1

I am trying to reverse a software which loads its own dll-file filled with protection stuff. I was able to successfuly locate the functions of interest. Then I patched the first function and test the software. It worked. Then I patched the second function and try to run the software, but this time it got jammed. I noticed in the OLLYDBG log note "crc changed, discarding .udd data" after this dll was loaded. PEid v0.94 Krypto Analyzer pluging reports CRC32 with some references. Speaking in short: How can I find where this CRC is checked so I can patch it ?

1
  • delete the old udd file (it should be in the same folder where ollydbg resides if you have not set it via udd path option cd %ollydbg.exepath% del xxxxxxxxxxx.udd ollydbg will create an new udd – blabb Jun 9 '15 at 6:57
6

The message "crc changed, discarding .udd data" is from OllyDbg itself, not from your target application.

1
  • 3
    To make Jason's statement (which is 100% correct!) a bit more clear: OllyDbg produces an .udd file from every DLL it encounters; when it loads the dll a second time, it takes a few shortcuts by loading the .udd instead of re-parsing the DLL. If the DLL changes (which OllyDbg detects by verifying a CRC), the .udd becomes invalid, and the DLL needs to be reparsed. However, this has nothing to do with your application code. – Guntram Blohm Jun 7 '15 at 21:05
1

If there a protection that uses CRC check, try to put breakpoints on CRC addresses you've got from Krypto Analyzer (I recommend Keygener Assistant) then see if they are hit. If so, see how to tackle them and you may change the whole routine to something like (in this example, eax is the register used after the routine call):

mov eax,1
ret

P.S: sometimes, the app will mess up if changed the routine and that routine is used inside other functions of the app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.