10

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then switch to OllyDBG for patching. Well, the problem is, since Olly dynamically loads the dll (in contrast to the static standalone analysis in IDA), the offsets are different and I don't know how to find the offset that I've inspected in IDA. Is there some easy way to "rediscover" the offset in the dll?

Thanks in advance!

  • 2
    You patch a live program or on disk? Why not do all of it in IDA? – 0xC0000022L Apr 17 '13 at 14:23
  • i'd guess that actual offsets are the same, but the base is changed? – 0xea Apr 17 '13 at 14:47
  • Running a patched program directly in IDA (Pro 6.1)? How? I can use the "Assemble" function in IDA and then export the diff. But running the changed code directly? Additionally, since the changes are in the dll and I can only open one file at a time, I wonder how this should work... – Caroline Apr 17 '13 at 14:55
  • @Caroline: IDA has a debugger, you know. – Igor Skochinsky Apr 17 '13 at 16:58
12

If only the base is changed, but offsets are constant (as I'd guess is the case), you can just rebase the program in IDA. You can do so by edit->segments->Rebase program ... menu. Specifying the same starting base in IDA as is in Olly should help. Base may be different for numerous reasons, one of which might be ASLR.

  • 1
    I usually calculate it using calc which feels really clumsy. There has to be a better way than doing this sort of stuff manually or rebasing things back and forth. In my experience after you rebase you can get some notation errors in IDA. – Peter Andersson Apr 17 '13 at 15:29
  • I think I had encountered the same issue, and sometimes am calculating the addresses back and forth which is error prone and tedious. Would like to see a better solution too. – 0xea Apr 17 '13 at 20:41
8

Is there some easy way to "rediscover" the offset in the dll?

Yes, here's the algorithm:

Target_Address_in_OllyDbg = Source_Address_in_IDA - Base_Address_in_IDA + Base_Address_in_OllyDbg

Here are the definitions:

Target_Address_in_OllyDbg: The target address in OllyDbg.

Source_Address_in_IDA: The source address in IDA.

Base_Address_in_IDA: The base address of the disassembled module in IDA. You can find this value by going to Edit --> Segments --> Rebase program... in IDA's menu bar. The Value for Image base in that dialog box is the Base_Address_in_IDA.

Base_Address_in_OllyDbg: The base address of the target module in OllyDbg. You can find this value by pressing Alt-E in OllyDbg (or by going to View --> Executable modules in OllyDbg's menu bar). Find your target module in the Executable modules window; the leftmost field (Base) is the Base_Address_in_OllyDbg.

0

If anyone finds it useful I made myself a little calculator to easily get addresses for locations in my disassembler which uses the same algorithm described above. It currently defaults to binary ninja's base address but this is easy to change in the code. https://github.com/scrapbird/OffsetCalc

0

i use this small idc script i set the base once and input the olly address using the AskAddr

auto olbase , oladdr , rva;
olbase = 0x20000;
oladdr = AskAddr(0,"enter address as seen in olly");
Jump(  MinEA() + oladdr - olbase);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.