0

I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.

I searched using for the function with Ctrl+G
enter image description here

I pressed on Follow expression and it put me on the definition of the function on the WinHttp module:
enter image description here

I wanted to find the place where the main module of the program is calling this function and not the definition.

I put a breakpoint there and after the program stopped there I tried to use the Go to -> Previous location\procedure so see the calling to this function from the program but it send me to different places.

Any idea how can I find the places where the program is calling to a specific function, in my case WinHttpOpenRequest ?

I have a workaround and use IDA to find the exact place, but I am sure OllyDbg has this ability and I just not familiar with it.

1

viewing previous procdures does not imply previous callers to view previous callers you need to look at the stack if you are executing the binary

use ctrl+k
btw winhttp uses com so it would be convoluted indirect access on vtables over activex object

it is not clear if you are executing the binary but just disassembling and trying to look at the references since you mention you have a workaround in ida

i presume you are meaning the xrefs in ida

if that is the case then ollydbg shows those references when you
analyze the winhttp.dll ctrl+a if you had analyzed the winhttp and used ctrl+g to go to the api

you will see a small pane between cpu window and dump window stating local calls from if you double click it you will see all the references to the present call

enter image description here

  • Yes, you understood me right. I searched for something like xref in IDA. – E235 Feb 12 '18 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.