Log in

View Full Version : Ollydbg and OutputDebugString()

Aelorean
May 10th, 2006, 13:38
I just started using ollydbg for particular tasks and noticed that it treats OutputDebugString() differently than windbg. Is there an option in ollydbg somewhere that I'm missing? I would prefer that it not automatically add a carriage return at the end of every OutputDebugString() call.

Otherwise, I have to do something like this...which is a major pain:

Code:


   #ifdef OLLYDBG

   sprintf(buf,"%s %s",DebugHeader,szOutput);

   #else

   sprintf(buf,"%s %s\n",DebugHeader,szOutput);

   #endif

   OutputDebugString(buf);
Kayaker
May 10th, 2006, 21:43
Hi

It looks like you're stuck, unless you want to do some creative reversing. Notice that Olly concatenates your string with "Debug string:" and outputs it to the log window and status bar. You can find the routine that handles this, part of a switch statement for DEBUG_EVENT (OUTPUT_DEBUG_STRING_EVENT):

:0042F49D Case_OUTPUT_DEBUG_STRING_EVENT: ; CODE XREF: sub_42D174+36
:0042F49D push offset aDebugString ; case 0x8 "Debug string:"
:0042F4A2 lea edx, [ebp+var_25C]
...

I set a breakpoint on this in Softice (try VA 43127D) and traced it to see what was going on when an OutputDebugString was encountered. As you can tell, Olly uses a wrapper routine and concatenates your string with its own, rather than just passing it to OutputDebugString. I think it would be kind of difficult to rewrite this code so the extra string and line break was eliminated so it would look like Windbg output.

Maybe you could turn your #ifdef statements into a macro to simplify the coding down to a single line anyway, that should pretty much solve the 'major pain' problem.

Cheers,
Kayaker
Aelorean
May 10th, 2006, 22:47
The major pain is just having to remember whether to set the preprocessor on my application to be set for debugging with windbg or ollydbg.

I just can't think of any other way to do it other than patching ollydbg itself...

I wish there was still an ollydbg forum to make that request of the author
Kayaker
May 11th, 2006, 00:15
I'm a bit confused actually. Your #ifdef statements indicate you *want* a line break for Windbg, but not for Olly. The thing is, Olly ignores any extra linebreaks you add, in fact it parses your string and null terminates it before any "\n" you might have added. Instead it effectively adds its own somewhere later, and only once.

Code:


 :0042F5A2                 cmp     edx, 0Ah       // Olly looks for "\n"

 :0042F5A5                 jz      short loc_42F589

 :0042F5A7                 mov     eax, [ebp+var_C]

 :0042F5AA                 lea     ecx, [ebp+var_25C]

 :0042F5B0                 test    edi, edi

 :0042F5B2                 mov     byte ptr [ebp+eax+var_25C], 0 

 // null terminate the true string, overwriting the first "\n" encountered


So essentially that seems to come to the same thing, I don't see that you'd need different OutputDebugString statements for each debugger. Just add a single "\n" for the Windbg instance and with Olly you should get the exact same output. It won't add "extra" linebreaks just because you specified them inline as "\n".

If you don't want the "Debug string:" suffix you can patch the first character of that ascii string
.data:004AE3CC aDebugString db 'Debug string: ',0
with 00h and it won't be shown. I did this within Softice and the output became identical to Windbg.
Aelorean
May 11th, 2006, 11:27
Well, I made some adjustements to my code to involve less 'sprintf'ing (gotta love that word) per debugspew, and things work as they're supposed to (ie, the /n is getting stripped properly).

Thanks, and I'm sorry for wasting everyone's time!
blabberer
May 12th, 2006, 12:24
well when i read this post and saw ollydbg needs to patched i didnot understand what is the problem so i thought let me code a outputdebugstring program and check it out

Code:


#include <stdio.h>

#include <windows.h>



char buf[500];

int main()

{

	printf("hello Debug String\n";

	sprintf(buf,"%s","hohaaa";

	OutputDebugString(buf);

	printf("blah\n";

	sprintf(buf,"%s","second hohaaa";

	OutputDebugString(buf);

	printf("second blah\n";

	return 1;

}


Code:




D:\borland\Bin>bcc32 d:\borland\opdbg.c

Borland C++ 5.5.1 for Win32 Copyright (c) 1993, 2000 Borland

d:\borland\opdbg.c:

Turbo Incremental Link 5.00 Copyright (c) 1997, 2000 Borland



D:\borland\Bin>opdbg

hello Debug String

blah

second blah



D:\borland\Bin>d:\borland\odbg\ollydbg.exe opdbg.exe



D:\borland\Bin>


Code:


Log data

Address    Message

           OllyDbg v1.10

           Command line: opdbg.exe



           Console file 'D:\borland\Bin\opdbg.exe'

           Command line plugin v1.10

             Written by Oleh Yuschuk

           Bookmarks sample plugin v1.06 (plugin demo)

             Copyright (C) 2001, 2002 Oleh Yuschuk

           Strings plugin v1.10

               authored by blabberer

           New process with ID FFF34713 created

00401000   Main thread with ID FFF52F73 created

00400000   Module D:\BORLAND\BIN\OPDBG.EXE

BFE80000   Module C:\WINDOWS\SYSTEM\ADVAPI32.DLL

BFF20000   Module C:\WINDOWS\SYSTEM\GDI32.DLL

BFF50000   Module C:\WINDOWS\SYSTEM\USER32.DLL

BFF70000   Module C:\WINDOWS\SYSTEM\KERNEL32.DLL

00401000   Program entry point

0040117F   Debug string: hohaaa

004011A8   Debug string: second hohaaa

           Process terminated, exit code 1


any way it seems you solved your problem