0

I have the following call to a function.

      ....
      push eax
      push prog.00401D19
      call dword ptr ds:[&USER32.EnumWindows]
      ....

So, as you can see, this is a call to EnumWindows. But I would like to analyze the code at 00401D19. Do you know how to do that in ollydbg ?

ps: when I make 00401D19 as my new origin (Ctrl + Gray *), then I can not go back to the line after EnumWindows because side effects etc. can happen. Therefore, I search a different option.

1
  • ctrl+grey asterisk changes the instruction pointer (EIP) use it only when you want to change EIP to hop front and and back use ctrl '+' plus and ctrl '+' minus to analyse the Callback use contextmenu->follow or ctrl+g -> enter address -> ok
    – blabb
    Commented May 8, 2015 at 6:25

1 Answer 1

4

You have a couple of options:

  1. Select the push prog.004013D19 line in OllyDbg and press Enter on your keyboard.
  2. Left click anywhere in the disassembly listing in OllyDbg, press Ctrl+G on your keyboard, and enter 004013D19 in the popup window.
3
  • Bonus: press Esc to go back to the place you were before
    – rev
    Commented May 7, 2015 at 21:07
  • @AcidShout iirc you are confusing ida with ollydbg in ollydbg esc pauses the debugger (equivalent to f12 key )
    – blabb
    Commented May 8, 2015 at 6:28
  • @blabb I just tried it and nope, it works there too. In OllyDbg 2, however, you need to press NUMPAD- to go back.
    – rev
    Commented May 8, 2015 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.