0

I have the following call to a function.

      ....
      push eax
      push prog.00401D19
      call dword ptr ds:[&USER32.EnumWindows]
      ....

So, as you can see, this is a call to EnumWindows. But I would like to analyze the code at 00401D19. Do you know how to do that in ollydbg ?

ps: when I make 00401D19 as my new origin (Ctrl + Gray *), then I can not go back to the line after EnumWindows because side effects etc. can happen. Therefore, I search a different option.

1
  • ctrl+grey asterisk changes the instruction pointer (EIP) use it only when you want to change EIP to hop front and and back use ctrl '+' plus and ctrl '+' minus to analyse the Callback use contextmenu->follow or ctrl+g -> enter address -> ok – blabb May 8 '15 at 6:25
4

You have a couple of options:

  1. Select the push prog.004013D19 line in OllyDbg and press Enter on your keyboard.
  2. Left click anywhere in the disassembly listing in OllyDbg, press Ctrl+G on your keyboard, and enter 004013D19 in the popup window.
3
  • Bonus: press Esc to go back to the place you were before – rev May 7 '15 at 21:07
  • @AcidShout iirc you are confusing ida with ollydbg in ollydbg esc pauses the debugger (equivalent to f12 key ) – blabb May 8 '15 at 6:28
  • @blabb I just tried it and nope, it works there too. In OllyDbg 2, however, you need to press NUMPAD- to go back. – rev May 8 '15 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.