3

My program loads and unloads a DLL of main interest at runtime. I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most of the time.

I'm in search for an OllyDbg plugin to preserve the comments and labels when a DLL gets rebased (for Olly 1, but this task is that important that I'd also switch to Olly 2 if there is a plugin only for 2).

  • I tried Labelmaster, it can export and import comments and labels into text files. But the addresses in the textfiles are completely static and do not respect rebased DLLs.
  • A forum user posted a plugin named "Dynamic Debugging" which would solve my problems as it can load stored comments and labels with a base address I can manually specify. However, the thread is from 2006, and the download cannot be found on the net anymore, not even in archives.

Anyone knowing a plugin or still having the "Dynamic Debugging" plugin?

| improve this question | |
  • 2
    Have you tried the latest OllyDbg 2 to see if this is fixed (without needing any plugins)? – Jason Geffner Oct 5 '14 at 14:08
  • @JasonGeffner: It's not a bug, it's just a missing feature I guess. I have yet to test if Olly optimizes this behavior. It also happens in IDA. However, I've extended the Labelmaster plugin, s. my answer. – Ray Oct 5 '14 at 20:51
  • 2
    Right, but I believe that OllyDbg 2 has that feature built-in already. – Jason Geffner Oct 5 '14 at 21:07
  • @JasonGeffner: Wow, you're right! At least in my short test it worked. It was definitely rebased and my test comment was still there. Cool stuff! – Ray Oct 5 '14 at 23:00
4

OllyDbg2 supports this.

For OllyDbg1:

I have extended the Labelmaster plugin mentioned above. It now subtracts the current modules base before exporting the labels and comments and adds the current modules base when importing them. Thus it's now requried to have the correct module focused when importing the files.

I also added importing label and comment files at once (but still with two open file dialogs and two different files, too lazy now to optimize this).

You can download the LabelmasterEx plugin by me here:

To convert your current Labelmaster exports, here's my Excel worksheet subtracting the bases from them:

Another possibility of forcing ASLR off to get the same bases every time a DLL is loaded did not work for me. For those who want to try it: Start a Visual Studio Developer prompt (yeah, you'd need VS) and type in

editbin /DYNAMICBASE:NO C:\Game\game.exe

It should modify the PE header to disable ASLR in that executable and all DLLs it loads. But as said, it had no effect for me.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.