[kdlsw]

There are some files I need to modify with Olldbg, to bypass those anti-virus software, not necessarily to be exe files, currently I am dealing with a vbs.

I have already located the AV signature address and their length, however, they are the physical address of the file I think, when I trying to use Olldbg to add some assembly command, I realize that it is in memory address.

I did some researches on how to convert the physical address to a memory address that is used in Olldbg, but most are not quite fit to my situation. Can someone please give a brief suggestion? Or, perhaps, could there be a calculator for that? I found one for exe only (In fact I am a bit curious, shouldn't all files has the same address shifting rule? Why only exe works)

Please, any suggestions or ideas are appreciated, Thanks!

[MrKebab]

This is obviously for exe files. You cant use Olly for vbs. Whats the point of that when you can just right click it and edit its code in notepad....

You cant calculate a memory address. They will always change. But you can do an inline patch after the main program has loaded the parts you need to change in to memory. So what you can do is fetch the memory address after its loaded, by looking at the code who actually loaded it there in the first place. When you have it, take its mem address from one of the registers and make a codecave to change what you need.... poof done