Author Topic: Ollydbg - Memory Dump  (Read 2782 times)

Kockatá hlava

  • Junior Member
  • ***
  • Posts: 134
  • n00b
    • x86asm.net
Re: Ollydbg - Memory Dump
« Reply #30 on: November 18, 2008, 04:47:12 PM »
Quote from: pr0p4g4nd4
Ja som zvyknuty mat nazov konstanty zarovno s bytmi(pripadne wordami alebo dwordami). Neviem aku mam verziu.. Ale mam dojem ze verziu 8.2.. Ale nedal by som za to ruku do ohna :D

Pozor, michas tady verzi ML.EXE a baliku MASM32 (celkem castej problem, protoze nazev MASM32 pro balik nastroju fakt neni nejlepsi). MASM32 je aktualne ve verzi 10, ale ML.EXE uvnitr je 6.14 (z licencnich duvodu). Jinak nejnovejsi ML.EXE je ve verzi 9.x (takze se to zase pekne plete s verzi MASM32).

Sorry za OT.

eraser

  • repe cmpsb
  • Senior Member
  • ****
  • Posts: 268
  • Kill malware!
Re: Ollydbg - Memory Dump
« Reply #31 on: July 24, 2009, 07:38:11 PM »
Tak tento tyzden mi tento sikovny plugin usetril brutalnu kopu prace, ked som extrahoval povodne exace z roznych smejdovych protektorov.

Zaradujem ho povinne do Ollyho.

aeon: Inak by nebolo na skodu ho sem opat attachnut (upravit prvy prispevok a vlozit ho tam), kedze sa vsetky prilohy pri exporte odpalili.
th3 r341 f4!1ur3 !5 wh3n y0u d0n't 134rn 4nyth!n6 fr0m 4ny 6!v3n 5!tu4t!0n
the real failure is when you don't learn anything from any given situation

Zodiac

  • Trial Member
  • **
  • Posts: 80
Re: Ollydbg - Memory Dump
« Reply #32 on: July 25, 2009, 07:01:30 PM »
heh, som rad ze sa aj tebe pozdava  :)

mna ani netrklo ze ked sa prestahovalo forum tak vsetky prilohy su fuc, do prveho prispevku ho davat nebudem, bolo by to dost odveci , tak aspon supnem ten povodny zip aj s popisom
« Last Edit: August 04, 2009, 03:09:14 PM by Zodiac »

Zodiac

  • Trial Member
  • **
  • Posts: 80
Re: Ollydbg - Memory Dump
« Reply #33 on: August 04, 2009, 03:11:10 PM »
update:
urobil som par zmien , nejake veci pridal , nieco opravil, nieco neopravil  ???

davam to sem(ak ma este niekto zaujem) skor na testing purposes

vsetko podstatne(ak nieco) piste sem

Quote

       -= Memory Dump 0.9a for Olly Debugger by AeoN =-
       -==============================================-



Installation
============
 Copy plugin into Olly's plugin directory.


Usage & Help
============

 Plugin is intended to save/load bytes from momory dump window of the process in
 various forms. In the dump window right click and select 'Memory Dump' in the popup menu
 pick your choice.

 Possible choices are:

 - Load Dump
    Allows to fill process' memory with data from a file. (Be sure what you are
    doing, overwriting the process memory may cause you a lot of trouble.)

 - Save Dump
    Copies selected bytes from dump into a file.
         
 - Clipboard(Text)
    Copies selected bytes from dump into a clipboard (text only).

 - Delphi/Pascal Table
    Generates table of selected bytes which can be easily used in Delphi/Pascal

 - C/C++ Table
    Generates table of selected bytes which can be easily used in C/C++

 - ASM Table
    Generates table of selected bytes which can be easily used in Assembler
    (MASM Tested)

 - Visual Basic Table
    Generates table of selected bytes which can be easily used in Visual Basic

 - Range Dump (ALT+R)
    Dumps Range of defined bytes by:

   - Lenght : Tick End Address/Lenght
        - End Address : Untick End Address/Lenght

    Xor Dump With: Self-explanatory
   
    Button with [<] symbol enters address of last byte clicked(not selected) in the dump,
    it's more convenient than entering addresses manually.


 - Xor Selection
    Xors Selection and shows dumped data in Olly's window. This window cannot be used
    for another byte manipulation with plugin because dump is created in your Win's
    temporary folder and not in memory.


 - Quick Dump (ALT+Q)
     Allows quickly select and dump data, mark the start(SHIFT+1) and the end(SHIFT+2) of
     the block in dump window, then just press (ALT+Q).



What's new
==========

 v0.91 - [Aug. 2009]

  - load data into process from file
  - bug in Range Dump fixed (the bug caused selection dump to be shorter by one byte)
  - shortcut key (ALT+R) for Range Dump
  - shortcut keys (SHIFT+1) and (SHIFT+2) for block selection
  - fast dump(ALT+Q)



History
=======


 v0.9 - [Dec. 2007]
  - 2 bugs in ASM Table fixed

 v0.8 - [Nov. 2007]
  + Xor Selection
  + Visual Basic Table
  + Updated Range Dump With Xor
  - Removed bug which allocated space in memory

 v0.7 - [Nov. 2007]
  + Updated Range Dump Again

 v0.6 - [Nov. 2007]
  + Updated Range Dump

 v0.5 - [Nov. 2007]
  + Range Dump
  - Bug Fixed

 v0.4 - [Oct. 2007]
  + ASM Table

 v0.3 - [Sept. 2007]
  + Delphi/Pascal Table
  + C/C++ Table
  + Version for Immunity Debugger

 v0.2 - [Sept. 2007]
  + Copies Selected Strings form Dump Window into clipboard
  + Version for Immunity Debugger

 v0.1 - [July 2007] - Initial Private Build
  + Copies Selected Strings form Dump Window into a file




Warning:
========

Plugin does not perform space check so be sure what you are doing when
loading data into memory(have in mind size of the file too), also be
sure not to cross memory blocks otherwise olly doesn't import anything.
Another possible reason of not loading data is because targeted memory
block may be read-only.



Thanks to
=========

 DARKER - for VB table specification
 pr0p4g4nd4 and eraser - for pointing out some bugs



Contact
========
 comer@mail2expert.com




« Last Edit: August 04, 2009, 03:17:08 PM by Zodiac »

pr0p4g4nd4

  • [SCF]
  • Senior Member
  • ****
  • Posts: 429
Re: Ollydbg - Memory Dump
« Reply #34 on: August 05, 2009, 10:00:34 AM »
popichi starec!
Aký je rozdiel medzi mladým a starým chlapom?
Mladému behá piča po rozume, starému po byte...

Kto robí je robot, kto koktá je.. koktavý!

H4P0

  • Newbie
  • *
  • Posts: 25
Re: Ollydbg - Memory Dump
« Reply #35 on: August 06, 2009, 12:20:49 PM »
By som si dovolil vam ukazat moj skromny, prvy(a asi aj posledny) pluginik do olly  :)

Robi to co ste uz z nazvu vydedukovali a este aj viac.
 
Umoznuje kopirovat vyznacene data z dump okien viacerymi sposobmi:

 - export tables pre ASM, C, DELPHI
 - export oznacenych bytes do suboru
 - export stringov priamo do schranky,  uzitocne najma pre rychly pristup k   datam pouzitelnych  inde (nepodporuje riadiace znaky)

Vsetky staznosti mi mozete posielat sem.  :o

A kde najdem teraz ten plugin po 2 rokoch od zalozenia temy? :)

Zodiac

  • Trial Member
  • **
  • Posts: 80
Re: Ollydbg - Memory Dump
« Reply #36 on: August 06, 2009, 01:42:37 PM »
najnovsi najdes ked sa pozres o tri prispevky vyssie a dobre sa zahladis na koniec mojho prispevku ale uznavam ze by sa tomu hodilo nejake viditelnejsie miesto
« Last Edit: August 06, 2009, 01:44:32 PM by Zodiac »