Ok great, i've made a simple working skeleton plugin (basically just a Hello World plugin so as to base future plugins off), but I can't think of any plugins to write ...
Any ideas anyone?

hi 1bitshort.

i like trace compare plugins (if possible)

thanks

i think i know what you mean, but can you give me more information/an example? thanks

hi 1bitshort.

Let's write plugin to show in title of disasm windows offset from
current low-nearest exported function.
Like kernel32.GetProcAddress+0x22
It can be useful, if you are traicing in dll, and want to know where you are.

thanks.

FKMA interesting idea, but the problem with that is that there's no way for the plugin to know when an exported function ends, so it may say "kernel32.GetProcAddress+0x456" when it's no longer in GetProcAddress. (And if youre debugging just an exe then there probably wont be any exported functions anyway)
Hmmm

1bitshort
There is , IMHO, two ways to resolve problem,
and both not ideal:
1) consider the begin of next exported function as end of previous
2) find the end of function by signature pop xx; pop xx ; ret(n);

The begins and ends of funcs for particulary dll find once a user
popup the disasm window in that dll and stored internally in linked list or array for speed search reason.

And in exe auto switch off this possibility.

Some week ago i want to write such plugin. That like softice show offset.
But in this period i too busy on work and don't have many time.
Sorry for my english

Thanks.

I think option 1) would work fine. You just look at the current offset and see which function address is closest to it, without being more than it. ie,

GetWindowLong 0x100
DrawRect 0x200
OtherFunc 0x300

If the offset is 0x259, you can deduce that you are in function DrawRect, or at least can show the address as an offset from this function. This is basically what FKMA has just said :P

Oh, yes .

Is there a plug in that can log the steps like smartcheck by numega does? If not that would be a cool plugin so you could trace the program especially if it is encrypted like an SHA1 hash.

What do you think?

cubituz - Member says:

hi 1bitshort.

i like trace compare plugins (if possible)

thanks

...........................

1. save memory (press button)
2a. ... now you do somethink in program ...
2b. save memory (press button)
2c. now you compare 1 & 2b (search changes (you type what changes))
3a. ... now you do somethink in program ...
3b. save memory (press button)
2c. now you compare 2b & 3b (search changes (you type what changes))
4a...
4b...
4c...
...

write a plugin which makes tutorials for olly...
like if u set breakpoint to somewhere it'll write text "Now set breakpoint to <address>" into html document and in future releases it could take screenshots for tutorial by pressing some key combo like ctrl+home.

mhhh ... i wrote a plugin which permits to converts asm code to it's html view with colors ... useful for tutorials writing (http://ollydbg.win32asmcommunity.net/?action=vthread&forum=2 &topic=1588)
it's not exactly what you want but there's source code (delphi) if you (or someone) want to take a look.
maybe it can help you ....

how u can write plugins with delphi for olly? is it possible with vb too?

actually there is no SDK for VB.
you can view sdk here : http://ollydbg.win32asmcommunity.net/stuph/ ("http://ollydbg.win32asmcommunity.net/stuph/")