有和没有ollydbg奇怪问题的十六进制编辑

时间：2014-04-21 17:32:03

标签： debugging binary hex ollydbg hexdump

我对这个很困惑。我试图做一些手动exe修补，因为我有一个程序的想法。所以我在程序集（5kb）中创建了一个非常小的文件，它基本上只创建了一个txt文件。我用ollydbg打开它并将这个十六进制添加到它“494E4A45” 并保存了exe文件。然后我在与记事本完全相同的位置手动完成此操作并使用十六进制编辑器保存。

这是奇怪的部分 然后我打开了ollydbg中的两个exes。现在记住它们是完全相同的十六进制明智的。在我用ollydbg修改的exe中，我得到了这个 ！[在此输入图像说明] [1]

enter image description here 我的指示被制作成 dec ecx dec esi dec edx inc ebp 但是当我打开exe时，我用精确的字节代码手动编辑，我在ollydbg中得到它 enter image description here 我的代码被翻译成“INJE”ASCII

所以我的问题是如何使用记事本和十六进制编辑器手动编辑exe并让它说inc ebx和所有这些而不是说它是ascii？

P.S。他们是我在diffnow.com上运行的那些exes，他们显示0差异

在ollydbg中修改的exe的代码

4D5A80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0A240000000000000000504500004C010400E9D052530000000000000000E0000F010B01014700040000000C0000000000000010000000100000002000000000400000100000000200000100000000000000040000000000000000500000000400006A87000002000000001000000010000000000100000000000000000010000000000000000000000000300000C402000000400000C405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E746578740000006C020000001000000004000000040000000000000000000000000000200000602E6461746100000086000000002000000002000000080000000000000000000000000000400000C02E69646174610000C40200000030000000040000000A0000000000000000000000000000400000C02E72737263000000C40500000040000000060000000E00000000000000000000000000004000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006A00FF1598304000A3102040006A1150FF1584314000A31420400068007F00006A00FF1580314000A3182040006800204000FF156831400085C00F8484000000FF1560314000684A20400050FF15643140006A25FF3510204000FF15883140006A00FF3510204000506A00685802000068200300006A006A00680000CF10682820400068282040006A00FF156C31400085C074306A006A006A00685A204000FF157431400083F801723B75E8685A204000FF1578314000685A204000FF157C314000EBD06A106A00E81000000053746172747570206661696C65642E006A00FF1598314000FF3562204000FF15B03040005589E5535657837D0C017442837D0C050F840E010000837D0C070F8437010000817D0C110100000F8435010000837D0C020F8433010000FF7514FF7510FF750CFF7508FF1570314000E9260100006876204000FF7508FF158C314000E80A0000007469746C652E65786500FF159C304000E80A0000007469746C652E65786500E8160000006E657766696C65666F727A6D68746563682E65786500FF15A03040006A0068800000006A046A006A036800000040E80B0000007570646174652E74787400FF15A43040006A006A006A00E8010000000050FF15A830400050FF15AC3040006A016A006A00E80A0000007469746C652E657865006A006A00FF15AC3240006A00FF15B030400064A1300000008B406883E0707504C9C210006A00FF15B03040006876204000FF7508FF158C3140006A01FF3582204000FF357E204000FF357A204000FF357620400056FF159031400031C0EB1D56FF159431400031C0EB128B451025FFFF00006A00FF159C31400031C05F5E5BC9C2100031C0494E4A45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F110400000000000000000000000000000000000000000001000000000000000282040005A4D482054656368204F70656E20616E6420636C6F7365206469736B20747261790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078300000000000000000000050300000983000001C31000000000000000000005E30000060310000A432000000000000000000006A300000AC32000000000000000000000000000000000000000000004B45524E454C33322E444C4C00005553455233322E444C4C00005368656C6C33322E646C6C000000B8300000CC300000DA300000E6300000F4300000003100000E31000000000000B8300000CC300000DA300000E6300000F4300000003100000E3100000000000000004765744D6F64756C6548616E646C65410000000044656C65746546696C65410000004D6F766546696C654100000043726561746546696C6541000000577269746546696C65000000436C6F736548616E646C650000004578697450726F6365737300A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A32000078320000843200009232000000000000A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A3200007832000084320000923200000000000000004765744465736B746F7057696E646F770000000047657457696E646F77526563740000005265676973746572436C617373410000000043726561746557696E646F7745784100000044656657696E646F7750726F6341000000004765744D657373616765410000005472616E736C6174654D6573736167650000000044697370617463684D65737361676541000000004C6F6164437572736F72410000004C6F616449636F6E410000004C6F61644D656E7541000000476574436C69656E74526563740000004D6F766557696E646F7700000000536574466F637573000000004D657373616765426F7841000000506F7374517569744D65737361676500B432000000000000B43200000000000000005368656C6C4578656375746541000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E9D0525300000000000002001000000050000080180000002000008000000000E9D052530000000000000100010000003800008000000000E9D052530000000000000100000000008000000000000000E9D052530000000000000100010000006800008000000000E9D052530000000000000100000000008C02000090400000FB01000000000000000000003C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D22796573223F3E0D0A3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C617373656D626C794964656E74697479206E616D653D22782E782E78222070726F636573736F724172636869746563747572653D222A222076657273696F6E3D22352E312E302E302220747970653D2277696E3332222F3E200D0A3C6465736372697074696F6E3E6E6F3C2F6465736372697074696F6E3E0D0A3C646570656E64656E63793E0D0A3C646570656E64656E74417373656D626C793E0D0A3C617373656D626C794964656E7469747920747970653D2277696E333222206E616D653D224D6963726F736F66742E57696E646F77732E436F6D6D6F6E2D436F6E74726F6C73222076657273696F6E3D22362E302E302E30222070726F636573736F724172636869746563747572653D222A22207075626C69634B6579546F6B656E3D223635393562363431343463636631646622206C616E67756167653D222A22202F3E0D0A3C2F646570656E64656E74417373656D626C793E0D0A3C2F646570656E64656E63793E0D0A3C2F617373656D626C793E0D0A909C420000280300000000000000000000280334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000000000000000000000000000000040000000100000000000000000000000000000088020000010053007400720069006E006700460069006C00650049006E0066006F0000006402000001003000340030003900300034004500340000007200270001004C006500670061006C0043006F007000790072006900670068007400000043006F0070007900720069006700680074002000A900200032003000310033002C00200041006C006C0020007200690067006800740073002000720065007300650072007600650064002E00000090906C0022000100460069006C0065004400650073006300720069007000740069006F006E00000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000300008000100460069006C006500560065007200730069006F006E000000909031002E0030002E0030002E003000000064002200010049006E007400650072006E0061006C004E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B002000740072006100790000007400260001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079002E006500780065000000640022000100500072006F0064007500630074004E0061006D006500000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E000000000009040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

我手动编辑的exe代码

4D5A80000100000004001000FFFF00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0A240000000000000000504500004C010400E9D052530000000000000000E0000F010B01014700040000000C0000000000000010000000100000002000000000400000100000000200000100000000000000040000000000000000500000000400006A87000002000000001000000010000000000100000000000000000010000000000000000000000000300000C402000000400000C405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E746578740000006C020000001000000004000000040000000000000000000000000000200000602E6461746100000086000000002000000002000000080000000000000000000000000000400000C02E69646174610000C40200000030000000040000000A0000000000000000000000000000400000C02E72737263000000C40500000040000000060000000E00000000000000000000000000004000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006A00FF1598304000A3102040006A1150FF1584314000A31420400068007F00006A00FF1580314000A3182040006800204000FF156831400085C00F8484000000FF1560314000684A20400050FF15643140006A25FF3510204000FF15883140006A00FF3510204000506A00685802000068200300006A006A00680000CF10682820400068282040006A00FF156C31400085C074306A006A006A00685A204000FF157431400083F801723B75E8685A204000FF1578314000685A204000FF157C314000EBD06A106A00E81000000053746172747570206661696C65642E006A00FF1598314000FF3562204000FF15B03040005589E5535657837D0C017442837D0C050F840E010000837D0C070F8437010000817D0C110100000F8435010000837D0C020F8433010000FF7514FF7510FF750CFF7508FF1570314000E9260100006876204000FF7508FF158C314000E80A0000007469746C652E65786500FF159C304000E80A0000007469746C652E65786500E8160000006E657766696C65666F727A6D68746563682E65786500FF15A03040006A0068800000006A046A006A036800000040E80B0000007570646174652E74787400FF15A43040006A006A006A00E8010000000050FF15A830400050FF15AC3040006A016A006A00E80A0000007469746C652E657865006A006A00FF15AC3240006A00FF15B030400064A1300000008B406883E0707504C9C210006A00FF15B03040006876204000FF7508FF158C3140006A01FF3582204000FF357E204000FF357A204000FF357620400056FF159031400031C0EB1D56FF159431400031C0EB128B451025FFFF00006A00FF159C31400031C05F5E5BC9C2100031C0494E4A45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F110400000000000000000000000000000000000000000001000000000000000282040005A4D482054656368204F70656E20616E6420636C6F7365206469736B20747261790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078300000000000000000000050300000983000001C31000000000000000000005E30000060310000A432000000000000000000006A300000AC32000000000000000000000000000000000000000000004B45524E454C33322E444C4C00005553455233322E444C4C00005368656C6C33322E646C6C000000B8300000CC300000DA300000E6300000F4300000003100000E31000000000000B8300000CC300000DA300000E6300000F4300000003100000E3100000000000000004765744D6F64756C6548616E646C65410000000044656C65746546696C65410000004D6F766546696C654100000043726561746546696C6541000000577269746546696C65000000436C6F736548616E646C650000004578697450726F6365737300A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A32000078320000843200009232000000000000A4310000B8310000C8310000DA310000EC310000FE3100000C3200002032000034320000423200004E3200005A3200006A3200007832000084320000923200000000000000004765744465736B746F7057696E646F770000000047657457696E646F77526563740000005265676973746572436C617373410000000043726561746557696E646F7745784100000044656657696E646F7750726F6341000000004765744D657373616765410000005472616E736C6174654D6573736167650000000044697370617463684D65737361676541000000004C6F6164437572736F72410000004C6F616449636F6E410000004C6F61644D656E7541000000476574436C69656E74526563740000004D6F766557696E646F7700000000536574466F637573000000004D657373616765426F7841000000506F7374517569744D65737361676500B432000000000000B43200000000000000005368656C6C4578656375746541000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E9D0525300000000000002001000000050000080180000002000008000000000E9D052530000000000000100010000003800008000000000E9D052530000000000000100000000008000000000000000E9D052530000000000000100010000006800008000000000E9D052530000000000000100000000008C02000090400000FB01000000000000000000003C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D22796573223F3E0D0A3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C617373656D626C794964656E74697479206E616D653D22782E782E78222070726F636573736F724172636869746563747572653D222A222076657273696F6E3D22352E312E302E302220747970653D2277696E3332222F3E200D0A3C6465736372697074696F6E3E6E6F3C2F6465736372697074696F6E3E0D0A3C646570656E64656E63793E0D0A3C646570656E64656E74417373656D626C793E0D0A3C617373656D626C794964656E7469747920747970653D2277696E333222206E616D653D224D6963726F736F66742E57696E646F77732E436F6D6D6F6E2D436F6E74726F6C73222076657273696F6E3D22362E302E302E30222070726F636573736F724172636869746563747572653D222A22207075626C69634B6579546F6B656E3D223635393562363431343463636631646622206C616E67756167653D222A22202F3E0D0A3C2F646570656E64656E74417373656D626C793E0D0A3C2F646570656E64656E63793E0D0A3C2F617373656D626C793E0D0A909C420000280300000000000000000000280334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000000000000000000000000000000040000000100000000000000000000000000000088020000010053007400720069006E006700460069006C00650049006E0066006F0000006402000001003000340030003900300034004500340000007200270001004C006500670061006C0043006F007000790072006900670068007400000043006F0070007900720069006700680074002000A900200032003000310033002C00200041006C006C0020007200690067006800740073002000720065007300650072007600650064002E00000090906C0022000100460069006C0065004400650073006300720069007000740069006F006E00000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000300008000100460069006C006500560065007200730069006F006E000000909031002E0030002E0030002E003000000064002200010049006E007400650072006E0061006C004E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B002000740072006100790000007400260001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000005A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079002E006500780065000000640022000100500072006F0064007500630074004E0061006D006500000090905A004D0048002000540065006300680020004F00700065006E00200061006E006400200063006C006F007300650020006400690073006B00200074007200610079000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E000000000009040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

非常感谢你们

2 个答案:

答案 0 :(得分：0)

INJE = 49 4E 4A 45

7C97DFCA 49 4E 4A 45 0>ASCII "INJE",0

as opcodes 

7C97DFCA    .  49            DEC     ECX
7C97DFCB    .  4E            DEC     ESI
7C97DFCC    .  4A            DEC     EDX
7C97DFCD    .  45            INC     EBP

如上所示

49 is opcode for DEC ecx也是ASCII char "I"

可以向ollydbg询问assume specific forms on selected bytes

选择显示为Ascii的字节（＆＃34; INJE＆＃34;）

right click 
analysis -> During Next Analysis Treat Selection as->commands

和reanalyze with ctrl+a Ascii将显示为操作码

答案 1 :(得分：0)

在ollyDBG中按ctrl + A查看它们是否相同。

ollyDBG识别49 4E 4A 45是ASCII字符还是操作码。

最好说ollyDBG猜测。

例如：数据段中的字节通常不是操作码，但您可以将它们称为函数。

并且CPU会将它们视为操作码。

如果你想知道更多这样做：

查看ollyDBG内存窗口中的所有段。

右键单击它们并按DUMP。

右键单击DUMP窗口中的

并指定它们看作“hex ASCII”“Unicode ASCII”“Short”“Text”“Long”或它们是操作码（Disassemble）。

相关问题
最新问题