Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-16-2005, 20:05
SystemeD SystemeD is offline
Friend
 
Join Date: Dec 2004
Posts: 68
Rept. Given: 8
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
SystemeD Reputation: 1
OllyScript Dump problem

Hi all,
I'm trying to write a little script for Olly using OllyScript v0.92. I simply place an hw breakpoint and then I dump a portion of memory with this command:
Code:
DM
DM addr, size, file
-----------
Dumps memory of specified size from specified address to specified file
Well, the dump is not correct! It doesn't have the right size and I discover that 0D is added somewhere in the dump.
Here is an example of the dump compared with one taken with the IsDebuggerPresent plugin's dump feature. Look at offset 0x77.

OllyScript:
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00   MZ.........ÿÿ..
00000010   B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ¸.......@.......
00000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000030   00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00   ............€...
00000040   0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68   ..º..´.Í!¸.LÍ!Th
00000050   69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F   is program canno
00000060   74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20   t be run in DOS 
00000070   6D 6F 64 65 2E 0D 0D 0D  0A 24 00 00 00 00 00 00   mode.....$......
00000080   00 50 45 00 00 4C 01 03  00 82 7F 6C 42 00 00 00   .PE..L...‚lB...
IsDebuggerPresent:
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00   MZ.........ÿÿ..
00000010   B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ¸.......@.......
00000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000030   00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00   ............€...
00000040   0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68   ..º..´.Í!¸.LÍ!Th
00000050   69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F   is program canno
00000060   74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20   t be run in DOS 
00000070   6D 6F 64 65 2E 0D 0D 0A  24 00 00 00 00 00 00 00   mode....$.......
00000080   50 45 00 00 4C 01 03 00  82 7F 6C 42 00 00 00 00   PE..L...‚lB....
Any idea on how to solve this problem?
Thanks.
Reply With Quote
  #2  
Old 09-16-2005, 21:59
Jay Jay is offline
VIP
 
Join Date: Feb 2002
Posts: 249
Rept. Given: 31
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 15
Thanks Rcvd at 13 Times in 5 Posts
Jay Reputation: 3
I did hear mention of a bug in the original ollyscript, I uploaded a fixed dll that is supposed to fix it though I never got around to trying it.
http://rapidshare.de/files/5164283/OllyScript_fixed.rar.html
Reply With Quote
  #3  
Old 09-16-2005, 22:34
SystemeD SystemeD is offline
Friend
 
Join Date: Dec 2004
Posts: 68
Rept. Given: 8
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
SystemeD Reputation: 1
Hi Jay,
Thank you very much, it works perfectly now!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
OllyScript scripts for FSG 1.0 and 2.0 TQN General Discussion 1 05-26-2004 20:14
Dump Problem ssh General Discussion 2 05-23-2003 03:13


All times are GMT +8. The time now is 09:40.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )