코드루덴스

^{OllyDbg Command}

^{origin : http://webster.cs.ucr.edu/AsmTools/OllyDbg/CMDLINE.HTML}

^#$KCommand line plugin: Preliminary description

Welcome. I'm glad to present you the first version of command line plugin, with very limited capabilities but completely functional. Its source code is free, so you can add any commandsHow to add and modify functionality of existing. Plugin uses new OllyDbg functions described in details in the PDK 1.08. Note that plugin does not work with any OllyDbg version prior to 1.08.

Shortcut for command line plugin: Alt+F1. Currently, it supports following commands:

Commands are not case-sensitive, parameters in brackets are optional. Expressions may include constants, registers and memory references and support all standard arithmetical and boolean functions. By default, all constants are hexadecimal. To mark constant as decimal, follow it with decimal point. Examples:

• 2+2 - calculate value of this expression;
• AT [EAX+10] - disassemble at address that is the contents of memory doubleword at address EAX+0x10;
• BP KERNEL32.GetProcAddress - set breakpoint on API function. Note that you can set breakpoint in system DLL only in NT-based operating systems;
• BPX GetProcAddress - set breakpoint on every call to external function GetProcAddress in the currently selected module;
• BP 412010,EAX==WM_CLOSE - set conditional breakpoint at address 0x412010. Program pauses when EAX is equal to WM_CLOSE.

You can find full description of expressions supported by OllyDbg in the OllyDbg help.

^#$KHow to add new command

To add new command, first you must register it in the array cmdlist[]. Elements of this array are structures of type t_command. First element is the command in uppercase, second element describes its operands. Current version of plugin supports only three types of operands:

A - address expression with value in address. Plugin checks that it points to allocated memory.

a - same as A but optional. If expression is absent, address is set to 0.

V - expression of any type in value. If you expect integer expression, check that value.dtype is DEC_DWORD and use contents of value.u.

v - same as V but optional. If expression is absent, value.dtype is DEC_UNKNOWN and value.u is 0.

S - ASCII string in string, may be empty.

Third element is a constant that will be passed to command procedure, and the fourth one is the address of procedure that executes the command:

typedef int t_exefunc(char *answer,ulong parm);

If all operands of the recognized command are parsed and estimated correctly, plugin calls this procedure. First argument, answer, is the pointer to string 256 bytes long. Its contents will be displayed in the command line window after command is executed. Second argument is the parameter from cmdlsit[]. If function returns 0, command is considered correct and will be added to the history list.