 16:47
You're right, I was a bit in a hurry last time but I did a search and found out that it could easily be done through OllyDump (which I did then).
The only problem now is that (after making the RAW size equal the virtual size) the executable no longer works

Ricardo Narvaja
June 25th, 2006, 17:24
you not only need raw size = virtual size you need add the bytes with a hex editor, the file is needed be increased , not only changin a value in the header the file grow, in a hex editor look the end of the section and add zeros, to complete till the size nedded.

Ricardo Narvaja

Perkele
June 26th, 2006, 10:08
I did that and it worked
Poorly the application however has a protection system which checks its (I think filesize or hash) and overwrites itself when it's not the correct value

dELTA
June 26th, 2006, 10:57
Well, I guess you know what your next step is then...

Perkele
June 27th, 2006, 11:08
I do yes, at least I've gotten further and on the way I even learned something

dELTA
June 27th, 2006, 17:40
Sounds good. And if you get stuck, simply give a good presentation of your work so far and your problem, and you can get more good assistance here.