How to disassemble bytes that Ollydbg thinks are data, not code?

Question

I am looking at some executables that use anti-disassembly techniques, often causing code to be obfuscated as text. In IDA Pro, there are the easy 'c' and 'd' hotkeys to switch instructions between code and data. Is there an equivalent way to do that in Ollydbg?

For example:

As data:

.text:00401283                 db 55h
.text:00401284                 db 89h
.text:00401285                 db 0E5h ; s
.text:00401286                 dd 480C458Bh

As code:

.text:00401283                 push    ebp
.text:00401284                 mov     ebp, esp
.text:00401286                 mov     eax, [ebp+0Ch]

The best you can do is Analysis->Analyse Code (Ctrl-A) and Analysis->Remove analysis from selection (Ctrl-Bkspace). Both accessible from the right-click context menu of the disassembly pane of the cpu window. — enhzflep

Amir Amir · Accepted Answer · 2016-03-14T15:49:34

yes dump memory and right click on it. select the format that you want to see. Disassemble show data as assembly code.

How to disassemble bytes that Ollydbg thinks are data, not code?

2 Answers