Log in

View Full Version : 2 questions about Delphi progs


MARcoDEN
August 22nd, 2004, 01:45
hello everybody!
i have two questions:
1) OllyDbg analyses Delphi applications not so good as VC ones. All the time i see CALL OGSoft_F.00408DC8 instead of usual StrToInt function. Of course, IDA does the trick, but switching between them is really unconvenient for me. I know it's possible to load specific libs. Here is my first question: which libraries namely do i need in order to get normal names of functions?
2) The second question: can i rename unrecognized calls? e.g. "CALL Prog_F.00403AEF" rename to "CALL DecodeFile".

blabberer
August 23rd, 2004, 07:36
hello marco,

have you tried using the mapconvertor plugin
it can be used to rename the functions ida style
open the proggie in ida and create a .map then use the plugin

for your 2nd question are you going to label them manually if yes then you can do it by all means

when you are on call blah press enter to follow
when you are on the first command of call press : (colon)
it will pop up a dialog (enter name of label blah) type what ever yu want like ("this call is just garbage" and press ok

you will see olly changing the call blah to call this call is garbage at all instances of the call

you can also try labeller plugin or labelmaster plugin though i had some problems when i tried them

MARcoDEN
August 24th, 2004, 01:27
oh me anon, thank you for such detailed instructions! i appreciate it. but where can i download the mapconvertor plugin? i've searched in google, yandex and other search systems but without result.

and please tell me, this plugin is for IDA or Olly?

blabberer
August 24th, 2004, 03:25
well marco ,

if you want to program and debug programs then you will need to be more attentive to some things that are called earmarks
it seems you haven't even searched this very site so google and yandex are very far away from the context try clicking the stuphlink in the top of this page

there is whole subforum called plugins here in this forum if you had skimmed through it you would have got hold of the plugin and many info

also if you going to use a forum make it a habit of reading these first even before your first post :

1) the rules page (may be just know and understand how to break them is a good motive to read them but make sure you read them)

2)the announcements page
this almost always contain things that you find to be very usefull in the long run BELEIEVE ME had you read the announcements forum you would have noticed the address of plugin updates thread

3)skimmming through the posts that were made before you think of posting something there is a sure shot possibility (odds are greater than 100) that it may have been asked already and answered precisely and concisely

4)and make sure you utilise the search function of any forum
("with key words like how to spell s@#$" and you will see you can find thousands of ways to spell s@#$

5)and then make it a point to experiment and find out yourself answers for questions like is this plugin for ida or olly
if it were for olly then you found a new toy it if were for ida then you found a new tweak and you profit in both ways

6)these are no criticisms these are my firm opinions on the subject
and there is no offence meant in the process
hope you read through and see what iam trying to make you see

regards