Hello everyone,

OllyScript v0.6 is now available for download at
http://ollyscript.apsvans.com ("http://ollyscript.apsvans.com")

Here is an except from the readme:

2.1 What's new?
---------------
The internal architecture of the plugin totally redone and object-oriented
(its not perfect OO, but bear with it). Because of this rewrite, bugs are
likely to appear. Please report them to me ASAP!
Bugs with script processing are fixed, parts of code are redone etc.

+ New commands:
BPCND, BC, BPMC, JA, JB, JAE, JBE, AI, AO, TI, TO
+ Conditional breakpoints
+ Breakpoint clearing (even memory)
+ Tracing and animation
+ More jumps
+ Stepping through script supported
# BP behaviour fixed (it now SETS breakpoint, instead of TOGGLEING it).
# Bugs in script processing fixed (thanks s0nkite).
# LOG now logs things like strings that are referenced by the address,
referenced function addresses etc. Try it, its cool!
# "Thanks" section of readme updated. =)
------------------------------

Hope you like it! =)

How the Stepping through script supported is working ?
How to load the Logs window ?

1. Use the Step command on the plugin menu to execute one script step at a time when script is paused.
2. RTFM =) (or try looking at the top of the View menu)

thanks
Good
psyCK0:
new command:
hedit addr,#HEX#?
bp aadr,EAX==111,DO set ZF=0 ??

v0.61 uploaded (bugfix).

loveboom
1. This is already there, just use MOV [addr], #001234#.
2. The DO is not necessary, you can use EOB. Setting flags is
a nice idea, will come in 0.7.

idea:
do this hide ring3 debug with ollyscript
var eax
var addr1
mov eax,dword ptr fs:[30] //?here
add eax,2
mov addr1,eax
mov eax,[eax]
cmp al,1
jne end
mov [addr1],0
end:
or mov eax,dword ptr fs:[18] //?here
thanks

today i cann't open:http://ollyscript.apsvans.com (yestoday can do it).post a obsidium 1.0061 crack version unpack script:
test:win2kadv、ollyscripts v0.6(only v0.6)
/*
////////////////////////////////////////////////////////////////////// ////
★ Obsidium1.061 OEP Founder v0.1(for VB only) ★
★ Author: loveboom ★
★ Email : bmd2chen@tom.com ★
★ Date : 2004-2-17 ★
★ Note : If you have one or more question ★
★ email to bmd2chen@tom.com(china) thank you! ★
★ this script can help you found oep、Fix Import、patch OEP code. ★
★ Setting: ALT+O open option window,Exceptions->uncheck . ★
★ all Exception OPT! ★
////////////////////////////////////////////////////////////////////// ////
*/

var cbase
var csize
var count
var patchaddr
var patchcode

gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT

mov count,11
eoe lbl1
eob lbl1
run

lbl1:
cmp count,0
je lbl2
sub count,1
esto
jmp lbl1

lbl2:
eob lbl3
gpa "LoadLibraryExA","kernel32.dll"
bp $RESULT
esto

lbl3:
eob lbl4
bc $RESULT
rtu

lbl4:
eob lbl5
findop eip,#66F7062000#
bphws $RESULT,"x"
run

lbl5:
eoe lbl6
bphwc $RESULT
asm eip,"TEST WORD PTR [ESI],8"
sto
mov count,eip
mov [count],#7546#
findop eip,#7439#
mov count,$RESULT
mov [count],#7424#
findop eip,#7417#
mov count,$RESULT
mov [count],#7402#
mov count,3
run

lbl6:
cmp count,0
je lbl7
sub count,1
esto
jmp lbl6

lbl7:
eob lbl8
findop eip,#EB03#
bp $RESULT
esto

lbl8:
eoe lbl9
log $RESULT
bc $RESULT
bprm cbase,csize
run

lbl9:
bpmc
mov patchaddr,eip
sub patchaddr,4
mov [patchaddr],[esp]
sub patchaddr,1
mov [patchaddr],#68#
cmt patchaddr,"OEP!,patch oep pass.please dump->fixdump."
msg "Thank you for using my script!Note:if imprec found Invalid API then Cut it!"
ret

God damn, thats an impressive script! You truly used every feature OllyScript has to offer! =)
Will put it on my site as soon as it's up (that's what happens
when you choose the cheapest hosting provider =) ).

loveboom: Your idea about debugger hiding... Do you mean you want a script command that would hide/unhide debugger from IsDebuggerPresent calls?

yes!
v0.61 have a bug eob/bphwc,you can test my obs script(pass in v0.6),thank you !

loveboom: please tell me more about the bug. When does it occur? What happens? Maybe you could write a small script that illustrates the problem?

test:win2kadv+ollydbg 1.1b

lbl5:
eoe lbl6
bphwc $RESULT //bphwc pass
asm eip,"TEST WORD PTR [ESI],8" //v0.61 stop here
sto

OllyScript v0.62 posted.

* Breakpoint bug fixed (again).
* EFLAGS can be changed.

hi psycko

i am new to ollydbg and ollyscript... i did put ollyscript files on ollydbg directory..

my question is how to i use the ollyscript and the text samples u hav on ur great site...

more power and regards

Anonymous: read the readme :-)

hi,

i did read the readme. and still not know how to use ollyscript.. ;-(

anyways thanks

regards

I think Anonymous #2 said it all... We are at over 3000 downloads now, and it seems people have managed to learn to use my plugin quite fine.
My tips to you:
1. Learn to use OllyDbg
2. Find out what (if any) tasks repeat themselves in your work
3. Use my plugin to automate them

I hope you dont think I am rude.
Good luck!

hi, psycko

u r not rude.. ;-)

sadly i am new to ollydbg but learning... in regards to script.. i will keep trying..

just maybe i am overwhelm with ollydbg and ollyscript power..

will ask again by next week if i still cannot understand how-to make it work.

thanks and more power

AL

To learn, I would try playing with some of the scripts, and then try creating a few simple scripts to set a break point and run, recover from exception, and change the EIP to bypass a troubling line of code.

You'll be shocked at how much faster things become. You automate all the things you learn, so what's left is all you need to concentrate on. No more monotony.

Yes, coders and crackers need toil no more with three kazillion Shift F9's followed by setting a register at exactly the right exception followed by..., well, you get the idea.

Who knows, maybe with all this free time, we may actually get to USE some of the stuff we modify...

HI sgdt

honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(

i did use tr (dos debuger) with script w/o problems.

regards
AL

psyCK0
a bug with findop?:
use ollydbg CTRL+B find hex 89bd
xxxxxxab 75 89 jz xxxxxx //stop here
xxxxxxad bdxxxxxx xxxxxx
use findop eip,#89bd# return zero(000000)
right code:
xxxxxxac 89bdxxxxxx xxxxxx

loveboom: this is by design (thats why its called "findop".

For example:
00412FDD 47 INC EDI
00412FDE 01DB ADD EBX,EBX

findop eip, #47# <-- works
findop eip, #01DB# <-- works
findop eip, #4701# <-- doesn't work because those are from different instructions

Maybe I should implement a "findhex" or something...

HI sgdt

honestly i still can't use ollyscript... in the plugin menu i not see it there... my real problem is how do i activate script. ;-(

i did use tr (dos debuger) with script w/o problems.

regards
AL

Verify you have OllyDbg 1.10, run it. Go to Options->Appearance, click Directories tab, and look at the Plugin Path. Bring up windows explorer, and verify the script DLL is in that directory. Once those are done, re-run OllyDbg, you should have (under Plugins menu) a OllyScript menu item.

Hi sgdt,

i followed ur instruction still i have no ollyscript menu...

thanks.. i will keep trying...

Log data
Address Message
OllyDbg v1.10 (intermediate version - under development!)
CommandBar v3.00.108
Originary Written by Oleh Yuschuk Modified by Gigapede Contributors:TBD Wayne psyCK0 mfn
Labeler v1.32.108 by Gigapede
IsDebugPresent plugin v1.4 (SV 2oo3)
OllyDump v2.21.108 by Gigapede


regards

Anonymous: what OS are you on?
Also, please try redownloading the plugin. =)

Hi, PsyCKO

win98 2nd edition....

ok... d/ling....

Yes, finally i can see the ollyscript menu.. ;-)

Thanks and More power psyCKO...

now, hope i can help others too...

regards