I made some improvements to AnalyzeThis mainly to analyze a memory section which originally reports "this section is not associated with any module".
....
Sometimes (especially when dealing with packers) you may need to run OllyDbg's code analysis function, only to find it's not available to you because the EIP is currently outside the code segment as defined by the PE header. AnalyzeThis! is an OllyDbg plugin to allow OllyDbg's analysis function to operate outside of the marked code segment, by telling OllyDbg the current segment *is* the code segment.
Caveats: OllyDbg can only store one analysis table, so if you analyze a new segment, it will remove any existing analysis that has been done.
Source code has not been included; not because I don't want to release it at this time, but because I can't find it offhand. If you really need it, email me and I'll look harder for it.
发表于 2010-1-14 14:37
|
发表于 2010-1-14 14:42
发表于 2010-1-14 15:44
发表于 2010-1-14 16:32
