PDA

View Full Version : Single Stepping?


pedram
February 29th, 2004, 20:07
Is it possible for an OllyDbg plugin to single step through an entire application, instruction by instruction and process each one? I haven't seen any singlestep API call and a simple loop around:

Sendshortcut(PM_MAIN, 0, WM_KEYDOWN, 0, 0, VK_F7);

Does not work. Furthermore can certain modules (ie: kernel32) be overlooked? More specifically as every instruction is being single stepped and processed if the plugin detects that it has entered kernel32 to simply execute until breaking out of that module.

Thanks in advance.

psyCK0
March 1st, 2004, 01:27
Well, single stepping works as long as you implement it correctly. You can only call Sendshortcut once per execution of ODBG_Pluginmainloop. You cen check the OllyScript source for details.

When it comes to module detection, you can get module information and then check if EIP is in the correct module?

blabberer
March 1st, 2004, 09:28
well pedram try playing with run trace (ctrl+f11) is equivalent to
f77inng the whole application including system dlls

ctrl+f12 is equivalent to f8inng the whole app

yes oleh has implemented what you ask too if you dont want to step into dlls

goto options ---> debugging options---->(alt+o) --->trace --->checkmark always step over system dlls

btw oleh is one step ahead too in this regard if you dont like to see repecmpsb repne movsb rep lodsb (all sting manipulation being single stepped) you can check mark always trace over string commands too

and yes you can log this single stepping to a log file
to do that before trace select log to file
and then start tracing you will see all the commands in a .txt file you specify

to view runtrace during execution use view -->runtrace

or the ... (three dots) button if you have enabled the tool bar

and you can profile the whole runtrace
either module by module
or global profile it

hope you find it usefull to use the same functionality in a plugin too
just find how he does it and send shortcut to it