4

I am debugging an app in OllyDBG. I want to create a script or automation. I set a breakpoint on a certain address and goto its stack arguments. There are four stack arguments.

I use the address of the 2nd argument and the size from the 4th argument and dump the HEX data in a log file. For example:

  1. I set a breakpoint at 0x512A12.
  2. I see the following in stack:

    00192003   005DB123  RETURN to program.005DB123 from program.00512A12
    00192011   0018F058 - 1st argument
    00192028   03F48D78 - 2nd argument
    00192032   03F48D78 - 3rd argument
    00192036   00000500 - 4th argument
    
  3. So, I dump the data from address starting at 0x00192028 03F48D78 - 2nd argument. Which is 0x03F48D78.

  4. I use the size from the 4th argument - 00192036 00000500 - 4th argument. Which is 500.
  5. Then, the data is saved in a log file. It is hex data from the dump section in Olly.

So, I want to loop this function and automate it.

How can this automation on Ollyscript or on something else created ?

1

your thread is lacking more informations , like entrypoint and endpoint of your code , so my script isnt supposed to reach an end.

var v
var h
br:
cmp eip,00192003
jne label
mov v,[00192036]
mov h,[00192028]
dma h, v, "c:\dump.bin"
label:
sti
run
jmp br

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.