Hot answers tagged

4

ReadCommand() Returns bytes from internally cached buffer and returns atmost MAXCMDSIZE Bytes the below snippet will take an address (HEX ONLY) read the command print the bytes and disassembly pertaining that address to log window take a look void disasm( void) { ULONG data = 0; if((Getlong("enter address to disassemble",&data,4,0,DIA_HEXONLY)) !=...


2

You're currently passing a string as the second argument to GenerateFile(), but the second argument needs to be a file handle.


2

It is quite possible for Ollydbg's plugin to interfere with each other. Generally you should only keep plugins that you use. The best anti-debugging plugins for Ollydbg as of now are ScyllaHide for user-mode and TitanHide for kernel mode. Both of them are open source and well maintained.


2

the latest version is available in blog entry https://www.openrce.org/repositories/users/anonymouse/ModifiedCommandLinePluginWithChildDbg_Date_16082008.rar if the link did not work you can download a modified version of the plugin with an additional command .writemem compiler has been changed to vc++ and old code modified to suit vc++ so the ...


1

You need to compile the plugin using the IDA SDK, which should result in a binary which you can then copy to the plugins directory. Possibly the original project on sourceforge provided precompiled binaries but they don’t seem to be present on the GitHub mirror.


1

Download Download the files apis_def.zip xAnalyzer.dp32 xAnalyzer.dp64 from here Steps Copy xAnalyzer.dp32 to x32/plugins directory Copy xAnalyzer.dp64 to x64/plugins directory Create a folder named "apis_def" in both x32/plugins & x64/plugins directory Now copy the contents of "apis_def.zip" into both "apis_def" folder All done!


1

Given your reference to Plugingetvalue(), it looks like you're trying to write your plugin for OllyDbg v1. In that case, you could do the following: Get the address of the patch table's t_table: pPatchTable = Plugingetvalue(VAL_PATCHES); Hook Addsorteddata(), such that any time you see it called with sd == &pPatchTable->data, you'll see that the ...


Only top voted, non community-wiki answers of a minimum length are eligible