6

I am using Immunity Dbg v1.85 (the latest version to date). I spent about an hour analyzing a piece of malware, while making comments and relabeling functions from something like X.00402AC0 to something more useful like X.password_checker. After patching the malware to skip over the password checker function (Copy to executable > All modifications) and saving it to a new file, I see all my comments and label changes have disappeared upon opening the patched version in the debugger.

The interesting thing is when you terminate the debugger and then re-open the original unpatched executable, the comments and labels remain. It's only when you save binary modifications to a new file that they are lost. Needless to say, this is a huge inconvenience when working on complex binaries that need to be patched and shared.

Is there any way to save changes to labels and comments to new executables in Immunity?

1

Google finds these links. Do they help?

http://www.openrce.org/forums/posts/2072

http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html

  • Thanks for helping. I need to study these in detail and experiment. These tutorials are about saving comments when analyzing an executable and what to do if comments aren't saved when working with DLL files called by the executable. When you patch a binary, you save it to a new executable, and the new UDD file is not created until the new executable is opened, so I don't think any data saved in the original executable UDD is ever transferred. – AK-33 Aug 24 '15 at 9:44
  • In my own research, I came across somewhere that what I want to do is possible in OllyDbg 2.0. I may just have to bite the bullet and switch. Ughhh... – AK-33 Aug 24 '15 at 9:45
1

To preserve info from the mentioned OpenRCE forum thread, I pasted the relevant info here:

Other reasons for OllyDbg v1.10 to discard .UDD data are:

1) A change in the file pathname e.g. xxx.exe moved from "c:\xxx.exe" to "c:\new\xxx.exe".

You can set the "Ignore path and extension" option to bypass this check.

2) A change in the LastWrite time of file.

You can set the "Ignore timestamp" option to bypass this check.

3) A change in the CRC of the code section since last session.

You can set the "Ignore CRC of code section" option to bypass this check.

I think you have the case 3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.