Reputation: 1770
I am working on an executable with self modifying code. Unfortunately, Ollydbg does not detect that the executable has "changed' despite it rather obviously XORing itself.
Normally, I would choose "copy to executable" -> "All modifications", press copy all, when a new window has opened, just press right mouse button and press "save file"
However, Olly detects no "modifications" no matter how many times I try to force it to analyze the file.
How can I force it to do what I want?
Upvotes: 1
Views: 783
Reputation: 139
Try to set a hardware breakpoint on write on the section that the 'Xor' ing happens
Upvotes: 1