2

I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save it as a executable. I tried googling this up but no answers were in the slightest bit useful. I right clicked the CPU window and hovered over edit but it wasn't there. However when it did show up it was under the module ntdll instead of the actual exe. To be specific I'm simply trying to copy my modified code to a executable that's already cracked but the option to perform such a action isn't there it only pops up when I'm under ntdll but not the exe. Many thanks to whoever can solve this problem

  • Ok but how do I stop ntdll from popping up when I either press attach or open the exe directly? – mike Mar 22 '17 at 2:50
  • Hello? I'm using ollydebug v2 and I don't even see copy to executable under the edit menu – mike Mar 22 '17 at 4:01
  • if you have modifications in exes address space you will see it dont expect the modification you did in ntdll appear in your exe added an answer below with screen shots check it out – blabb Mar 22 '17 at 5:30
0

f your code pops up in ntdll you have added your code in ntdll do not do that dont modify system dlls you may destabilze your os add code only to your executable and use copy to executable

Dbg break is the first break for any process called system breakpoint andcit is ntdll step or run to your executable code viz address of entry point or start or main

see snap shot

enter image description here

copy to executable if you have modification in the executable will be available here
(if you do not have any modifications in the executable address space this wont appear
the modification that you have in ntdll wont appear here
you need to modify / add / delete / nop / do whatever in exes physicallly available space
you cant save to exe if you have code in page alignment / section alignment padding space

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.