0

I'm trying to figure out how to copy API function names to clipboard to analize the asm listing properly on my own editor.

I can see OllyDBG gives you the ability to mouse over a call and seeing the function name in a little window, that's quite cool

enter image description here

But... I don't see any way around to copy these function names to the clipboard so i could speed the process of play around with the final asm listing stored on disk faster.

Before even considering this manual copy/pasting I've thought about using a promising plugin called asm2clipboard but that one doesn't seem to work with ollydbg v2.01.

Usually API calls would appear in the form of comments when debugging normal exes, but these particular API functions were loaded by hash and are called via a pointer.

In any case, if there isn't any workaroudn about this, how can i learn how to build ollydbg v2.01 plugins? I see this another thread with a hello world example but it seems it requires plugin.h and ollydbg.lib, where can i find them? They don't seem to live in the odbg201.zip file

Improve this question

1 Answer 1

Reset to default
2

The plugin is available in an old beta version iirc 201 h scroll down a little in the sites page you should see it on nov 19 2012 entry look here for my earlier post iirc i posted a full plugin src with compile instructions using vc++

Avoid re-enabling patches between reruns in Ollydbg

Command for Command line plugin does not work

here is a source code for getting the information
usage right click in disassemble window to find men Blabbtest
on execution you will get a msgbox with the name of the api

compiled and linked with enterprise wdk compiler and linker using

cl /nologo /J /W4 /Ox /Zi /analyze /EHsc /LD *.cpp /link user32.lib ollydbg.lib 

#define _UNICODE #include <windows.h> #include <stdio.h> #include "plugin.h" void Disassemble(ulong addr,ulong threadid,wchar_t *jumpaddr) { ulong length,declength; uchar cmd[MAXCMDSIZE],*decode; t_disasm da; t_reg *reg; length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL); decode=Finddecode(addr,&declength); reg=Threadregisters(threadid); length=Disasm(cmd,length,addr,decode,&da,DA_TEXT|DA_OPCOMM|DA_MEMORY,reg,NULL); Decodeknownbyaddr(da.jmpaddr,0,0,0,jumpaddr,1,1); } static int About(t_table *,wchar_t *,ulong ,int mode) { int n; wchar_t s[TEXTLEN]; if (mode==MENU_VERIFY) { return MENU_NORMAL; } else if (mode==MENU_EXECUTE) { Resumeallthreads(); n=StrcopyW(s,TEXTLEN, L"BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n"); wchar_t jaddy[TEXTLEN] ={0}; Disassemble(Getcpudisasmselection(),Getcputhreadid(),jaddy); n+=StrcopyW(s+n,TEXTLEN-n,jaddy); MessageBoxW(0,s,L"BlabbTest",0); Suspendallthreads(); return MENU_NOREDRAW; }; return MENU_ABSENT; }; static t_menu mainmenu[] = { { L"|BlabbTest", L"About BlabbTest plugin", K_NONE, About, NULL, 0 }, { NULL,NULL,K_NONE,NULL,NULL,0} }; extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) { if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; } return NULL; }; BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; }; extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *, wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) { if (ollydbgversion<201) { return 0; } wcscpy_s(pluginname,SHORTNAME,L"BlabbTest"); wcscpy_s(pluginversion,SHORTNAME,L"2.00.01"); return PLUGIN_VERSION; };

here is the result enter image description here

instead of Decodeknownbyaddr() use Findlabel() to find the Label of jmpaddr

#define _UNICODE #include <windows.h> #include <stdio.h> #include "plugin.h" static int About(t_table *,wchar_t *,ulong ,int mode) { int n; wchar_t s[TEXTLEN],labl[TEXTLEN];ulong length,addr;t_cmdinfo cmdinf={0}; if ( mode==MENU_VERIFY ) { return MENU_NORMAL; } else if (mode==MENU_EXECUTE) { Resumeallthreads(); n=StrcopyW(s,TEXTLEN, L"BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n"); uchar cmd[MAXCMDSIZE]; addr = Getcpudisasmselection(); length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL); Cmdinfo(cmd,length,addr,&cmdinf,0xfff,NULL); Findlabel(cmdinf.jmpaddr,labl,0); n+=StrcopyW(s+n,TEXTLEN,labl); MessageBoxW(0,s,L"BlabbTest",0); Suspendallthreads(); return MENU_NOREDRAW; }; return MENU_ABSENT; }; static t_menu mainmenu[] = { { L"|BlabbTest", L"About BlabbTest plugin", K_NONE, About, NULL, 0 }, { NULL,NULL,K_NONE,NULL,NULL,0} }; extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) { if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; } return NULL; }; BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; }; extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *, wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) { if (ollydbgversion<201) { return 0; } wcscpy_s(pluginname,SHORTNAME,L"BlabbTest"); wcscpy_s(pluginversion,SHORTNAME,L"2.00.01"); return PLUGIN_VERSION; };

well you should at-least customarily peruse the code and documentation

add these two lines and pass the t_reg * to cmdinfo to decode register or indirect calls 

 t_reg *reg; reg=Threadregisters(Getcputhreadid()); Cmdinfo(cmd,length,addr,&cmdinf,0xfff,reg);

enter image description here

Improve this answer
3
  • Thanks for all your help wit this stuff, finally I've come up with a plugin which will help me to speed up the disassembling of some projects I got in mind, right now my olly environment is quite good. Ideally I'd write a plugin reading content from PWM_INFO but it seems quite time consuming I don't want to spend more time on this task, I see the answer of your other thread doesn't address the question so I'll wait for the author to mail me back (if he decides to do so...) or just him writing proper documentation. In any case, giving you +1 on the other thread for the effort, Have fun you too Commented Nov 18, 2016 at 11:32
  • Just for the record, x64dbg supports this out of the box and ignore you're missing something it's easy to implement. Commented Nov 18, 2016 at 21:26
  • 1
    @mrexodia First time I hear about that debugger, I've looked at it and it feels like it's a much better version of OllyDBG, plus it's open source, I don't see any reason why i should stay with the good old Olly anymore. Active community/development... what else? Thanks for this good advice! Commented Nov 20, 2016 at 10:56

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.