Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-29-2014, 16:12
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 507
Rept. Given: 493
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 1,242
Thanks Rcvd at 179 Times in 114 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Try use the DLLLoader01 tool developed by Mr.eXodia in attached for this two dll files and attach the process in olly, it's only an idea.
Regards
Attached Files
File Type: rar DLLLoader01.rar (6.7 KB, 6 views)
Reply With Quote
The Following User Gave Reputation+1 to wilson bibe For This Useful Post:
BlackWhite (07-29-2014)
  #2  
Old 07-29-2014, 20:37
TempoMat TempoMat is offline
Friend
 
Join Date: Jan 2006
Posts: 89
Rept. Given: 10
Rept. Rcvd 6 Times in 6 Posts
Thanks Given: 4
Thanks Rcvd at 28 Times in 21 Posts
TempoMat Reputation: 6
That is really strange, because the file paths (in this case the dll) and the respective sizes are stored in the udd.
Normally Olly appends "_x" where x is a number to a new file with different path.
Example with MyDll.dll from 2 different paths, you should find in the UDD-Directory MyDll.udd and MyDll_1.udd.

Here is a suggestion:

Check the option "Backup old .udd files" under the Menu Options->Appearance->Directories

Restart Olly and run two sections with each of the dlls. After that there should be at least one MyDll.udd and another MyDll.bak in your current situation.
Open these two files in a HexEditor and check from Offset 62 (decimal) for their paths and size.

Regards
Reply With Quote
The Following User Gave Reputation+1 to TempoMat For This Useful Post:
BlackWhite (07-29-2014)
  #3  
Old 07-29-2014, 22:00
BlackWhite BlackWhite is offline
Friend
 
Join Date: Apr 2013
Posts: 85
Rept. Given: 4
Rept. Rcvd 14 Times in 6 Posts
Thanks Given: 14
Thanks Rcvd at 56 Times in 25 Posts
BlackWhite Reputation: 14
Quote:
Originally Posted by TempoMat View Post
That is really strange, because the file paths (in this case the dll) and the respective sizes are stored in the udd.
Normally Olly appends "_x" where x is a number to a new file with different path.
Example with MyDll.dll from 2 different paths, you should find in the UDD-Directory MyDll.udd and MyDll_1.udd.

Here is a suggestion:

Check the option "Backup old .udd files" under the Menu Options->Appearance->Directories

Restart Olly and run two sections with each of the dlls. After that there should be at least one MyDll.udd and another MyDll.bak in your current situation.
Open these two files in a HexEditor and check from Offset 62 (decimal) for their paths and size.

Regards
Yes, there are MyDll.udd and MyDll.bak in udd folder,
but, OllyDbg seems not able to switch between them
correctly. Is there any settings that can force OllyDbg
to create both MyDll.udd and MyDll_1.udd?
Or will you please send me a copy of OlldyDbg used by
yourself? Thank you.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
DLLs loading sequence te$ter General Discussion 6 10-30-2013 18:52
How to patch .NET DLLs? Newbie_Cracker General Discussion 28 09-26-2005 04:52
Unpacking DLLs thomasantony General Discussion 22 08-18-2005 05:34
DLLs armmad8 General Discussion 2 06-09-2005 22:13


All times are GMT +8. The time now is 08:59.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )