4

I am debugging an app in OllyDBG. I want to create a script or automation. I set a breakpoint on a certain address and goto its stack arguments. There are four stack arguments.

I use the address of the 2nd argument and the size from the 4th argument and dump the HEX data in a log file. For example:

  1. I set a breakpoint at 0x512A12.

  2. I see the following in stack:

    00192003   005DB123  RETURN to program.005DB123 from program.00512A12
00192011   0018F058 - 1st argument
00192028   03F48D78 - 2nd argument
00192032   03F48D78 - 3rd argument
00192036   00000500 - 4th argument

  3. So, I dump the data from address starting at 0x00192028 03F48D78 - 2nd argument. Which is 0x03F48D78.

  4. I use the size from the 4th argument - 00192036 00000500 - 4th argument. Which is 500.
  5. Then, the data is saved in a log file. It is hex data from the dump section in Olly.

So, I want to loop this function and automate it.

How can this automation on Ollyscript or on something else created ?

perror
  • 19,083
  • 29
  • 87
  • 150
John Dev
  • 49
  • 2

1 Answers1

1

your thread is lacking more informations , like entrypoint and endpoint of your code , so my script isnt supposed to reach an end.

var v
var h
br:
cmp eip,00192003
jne label
mov v,[00192036]
mov h,[00192028]
dma h, v, "c:\dump.bin"
label:
sti
run
jmp br
Abr001am
  • 304
  • 1
  • 10