1

Is there any command in OllyScript that can fetch me table shown in Memory Map window of OllyDbg. (Memory window comes up when you click on "M" icon.) It shows address, size, Owner, Section, Contains, Type, Access, Initial, and Mapped as. But I only need Address, Size, Owner, contains. So even if I can somehow get these details it would be fine.

Improve this question

1 Answer 1

Reset to default
0

if you are comfortable with text parsing
right_click-> copy to clipboard->wholetable
paste to foo.txt and print the required columns with awk 

awk "{print $1,$2,$3,$5}" memor.txt | head -n 6
Memory map
Address Size Owner Contains
00010000 00010000 > Heap
00030000 00004000 > Map
00040000 00002000 > Map
00050000 00001000 > Priv

update

use windbg !address command with -c "cmdstr" option as pasted below

%1 to %7 are place holders respectively for
base,end,size .type , state,protection and usage
that !address command understand and replaces in the command string 

0:000> !address -c:".printf \"%8x\\t%8x\\t%7\\t        %4\\n\" , %1 , %3"
       0       10000    Free            
   10000       10000    Heap            MEM_MAPPED
   20000       10000    Free            
   30000        4000    Other           MEM_MAPPED
   34000        c000    Free            
   40000        2000    Other           MEM_MAPPED
   42000        e000    Free            
   50000        1000    Other           MEM_PRIVATE
   51000       5f000    Free            
   b0000       3c000    Stack           MEM_PRIVATE
   ec000        1000    Stack           MEM_PRIVATE
   ed000        3000    Stack           MEM_PRIVATE
   f0000       67000    MappedFile          MEM_MAPPED
  157000       19000    Free            
  170000        6000    Heap            MEM_PRIVATE
  176000       fa000    Heap            MEM_PRIVATE
  270000      920000    Free            
  b90000        1000    Image           MEM_IMAGE
  b91000       53000    Image           MEM_IMAGE
  be4000        5000    Image           MEM_IMAGE
  be9000       67000    Image           MEM_IMAGE
  c50000    6ccc0000    Free            
6d910000        1000    Image           MEM_IMAGE
Improve this answer
8
  • I have to repeat the procedure many times. So I am looking for a method/tool/automation/anything that can do this automatically. After that I need to take dumps of some sections. It need not necessarily be Ollydbg. Anything which gives me this mapping and can take required dumps.
    – Shan
    Nov 29, 2016 at 9:11
  • i updated the answer see
    – blabb
    Nov 30, 2016 at 6:02
  • Hi, This is quite helpful. Thanks. Now I will find the command to take the dump of sections, and pass the addresses to them. :)
    – Shan
    Dec 2, 2016 at 7:32
  • If it answered your query maybe you can mark it as such and or upvote so that others who look can find it easily
    – blabb
    Dec 2, 2016 at 11:37
  • Yes, I did that already. But I am do not have the required reputation points for my upvote to be publicly displayed. :/
    – Shan
    Dec 2, 2016 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.