Log in

View Full Version : symbols or implib


idanski
December 26th, 2003, 15:21
hi,
Some questions (or suggestions):

1) Is there any way to know in which function i'm in now (shown sometimes in the information bar in the CPU view)? I saw that this is working only in a few functions. even after i analyse the code...

2) It may be better to put lables in one line and the assembly in another: because if i want to see the name of the function/lable, then i must expand the first column. and it takes up lots of space...
For example, instad of this:

<pre>
77E7B332 kernel32.GetProcAddress |&#036; 55 |push ebp
77E7B333 |. 8BEC |mov ebp, esp
77E7B335 |. 51 |push ecx
</pre>

something like this (shown here without colors...):

<pre>
77E7B332 | |kernel32.GetProcAddress:
77E7B332 |&#036; 55 | push ebp
77E7B333 |. 8BEC | mov ebp, esp
77E7B335 |. 51 | push ecx
</pre>

3) It would be great to add an "input helper" to some edit boxes. for example: in the "Goto expression" dialog box: when i start writing a lable name, i'd like OllyDbg to show me all the lables that start with those letters.
another example is when i write a conditinal expression "MSG==WM_" -> i'd like to see all the messages known...

Thanks!

focht
December 26th, 2003, 15:45
Greetings,

i agree with you, the "column style" representation of function labels could be better.
It took me some time until i found that "extend 1st column to see function name" feature... and yes, it take much column width.

windbg style example:

<pre>
ntdll!DbgBreakPoint:
77f75a58 cc int 3
77f75a59 c3 ret
77f75a5a 8bff mov edi,edi
ntdll!DbgUserBreakPoint:
77f75a5c cc int 3
77f75a5d c3 ret
77f75a5e 8bff mov edi,edi
ntdll!DbgBreakPointWithStatus:
77f75a60 8b442404 mov eax,[esp+0x4]
ntdll!RtlpBreakWithStatusInstruction:
77f75a64 cc int 3
77f75a65 c20400 ret 0x4
</pre>

To maintain the "column style" cpu view implementation of ollydbg it makes sense to implement it like you suggested (3rd column = function label)

The other feature you're thinking of is "intellisense", autocompletion on typing.
This feature is nice to have but should be on lower priority i think
Maybe some plugin can implement such automagic behavior.

Regards,

A. Focht

idanski
December 27th, 2003, 03:09
I guess you are right about the autocompletion. another suggestion is a "goto lable" that shows all the lables in a list, and lets the user jump to any one of the lable.