1

for a manuelly unpacking process, I need the option "Remove analysis from module." It can be reached by right-click -> Analysis -> Remove analysis from module.

But I can not find it in my ollydbg program (I have the version ollydbg v1.10).

My question: Do I need a plugin for that? Or can I find that option in a higher version of ollydbg ?enter image description here

Improve this question

3 Answers 3

Reset to default
1

It's definitely in the standard OllyDbg v1.10.

Before right-clicking in the disassembly pane of the CPU window, be sure to left-click in the disassembly pane first so that OllyDbg sets the disassembly pane as the active pane. Once the disassembly pane is active (black disassembly text instead of gray disassembly text), you can then right click and find Remove analysis from module in the context menu:

OllyDbg v1.10 screenshot

Improve this answer
3
  • hmmh, yes I did the same thing that you described above, but the point is : I have only the options "Scan object files", "Remove object scan from module" and "During next analysis, treat selection as"
    – user3097712
    Dec 26, 2014 at 20:13
  • I have also take a picture how it looks like. You can see it in my edited question.
    – user3097712
    Dec 26, 2014 at 20:21
  • Ah, it's because for your unpacking scenario, OllyDbg did't realize that the OEP's memory region contains code. Given that OllyDbg didn't do a code analysis on that region, there's no analysis that needs to be removed. So if you're following a tutorial, you can skip the "Remove analysis from module" step.
    – Jason Geffner
    Dec 26, 2014 at 20:36
0

This might also be a reason of a wrong value used in BaseOfCode member of OptionalHeader. For example if the value is larger than the code section size OllyDbg won't show the Analyze Code option. Like what Jason Geffner said if the option Remove analysis from module is missing then the Analyze wasn't made. You can also try to use AnalyzeThis! plugin.

Improve this answer
0

after following the steps i got the OEP.Image is as follows

so ollydbg didn't understand the code put unnecessary code.so after doing "Remove analysis" from the assembly pane i got OEP Thanks @jason Geffner

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.