How to copy API calls names to clipboard on OllyDBG v2.01?

Question

I'm trying to figure out how to copy API function names to clipboard to analize the asm listing properly on my own editor.

I can see OllyDBG gives you the ability to mouse over a call and seeing the function name in a little window, that's quite cool

But... I don't see any way around to copy these function names to the clipboard so i could speed the process of play around with the final asm listing stored on disk faster.

Before even considering this manual copy/pasting I've thought about using a promising plugin called asm2clipboard but that one doesn't seem to work with ollydbg v2.01.

Usually API calls would appear in the form of comments when debugging normal exes, but these particular API functions were loaded by hash and are called via a pointer.

In any case, if there isn't any workaroudn about this, how can i learn how to build ollydbg v2.01 plugins? I see this another thread with a hello world example but it seems it requires plugin.h and ollydbg.lib, where can i find them? They don't seem to live in the odbg201.zip file

Answer 1

The plugin is available in an old beta version iirc 201 h scroll down a little in the sites page you should see it on nov 19 2012 entry look here for my earlier post iirc i posted a full plugin src with compile instructions using vc++

Avoid re-enabling patches between reruns in Ollydbg

Command for Command line plugin does not work

here is a source code for getting the information
usage right click in disassemble window to find men Blabbtest
on execution you will get a msgbox with the name of the api

compiled and linked with enterprise wdk compiler and linker using

cl /nologo /J /W4 /Ox /Zi /analyze /EHsc /LD *.cpp /link user32.lib ollydbg.lib

#define _UNICODE
#include <windows.h>
#include <stdio.h>
#include "plugin.h"
void Disassemble(ulong addr,ulong threadid,wchar_t *jumpaddr) {
  ulong length,declength; uchar cmd[MAXCMDSIZE],*decode; t_disasm da; t_reg *reg;
  length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL);
  decode=Finddecode(addr,&declength); reg=Threadregisters(threadid);
  length=Disasm(cmd,length,addr,decode,&da,DA_TEXT|DA_OPCOMM|DA_MEMORY,reg,NULL);
  Decodeknownbyaddr(da.jmpaddr,0,0,0,jumpaddr,1,1);
}
static int About(t_table *,wchar_t *,ulong ,int mode) {
  int n; wchar_t s[TEXTLEN]; if (mode==MENU_VERIFY) { return MENU_NORMAL; }
  else if (mode==MENU_EXECUTE) {
    Resumeallthreads(); n=StrcopyW(s,TEXTLEN,
        L"BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n");
    wchar_t jaddy[TEXTLEN] ={0};
    Disassemble(Getcpudisasmselection(),Getcputhreadid(),jaddy);
    n+=StrcopyW(s+n,TEXTLEN-n,jaddy); MessageBoxW(0,s,L"BlabbTest",0);
    Suspendallthreads(); return MENU_NOREDRAW;
  };  return MENU_ABSENT;
};
static t_menu mainmenu[] = {
  { L"|BlabbTest", L"About BlabbTest plugin", K_NONE, About, NULL, 0 },
  { NULL,NULL,K_NONE,NULL,NULL,0}    };
extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {
  if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; }   return NULL;
};
BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };
extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,
wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {
  if (ollydbgversion<201) {  return 0; }
  wcscpy_s(pluginname,SHORTNAME,L"BlabbTest");
  wcscpy_s(pluginversion,SHORTNAME,L"2.00.01");
  return PLUGIN_VERSION; };

here is the result

instead of Decodeknownbyaddr() use Findlabel() to find the Label of jmpaddr

#define _UNICODE
#include <windows.h>
#include <stdio.h>
#include "plugin.h"
static int About(t_table *,wchar_t *,ulong ,int mode) {
  int n; wchar_t s[TEXTLEN],labl[TEXTLEN];ulong length,addr;t_cmdinfo cmdinf={0};
  if ( mode==MENU_VERIFY ) { return MENU_NORMAL; }
  else if (mode==MENU_EXECUTE)   {
    Resumeallthreads();     n=StrcopyW(s,TEXTLEN,
    L"BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n");
    uchar cmd[MAXCMDSIZE]; addr = Getcpudisasmselection();
    length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL);    
    Cmdinfo(cmd,length,addr,&cmdinf,0xfff,NULL);    
    Findlabel(cmdinf.jmpaddr,labl,0);
    n+=StrcopyW(s+n,TEXTLEN,labl);
    MessageBoxW(0,s,L"BlabbTest",0);
    Suspendallthreads();     return MENU_NOREDRAW;
  };  return MENU_ABSENT;
};
static t_menu mainmenu[] = {
  { L"|BlabbTest", L"About BlabbTest plugin", K_NONE, About, NULL, 0 },
  { NULL,NULL,K_NONE,NULL,NULL,0}
};
extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {
  if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; }
  return NULL;
};
BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };
extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,
wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {
  if (ollydbgversion<201) {  return 0; }
  wcscpy_s(pluginname,SHORTNAME,L"BlabbTest");
  wcscpy_s(pluginversion,SHORTNAME,L"2.00.01");
  return PLUGIN_VERSION; };

well you should at-least customarily peruse the code and documentation

add these two lines and pass the t_reg * to cmdinfo to decode register or indirect calls

  t_reg *reg;
  reg=Threadregisters(Getcputhreadid());
Cmdinfo(cmd,length,addr,&cmdinf,0xfff,reg);