PDA

View Full Version : ODbgScript v1.20 - New Script Window !


Epsylon3
November 7th, 2005, 16:18
What's new?
---------------
1.21 (8 Nov 2005)
+ Remember Script Window Position & State
+ Automatic Scroll to follow script
+ Context Menu (Real MRU/Follow) in Script Window
# Fix table refresh
# CMP string compare is now case insensitive

1.20 (7 Nov 2005)
+ Script Window with values and eip
+ CMP now accepts strings from address

1.10 (5 Nov 2005)
+ MRU List

1.0 (4 Nov 2005)
# ODbgScript (VC6 Based)

You can download here :
http://e3.epsylon.org/olly/ODbgScript.1.21.VC6.rar
("http://e3.epsylon.org/olly/ODbgScript.1.21.VC6.rar
")

http://e3.epsylon.org/olly/script.png

http://e3.epsylon.org/olly/contextmenu.png

nick_name
November 7th, 2005, 16:41
Epsylon3, the new SCRIPT WINDOW is really really helpful !!
i'm already using it ...

hope u'll look into the matter to fix the tiny menu bug too

THANK YOU.

Epsylon3
November 7th, 2005, 16:59
=)

Next version :
- Remember Window State & Position (already made)
- Optimize Refresh when window hidded (some pbs with dual screen i've seen)
- Context menu in Script Window

SHaG
November 7th, 2005, 18:24
Beautiful work Epsylon3!
Thought about script tracing for a long time but never got around to implementing it... Guess I'm too lazy.

Epsylon3
November 7th, 2005, 18:57
tx =)

next version will be nice

1.21
+ Script Window Position & State
+ Automatic Scroll to follow script
+ Context Menu in Script Window
# Fix table refresh
# CMP string compare is now case insensitive
....

Epsylon3
November 7th, 2005, 19:09
do you have some other ideas ?

nick_name
November 8th, 2005, 04:04
epsylon3 , bueautiful work !!

how about adding a right click SCRIPT menu + MRU in the CODE WINDOW of olly like we use to c in Asm2Clipboard 'n in some other plugins ...

thank you, hope u'll keep up the good work !

mr haggar
November 8th, 2005, 06:06
New plugin needs word and byte variables, ROL and ROR opcodes. I had couple more ideas, maybe I'l post it later.

Epsylon3
November 8th, 2005, 10:53
Nick:
Ok for MRU, i ll try

Haggar:
If i make a third parameter to the MOV instruction (size 1 2 4, more for string), does that would solve your problem ? << could somebody tell me the right english sentence for this question (US person plz) i'm not sure )

Bob
November 8th, 2005, 19:40
It would be : "Would that solve your problem?"

Epsylon3
November 9th, 2005, 05:46
thanks bob ;p)

SHaG
November 9th, 2005, 20:05
# CMP string compare is now case insensitive

May I humbly suggest implementing it as a new command, something like scmp (String CoMPare) or cmpi (CoMPare case Insensitive)?

Epsylon3
November 11th, 2005, 06:43
yes, i think it's a good idea... maybe two new functions... SCMP and SCMPI

SHaG
November 11th, 2005, 08:49
Epsylon3: yeah, both are needed I think... By the way, if you are on EFnet would you please msg me? Have some things to ask. =) Nick: SHaG (surprise!).

Epsylon3
November 11th, 2005, 10:24
My Nick : Epsylon3

mr haggar
November 11th, 2005, 15:13
>If i make a third parameter to the MOV instruction (size 1 2 4, more for string), does that would solve your problem ? << could somebody tell me the right english sentence for this question (US person plz) i'm not sure )

You mean that only one byte is loaded in variable? Or in memory too? I was writing one script that decrypts Krypton0.5 pices of code that are encrypted. There I needed ROL and ROR opcodes, also that could work with bytes operands. I needed to decrypt byte-by-byte that pice of code. So what I need is:
- move one byte to variable
- ROL or ROR it
- place decrypted byte instead.
If you can make this working, that would be great. Maybe it can be done with present plugin, but that would be lot of working around.

Next thing that I would like to see. You know this:

gpa "SomeApiNameHere","SomeDllNameHere"

Can you make that script can read api and dll names from ASCII strings in exe? Like:

gpa x,y

where x and y would be addresses of ASCII strings terminated with zero, hardcoded in exe. I was unpacking beria and this would be usefull to rebuild thunks.

Thanks.

O yeah, I din't find manuall in your new plugin. Did I mised it? It would be nice to see new feature explained.

Epsylon3
November 13th, 2005, 14:21
try

gpa [x],[y]

humm... you are right, not working i think...
i will add that in next version...

i'm waiting for some fixes from exetools forum.... to release this next version...

where x y are string addresses

mr haggar
November 13th, 2005, 15:47
Great, thanks.

Epsylon3
November 14th, 2005, 07:01
New version uploaded with sources :

http://e3.epsylon.org/olly/
("http://e3.epsylon.org/olly/
")

1.23 (14 Nov 2005)
+ Enhanced String by Address support for commands (ex: gpa [nAddr],"KERNEL32.DLL"
+ lm, load Dm file to mem: lm, 0x401000, 0x100, "test.bin" (MetaCore)
# fix the dm, lm, dmp, dpe 's default dump path to debugging app's path. (MetaCore)
# fix dm, ...the open file parameter is incorrect, will add mess "0a 0d" at each lines tail. (MetaCore)
# fix all dump related function's parameter check, so when the real mem is smaller then gived
dump length, will not add mess data at the end, and the &#036;result also catched the real dump size. (MetaCore)

1.22 (11 Nov 2005)
+ Added SCMP and SCMPI for string comparaison (SCMPI for case insensitive)
# Restored CMP string comparaison to case sensitive