Scale Posted May 8, 2006 Posted May 8, 2006 In the 16'th tutorial lena shows a modifyed olly with an extra menu with his other tools.Now adding the menu wasnt that hard.But how do tell the program start those programs when clicking that menu button.A litle explantion or a point in the right direction or a tutorial would be very appriciated.Scale.(sorry if this wasnt in the correct section)
Whiterat Posted May 8, 2006 Posted May 8, 2006 For a start is HER, Lena is a woman.If your fairly new to ASM then it may not be for you, you have to have a little understanding.But I will save you some time and show you where I did it on my olly.00433A32 . E9 0DBC0700 JMP 0llyICU.004AF644This is the End of the menu compare section where it compares the handle.So we jump to some spare space so we can continue it.My rsrc:POPUP "&Tools"{ MENUITEM "&LordPE", 9901 MENUITEM "&ImpREC", 9902 MENUITEM "&Notepad", 9903}004AF644 > 81FA E51C0000 CMP EDX,1CE5004AF64A . 75 1C JNZ SHORT 0llyICU.004AF668004AF64C . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AD of switch 0043382F004AF64E . 6A 00 PUSH 0 ; |DefDir = NULL004AF650 . 6A 00 PUSH 0 ; |Parameters = NULL004AF652 . 68 60F74A00 PUSH 0llyICU.004AF760 ; |FileName = "LordPE.lnk"004AF657 . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF65C . 6A 00 PUSH 0 ; |hWnd = NULL004AF65E . E8 DFFCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF663 .^E9 2E4BF8FF JMP 0llyICU.00434196004AF668 > 81FA E61C0000 CMP EDX,1CE6004AF66E . 75 1C JNZ SHORT 0llyICU.004AF68C004AF670 . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AE of switch 0043382F004AF672 . 6A 00 PUSH 0 ; |DefDir = NULL004AF674 . 6A 00 PUSH 0 ; |Parameters = NULL004AF676 . 68 6BF74A00 PUSH 0llyICU.004AF76B ; |FileName = "ImpRec.lnk"004AF67B . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF680 . 6A 00 PUSH 0 ; |hWnd = NULL004AF682 . E8 BBFCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF687 .^E9 0A4BF8FF JMP 0llyICU.00434196004AF68C > 81FA E71C0000 CMP EDX,1CE7004AF692 . 75 17 JNZ SHORT 0llyICU.004AF6AB004AF694 . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AF of switch 0043382F004AF696 . 6A 00 PUSH 0 ; |DefDir = NULL004AF698 . 6A 00 PUSH 0 ; |Parameters = NULL004AF69A . 68 76F74A00 PUSH 0llyICU.004AF776 ; |FileName = "Notepad.exe"004AF69F . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF6A4 . 6A 00 PUSH 0 ; |hWnd = NULL004AF6A6 . E8 97FCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF6AB >^E9 E64AF8FF JMP 0llyICU.00434196
zako Posted May 8, 2006 Posted May 8, 2006 But I will save you some time and show you where I did it on my olly. nice, thanks for sharing
lena151 Posted May 8, 2006 Posted May 8, 2006 Another easy solution if you're not so familiar with coding is to use the TBar plugin from arjuns./>http://www.tuts4you.com/forum/index.php?showtopic=8504&hl=TBar (see post #3)
wynney Posted May 8, 2006 Posted May 8, 2006 Another easy solution if you're not so familiar with coding is to use the TBar plugin from arjuns./>http://www.tuts4you.com/forum/index.php?showtopic=8504&hl=TBar (see post #3)Thank you manI was using TBar, but i want to learn how to modifyCan you help me?
Whiterat Posted May 8, 2006 Posted May 8, 2006 I am not going to write a full tut as Im busy coding tools at the moment. As I said; if you dont have much experience then just use plugins for now. Ive given more than enough info above to be able to make a simple menu Remember its all just a switch table
wynney Posted May 8, 2006 Posted May 8, 2006 I am not going to write a full tut as Im busy coding tools at the moment.As I said; if you dont have much experience then just use plugins for now. Ive given more than enough info above to be able to make a simple menu Remember its all just a switch table ok,man thank you for your tips
Scale Posted May 10, 2006 Author Posted May 10, 2006 Thanks for the help ^^ And woow a dutch her that knows allot of assembly. Thanks for the tuts lena
Scale Posted May 10, 2006 Author Posted May 10, 2006 (edited) Hehe in your tuts theres allot of dutch around ^^ Like ik en wij, or opslaan als etc o crap lol must be belgium doh hehe edit: flags/netherlands_antilles.gif close enough ^^ Edited May 10, 2006 by Scale
lena151 Posted May 10, 2006 Posted May 10, 2006 Hehe in your tuts theres allot of dutch around ^^Like ik en wij, or opslaan als etc o crap lol must be belgium doh hehe edit: flags/netherlands_antilles.gif close enough ^^ Oh dear ... detected !
Goldocrack Posted May 13, 2006 Posted May 13, 2006 (edited) For a start is HER, Lena is a woman.If your fairly new to ASM then it may not be for you, you have to have a little understanding.But I will save you some time and show you where I did it on my olly.00433A32 . E9 0DBC0700 JMP 0llyICU.004AF644This is the End of the menu compare section where it compares the handle.So we jump to some spare space so we can continue it.My rsrc:POPUP "&Tools"{ MENUITEM "&LordPE", 9901 MENUITEM "&ImpREC", 9902 MENUITEM "&Notepad", 9903}004AF644 > 81FA E51C0000 CMP EDX,1CE5004AF64A . 75 1C JNZ SHORT 0llyICU.004AF668004AF64C . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AD of switch 0043382F004AF64E . 6A 00 PUSH 0 ; |DefDir = NULL004AF650 . 6A 00 PUSH 0 ; |Parameters = NULL004AF652 . 68 60F74A00 PUSH 0llyICU.004AF760 ; |FileName = "LordPE.lnk"004AF657 . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF65C . 6A 00 PUSH 0 ; |hWnd = NULL004AF65E . E8 DFFCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF663 .^E9 2E4BF8FF JMP 0llyICU.00434196004AF668 > 81FA E61C0000 CMP EDX,1CE6004AF66E . 75 1C JNZ SHORT 0llyICU.004AF68C004AF670 . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AE of switch 0043382F004AF672 . 6A 00 PUSH 0 ; |DefDir = NULL004AF674 . 6A 00 PUSH 0 ; |Parameters = NULL004AF676 . 68 6BF74A00 PUSH 0llyICU.004AF76B ; |FileName = "ImpRec.lnk"004AF67B . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF680 . 6A 00 PUSH 0 ; |hWnd = NULL004AF682 . E8 BBFCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF687 .^E9 0A4BF8FF JMP 0llyICU.00434196004AF68C > 81FA E71C0000 CMP EDX,1CE7004AF692 . 75 17 JNZ SHORT 0llyICU.004AF6AB004AF694 . 6A 01 PUSH 1 ; /IsShown = 1; Case 26AF of switch 0043382F004AF696 . 6A 00 PUSH 0 ; |DefDir = NULL004AF698 . 6A 00 PUSH 0 ; |Parameters = NULL004AF69A . 68 76F74A00 PUSH 0llyICU.004AF776 ; |FileName = "Notepad.exe"004AF69F . 68 7A914B00 PUSH 0llyICU.004B917A ; |Operation = "open"004AF6A4 . 6A 00 PUSH 0 ; |hWnd = NULL004AF6A6 . E8 97FCFFFF CALL <JMP.&SHELL32.ShellExecuteA> ; \ShellExecuteA004AF6AB >^E9 E64AF8FF JMP 0llyICU.00434196Hi whiterat,Thanks for your ollycode, but how do you do to determine the value of your for example( lordpe.ink)PUSH 0llyICU.004AF76B ; |FileName = "ImpRec.lnk"PUSH 0llyICU.004B917A How can i determine my value, because i suppose that even if my LordPe.ink on my desktop, my adresses are not the same like you?Do you use a special tools to calculate it?thanks Edited May 13, 2006 by Goldocrack
lena151 Posted May 13, 2006 Posted May 13, 2006 Oops !!! mxwr has left his disguise and is a now known as a respected guy. This looks a lot better too
Whiterat Posted May 13, 2006 Posted May 13, 2006 Lena: Hehe there arent many Cypriot Crackers; So it wasnt too hard But its nice to be out and about now. Goldocrack: Hehe, LordPE.LNK is just a shortcut which is then placed in the OllyDBG directory. The only thing I missed was to add a path for when im executing Olly from a link, so it wont run them (except notepad which is of course in the paths list anyway)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now