PDA

View Full Version : Pausedex & go problem


sinnernot
September 8th, 2005, 14:02
have several ollydbg plugins already done but I have a doubt and
kind of a problem with the function pausedex.

In general, in all the plugins I wrote I set a breakpoint using
Setbreakpointex at some point, and then, I handle the breakpoint at
Pausedex checking that reasonex == INT3_PPBREAK.

THe problem is i'm not sure exactly how to get out of Pausedex. I'm
using GO(0,0,STEP_RUN,0,0) but I'm having some problems.

it also seems strange to me that I have to do also a 'return' besides the GO()!!

eg:

Pausedx(...)
{
if( reasonex == PP_INT3BREAK) {

if( bp_addr == myaddress ) {
do_stuff..
}

}
// continue program execution
Go(0,0,STEP_RUN,0,0);
return 1;
}

is that the correct way to use GO? I don't think the function was
intended to be used like that, because I'm getting a lot of race
conditions and differents problems. Doing Go() and then returning
makes no sense to me, or maybe I'm missing something.
returnign 1 from Pausedex without the GO does not make the debugger
continue execution.

What I want to accomplish is to set a breakpoint, when the breakponit
is hit, I want to handle it in Pausedex and then let Ollydbg continue
execution of the program.

Using the method described above I can do it, and it is working, but
sometimes I get
very ugly race conditions and everything freezes.


Can you please help me?

Thank you!

blabberer
September 8th, 2005, 14:16
well may be try using SendShortcut (vk_f9) thats how i used pausedex
once never tried go as i couldnt understand its functionality and not sure wht threadid etc to use and first how to retrieve them etc
so opted out the first way it worked aks Sendshortcut (vk_f9)



Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
VirtualProtectEx(debproc,mbi.BaseAddress,mbi.RegionSize,lpOld,&lpOl d);
CloseHandle(debproc);
return 0;

sinnernot
September 8th, 2005, 14:20
Yes, I already tried uising Sendshortcut but the program DOES NOT continue.

Inside Pausedex I Did

Sendshortcut(PP_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
return 1;

but it does not work.
olly just sits there and the program does not continue.

anyways, it is still strange to me to tell the debugger to CONTINUE execution AFTER returning from the callback (Pausedex) that told me that a debug event occurred.

To me the logical thing would be for pausedex to return 1 and olly woud just continue execution.

blabberer
September 8th, 2005, 14:23
hehe i editeed the code and you replied
see edit above
whats pp_main ??

sinnernot
September 8th, 2005, 14:40
he, cool, thanks.
my brain is fried and I read PP_MAIN in the helpfile instead of PM_MAIN.
thanks a lot, now it works.
but I have another problem.
With Go() I can use the givechance parameter to pass exceptions to the app.
now, with Sendshorcut()... I cant...
so everything works fine until an exceptions is thrown and I have to manually press F9 to continue.

mm, i guess I should be able to deal with that with the debugevent parameter of pausedex... right? ..

sinnernot
September 8th, 2005, 14:45
mm, no, ok, now it works. I correct myelf.
But I get the same issue as when I was using GO.

I guess that after the breakpoint is hit, when I do GO/Senshortcut, it gets hit again, is that possible? because olly just keeps hitting breakpoints ALL THE TIME .

blabberer
September 9th, 2005, 06:01
everything is possible proabbaly you have set a breakpoint on
messageloop ()
try debugging the plugin and see why its happening the way its happening
or try using conditional break points