OllyDBG v2.xx plugin - OllyExt

[sendersu]

Hi, thanks for details
most strange thing is that ...... it works just 1 time!
the second time and the rest the app under test is just crashing!
do you see the same behaviour?

2) I've ida/etc SW installed, but not running - does it matter?
3) what OS are you working on

P.S> here is my olly setings http://prntscr.com/1x0ldg
are you using the same?

[ferrit.rce]

Just take the last original Olly, install my plugin, turn on the mentioned protections and it should work. I'm using Win7 Pro. Related the exceptions I have the exact same settings.

Originally Posted by sendersu

Hi, thanks for details
most strange thing is that ...... it works just 1 time!
the second time and the rest the app under test is just crashing!
do you see the same behaviour?

2) I've ida/etc SW installed, but not running - does it matter?
3) what OS are you working on

P.S> here is my olly setings http://prntscr.com/1x0ldg
are you using the same?

[ferrit.rce]

Hey, I've just found the problem It's an olly config issue. You have to turn off SFX -> Unpack SFX modules automatically and will work like a charm. Per default it's enabled but it should be off...

[nikre]

get error when try rip recursive
Unable to find target jump address at 00000000
File: OllyExtCodeRip.cpp Line: 191
Result of GetLastError: 00000000

[ferrit.rce]

Please send me an example binary and the range what you wanted to rip.

Originally Posted by nikre

get error when try rip recursive
Unable to find target jump address at 00000000
File: OllyExtCodeRip.cpp Line: 191
Result of GetLastError: 00000000

[nikre]

@ferrit.rce

here example
I found one were work recursive

CALL 004053DC                                ;//00403D90:

[ferrit.rce]

OK, I'll take a look at it...

Originally Posted by nikre

@ferrit.rce

here example
I found one were work recursive

CALL 004053DC                                ;//00403D90:

[quygia128]

@ferrit.rce:

Inside the function, i think you should use GetProclimits to get End address of function(RET) (must analysis code)

Get point of Jump command (jump XXX), calc byte lenght from XXX To End of function and copy data to clipboard.

[ferrit.rce]

1. The feature must go without code analysis
2. I'm doing that what you've described but we have a possible problem with the recursive feature

Originally Posted by quygia128

@ferrit.rce:

Inside the function, i think you should use GetProclimits to get End address of function(RET) (must analysis code)

Get point of Jump command (jump XXX), calc byte lenght from XXX To End of function and copy data to clipboard.

[sendersu]

@author
have you seen this interesting piece of code?
http://pastebin.com/6kbt1Vka

did you already have it inside the Ext the tool?

[memcpy]

This pastebin is irrelevant, it's for Kernel debugger detection. Olly is usermode debugger. You don't have to add this mate.

[s0me0n3]

Originally Posted by sendersu

@author
have you seen this interesting piece of code?
http://pastebin.com/6kbt1Vka

did you already have it inside the Ext the tool?

Originally Posted by memcpy

This pastebin is irrelevant, it's for Kernel debugger detection. Olly is usermode debugger. You don't have to add this mate.

I have to disagree from what I can see on the pastebin stuff:

//On the other hand, if KdPitchDebugger is set to false, a check for the "SeDebugPrivilege"
//privilege is conducted, a sign of presence of Kernel and/or UserMode debugger(s).

and

else
{
printf("Kernel Debugger present\r\n");
if(retValue != 0xC0000022) printf("UserMode Debugger present as well\r\n");
}
}

Tell me where I am wrong.

[ferrit.rce]

I've a test code for this and it's relevant only in some rare circumstances. The user mode debugger can be detected only if a kernel mode debugger is installed, running and the program debugged under the user mode debugger. I've never seen this protection in any protector but I can implement it in no time This will be done in the next release...

Originally Posted by s0me0n3

I have to disagree from what I can see on the pastebin stuff:



and



Tell me where I am wrong.

[qkumba]

Originally Posted by ferrit.rce

I've a test code for this and it's relevant only in some rare circumstances. The user mode debugger can be detected only if a kernel mode debugger is installed, running and the program debugged under the user mode debugger. I've never seen this protection in any protector but I can implement it in no time This will be done in the next release...

That's not even quite true. It's not detecting any user-mode debugger. It's detecting that a kernel debugger is running and that the process has the SeDebugPrivilege, which is completely independent of any user-mode debugger.

It's not a reliable detection method.

[ferrit.rce]

New v1.6.1 is out. Changes:

- Recursive code ripping fix