Olly Copy to executable -> All modifications gone

[RITZ]

Has anyone ever had this problem? I change a few jumps but the Copy to executable -> All modifications menu option never shows up, and my changes don't stay permanent.

[blabberer]

are you sure the changes you make are in analysed portions of the exe ?

are you sure they are not virtual allocated etc?

can you check if you can hexedit them and see if the changes persist ?

for ollydbg to do its job it needs analysis information

or if you want to do it raw

right click view executable modify and right click save file

[RITZ]

The changes are in the analyzed portion of the exe. (I'm actually not sure how they couldn't be. Wouldn't it need to be analyzed for me to make a change?)

Virtually allocated? You mean dynamically allocated? The code is not dynamically produced. This is further verified by the fact that I can indeed view the executable and assemble the changes in the file with no problems at all.

[Ricardo Narvaja]

copy to executable - all modifications and on the new window right click SAVE FILE, if you don´t save, the changes will be not permanent.

Ricardo Narvaja

[LLXX]

So you're too lazy to use a hex editor?

Copying loaded data back into a PE is not exactly reliable... unless you're doing a dump I won't recommend it at all.

[xenakis]

The "copy to executable -> all modifications" option indeed can dissapear at times (for various resons). I suggest you try the Ollyadvance plugin, which has a fix for this (works for some of the causes). From the help file:

Code:

Always enable "Copy all" 



This option enables the "Copy all" option in Olly always when you've done modifications. This option sometimes disappear for unpacked applications too by an Olly-fault.

"All modifications" can also disappear if Base of Code is changed.



Note: This option is heavy influenced by option "Handle Base of Code, Size of Code and Base of Data". Modifications are taken then PE-Wide, that means also YOUR OWN changes (not changes by the program) are included from every section. 

Hope this helps.

[SiGiNT]

If you are trying to copy to the executable while the soft is paused, try letting it run and copy to executable, this has happened to me more than once.

SiGiNT

[RITZ]

@LLXX: Not lazy, just want to understand why.

@xenakis: Thanks, that explains why, and I will use that plugin from now on.

@sigint33: That didn't work in this specific instance, but I'll keep it in mind if this happens again.