1

for a manuelly unpacking process, I need the option "Remove analysis from module." It can be reached by right-click -> Analysis -> Remove analysis from module.

But I can not find it in my ollydbg program (I have the version ollydbg v1.10).

My question: Do I need a plugin for that? Or can I find that option in a higher version of ollydbg ?enter image description here

1

It's definitely in the standard OllyDbg v1.10.

Before right-clicking in the disassembly pane of the CPU window, be sure to left-click in the disassembly pane first so that OllyDbg sets the disassembly pane as the active pane. Once the disassembly pane is active (black disassembly text instead of gray disassembly text), you can then right click and find Remove analysis from module in the context menu:

OllyDbg v1.10 screenshot

  • hmmh, yes I did the same thing that you described above, but the point is : I have only the options "Scan object files", "Remove object scan from module" and "During next analysis, treat selection as" – user3097712 Dec 26 '14 at 20:13
  • I have also take a picture how it looks like. You can see it in my edited question. – user3097712 Dec 26 '14 at 20:21
  • Ah, it's because for your unpacking scenario, OllyDbg did't realize that the OEP's memory region contains code. Given that OllyDbg didn't do a code analysis on that region, there's no analysis that needs to be removed. So if you're following a tutorial, you can skip the "Remove analysis from module" step. – Jason Geffner Dec 26 '14 at 20:36
0

This might also be a reason of a wrong value used in BaseOfCode member of OptionalHeader. For example if the value is larger than the code section size OllyDbg won't show the Analyze Code option. Like what Jason Geffner said if the option Remove analysis from module is missing then the Analyze wasn't made. You can also try to use AnalyzeThis! plugin.

0

after following the steps i got the OEP.Image is as follows

so ollydbg didn't understand the code put unnecessary code.so after doing "Remove analysis" from the assembly pane i got OEP Thanks @jason Geffner

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.