View Full Version : [plugin] OllyScript v0.6
psyCK0
February 24th, 2004, 07:22
Hello everyone,
OllyScript v0.6 is now available for download at
http://ollyscript.apsvans.com ("http://ollyscript.apsvans.com")
Here is an except from the readme:
2.1 What's new?
---------------
The internal architecture of the plugin totally redone and object-oriented
(its not perfect OO, but bear with it). Because of this rewrite, bugs are
likely to appear. Please report them to me ASAP!
Bugs with script processing are fixed, parts of code are redone etc.
+ New commands:
BPCND, BC, BPMC, JA, JB, JAE, JBE, AI, AO, TI, TO
+ Conditional breakpoints
+ Breakpoint clearing (even memory)
+ Tracing and animation
+ More jumps
+ Stepping through script supported
# BP behaviour fixed (it now SETS breakpoint, instead of TOGGLEING it).
# Bugs in script processing fixed (thanks s0nkite).
# LOG now logs things like strings that are referenced by the address,
referenced function addresses etc. Try it, its cool!
# "Thanks" section of readme updated. =)
------------------------------
Hope you like it! =)
helloword
February 24th, 2004, 10:44
How the Stepping through script supported is working ?
How to load the Logs window ?
psyCK0
February 24th, 2004, 14:54
1. Use the Step command on the plugin menu to execute one script step at a time when script is paused.
2. RTFM =) (or try looking at the top of the View menu)
loveboom
February 27th, 2004, 14:36
thanks
Good
psyCK0:
new command:
hedit addr,#HEX#?
bp aadr,EAX==111,DO set ZF=0 ??
psyCK0
February 27th, 2004, 15:58
v0.61 uploaded (bugfix).
loveboom
1. This is already there, just use MOV [addr], #001234#.
2. The DO is not necessary, you can use EOB. Setting flags is
a nice idea, will come in 0.7.
loveboom
March 1st, 2004, 04:44
idea:
do this hide ring3 debug with ollyscript
var eax
var addr1
mov eax,dword ptr fs:[30] //?here
add eax,2
mov addr1,eax
mov eax,[eax]
cmp al,1
jne end
mov [addr1],0
end:
or mov eax,dword ptr fs:[18] //?here
thanks
loveboom
March 2nd, 2004, 21:27
today i cann't open:http://ollyscript.apsvans.com (yestoday can do it).post a obsidium 1.0061 crack version unpack script:
test:win2kadv、ollyscripts v0.6(only v0.6)
/*
////////////////////////////////////////////////////////////////////// ////
★ Obsidium1.061 OEP Founder v0.1(for VB only) ★
★ Author: loveboom ★
★ Email : bmd2chen@tom.com ★
★ Date : 2004-2-17 ★
★ Note : If you have one or more question ★
★ email to bmd2chen@tom.com(china) thank you! ★
★ this script can help you found oep、Fix Import、patch OEP code. ★
★ Setting: ALT+O open option window,Exceptions->uncheck . ★
★ all Exception OPT! ★
////////////////////////////////////////////////////////////////////// ////
*/
var cbase
var csize
var count
var patchaddr
var patchcode
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
mov count,11
eoe lbl1
eob lbl1
run
lbl1:
cmp count,0
je lbl2
sub count,1
esto
jmp lbl1
lbl2:
eob lbl3
gpa "LoadLibraryExA","kernel32.dll"
bp $RESULT
esto
lbl3:
eob lbl4
bc $RESULT
rtu
lbl4:
eob lbl5
findop eip,#66F7062000#
bphws $RESULT,"x"
run
lbl5:
eoe lbl6
bphwc $RESULT
asm eip,"TEST WORD PTR [ESI],8"
sto
mov count,eip
mov [count],#7546#
findop eip,#7439#
mov count,$RESULT
mov [count],#7424#
findop eip,#7417#
mov count,$RESULT
mov [count],#7402#
mov count,3
run
lbl6:
cmp count,0
je lbl7
sub count,1
esto
jmp lbl6
lbl7:
eob lbl8
findop eip,#EB03#
bp $RESULT
esto
lbl8:
eoe lbl9
log $RESULT
bc $RESULT
bprm cbase,csize
run
lbl9:
bpmc
mov patchaddr,eip
sub patchaddr,4
mov [patchaddr],[esp]
sub patchaddr,1
mov [patchaddr],#68#
cmt patchaddr,"OEP!,patch oep pass.please dump->fixdump."
msg "Thank you for using my script!Note:if imprec found Invalid API then Cut it!"
ret
psyCK0
March 3rd, 2004, 01:57
God damn, thats an impressive script! You truly used every feature OllyScript has to offer! =)
Will put it on my site as soon as it's up (that's what happens
when you choose the cheapest hosting provider =) ).
loveboom: Your idea about debugger hiding... Do you mean you want a script command that would hide/unhide debugger from IsDebuggerPresent calls?
loveboom
March 3rd, 2004, 04:13
yes!
v0.61 have a bug eob/bphwc,you can test my obs script(pass in v0.6),thank you !
psyCK0
March 3rd, 2004, 09:36
loveboom: please tell me more about the bug. When does it occur? What happens? Maybe you could write a small script that illustrates the problem?
loveboom
March 4th, 2004, 03:28
test:win2kadv+ollydbg 1.1b
lbl5:
eoe lbl6
bphwc $RESULT //bphwc pass
asm eip,"TEST WORD PTR [ESI],8" //v0.61 stop here
sto
psyCK0
March 4th, 2004, 09:12
OllyScript v0.62 posted.
* Breakpoint bug fixed (again).
* EFLAGS can be changed.
Anonymous
March 5th, 2004, 08:09
hi psycko
i am new to ollydbg and ollyscript... i did put ollyscript files on ollydbg directory..
my question is how to i use the ollyscript and the text samples u hav on ur great site...
more power and regards
Anonymous
March 5th, 2004, 15:01
Anonymous: read the readme :-)
Anonymous
March 8th, 2004, 01:55
hi,
i did read the readme. and still not know how to use ollyscript.. ;-(
anyways thanks
regards
psyCK0
March 8th, 2004, 14:08
I think Anonymous #2 said it all... We are at over 3000 downloads now, and it seems people have managed to learn to use my plugin quite fine.
My tips to you:
1. Learn to use OllyDbg
2. Find out what (if any) tasks repeat themselves in your work
3. Use my plugin to automate them
I hope you dont think I am rude.
Good luck!
Anonymous
March 8th, 2004, 18:17
hi, psycko
u r not rude.. ;-)
sadly i am new to ollydbg but learning... in regards to script.. i will keep trying..
just maybe i am overwhelm with ollydbg and ollyscript power..
will ask again by next week if i still cannot understand how-to make it work.
thanks and more power
AL
sgdt
March 8th, 2004, 21:05
To learn, I would try playing with some of the scripts, and then try creating a few simple scripts to set a break point and run, recover from exception, and change the EIP to bypass a troubling line of code.
You'll be shocked at how much faster things become. You automate all the things you learn, so what's left is all you need to concentrate on. No more monotony.
Yes, coders and crackers need toil no more with three kazillion Shift F9's followed by setting a register at exactly the right exception followed by..., well, you get the idea.
Who knows, maybe with all this free time, we may actually get to USE some of the stuff we modify...

Anonymous
March 8th, 2004, 23:02
HI sgdt
honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(
i did use tr (dos debuger) with script w/o problems.
regards
AL
loveboom
March 9th, 2004, 03:28
psyCK0
a bug with findop?:
use ollydbg CTRL+B find hex 89bd
xxxxxxab 75 89 jz xxxxxx //stop here
xxxxxxad bdxxxxxx xxxxxx
use findop eip,#89bd# return zero(000000)
right code:
xxxxxxac 89bdxxxxxx xxxxxx
psyCK0
March 9th, 2004, 04:11
loveboom: this is by design (thats why its called "findop"

.
For example:
00412FDD 47 INC EDI
00412FDE 01DB ADD EBX,EBX
findop eip, #47# <-- works
findop eip, #01DB# <-- works
findop eip, #4701# <-- doesn't work because those are from different instructions
Maybe I should implement a "findhex" or something...
sgdt
March 9th, 2004, 08:06
HI sgdt
honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(
i did use tr (dos debuger) with script w/o problems.
regards
AL
Verify you have OllyDbg 1.10, run it. Go to Options->Appearance, click Directories tab, and look at the Plugin Path. Bring up windows explorer, and verify the script DLL is in that directory. Once those are done, re-run OllyDbg, you should have (under Plugins menu) a OllyScript menu item.
Anonymous
March 9th, 2004, 17:32
Hi sgdt,
i followed ur instruction still i have no ollyscript menu...
thanks.. i will keep trying...
Log data
Address Message
OllyDbg v1.10 (intermediate version - under development!)
CommandBar v3.00.108
Originary Written by Oleh Yuschuk Modified by Gigapede Contributors:TBD Wayne psyCK0 mfn
Labeler v1.32.108 by Gigapede
IsDebugPresent plugin v1.4 (SV 2oo3)
OllyDump v2.21.108 by Gigapede
regards
psyCK0
March 10th, 2004, 02:37
Anonymous: what OS are you on?
Also, please try redownloading the plugin. =)
Anonymous
March 10th, 2004, 17:41
Hi, PsyCKO
win98 2nd edition....
ok... d/ling....
Yes, finally i can see the ollyscript menu.. ;-)
Thanks and More power psyCKO...
now, hope i can help others too...
regards
Powered by vBulletin® Version 4.2.2 Copyright © 2019 vBulletin Solutions, Inc. All rights reserved.