Saving labels and comments in Immunity Debugger

Question

I am using Immunity Dbg v1.85 (the latest version to date). I spent about an hour analyzing a piece of malware, while making comments and relabeling functions from something like X.00402AC0 to something more useful like X.password_checker. After patching the malware to skip over the password checker function (Copy to executable > All modifications) and saving it to a new file, I see all my comments and label changes have disappeared upon opening the patched version in the debugger.

The interesting thing is when you terminate the debugger and then re-open the original unpatched executable, the comments and labels remain. It's only when you save binary modifications to a new file that they are lost. Needless to say, this is a huge inconvenience when working on complex binaries that need to be patched and shared.

Is there any way to save changes to labels and comments to new executables in Immunity?

Answer 1

Google finds these links. Do they help?

http://www.openrce.org/forums/posts/2072

http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html

Answer 2

To preserve info from the mentioned OpenRCE forum thread, I pasted the relevant info here:

Other reasons for OllyDbg v1.10 to discard .UDD data are:

1) A change in the file pathname e.g. xxx.exe moved from "c:\xxx.exe" to "c:\new\xxx.exe".

You can set the "Ignore path and extension" option to bypass this check.

2) A change in the LastWrite time of file.

You can set the "Ignore timestamp" option to bypass this check.

3) A change in the CRC of the code section since last session.

You can set the "Ignore CRC of code section" option to bypass this check.

I think you have the case 3.