0

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, which type of data will always be the same... in case of having several Olly instances opened I wanted my plugin to capture the info from the right Olly process. Example of information captured by winspy++

enter image description here

What I've attempted so far:

enter image description here

What could I be missing with that little snippet of code? I guess I'm not filling properly the t_frame input structure but I don't know how.

You can find the WIP plugin's sources here

1

i see you have started a new question
as i posted earlier the window is PWM_INFO it is a user defined custom table
it doesn't have any sorted data only sorted.n , sorted.selected and offset
the test or whatever it is is probably drawn using gdi functions
or i think rendered

you should take time to read whatever scanty documents are available
i don't think you can getwindowtext() from that window

if you cant find documentation debug ollydbg break and check what you see when you are on some call

if you use windbg you can strip the About Function to bare minimum and check what the t_table contains when you break on About() and you changed the mainmenu to PWM_INFO

assuming you compiled this and broke on About in windbg and check t_table

#define _UNICODE
#include <windows.h>
#include <stdio.h>
#include "plugin.h"
static int About(t_table *,wchar_t *,ulong ,int mode) {
  int n; wchar_t s[TEXTLEN];  if ( mode==MENU_VERIFY ) { return MENU_NORMAL; }
  else if (mode==MENU_EXECUTE) {
    Resumeallthreads();     n=StrcopyW(s,TEXTLEN,
    L"BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n");
    MessageBoxW(0,s,L"BlabbTest",0);
    Suspendallthreads();     return MENU_NOREDRAW;
  };  return MENU_ABSENT;
};
static t_menu mainmenu[] = {
  { L"|BlabbTest", L"About BlabbTest plugin", K_NONE, About, NULL, 0 },
  { NULL,NULL,K_NONE,NULL,NULL,0}
};
extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {
  if(wcscmp(type,PWM_INFO)==0) { return mainmenu; }
  return NULL;
};
BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };
extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,
wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {
  if (ollydbgversion<201) {  return 0; }
  wcscpy_s(pluginname,SHORTNAME,L"BlabbTest");
  wcscpy_s(pluginversion,SHORTNAME,L"2.00.01");
  return PLUGIN_VERSION; };

you would get this info about t_table which shows the sorted data is null
so you cannot get what is in there as text
you can only screen shot it
click capture in winsp++ and try pasting it in mspaint
you can see the result

cdb.exe ollydbg.exe CALC

Microsoft (R) Windows Debugger Version 10.0.14951.1001 X86
CommandLine: ollydbg.exe CALC

0:005> bp infodump!About "dv"
0:005> g

       __formal = 0x005e6ab8
       __formal = 0x0012e71c "BlabbTest"

       infodump!About:
665e1300 81ec04020000    sub     esp,204h

0:000> dx -r3 (infodump!t_table *) 0x5e6ab8
(infodump!t_table *) 0x5e6ab8 : 0x5e6ab8 [Type: t_table *]
    [+0x000] name             : "CPU Info" [Type: wchar_t [32]]
    [+0x040] mode             : -1866396925 [Type: int]
    [+0x044] sorted           [Type: t_sorted]
        [+0x000] n                : 5 [Type: int]  <========
        [+0x004] nmax             : 0 [Type: int]
        [+0x008] itemsize         : 0x0 [Type: unsigned long]
        [+0x00c] mode             : 0 [Type: int]
        [+0x010] data             : 0x0 [Type: void *]
        [+0x014] block            : 0x0 [Type: void * *]
        [+0x018] nblock           : 0 [Type: int]
        [+0x01c] version          : 0x0 [Type: unsigned long]
        [+0x020] dataptr          : 0x0 [Type: void * *]
        [+0x024] selected         : -1 [Type: int] <--------- no selection 
        [+0x028] seladdr          : 0x0 [Type: unsigned long]
        [+0x02c] selsubaddr       : 0x0 [Type: unsigned long]
        [+0x030] sortfunc         : 0x0 [Type: int (__cdecl*)(t_sorthdr *,t_sorthdr *,int)]
        [+0x034] destfunc         : 0x0 [Type: void (__cdecl*)(t_sorthdr *)]
        [+0x038] sort             : 0 [Type: int]
        [+0x03c] sorted           : 0 [Type: int]
        [+0x040] sortindex        : 0x0 [Type: int *]
    [+0x088] subtype          : 0 [Type: int]
    [+0x08c] bar              [Type: t_bar]
        [+0x000] nbar             : 1 [Type: int]
        [+0x004] visible          : 0 [Type: int]
        [+0x008] name             [Type: wchar_t * [17]]
            [0]              : 0x0 [Type: wchar_t *]
            [1]              : 0x0 [Type: wchar_t *]
            [2]              : 0x0 [Type: wchar_t *]
            [3]              : 0x0 [Type: wchar_t *]
            [4]              : 0x0 [Type: wchar_t *]
            [5]              : 0x0 [Type: wchar_t *]
            [6]              : 0x0 [Type: wchar_t *]
            [7]              : 0x0 [Type: wchar_t *]
            [8]              : 0x0 [Type: wchar_t *]
            [9]              : 0x0 [Type: wchar_t *]
            [10]             : 0x0 [Type: wchar_t *]
            [11]             : 0x0 [Type: wchar_t *]
            [12]             : 0x0 [Type: wchar_t *]
            [13]             : 0x0 [Type: wchar_t *]
            [14]             : 0x0 [Type: wchar_t *]
            [15]             : 0x0 [Type: wchar_t *]
            [16]             : 0x0 [Type: wchar_t *]
        [+0x04c] expl             [Type: wchar_t * [17]]
            [0]              : 0x0 [Type: wchar_t *]
            [1]              : 0x0 [Type: wchar_t *]
            [2]              : 0x0 [Type: wchar_t *]
            [3]              : 0x0 [Type: wchar_t *]
            [4]              : 0x0 [Type: wchar_t *]
            [5]              : 0x0 [Type: wchar_t *]
            [6]              : 0x0 [Type: wchar_t *]
            [7]              : 0x0 [Type: wchar_t *]
            [8]              : 0x0 [Type: wchar_t *]
            [9]              : 0x0 [Type: wchar_t *]
            [10]             : 0x0 [Type: wchar_t *]
            [11]             : 0x0 [Type: wchar_t *]
            [12]             : 0x0 [Type: wchar_t *]
            [13]             : 0x0 [Type: wchar_t *]
            [14]             : 0x0 [Type: wchar_t *]
            [15]             : 0x0 [Type: wchar_t *]
            [16]             : 0x0 [Type: wchar_t *]
        [+0x090] mode             [Type: int [17]]
            [0]              : 8 [Type: int]
            [1]              : 0 [Type: int]
            [2]              : 0 [Type: int]
            [3]              : 0 [Type: int]
            [4]              : 0 [Type: int]
            [5]              : 0 [Type: int]
            [6]              : 0 [Type: int]
            [7]              : 0 [Type: int]
            [8]              : 0 [Type: int]
            [9]              : 0 [Type: int]
            [10]             : 0 [Type: int]
            [11]             : 0 [Type: int]
            [12]             : 0 [Type: int]
            [13]             : 0 [Type: int]
            [14]             : 0 [Type: int]
            [15]             : 0 [Type: int]
            [16]             : 0 [Type: int]
        [+0x0d4] defdx            [Type: int [17]]
            [0]              : 256 [Type: int]
            [1]              : 0 [Type: int]
            [2]              : 0 [Type: int]
            [3]              : 0 [Type: int]
            [4]              : 0 [Type: int]
            [5]              : 0 [Type: int]
            [6]              : 0 [Type: int]
            [7]              : 0 [Type: int]
            [8]              : 0 [Type: int]
            [9]              : 0 [Type: int]
            [10]             : 0 [Type: int]
            [11]             : 0 [Type: int]
            [12]             : 0 [Type: int]
            [13]             : 0 [Type: int]
            [14]             : 0 [Type: int]
            [15]             : 0 [Type: int]
            [16]             : 0 [Type: int]
        [+0x118] dx               [Type: int [17]]
            [0]              : 1536 [Type: int]
            [1]              : 0 [Type: int]
            [2]              : 0 [Type: int]
            [3]              : 0 [Type: int]
            [4]              : 0 [Type: int]
            [5]              : 0 [Type: int]
            [6]              : 0 [Type: int]
            [7]              : 0 [Type: int]
            [8]              : 0 [Type: int]
            [9]              : 0 [Type: int]
            [10]             : 0 [Type: int]
            [11]             : 0 [Type: int]
            [12]             : 0 [Type: int]
            [13]             : 0 [Type: int]
            [14]             : 0 [Type: int]
            [15]             : 0 [Type: int]
            [16]             : 0 [Type: int]
        [+0x15c] captured         : 0 [Type: int]
        [+0x160] active           : 0 [Type: int]
        [+0x164] scrollvx         : 0 [Type: int]
        [+0x168] scrollvy         : 0 [Type: int]
        [+0x16c] prevx            : 0 [Type: int]
        [+0x170] prevy            : 0 [Type: int]
    [+0x200] bottomspace      : 0 [Type: int]
    [+0x204] minwidth         : 0 [Type: int]
    [+0x208] tabfunc          : 0x4773cc [Type: long (__cdecl*)(t_table *,HWND__ *,unsigned int,unsi
gned int,long)]
        [Type: long __cdecl(t_table *,HWND__ *,unsigned int,unsigned int,long)]
    [+0x20c] updatefunc       : 0x0 [Type: int (__cdecl*)(t_table *)]
    [+0x210] drawfunc         : 0x477178 [Type: int (__cdecl*)(wchar_t *,unsigned char *,int *,t_tab
le *,t_sorthdr *,int,void *)]
        [Type: int __cdecl(wchar_t *,unsigned char *,int *,t_table *,t_sorthdr *,int,void *)]
    [+0x214] tableselfunc     : 0x0 [Type: void (__cdecl*)(t_table *,int,int)]
    [+0x218] menu             : 0x53f05c [Type: t_menu *]
        [+0x000] name             : 0x53f4c2 : "!" [Type: wchar_t *]
        [+0x004] help             : 0x0 [Type: wchar_t *]
        [+0x008] shortcutid       : 0 [Type: int]
        [+0x00c] menufunc         : 0x474ce0 [Type: int (__cdecl*)(t_table *,wchar_t *,unsigned long
,int)]
            [Type: int __cdecl(t_table *,wchar_t *,unsigned long,int)]
        [+0x010] submenu          : 0x0 [Type: t_menu *]
        [+0x014] index            : 0x0 [Type: unsigned long]
        [+0x014] hsubmenu         : 0x0 [Type: HMENU__ *]
    [+0x21c] custommode       : 0x0 [Type: unsigned long]
    [+0x220] customdata       : 0x0 [Type: void *]
    [+0x224] hparent          : 0x260940 [Type: HWND__ *]
        [+0x000] unused           : Unable to read memory at Address 0x260940
    [+0x228] hstatus          : 0x0 [Type: HWND__ *]
    [+0x22c] hw               : 0x21075a [Type: HWND__ *]
        [+0x000] unused           : Unable to read memory at Address 0x21075a
    [+0x230] htooltip         : 0xb08e0 [Type: HWND__ *]
        [+0x000] unused           : Unable to read memory at Address 0xb08e0
    [+0x234] font             : 1 [Type: int]
    [+0x238] scheme           : 0 [Type: int]
    [+0x23c] hilite           : 2 [Type: int]
    [+0x240] hscroll          : 1 [Type: int]
    [+0x244] xshift           : 0 [Type: int]
    [+0x248] offset           : 0 [Type: int] <---------------
    [+0x24c] colsel           : 0 [Type: int]
    [+0x250] version          : 0x0 [Type: unsigned long]
    [+0x254] timerdraw        : 0x0 [Type: unsigned long]
    [+0x258] rcprev           : {LT(0, 0) RB(0, 0)  [0 x 0]} [Type: tagRECT]
        [<Raw View>]     [Type: tagRECT]
    [+0x268] rtback           : 0 [Type: int]
0:000>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.