PDA

View Full Version : conditional log bp


dion
July 31st, 2007, 09:41
i'm stuck debugging delphi apps.

since i get bored pretty quick, i look for a way to log bps, instead of normal bp in olly. that's when i used conditional log bp. then problem arose.

the first. seems like i can't find a way to display *more than one* param (using expression). i.e. if i want to display eax and ebx value in one line, then : [EAX] [EBX]

the second. it is delphi, so it is pascal style string. i can't use STRING [EAX]. if only... i can use PASCALSTRING [EAX] in olly

the third. what i want is simple. to log a function, complete with input params, and output params. input param still can be displayed somehow. but, output param, i can't think a way.
i only put those cond.log.bp *in* function address range. i do not plan to put it elsewhere, as it'd be stressful work.
as you know, delphi mostly using register to pass parameters. if i put cond.log.bp at the end of function (ret), i still can't find a way to know the register value used before (in start of function). what i can think off, is using plugin to somehow *remember* these values, to be used in this cond.log.bp to display out params.

if any, i want to know, if there's a way to solve this, or there is plugin capable to do this.

rgd

blabberer
July 31st, 2007, 12:20
Quote:

the first. seems like i can't find a way to display *more than one* param (using expression). i.e. if i want to display eax and ebx value in one line, then : [EAX] [EBX]


try modified commandline plugin by anonymouse available for download here in ollystup as well as opernrce downloads

it has a print functionality which can print multiple expressions
you have to pass .print arguments in pass commands to plugin when paused edit box
and then include a .run in next line to continue without pausing

never checked if pascalstringsyntax exist but if remember right its counted string and its count is the first byte or word whatever simply skip them and print them ????
assuming 25hellodion at say ox12345678 .print string [[0x12345678]+2] ???? doesnt sound feasible ????

if you have custom requirements you may have to hack together your own custom implementations as well
you may think of setting two conditional breakpoints one address after another and then
tranparently log input as well as output provided you are breaking on a call

assuming call 12345678
cmp eax,somereturn

set bp on call .print eax,ebx, whatever you fancy
set bp on cmp,eax and pass .print hex address range for a dump of results

if you are a windbg fan then you can use pseudo registers and do g@ra and then log them
(i knew the way it works but you can find a detailed explanation with examples of windbg specifics at skywings blog nynaeve.net he recently wrote a three part series on custom logging with windbg check it out)