Jump to content
Tuts 4 You

Need help with dumping an exe with OllyDump


szczurcio

Recommended Posts

Hey,


I was playing with a simple UPX .exe. I found the OEP and I want to dump it using OllyDump, but its auto-detection fails and gives me errors:


944266aba7c298f1e0d6353200fe5091.png


 


 


I suppose I'm just trying to dump the wrong address, but I don't really understand the options:


e62dd1ea03d9f397332577727602e81b.png


 


Most tuts will just happily tell you to click OK without explaining anything, so that doesn't help me. I know the OEP address, but what should I put in the start address box? The first address Olly shows to me? What about the size and the Bases (code/data)? I'd be grateful if someone could explain it in detail.


Edited by szczurcio
Link to comment

the base address is the start address.. typically 0x400000 for a windows exe..

base of code is the base address (plus start address) of where 'code' starts...

data is just a variation on the above

Link to comment

Thing is, the base address is different from the default (0x400000) for this .exe, I don't know why MSVC decided to compile it like this. Anyway, here is the file in question:


 


https://www.sendspace.com/file/gwjez7


 


(my own simple test code, just printfs to console, virus scan if someone's anxious: https://www.virustotal.com/en/file/bc491ea2120dd4720daa51b4a98967e20d42f3930c8d02fdcc169b3a8e2089a8/analysis/1424373899/ )


Edited by szczurcio
Link to comment

That imagebase change caused by ASLR in Windows Vista+. To keep things simple, you can either disable ASLR for reversing targets or switch to Windows XP for reversing. Also OllyDump import rebuilding might not work correctly in Win7+ - Scylla is much better option.


 


To answer your question - in start box you should enter imagebase of main module. You can find it in Modules, Log or Memory window in Olly.


Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...