3

I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How?

Thanks a lot.

4

There are quite a few ways to achieve this.

  1. In OllyDbg search for all Intermodular calls. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on all the functions. The disadvantage of this approach is that dynamically resolved function calls cannot not be intercepted. enter image description here

  2. Search for Name in all modules. Next set logging breakpoints on all exported entries. Disadvantage of this approach is that there will be a lot of false positives such as when a function from kernel32 calls into another function in ntdll, it will be logged too. To clear the false positives you can use a conditional logging breakpoint to check if the return address is within the ranges of the main module.
    enter image description here

  3. Use a dedicated tool for this purpose like API Monitor, SpyStudio etc. If you use the SpyStudio, be sure to check out the docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.