Given a breakpoint at an expression MOV EDI, EAX
, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
2 Answers
Select the MOV EDI, EAX
instruction and press Shift+F4 to open the Conditional log breakpoint window.
In that window, specify eax
as the expression, set Pause program to Never, and set Log value of expressions to Always:
Press the OK button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is hit.
-
With regard to blabb's answer below, yes, my answer above was for OllyDbg 2. Feb 7, 2014 at 20:27
-
in odbg version 1.10
that will only log eax
not the string
in the expression box put either STRING [EAX]
or UNICODE [eax]
as the case may be
or with plain eax select pointer to ascii or unicode string
in decode expression as
dropdown box to log strings
Log data, item 0 Message=eax = 1001590 [eax] = 74636868 string [eax] = hhctrl.ocx unicode [eax] =
odbg 210
will decode expression automatically
01012475 INT3: plain eax = 1001590 ASCII "hhctrl.ocx"
dword ptr eax = 74636868 (1952671848.)
ascii string ptr eax = hhctrl.ocx