OllyDBG and 64-bit Windows 7

[FriedTaco]

I seem to have a problem, when i find an address in IDA, it doesn't match up in Olly. I'm running a 64-bit version of Windows 7 right now, is there any way to fix this?

It shows up as like 1XXXXXXX in IDA and 7XXXXXXX in Olly, and I'm pretty sure the IDA address is correct.

[Halfslashed]

/facepalm

Why, oh why are you a moderator on MM.

Just use Ctrl+G for the address you wanna go to and it will take you there, end of story.

[FriedTaco]

Originally Posted by Halfslashed

/facepalm

Why, oh why are you a moderator on MM.

Just use Ctrl+G for the address you wanna go to and it will take you there, end of story.

I can't, the addresses don't match up. >_> It will complain that such an address does not exist. I thought I already stated this?

I'd go ask the same on MM, but Marck took away my senior board rights due to leakage. I'm assuming I'm a suspect, though I was aware of such leaks.

Edit: Here's a screenshot before you call me an idiot and tell me the exact same thing again.

 Spoiler

[Halfslashed]

Okay, so I'll eat my words. You didn't specify enough information in your problem therefore I assumed incorrectly.

Did you even try checking the other sites?

[FriedTaco]

Originally Posted by Halfslashed

Okay, so I'll eat my words. You didn't specify enough information in your problem therefore I assumed incorrectly.

Did you even try checking the other sites?

Sorry about the vagueness of my original post >.< But yes, I have checked MabiZone as well. The problem still stands with the addresses not being the same after I tried every fix i could find.

[Halfslashed]

The addresses don't have to be the same. It's because Olly loads all the files that your dll loads. Most likely, it starts out in ntdll, which has a different base address than the dll you tried to load.

Oh, and two things wrong with what you're trying to do.

1. You're modifying the wrong arrow revolver, the one you're modifying is Mari's arrow revolver. The correct function is core::CSkillArrowRevolver2::OnCanEnterPreparing().

2. What you're trying to do is server sided.

[FriedTaco]

Originally Posted by Halfslashed

The addresses don't have to be the same. It's because Olly loads all the files that your dll loads. Most likely, it starts out in ntdll, which has a different base address than the dll you tried to load.

Oh, and two things wrong with what you're trying to do.

1. You're modifying the wrong arrow revolver, the one you're modifying is Mari's arrow revolver. The correct function is core::CSkillArrowRevolver2::OnCanEnterPreparing().

2. What you're trying to do is server sided.

Two things:

1. Then how do I find the address I was trying to jump to?

2. The screenshots I posted there were just random addresses to show my problem, they have no relevance to what I'm trying to do.

[Halfslashed]

I offered all the support that I could, I don't run a 64-bit system and I posted the only fix i know.

Maybe someone else will help you.

[skititlez]

64bit uses different addresses for future references. when loading on a 64bit, the dlls have change address sometimes, i wish i could help however i never fooled around with dll edits.

[Trismic]

Try this if you are on x64?

[fenrir2037]

Do it the hard way: Find it in IDA, sync with the hex, copy the hex, search for it in Olly...

Painful, and probably another easier way.. But that's what I can suggest from what I know :P

[FriedTaco]

Originally Posted by Trismic

Try this if you are on x64?

Thanks to everyone who's offered help so far, but this didn't help either, the addresses are still read differently than with IDA even when i run the script.

Originally Posted by fenrir2037

Do it the hard way: Find it in IDA, sync with the hex, copy the hex, search for it in Olly...

Painful, and probably another easier way.. But that's what I can suggest from what I know :P

Errrm, explain what you mean by sync with the hex?

[kakashisfriend]

Since it seems like a pain in the **** to be on x64, maybe virtual machine with a x32? o.o
You can find both an OS and a VM for free easily

[FriedTaco]

Originally Posted by kakashisfriend

Since it seems like a pain in the **** to be on x64, maybe virtual machine with a x32? o.o
You can find both an OS and a VM for free easily

Already tried that with Microsoft Virtual PC and a copy of 32-bit Windows XP that had laying around. No luck there.

[fenrir2037]

Originally Posted by FriedTaco

Errrm, explain what you mean by sync with the hex?

As in: in IDA, there's IDA-View A, and Hex View A. Get the hex you want, and then search the hex in Olly...

I really don't want to add pictures... This doesn't seem hard....