0

In Ollydbg, if an instruction causes a register to change, it is highlighted red in the registers window in the CPU view.

Is it possible to have the same happen in the hex dump or stack windows? Of course the area of memory being watched would have to have limits, perhaps only what is seen, or between some limits?

Improve this question

1 Answer 1

Reset to default
2

yes it is possible to but you have to set the dump characteristics manually
suppose you are on an instruction push 58
this instruction will modify the stack so select esp from the registers pane rightclick->and follow in dump
select some bytes and press ctrl+e
modify some bytes in the selection
and reset it back to original bytes with alt+backspace
now if you execute push 58 the dump at position esp-4 will be highlighted in red

enter image description here

Improve this answer
2
  • another great helpful answer from Blabb. Actually, I find that the necessary steps are just to change memory, and then to undo with the alt-BACKSPACE as you said. This works for either the hex dump window or the stack, just change something and undo the change (undo critical step it seems) and then it will show changes in red from then on. If the hex dump pane is set to the stack memory area, it will appear in both. It's not necessary to follow the stack pointer from the register pane first (although this helps us get to the address faster if we wish to follow the stack).
    – Markbotix
    Commented Feb 6, 2016 at 20:36
  • In my above comment, I used Ollydbg 2.01.
    – Markbotix
    Commented Feb 6, 2016 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.