3

Is it possible to somehow copy/paste sections of data in the hex dump, or lines of code in the code (top left in CPU window disassembly window)?

Example: cloning a function, and then making some changes. Another example, copying a section of code that puts arguments on the stack and then calls a function like opening a messagebox, i.e. copying some 4-5 lines.

I can double click in the code (disassembly) window in the "command" column to open the "assemble" dialog, copy the text (such as CALL 004026F8), then close it (without changing this instruction) then go to some NOP's or 0's or something, double clicking ("command" column again) to open the assembly dialog again and pasting it in. This is ok for one or two instructions, but it would be nice if I could just select several lines and copy/paste them at once. Or if I could do it in the hex dump window by copying just bytes instead of lines of code.

I see the "binary copy" and "binary paste" in the hex dump window but they only do it for one byte, not a selected region.

I see in some videos people noting down addresses and running a separate hex editor program just to do this type of operation.

By the way, by selecting a region of data in the hex dump, one can right-click "Open in separate dump window" to open a window containing just this, and then write this selected data out to a file link. And one can bring in .bin files (not by File-Open but by drag and dropping them in) to a window also. But I can't see how to copy more than one byte at a time between them.

I'm almost embarrassed to ask this question, but I like Olly and want to be a "power-user".

Improve this question

1 Answer 1

Reset to default
3

select -> ctrl+c copy the whole display as text usefull for taking notes option available in all mdi windows 

CPU Disasm
Address          Hex dump   Command                                     Comments
01261970 _allmul /$  8B4424 MOV     EAX, DWORD PTR SS:[ESP+8]      ; multiargs._allmul(void)
01261974         |.  8B4C24 MOV     ECX, DWORD PTR SS:[ESP+10]
01261978         |.  0BC8   OR      ECX, EAX
0126197A         |.  8B4C24 MOV     ECX, DWORD PTR SS:[ESP+0C]

binary copy copies only the bytes 

8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C

binary paste pastes multiple bytes

for pasting several copied bytes your paste area selection must be as big as copy if you copied 5 bytes and want to paste 5 bytes select 5 bytes before pasting

to make the address column symbols highlighted use options (alt + o ) dump -> highlight symbolic names in address column

Improve this answer
3
  • Thanks , I had assumed that if I selected and binary copied 5 bytes, that they would start from the place I do a binary paste, whereas as you say, I must select the right number of destination bytes. I see when doing binary copy paste, it pastes the shorter of the two: 1) copied bytes, and 2) selected paste bytes.
    – Markbotix
    Jan 31, 2016 at 9:15
  • If I select 5 source bytes (from disassembly or hex dump window), hit 'ctrl-insert' or right-click and select "binary copy", and then go drag and select 4 other bytes and binary paste ('shift-insert' or right-click perform "binary paste") it will write over 4 bytes. If I select 7 and do binary paste it will only change the first 5.
    – Markbotix
    Jan 31, 2016 at 9:15
  • in your answer to highlight column symbols you didn't mention 'Code'. For me with Ollydbg 2.01 I need to do: -options (alt-'O') -> Code->Dump -> enable checkbox "highlight symbolic names in address column"
    – Markbotix
    Jan 31, 2016 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.