I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of
0x400000 (Checked by various PE tools).
However, every time I run the program in OllyDbg, the image would located an a different base address. It would change the image base when I reopen the binary and start run it, and would not change the image base when I click the restart icon in OllyDbg. I read at this post saying that win32 exe never use ASLR. Is this true? I have win7 pro and OllyDbg1.10.
Here is my real question. The unpacked executable have some address reference invalid. They are all using the standard win32 base
For example, I have the following instructions in my unpacked program, the reference to the
407018 is invalid.
- How could I fix this address reference?
- How to change all the address references in the format of
0x1150000in code section? Is there a tool to do this?
01153F2B |. A1 18704000 MOV EAX,DWORD PTR DS: 01153F30 |. 8365 F8 00 AND DWORD PTR SS:[EBP-8],0 01153F34 |. 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 01153F38 |. 53 PUSH EBX 01153F39 |. 57 PUSH EDI 01153F46 |. 74 0D JE SHORT CrackME.01153F55
setdllcharacteristics -d your_file.exe