PDA

View Full Version : To Gigapede


psyCK0
March 9th, 2004, 15:07
Hey Gigapede!

I'm getting user requests to somehow make my OllyScript plugin to cooperate with your OllyDump plugin to automatically dump files at some point... I was thinking maybe we could cooperate so that this feature is made available somehow?

Gigapede
March 10th, 2004, 08:22
Hi.

Yes, of course I want to cooperate. But I don't know how to do it.
Just export some functions? Or register some shortcut?
Please give me some advice.

I have another cooperation idea.
I'd like to call OllyScript from CommandBar.
Command is like this;

oscr SCRIPTNAME

Nice, isn't it?

psyCK0
March 10th, 2004, 10:04
Gigapede: great idea about putting an OllyScript command into CommandBar!!! =)

I'll try to think of some way to make the plugins listen to eachother. You think a little too, ok? Then we can post our ideas here.

psyCK0
March 12th, 2004, 06:07
Hey again,

We can use shared memory to communicate between plugins.
Check out: http://ollyscript.apsvans.com/download/TestSharedMem.rar
("http://ollyscript.apsvans.com/download/TestSharedMem.rar
")

The SharedMemory class (defined in SharedMemory.h) should be used in both our plugins. Then we define one or two shared memory areas and communicate using those. We can for example check the contents of this memory each time we pass the plugin loop and if there are commands in it execute them...

I was also thinking named pipes, but they are really a hell to implement in an assynchronous way.

What do you think?

sgdt
March 12th, 2004, 12:55
Named events are easy and very eligent, and would probably do exactly what you want (syncronizing shared memory). Pipes are, well, yuchy...

psyCK0
March 12th, 2004, 13:00
Great idea sgdt! The class will have to be revised then...

Gigapede
March 13th, 2004, 20:42
Sorry, I don't understand these ideas very well.
I'm not a real programmer...

psyCK0
March 14th, 2004, 05:34
I have an even easier idea... The plugins run all in the same process so we can do it like this:

1. Both of us export some function. For example lets say I export:
extc int _export cdecl DoSomeShit(int x)
{
cout << "Hello" << endl;
return 0;
}

2. To call this function you do:
HMODULE hMod = GetModuleHandle("OllyScript.dll";
if(hMod) // Check that the other plugin is present and loaded
{
// Get address of exported function
int (*pFunc)(int) = (int (*)(int)) GetProcAddress(hMod, "DoSomeShit";
if(pFunc) // Check that the other plugin exports the correct function
pFunc(10); // Execute exported function
}


Thats it! Easy, huh? I've tested it and it seems to work!
So, because you wanted to execute a script from CommandBar I will export:
extc bool _export cdecl ExecuteScript(const char* const scriptName).

What parameters do you need to dump a file in OllyDump?
You can export something like:
extc bool _export cdecl Dump(......).

Gigapede
March 15th, 2004, 06:24
Yeah, it is easy to use and implement.
But I didn't make functions with suitable to export.
I must modify it a little.

Is it required a full dump only or also a partial dump?

I am very busy with work now.
So please wait patiently.

psyCK0
March 15th, 2004, 07:56
I think we can start with full dump and then implement other stuff later...

psyCK0
April 11th, 2004, 12:46
Gigapede: the new version of OllyScript exports a function that can be called from other plugins to execute a script... Thought you might want to add it to CommandBar. =)

Check readme for details on how to call the exported func.

Radier
April 25th, 2004, 05:45
Hi psyCK0,

I have added the functionality to ollyscript to dump the PE.
but need a bit of help with the commands setup tho
currently borrowing your DM cmd

Best Wishes
R@dier

Gigapede
May 5th, 2004, 01:16
psyCK0:: I implement command calling OllyScript in CommandBar.

http://dd.x-eye.net/file/cmdbar310109c.zip
("http://dd.x-eye.net/file/cmdbar310109c.zip
")
[OSC script file name(fullpath|relative from OllyDbg installed)]

It is nice to make option to set default path of script file in OllyScript, isn't it ?
It is such a bother to have to specify full path.

anyway thanks.

Please wait the OllyDump export function.