View Full Version : [TIP] Messages Spy
TBD
November 12th, 2002, 03:47
1. open program [CTRL+O]
2. Names window [CTRL+N in CPU Window]
3. Find User32.TranslateMessage API
4. right click/FindReferences
5. conditional breakpoint [SHIFT+F4]
6. expression: MSG
log function arguments: Always
now you can do a message spy - good for debugging mouse movements, paint, keyboard, ...
dont forget to read ollydbg.hlp/Evaluation of expressions section
enjoy and if you find cool conditions post them here

Wayne
November 12th, 2002, 20:56
TBD, great tip! but ive done everything you said, but where are the spied message saved? I cant see them in any windows
Thanks,
Wayne
TBD
November 12th, 2002, 22:20
Wayne: Log Window - ALT+L.
try first on a simple program, only one window(not a dialog)
Wayne
November 13th, 2002, 00:00
Very, very cool!
TBD
November 13th, 2002, 00:36
Wayne: glad you like it ... I plan to do this regularly, maybe tip-a-week
Wayne
November 13th, 2002, 00:42
The more tips the better! I wonder how many other powerful features there are like this that I still havent seen yet?

It'll be good when the helpfile is a bit more comprehensive!
Anonymous
November 25th, 2002, 23:37
I only want to capture WM_COMMAND, how can I do this?
Anonymous
November 25th, 2002, 23:51
Ah, Message breakpoints via the Windows window ... very nice!
Anonymous
January 3rd, 2003, 19:30
Sorry I did get it regarding the WM_COMMAND.
You mean that we need to enter in the expression box:
MSG==WM_COMMAND
I tried but all WM_xx are also loged
luucorp
January 4th, 2003, 03:19
greats tip. i will use....
Anonymous
January 4th, 2003, 16:55
To Log Only WM_COMMAND
do it in this way
1. open program [CTRL+O]
2. Names window [CTRL+N in CPU Window]
3. Find User32.TranslateMessage API
4. right click/FindReferences
5. conditional breakpoint [SHIFT+F4]
6. Condtion box: MSG==WM_COMMAND
7. log function arguments: On Condition
Et Voila
Anonymous
January 9th, 2003, 18:28
3. Find User32.TranslateMessage API
Hummmm... I cant find it. Is there present in all .exe files?
Thx
TBD
January 10th, 2003, 01:59
if it has a GUI usually yes. also if it is packed you will not find in Names window (try also Search for/All intermodular calls).
ps. oops, i responded to an anonymous post. bad TBD

if you dont know what i am talking aboutm than read <u>this</u> ("http://www.rohanpall.com/ollydbg/?action=vthread&forum=5&topic=119")
FuZzYBiT
January 10th, 2003, 09:54
Thanks, that was what I was looking for.
PS. I've registered ... sorry for being anonymous

Anonymous
February 1st, 2003, 14:55
thanks
but where can i do 7. log function arguments: On Condition ? please
Mikelo2k
February 2nd, 2003, 20:48
Thanx 4 the tip man, will come in handy

Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.