8

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.

Originally, I had an executable that was meant to accept two command line parameters and run a handwritten function on them. However, I ran into annoyances with using GetCommandLine et al. to return the parameters in my ASM. Namely, it returned Unicode and I needed the parameters in ANSI. Rather than dealing with setting up the library calls and converting that way, I compiled a small program that uses command line arguments with the intent of reusing code.

So now I have two executables:

  • one with the command line parameters parsed and in their proper places
  • two with the actual assembled function code inside of it.

The first executable has the space for the function NOP'd out, but I need a good way to paste the logic in. I've looked at Asm2clipboard, Code Ripper and data ripper, but they only have the functionality to rip the assembly out, but not paste it back in.

I'm aware I'll have to fix addresses and things like that, but I can't find a way in Olly or other tools to move the code between the executables. I can go into HexEdit or something like that I supposed, but I was hoping there's an easier way.

1
  • uhm, GetCommandLineA or GetCommandLineW? Why not simply use the correct one for your context?
    – 0xC0000022L
    Apr 19, 2013 at 19:02

3 Answers 3

6

For OllyDbg, it is

  1. Select code from the CPU window

  2. Right-click and choose Binary

  3. Choose Binary Copy

  4. In the target CPU window, do the same but select Binary Paste

6

disasm

use IDA (why olly only? IDA free might do the trick), or OllyDbg with BeaEngine plug-in (it has some specific ASM syntax options)

improve in the disassembler

rename as many labels as possible, using delta address - it's painful to do that later

export to ASM

rework the ASM syntax to get it re-assemblable

patch

either:

  • make your ASM code EIP-independant and patch it as hex

  • re-inject it with Iczelion's Code Snippet Creator (it injects your ASM code compiled as from your OBJ)

5

Multiline Ultimate Assembler is a multiline (and ultimate) assembler (and disassembler) plugin for OllyDbg. It’s a perfect tool for modifying and extending a compiled executable functionality, writing code caves, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.