4

I'm editing executables on a(n) (almost) daily bases in Ollydbg and it is very annoying that the 'Copy all modifications to executable' doesn't work properly.

All the code I edit in the .text section is copied to the new executable, but all the changes made to the .rsrc section (resources) is not copied. (Using 'Copy all...')

To save my changes made in the .rsrc section, I need to select the modified code in this section and specifically click 'Copy to executable'.

Is there a workaround to actually copy ALL modifications?

Improve this question
1

You need two times to save the changes. Once for .text section and re-do for .rsrc section.

Each time you use this option OllyDBG just save all change of the section that you use "copy to executable"

Improve this answer
  • @ Hamid ollydbg depends on analysis data to save all modifications and it does not analyse any section apart from code section if you have n number of modifications in rsrc section you may need to do copy to executable n number of times if all your modifications are in .rsrc section ollydbg iirc will not even show the copy all modifications context menu in any other section except code section for which it has analysis data and a copy of its internal modifications (int cc hit trace runtrace name symbol info) and external modifications (patch window) blind copyall is illogical requirement imho – blabb Feb 2 '14 at 17:54
  • @blabb The best choices is to change the data in resource section use the resource editor software. It's a mistake, if you have N section you need to do 'copy to executable' N times, Each time a section. if you use 'copy to executable' in resource section you cannot save another change in another section, you just save this section.But the changes should be in the range of PE file size. Sometimes VSize is greater than RSize. – HamiD Feb 3 '14 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.