Abundance
Abundance

Reputation: 2183

How to disassemble bytes that Ollydbg thinks are data, not code?

I am looking at some executables that use anti-disassembly techniques, often causing code to be obfuscated as text. In IDA Pro, there are the easy 'c' and 'd' hotkeys to switch instructions between code and data. Is there an equivalent way to do that in Ollydbg?

For example:

As data:

.text:00401283                 db 55h
.text:00401284                 db 89h
.text:00401285                 db 0E5h ; s
.text:00401286                 dd 480C458Bh

As code:

.text:00401283                 push    ebp
.text:00401284                 mov     ebp, esp
.text:00401286                 mov     eax, [ebp+0Ch]

Upvotes: 2

Views: 1368

Answers (2)

David Liu
David Liu

Reputation: 11

right click->Analysis->Analyse code or ctrl+a

Upvotes: 1

Amir
Amir

Reputation: 1844

yes dump memory and right click on it. select the format that you want to see. Disassemble show data as assembly code.

enter image description here

Upvotes: 1

Related Questions