Ollydbg text assembler (concept)

[Guest Dreamer9210]

Hello!

I'm using OllyDbg quite often, and sometimes I use it to add/edit functionality to existing binary applications.

It's very convenient to see the changes in real time, being able to insert breakpoints while writing/editing the code.

But the main problem, in my opinion, is that it's difficult to maintain already written code - if I have to insert or remove commands, I have to manually fix calls/jumps.

That's why I wanted to write a plugin to fix the situation, but I am not experienced in writing OllyDbg plugins, and I don't have much time for it, so I want to share the concept with you:

Click here

It's similar to the known Code Ripper plugin, with an extra feature to allow to patch changes back to the running process.

Perhaps one of you legendary plugin writers will make us happy by writing it.

Share your opinions!

Cheers.

[Ufo-Pu55y]

tried it? http://www.tuts4you.com/download.php?view.1221

[Guest Dreamer9210]

Thanks, a nice plugin!

Although it crashed a couple of times in a 5 min testing, it's buggy (jmp eax assembles as jmp $, for example), has it's own syntax, and cannot get code directly from an executable, it can be quite useful

Is the source code available? I might make some fixes if it is.

[Ufo-Pu55y]

jmp eax assembles as jmp $

I didn't get that one :? Regarding the source, I was looking for it aswell in the past.. no luck.

In any case you should try out this baby, too: http://forum.tuts4you.com/index.php?showtopic=14483

He promised to improve it, but I assume he's kinda outta it :\

[Guest Dreamer9210]

jmp eax assembles as jmp $

I didn't get that one :?

If you try something like:

@0x00401000:

jmp eax

It assembles EB FE (jmp 0x00401000 in this case, jmp $ in MASM) instead

In any case you should try out this baby, too: http://forum.tuts4you.com/index.php?showtopic=14483

He promised to improve it, but I assume he's kinda outta it :\

The assembler here does not support labels and multiple addresses, so it's like assembling in OllyDbg, nothing special

It has some nifty features though, like showing selected block size in bytes, and copying the address of a command

[Ufo-Pu55y]

jmp eax

Uh ya, never noticed before.. doesn't even matter at all which

string follows the jmp (as long as no C hex value) :\

"jmp ~~~wtffffffomg~~~" turns into EBFE.. let's call it feature instead

Edited September 3, 2009 by Ufo-Pu55y

[Guest Dreamer9210]

OK, I'm in a process of writing an alternative

Stay tuned