PDA

View Full Version : Olly Copy to executable -> All modifications gone

RITZ
November 15th, 2006, 10:57
Has anyone ever had this problem? I change a few jumps but the Copy to executable -> All modifications menu option never shows up, and my changes don't stay permanent.
blabberer
November 15th, 2006, 12:14
are you sure the changes you make are in analysed portions of the exe ?

are you sure they are not virtual allocated etc?

can you check if you can hexedit them and see if the changes persist ?

for ollydbg to do its job it needs analysis information

or if you want to do it raw

right click view executable modify and right click save file
RITZ
November 15th, 2006, 14:11
The changes are in the analyzed portion of the exe. (I'm actually not sure how they couldn't be. Wouldn't it need to be analyzed for me to make a change?)

Virtually allocated? You mean dynamically allocated? The code is not dynamically produced. This is further verified by the fact that I can indeed view the executable and assemble the changes in the file with no problems at all.
Ricardo Narvaja
November 15th, 2006, 18:33
copy to executable - all modifications and on the new window right click SAVE FILE, if you donīt save, the changes will be not permanent.

Ricardo Narvaja
LLXX
November 16th, 2006, 00:21
So you're too lazy to use a hex editor?

Copying loaded data back into a PE is not exactly reliable... unless you're doing a dump I won't recommend it at all.
xenakis
November 16th, 2006, 12:50
The "copy to executable -> all modifications" option indeed can dissapear at times (for various resons). I suggest you try the Ollyadvance plugin, which has a fix for this (works for some of the causes). From the help file:

Code:
Always enable "Copy all" 



This option enables the "Copy all" option in Olly always when you've done modifications. This option sometimes disappear for unpacked applications too by an Olly-fault.

"All modifications" can also disappear if Base of Code is changed.



Note: This option is heavy influenced by option "Handle Base of Code, Size of Code and Base of Data". Modifications are taken then PE-Wide, that means also YOUR OWN changes (not changes by the program) are included from every section.


Hope this helps.
SiGiNT
November 16th, 2006, 19:00
If you are trying to copy to the executable while the soft is paused, try letting it run and copy to executable, this has happened to me more than once.

SiGiNT
RITZ
November 16th, 2006, 21:18
@LLXX: Not lazy, just want to understand why.

@xenakis: Thanks, that explains why, and I will use that plugin from now on.

@sigint33: That didn't work in this specific instance, but I'll keep it in mind if this happens again.