1

I'm currently reversing a function which looks like the following

.text:0040383F 8D 04 BF          lea     eax, [edi+edi*4]
.text:00403842 6A 14             push    20
.text:00403844 C1 E0 03          shl     eax, 3
.text:00403847 99                cdq
.text:00403848 59                pop     ecx
.text:00403849 F7 F9             idiv    ecx
.text:0040384B 03 45 08          add     eax, [ebp+arg_0]
.text:0040384E 8A 84 30 C8 31 00+mov     al, [eax+esi+31C8h]
.text:00403855 32 C3             xor     al, bl
.text:00403857 88 84 3E 28 27 00+mov     [esi+edi+2728h], al
.text:0040385E 47                inc     edi
.text:0040385F 81 FF 07 0B 00 00 cmp     edi, 0B07h
.text:00403865 75 D8             jnz     short loc_40

Since I don't have any clue what's going there I wanted to Debug this part with OllyDbg. I want to understand what's inside al, bl and the result of xor al, bl for all "0B07h" steps the loop is running.

I just saw that Immunity provides some sort of scripting functionality. Is it possible to achieve this with a simple python script in Immunity? Maybe there are other ways with OllyDbg?

I just want something like:

If EIP == "403855" then print al, bl
Else go_ahead

1 Answer 1

2

No scripting required.

In OllyDbg's disassembly window, left-click on line .text:00403855 32 C3 xor al, bl to select the line, then right-click on the selected line and choose Breakpoint → Conditional log....

In the breakpoint dialog box that opens up, use the following options:

Conditional log

Press OK, run the program, and every time .text:00403855 32 C3 xor al, bl is executed, OllyDbg will print the values of al and bl to the log window.

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.