3

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and type the following command:

childdbg 1

(that is also described at https://stackoverflow.com/questions/21695192/can-ollydbg-trace-a-launched-exe by blabb )

But the plugin says:

 Unrecognized command: CHILDDBG

Why this appears? How can I fix it ?

PS: Before somebody recommend me to use ollydbg v2.01 (because it has a built-in option to debug a child process), I can say that I can not open the sample with ollydb v2.01 but this is a topic which I asked here: "Debugged application has modified the debugging registers" with ollydbg 2.01

best regards,

Improve this question

1 Answer 1

Reset to default
2

the latest version is available in blog entry

https://www.openrce.org/repositories/users/anonymouse/ModifiedCommandLinePluginWithChildDbg_Date_16082008.rar

if the link did not work you can download a modified version of the plugin with an additional command .writemem compiler has been changed to vc++ and old code modified to suit vc++ so the functionality of old commands not tested use it cautiously. i have tested only the .writemem functionality

some background for the additional command can be found here https://stackoverflow.com/questions/28488750/how-to-automate-task-in-ollydbg-using-ollyscript-or-any-other-tool/28556003#28556003

http://wikisend.com/download/750442/cmdline.dll

Improve this answer
2
  • ah, ok. thanks, now it works. Ahm, for those who have the same problem with childdbg. In my case, the link provided by blabb maked some problems with the firefox browser. So, I try to open the link with Google Chrome, it works. (and with IE it also works).
    – user3097712
    Apr 4, 2015 at 17:08
  • i have added an additional download link to another modifed version (compiled dll) this dll was created with the same code base but with an additional command .writemem and the compiler replaced from bcc5.5 to vc++ 2010 express by me old commands untested so if you find any problem pl post back or msg me so that i can take a look
    – blabb
    Apr 5, 2015 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.