6

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?

2 Answers 2

8

Select the MOV EDI, EAX instruction and press Shift+F4 to open the Conditional log breakpoint window.

In that window, specify eax as the expression, set Pause program to Never, and set Log value of expressions to Always:

Conditional log

Press the OK button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is hit.

2
  • With regard to blabb's answer below, yes, my answer above was for OllyDbg 2. Feb 7, 2014 at 20:27
  • Is there a to way log in case of some memory DWORD has changed?
    – ST3
    Feb 18, 2015 at 8:47
0

in odbg version 1.10 that will only log eax not the string
in the expression box put either STRING [EAX] or UNICODE [eax] as the case may be
or with plain eax select pointer to ascii or unicode string in decode expression as dropdown box to log strings

Log data, item 0 Message=eax = 1001590 [eax] = 74636868 string [eax] = hhctrl.ocx unicode [eax] =

odbg 210 will decode expression automatically

01012475  INT3: plain eax = 1001590 ASCII "hhctrl.ocx"
                dword ptr eax = 74636868 (1952671848.)
                ascii string ptr eax = hhctrl.ocx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.