1

I have an application programmed with delphi. I want to find the section of code of the function OnChange of a text field. How to find it on Ollydbg?

Also, how can I set breakpoint on any window show event and analyze the code of it?

1 Answer 1

1

Delphi applications are well known for jump offsets. Since the delphi compiler version is not specified, I will assume it to be Delphi 7. I have tested the above scenario by making a demo application having TEdit and TMemo components.(link to source code)

For finding the section of code of the function OnChange of a text field, you need to search through the .CODE section of the file in Ollydbg. Though I would suggest you use a disassembler of your choice as it would make searching and analyzing .CODE section easier and faster.

However, if I don't have another choice except Ollydbg, then I would right click on CPU view Search for -> All referenced text strings and then search for TForm1 assuming the developer has not changed the default name of TForm. Clicking on the occurrence of TForm1 would take me to .CODE section where the predefined text, names of components would reside.

I have attached 2 screenshots for reference:

Ollydbg screenshot


ida screenshot

  • How to set breakpoint on any window show event:

Right click on Disassembly/CPU view, click on Search for -> All intermodular calls, you will get the list of windows functions used by the application. Now you can set breakpoints individually or on all the calls of a specific function. for example. If you set a breakpoint on every SendMessageA function call then you can trace the method executed when the TEdit field is changed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.