2

In OllyDbg 1.10 it was possible to skip some parts of code when starting run trace(just example):

enter image description here

So when there is some heavy code it was possible to skip to trace only some useful information.

I cannot find same "Run trace -> Skip selection from run trace" option in OllyDbg 2.01. I cannot find any info on that on the internet too. Does it mean there is no such option in the newer version of the software? How is this possible at all?

I need to exclude some heavy code that is always present in the run trace, but I don't need it, and I cannot interact with the application when it records all those lines.

update

There is an answer that shows some workaround, but this is not exactly what 1.10 has, because in 1.10 you can select the code and just skip it. So I just want confirmation if this functionality was removed from the new version of OllyDbg, or there is some other (but also comfortable, not manual) way to do it.

Improve this question

1 Answer 1

Reset to default
2

use CTRL + P protocol only the following EIP ranges

Add the ranges above and below the block to be skipped

the skipped block !

enter image description here

edit

no there doesn't seem to be any skip feature looking inside plugin.h i see only MAX 64 (NRTPROT) ranges can be protocolled and the address is defined in t_range the code below can automate putting one range automatically into the dialog box for subsequent ranges you may need to implement logic that checks if selection is within an earlier block or not if yes split that block into pieces code below compilable in vc++ 2010 express 

#define UNICODE
#define _CHAR_UNSIGNED
#include <windows.h>
#include "plugin.h"
#pragma comment(lib,"ollydbg.lib")
//grab the plugin.h and ollydbg.lib from visual c folder in plugin kit and put them along
//this cpp file open vs2k10 express ->new -> project from existing code -> Dll ->finish
// open project properties and disable INCREMENTAL save solution and quit gui
// open a vs2k10 command prompt and do msbuild /p:configuration=Release 
BOOL WINAPI DllEntryPoint( HINSTANCE,DWORD,LPVOID ) { return 1; };
int Skiprangefromrtprot( t_table *pt, wchar_t *name, ulong index, int mode ) {
    if (mode==MENU_VERIFY) { return MENU_NORMAL;
    } else if ( mode==MENU_EXECUTE) {
        Resumeallthreads();
        t_dump *cpudump = Getcpudisasmdump();
        ulong startsel = cpudump->sel0;
        ulong endsel = cpudump->sel1;
        t_module *curmod = Findmodule(startsel);
        if(curmod != 0) {
            Addprotocolrange(curmod->base,startsel);
            Addprotocolrange(endsel,(curmod->base + curmod->size));
        }
        Suspendallthreads();
        return MENU_NOREDRAW;
    } else {
        return MENU_ABSENT;
    }
};
t_menu disasmmenu[] = {
    { L"|SkipFromRunTrace", NULL,K_NONE, Skiprangefromrtprot, NULL, 0 },
    { NULL, NULL,K_NONE, NULL, NULL, 0 }
};
extc int __cdecl ODBG2_Pluginquery( int ollydbgversion, ulong *features,
    wchar_t pluginname[SHORTNAME], wchar_t pluginversion[SHORTNAME] ) {
        if (ollydbgversion<201)
            return 0;
        wcscpy_s( pluginname, SHORTNAME,L"SkipFromRunTrace" );
        wcscpy_s( pluginversion,SHORTNAME, L"2.00.01" );
        return PLUGIN_VERSION;
};
extc t_menu * __cdecl ODBG2_Pluginmenu( wchar_t *type ) {
    if (wcscmp(type,PWM_DISASM)==0)
        return disasmmenu;
    return NULL;
};
Improve this answer
3
  • Thanks, actually I found it yesterday on my own, but still there is no automatic way to do what I want. My intention is to add the whole module first, then when run trace is run, I see what parts I don't need and just skip them. Manually it takes time to put skipped parts to the range. I am thinking about maybe to write plugin which will do the job.
    – Andriy Kizym
    Feb 20, 2015 at 10:19
  • i am not sure if you can skip but you dont have to enter ranges manually select a block right click -> breakpoint -> add selection to protocol / add procedure to protocol
    – blabb
    Feb 23, 2015 at 19:07
  • yes, but it adds only selected to the protocol, i need opposite. I need to track everything except some procedures which I want to select. It should have some option, like invert ranges or smth like that.
    – Andriy Kizym
    Feb 25, 2015 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.