|
== Known Issue - Incorrect memory attribute OllyDbg 1.10 and Immunity Debugger Image type memory is always readonly. IDA Pro cannot detect Mapped type, Guard, CopyOnWrite attribute. - All Memory Search mode hit listed module OllyDbg 1.10 and Immunity Debugger not refresh t_memory table automatically. Open Memory window and refresh (ALT+M) before search. - Cannot search memory address greater than 0x7FFFFFFF OllyDbg 2.01h seems to be 0x80000000-0xFFFEFFFF memory range as kernel memory even if debuggee compiled with LARGEADDRESSAWARE option. - 64bit Limitation ImageBase change not supported. - Dumped UPX binary not work (FAQ) Disable "Prefer Original Characteristics" option before dump. Problem is PE characteristics and memory access permission inconsistency.
== Changelog - v1.40 / 2014-12-17 Add: Support x64_dbg plugin interface (both 32bit and 64bit) Improve: Enable NXCOMPAT and DYNAMICBASE for plugin binaries - v1.30 / 2013-06-28 Add: Support WinDbg plugin interface (both 32bit and 64bit) Improve: Add plugin name and version directory to archive file Bugfix: Data after section headers in PE Header has been ignored Bugfix: Fix SizeOfHeaders inconsistency - v1.20 / 2013-05-27 Add: Support IDA Pro plugin interface (both Retail and Freeware version) Add: Support native 64bit process dump (IDA Pro only) Improve: Change dialog position to center of parent window Improve: Add debug toggle menu to dialog system menu Improve: Section size handling single section belongs to multiple memory segments Bugfix: Zero virtual size section handling - v1.12 / 2013-04-02 Improve: Update to OllyDbg 2 latest version PDK (2.01h, PLUGIN_VERSION 0x02010001) Improve: Tested with latest version of debuggers (OllyDbg 2.01h and Immunity Debugger 1.85) Bugfix: Search greater than 0x7FFFFFFF memory address failed (IMAGE_FILE_LARGE_ADDRESS_AWARE) - v1.10 / 2013-03-24 Add: Search type All Memory Add: Binary dump mode (no rebuild PE header, for before load image) Add: PE32+ support (Binary dump mode only) Add: Memory Address/Size parameters editable (dump source address) Improve: Add info message for Relocation Flag and EXE/DLL type Improve: Large PE Header handling (larger than 0x1000) Improve: Check SectionAlignment and FileAlignment consistency Improve: Reduce search memory usage (not depend on target memory size) Improve: Detect PE Header across different type pages (parse and search) Bugfix: Improper owner window handle Bugfix: Section not listed when belong memory range not exists Bugfix: Almost features broken when memory window sort order changed - v1.00 / 2013-03-12 Add: Selectable Base PE Header (Module/Memory/Address) Add: Search PE Header from memory Improve: PE Source default change Disk to Memory Improve: ASLR aware (except PE Source from Disk mode) Improve: Clear DynamicBase DllCharacteristics flag with Disable Relocation option Improve: PE Header parse and modify more carefully (corrupt PE handling) Improve: Inherit selected address from memory window Bugfix: Fix Virtual Offset feature cause crash (divide by zero) Bugfix: Parse invalid sections cause crash - v0.92 / 2012-10-09 Improve: Support OllyDbg version 2 plugin new interface - v0.90 / 2011-08-24 Add: Support OllyDbg version 2 plugin interface (EXPERIMENTAL) Improve: Rewrite Wide/Multibyte-Character support code Improve: Decode CopyOnWrite page attribute Bugfix: Detect working directory (Wide-Character only) - v0.80 / 2011-08-01 Add: Support Immunity Debugger version 1.8x or higher Improve: Data Directory rebuild option (check rewrite range) Improve: Always round up PE header size to 0x1000 (ImportRec not extend itself) Bugfix: TLS Data Directory ignored - v0.70 / 2011-07-07 Add: Support Immunity Debugger version 1.7x or lower Improve: Data Directory rebuild option (support ImportTable) Improve: Image Base Address alignment checking Improve: Virtual Offset Address alignment checking - v0.60 Improve: DeSelect is too slow when Auto Adjust Image Base option enabled Add: Virtual Offset Address overlap checking - v0.50 Improve: Data Directory rebuild option (support ResourceDirectory) Add: Auto Adjust Image Base Address option - v0.40 Add: Data Directory rebuild option for RVA Adjust (support ExportTable) Improve: Invalid Image Base checking Improve: Virtual Offset overlap checking - v0.30 Add: Section sort by Virtual Offset Add: Fill Virtual Offset Hole option - v0.20 Bugfix: Fix many bugs - v0.10 Initial version
== Bug Report Please try latest version before report. With your environment detail, logs and way to reproduce. MAIL: lowprio20/_at_/gmail/_dot_/com
| 
IP卡
发表于 2014-12-19 20:45:20
提升卡
置顶卡
变色卡
千斤顶
显身卡
发表于 2014-12-19 21:02:19
发表于 2014-12-19 21:24:54
发表于 2014-12-19 23:28:53
发表于 2014-12-20 09:35:29