1

I'm trying to interpret some contents of memory, it would be nice to decode contents of the lower left window in Olly (memory hex dump).

A specific example is a char** array. Specifically char *argv[]. argv is a pointer to an array of pointers, each of which is the beginning of a string. Here I have 3 arguments to my program, so including the path and exe name that makes argc=4 as I enter main(int argc, char *argv[]).

In the image below I graphically show argv=0x0041 0E80 from where we see 4 32-bit values in memory, each is a pointer to the beginning of strings argv[0], argv1, argv[2], and argv[3] (sorry about red line).

hexdump window in Olly (sorry about red line)

If I select the 4 bytes at 00410EA0, or those 16 bytes starting at 00410EA8 and right-click in this hex-dump window of Olly (lower left quadrant) I'd like to bring up a list of strings. I see there are options to decode as structures and pointer to structure, so I would think there would be something simpler for arrays and arrays of strings.

Any hints? Thanks.

3

right click in the dump pane -> integer -> address with ascii/unicode dump

src , execution , and screen shot below

multiargs.exe I Me You We Us Them

arg 00 = multiargs.exe
arg 01 = I
arg 02 = Me
arg 03 = You
arg 04 = We
arg 05 = Us
arg 06 = Them

ollydbg.exe multiargs.exe I Me You We Us Them

type multiargs.cpp

#include <stdio.h>
int main (int argc , char *argv[]) {
        for (int i=0;i<argc;i++){
                printf("arg %02d = %s\n",i,argv[i]);
        }
}

enter image description here

  • That's great, thanks. You answered it completely. "Integer" by itself not what I would have thought of, but I guess I should keep in mind Olly seems to analyze lots of data, such as in immediate operands in code, or register contents, to see if they are strings. So indirectly I get my desired result by having Olly list the bytes as 32-bit quantities, which happen to list strings since it checks values to see if they're valid strings. Great answer, thanks! This will lead me to writing another question, how to make my own structure to use in "Decode as structure..." – Markbotix Jan 30 '16 at 8:16
  • I might add that I learned two more things from your answer: how to move over the leftmost address column in the code quadrant (upper left of CPU window) to show the labels (eg: "main" and "printf"), and that I can run Olly from the DOS command line! By the way, how did you get it the label to appear in red? Sorry... kind of trivial question. – Markbotix Jan 30 '16 at 8:22
  • I notice it is the same mechanism as the stack (lower right quadrant in CPU window) with its "Columns"->"Address" or "Address with ascii dump". – Markbotix Jan 30 '16 at 8:39
  • I think when I encounter char** arrays I will use your answer method as follows: I'll select the memory words of the array in the hex dump, right-click -> "Open in separate dump window", and in that window I'll apply your right-click -> "Integer"->"Address". – Markbotix Jan 30 '16 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.