0

I'm trying to figure out how to copy "properly" strings from memory, I see there are very few plugins available for ollydbg2.x.x and the one I've tried, called BinaryCopyEx didn't work ok, for instance, It was impossible to press the buttons to "Copy to clipboard" or "save to file" (using 1920x1080 resolution).

Also, I wouldn't like to come back to ollydbg110 because the packed executables I'm dealing with were having some issues being opened with v110. When I say properly I don't mean using "Copy as a table" command, I'd just want to extract the string content (beautified or not).

So, could you please recommend me any OllyDbg v201 plugin suitable for the task? If not, any other proper method to copy large random strings from start to end offsets would be welcome.

Improve this question
1

Why not use olly's built-in copy?

binary copy

Right click->Edit->Binary copy will give you the hex string of bytes, and then to get that sting out of that in python 2 for example, you can run this one liner: binary_output.replace(' ', '').decode('hex') where binary_output is the clipboard value after using the binary copy option.

Another way, to copy the string as text into your clipboard (save the overhead of decoding the hex values) would be using the "Binary edit" option:

binary edit

And then highlighting the "ASCII" text box and copying the string directly from there:

enter image description here

Improve this answer
3
  • @Nirlzr Thanks a lot (+1), binary edit worked as a charm ;-) . One unrelated question to the current thread, do you know why i can't drag executables with ollydbg v201? I ask you this cos I've seen youtube videos dragging out executables and working out of the box. Maybe is that a plugin or..?
    – BPL
    Nov 12 '16 at 17:05
  • What do you mean by dragging out executables? Perhaps start another question?
    – NirIzr
    Nov 12 '16 at 17:06
  • @Nirlzr I mean opening executables using the typical "drag and drop" functionality, take a look to this example, as you can see I've tried drag and drop to the empty workspace, cpu window or another window and OllyDbg v201 isn't able to open that executable
    – BPL
    Nov 12 '16 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.