flat assembler
Message board for the users of flat assembler.

Index > Heap > Hexadecimal editing with and without ollydbg weird issue

Author
Thread Post new topic Reply to topic
patchariadog



Joined: 24 Mar 2013
Posts: 94
patchariadog
I am very confused with this one. I was trying to do some manually exe patching because I had an idea for a program. so I made a really small file in assembly (5kb) that just basically creates a txt file. I opened it up with ollydbg and added this hexadecimal to it "494E4A45" and saved the exe file. I then did this manually in the exact same postion with notepad and saved it using a hexadecimal editor.

here is the weird part I then opened both of the exes in ollydbg. now remember they are exactly the same hexadecimal wise. in the exe I modified with ollydbg I get this
[img]
http://i.stack.imgur.com/LqJHZ.jpg
[/img]
my instructions are made into
dec ecx
dec esi
dec edx
inc ebp
but when I open the exe I manually edited with the exact byte code I get this in ollydbg
[img]
http://i.stack.imgur.com/zkYgD.jpg
[/img]
my code gets translated to "INJE" ASCII

so my question is how can I manually edit the exe using notepad and a hex editor and get it to say inc ebx and all of that instead of it saying it is ascii?

P.S. they are exactly the same exes I ran them on diffnow.com and they show 0 differences

code for exe that was modified in ollydbg
Code:
4D5A80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0A240000000000000000504500004C010400E9D052530000000000000000E0000F010B01014700040000000C0000000000000010000000100000002000000000400000100000000200000100000000000000040000000000000000500000000400006A87000002000000001000000010000000000100000000000000000010000000000000000000000000300000C402000000400000C405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E746578740000006C020000001000000004000000040000000000000000000000000000200000602E6461746100000086000000002000000002000000080000000000000000000000000000400000C02E69646174610000C40200000030000000040000000A0000000000000000000000000000400000C02E72737263000000C40500000040000000060000000E00000000000000000000000000004000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006A00FF1598304000A3102040006A1150FF1584314000A31420400068007F00006A00FF1580314000A3182040006800204000FF156831400085C00F8484000000FF1560314000684A20400050FF15643140006A25FF3510204000FF15883140006A00FF3510204000506A00685802000068200300006A006A00680000CF10682820400068282040006A00FF156C31400085C074306A006A006A00685A204000FF157431400083F801723B75E8685A204000FF1578314000685A204000FF157C314000EBD06A106A00E81000000053746172747570206661696C65642E006A00FF1598314000FF3562204000FF15B03040005589E5535657837D0C017442837D0C050F840E010000837D0C070F8437010000817D0C110100000F8435010000837D0C020F8433010000FF7514FF7510FF750CFF7508FF1570314000E9260100006876204000FF7508FF158C314000E80A0000007469746C652E65786500FF159C304000E80A0000007469746C652E65786500E8160000006E657766696C65666F727A6D68746563682E65786500FF15A03040006A0068800000006A046A006A036800000040E80B0000007570646174652E74787400FF15A43040006A006A006A00E8010000000050FF15A830400050FF15AC3040006A016A006A00E80A0000007469746C652E657865006A006A00FF15AC3240006A00FF15B030400064A1300000008B406883E0707504C9C210006A00FF15B03040006876204000FF7508FF158C3140006A01FF3582204000FF357E204000FF357A204000FF357620400056FF159031400031C0EB1D56FF159431400031C0EB128B451025FFFF00006A00FF159C31400031C05F5E5BC9C2100031C0494E4A45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F110400000000000000000000000000000000000000000001000000000000000282040005A4D482054656368204F70656E20616E6420636C6F7365206469736B20747261790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078300000000000000000000050300000983000001C31000000000000000000005E30000060310000A432000000000000000000006A300000AC32000000000000000000000000000000000000000000004B45524E454C33322E444C4C00005553455233322E444C4C00005368656C6C33322E646C6C000000B8300000CC300000DA300000E6300000F4300000003100000E31000000000000B8300000CC300000DA300000E6300000F4300000003100000E3100000000000000004765744D6F64756C6548616E646C65410000000044656C65746546696C65410000004D6F766546696C654100000043726561746546696C6541000000577269746546696C65000000436C6F736548616E646C650000004578697450726F6365737300A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A32000078320000843200009232000000000000A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A3200007832000084320000923200000000000000004765744465736B746F7057696E646F770000000047657457696E646F77526563740000005265676973746572436C617373410000000043726561746557696E646F7745784100000044656657696E646F7750726F6341000000004765744D657373616765410000005472616E736C6174654D6573736167650000000044697370617463684D65737361676541000000004C6F6164437572736F72410000004C6F616449636F6E410000004C6F61644D656E7541000000476574436C69656E74526563740000004D6F766557696E646F7700000000536574466F637573000000004D657373616765426F7841000000506F7374517569744D65737361676500B432000000000000B43200000000000000005368656C6C4578656375746541000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E9D0525300000000000002001000000050000080180000002000008000000000E9D052530000000000000100010000003800008000000000E9D052530000000000000100000000008000000000000000E9D052530000000000000100010000006800008000000000E9D052530000000000000100000000008C02000090400000FB01000000000000000000003C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D22796573223F3E0D0A3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C617373656D626C794964656E74697479206E616D653D22782E782E78222070726F636573736F724172636869746563747572653D222A222076657273696F6E3D22352E312E302E302220747970653D2277696E3332222F3E200D0A3C6465736372697074696F6E3E6E6F3C2F6465736372697074696F6E3E0D0A3C646570656E64656E63793E0D0A3C646570656E64656E74417373656D626C793E0D0A3C617373656D626C794964656E7469747920747970653D2277696E333222206E616D653D224D6963726F736F66742E57696E646F77732E436F6D6D6F6E2D436F6E74726F6C73222076657273696F6E3D22362E302E302E30222070726F636573736F724172636869746563747572653D222A22207075626C69634B6579546F6B656E3D223635393562363431343463636631646622206C616E67756167653D222A22202F3E0D0A3C2F646570656E64656E74417373656D626C793E0D0A3C2F646570656E64656E63793E0D0A3C2F617373656D626C793E0D0A909C420000280300000000000000000000280334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000000000000000000000000000000040000000100000000000000000000000000000088020000010053007400720069006E006700460069006C00650049006E0066006F0000006402000001003000340030003900300034004500340000007200270001004C006500670061006C0043006F007000790072006900670068007400000043006F0070007900720069006700680074002000A900200032003000310033002C00200041006C006C0020007200690067006800740073002000720065007300650072007600650064002E00000090906C0022000100460069006C0065004400650073006300720069007000740069006F006E00000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000300008000100460069006C006500560065007200730069006F006E000000909031002E0030002E0030002E003000000064002200010049006E007400650072006E0061006C004E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B002000740072006100790000007400260001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079002E006500780065000000640022000100500072006F0064007500630074004E0061006D006500000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E000000000009040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    

code for exe that I manually edited
Code:
4D5A80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0A240000000000000000504500004C010400E9D052530000000000000000E0000F010B01014700040000000C0000000000000010000000100000002000000000400000100000000200000100000000000000040000000000000000500000000400006A87000002000000001000000010000000000100000000000000000010000000000000000000000000300000C402000000400000C405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E746578740000006C020000001000000004000000040000000000000000000000000000200000602E6461746100000086000000002000000002000000080000000000000000000000000000400000C02E69646174610000C40200000030000000040000000A0000000000000000000000000000400000C02E72737263000000C40500000040000000060000000E00000000000000000000000000004000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006A00FF1598304000A3102040006A1150FF1584314000A31420400068007F00006A00FF1580314000A3182040006800204000FF156831400085C00F8484000000FF1560314000684A20400050FF15643140006A25FF3510204000FF15883140006A00FF3510204000506A00685802000068200300006A006A00680000CF10682820400068282040006A00FF156C31400085C074306A006A006A00685A204000FF157431400083F801723B75E8685A204000FF1578314000685A204000FF157C314000EBD06A106A00E81000000053746172747570206661696C65642E006A00FF1598314000FF3562204000FF15B03040005589E5535657837D0C017442837D0C050F840E010000837D0C070F8437010000817D0C110100000F8435010000837D0C020F8433010000FF7514FF7510FF750CFF7508FF1570314000E9260100006876204000FF7508FF158C314000E80A0000007469746C652E65786500FF159C304000E80A0000007469746C652E65786500E8160000006E657766696C65666F727A6D68746563682E65786500FF15A03040006A0068800000006A046A006A036800000040E80B0000007570646174652E74787400FF15A43040006A006A006A00E8010000000050FF15A830400050FF15AC3040006A016A006A00E80A0000007469746C652E657865006A006A00FF15AC3240006A00FF15B030400064A1300000008B406883E0707504C9C210006A00FF15B03040006876204000FF7508FF158C3140006A01FF3582204000FF357E204000FF357A204000FF357620400056FF159031400031C0EB1D56FF159431400031C0EB128B451025FFFF00006A00FF159C31400031C05F5E5BC9C2100031C0494E4A45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F110400000000000000000000000000000000000000000001000000000000000282040005A4D482054656368204F70656E20616E6420636C6F7365206469736B20747261790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078300000000000000000000050300000983000001C31000000000000000000005E30000060310000A432000000000000000000006A300000AC32000000000000000000000000000000000000000000004B45524E454C33322E444C4C00005553455233322E444C4C00005368656C6C33322E646C6C000000B8300000CC300000DA300000E6300000F4300000003100000E31000000000000B8300000CC300000DA300000E6300000F4300000003100000E3100000000000000004765744D6F64756C6548616E646C65410000000044656C65746546696C65410000004D6F766546696C654100000043726561746546696C6541000000577269746546696C65000000436C6F736548616E646C650000004578697450726F6365737300A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A32000078320000843200009232000000000000A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A3200007832000084320000923200000000000000004765744465736B746F7057696E646F770000000047657457696E646F77526563740000005265676973746572436C617373410000000043726561746557696E646F7745784100000044656657696E646F7750726F6341000000004765744D657373616765410000005472616E736C6174654D6573736167650000000044697370617463684D65737361676541000000004C6F6164437572736F72410000004C6F616449636F6E410000004C6F61644D656E7541000000476574436C69656E74526563740000004D6F766557696E646F7700000000536574466F637573000000004D657373616765426F7841000000506F7374517569744D65737361676500B432000000000000B43200000000000000005368656C6C4578656375746541000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E9D0525300000000000002001000000050000080180000002000008000000000E9D052530000000000000100010000003800008000000000E9D052530000000000000100000000008000000000000000E9D052530000000000000100010000006800008000000000E9D052530000000000000100000000008C02000090400000FB01000000000000000000003C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D22796573223F3E0D0A3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C617373656D626C794964656E74697479206E616D653D22782E782E78222070726F636573736F724172636869746563747572653D222A222076657273696F6E3D22352E312E302E302220747970653D2277696E3332222F3E200D0A3C6465736372697074696F6E3E6E6F3C2F6465736372697074696F6E3E0D0A3C646570656E64656E63793E0D0A3C646570656E64656E74417373656D626C793E0D0A3C617373656D626C794964656E7469747920747970653D2277696E333222206E616D653D224D6963726F736F66742E57696E646F77732E436F6D6D6F6E2D436F6E74726F6C73222076657273696F6E3D22362E302E302E30222070726F636573736F724172636869746563747572653D222A22207075626C69634B6579546F6B656E3D223635393562363431343463636631646622206C616E67756167653D222A22202F3E0D0A3C2F646570656E64656E74417373656D626C793E0D0A3C2F646570656E64656E63793E0D0A3C2F617373656D626C793E0D0A909C420000280300000000000000000000280334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000000000000000000000000000000040000000100000000000000000000000000000088020000010053007400720069006E006700460069006C00650049006E0066006F0000006402000001003000340030003900300034004500340000007200270001004C006500670061006C0043006F007000790072006900670068007400000043006F0070007900720069006700680074002000A900200032003000310033002C00200041006C006C0020007200690067006800740073002000720065007300650072007600650064002E00000090906C0022000100460069006C0065004400650073006300720069007000740069006F006E00000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000300008000100460069006C006500560065007200730069006F006E000000909031002E0030002E0030002E003000000064002200010049006E007400650072006E0061006C004E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B002000740072006100790000007400260001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079002E006500780065000000640022000100500072006F0064007500630074004E0061006D006500000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E000000000009040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    
Post 21 Apr 2014, 19:51
View user's profile Send private message Reply with quote
Walter



Joined: 26 Jan 2013
Posts: 143
Walter
Use a hex editor you idiot.
Post 21 Apr 2014, 20:52
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17467
Location: In your JS exploiting you and your system
revolution
Ollydbg keeps .udd files containing various pieces of information about the debugging session. So it is just using information stored in the .udd file to decide how to classify parts of the program for display. If you delete the .udd file then it won't know the history and will guess how to display things.


Last edited by revolution on 21 Apr 2014, 23:41; edited 1 time in total
Post 21 Apr 2014, 22:19
View user's profile Send private message Visit poster's website Reply with quote
patchariadog



Joined: 24 Mar 2013
Posts: 94
patchariadog
thanks revolution that was the problem. so I was wondering is their any way to hide code caves from the debugger? like can you fill the blank space with random data so it looks like real instructions, or is the best thing you can do just insert ascii data?

thanks for all the help guys
Post 21 Apr 2014, 23:36
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17467
Location: In your JS exploiting you and your system
revolution
If a debugger is any good and worth using then you can't hide anything from it. If you find a way to hide something then your debugger is not worth using.
Post 21 Apr 2014, 23:40
View user's profile Send private message Visit poster's website Reply with quote
patchariadog



Joined: 24 Mar 2013
Posts: 94
patchariadog
ok thanks for the help!
Post 22 Apr 2014, 00:09
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.