PDA

View Full Version : How to get the call references of a procedure?


henryouly
August 13th, 2005, 09:07
Hi, I'm writing a plugin of OD and have the following problem.
When I try to look into who is the callee of a proc from analyse data, this piece of code fail to work.(To simplify a bit, here I removed the statements for error checking)

start = Findprocbegin(current);
decode = Finddecode(start, &decode_size);
cmdsize = Readcommand(start, cmdbuf);
Disasm(cmdbuf, cmdsize, start, decode, &disasm_result, DISASM_ALL, 0);

I didn't find helpful info in disasm_result.opinfo[] in my testing, such as "Local call from xxx,xxx" which I saw in OD's main frame.

Can anyone tell me if I made a mistake, or give me some workable code? Thanks in advance.

blabberer
August 15th, 2005, 07:24
may be try using DecodeAddress
many of the calls that are seen on display are generated on the fly
in ollydbg so manytimes you are forced to do all the work again to get the same results again as you cant rely on some strored database

also to get referance you could try using SendShortcut(blah blah ctrl+r)
and then parse through the t_dump data

henryouly
August 16th, 2005, 00:14
Thanks very much.

I've noticed that t_module.jddata records all the anaylzed jump, so I search into it and get what I want on the fly

BTW, your idea of t_dump sounds wonderful that I want to have a try, too. Could you tell me which plugins used this technique so I can look into the code?

blabberer
August 16th, 2005, 05:55
there are no plugins as such i am aware of i was talking about some half baked code that i put together to retrieve some thing like this
when i tried to code together a visualizer but it seemed to be too much headache peering inside these structures
and i didnt have some quality time to spend on the subject
so dropped it but it is a feasible idea provided you can bypass all the
gui dependent code and directly jump into processing code

may be for example you can take a look at my NtGlobalFlag plugin
where i crete a thread and use the ollys gui to assemble in place and pass WM_COMMAND with SendMessage

blabberer
August 19th, 2005, 05:52
hey i see you wanted answer to this question because you are doing improvements in the visualiser
why dont you also post it somewhere where it is accessible to
many others who would like to take a look at the ollyflow plugin ??

henryouly
August 24th, 2005, 09:44
I've post it in several forums, and u know it will be nightmare to update all of them when new version comes up, and I am too lazy to create a homepage. However it is welcome for anyone to cross-post my plugin to any forum. Here I provide two links for download.

exetools:
http://www.exetools.com/forum/showthread.php?t=7939
("http://www.exetools.com/forum/showthread.php?t=7939
")

pediy(the famous cracking technical forum in china): http://bbs.pediy.com/showthread.php?s=&threadid=16171 ("http://bbs.pediy.com/showthread.php?s=&threadid=16171")

blabberer
August 24th, 2005, 10:05
the whole point of my post was to say it is impossible for many to download from those forums unless they are registered and whatnot

so i meant you post it some where wher it can be freely downloaded
but it is your wish

henryouly
September 17th, 2005, 13:15
It should be available here:
http://www.openrce.org/downloads/details/178/OllyFlow ("http://www.openrce.org/downloads/details/178/OllyFlow")