Need a little help with Olly

Why are the addresses in my IDA different from the ones in my Olly?

Same DLL, but I cant find the adress NOR the unicode in my Olly that I see in front of my in my IDA.

Any suggestions?

Edit: Using IDA 64 bit and normal OllyDbg

They're the same, you just need to dig into the right modules. Olly divides your modules up into sections and allows you to enter them separately, while IDA opens them all and lists every function/string/line from the modules.

Im aware of that, but normally I just get the text:(xxxxxxxx) and find it in olly and poof theres my stuff. But today it doesn't want to work.

EDIT2: Let me rephrase, LOADDLL.exe does not work on 64 bit machines, you can load a .exe file into Olly though.
I reccomend using VMware *Workstation* and opening a dll with Olly in there, or try editing with just IDA :x

Huh, that's weird. Olly WORKS normally, I just cant FIND what I'm editing. :/

I guess I'll give Vmware a try. ThinApp I suppose?

IDA finds things that Olly doesnt, and it also has more functions.

Try to use IDA more than Olly. Once you are able to work with IDA-Only, its like being on a whole new Level.

Having trouble figuring out how exactly how to edit in IDA

lostmage needs to post in this thread so I can thank him a trillion times. Lol.

In olly,

1; load the dll
2; right click anywhere inside the code
3; hover over view
4; find your module

that's what I think you're looking for, atleast.

Quote:

Originally Posted by lilaznboy2 In olly, 1; load the dll 2; right click anywhere inside the code 3; hover over view 4; find your module that's what I think you're looking for, atleast.

Not quite, thanks for trying. Figured it out.

I don't think you can edit in IDA... O_o Its just a tool for dissecting and viewing things in an easier way.

Quote:

Originally Posted by Kevsprk I don't think you can edit in IDA... O_o Its just a tool for dissecting and viewing things in an easier way.

You are correct =D

*posts in thread*?

I thought IDA pro lets you modify, though?

Apparently not. Despite DR's comments.