Flag: Tornado! Hurricane!

OllyDbg Plugins: Modified CmdLine Plug-in

File Information
Category Open Source # Downloads Version
OllyDbg Plugins Yes 19,823 1.1

Download from OpenRCE
MD5 Sum: 377181DCD6CA3DB120E7AE5F96539F5C

Last updated on Apr 29, 2007 with the following description: modified the default cmdline plugin with print command
updated on 2006-07-12 21.30  added command loaddll
updated on 2006-07-16 22.40 added command loadplugin
updated on 2007-04-29 21:15 added command
Loadpdb

updated on 16-08-2008 17:35 added command childdbg

Author Information
Username Name E-Mail URL
  anonymouse any_anonymouseyahoocom http://

Description This plug-in is a modified version of the default command line plugin and offers the following enhancements:

- Added a printing functionality to Cmdline.dll

- Can evaluate multiple expressions on conditional Log breakPoints and log them

- Can accept arguments as comma seperated values. Ex:

print eax,ecx,edx,byte ptr ds:[eax],hex 403000


- Can accept dot notation in Conditional Log BreakPoints for silent logging and continuation. Ex:

.print eax,ecx
.next command (.ti,.to,.si,.so,.run)

=========================================


added one more command loaddll

on the commandline type loaddll  "your_dll" (dll should be in search path) or loadlll fully qualified  path to your dll (path length <= MAX_PATH)  to load any dlls in debugees process space

a sample usage attaching piotr banias efilter.dll to an arbitrary process

10000000   Module C:\WINDOWS\DESKTOP\EFILTER.DLL
10001234   Debug string: [*] Efilter by Piotr Bania <http://pb.specialised.info> is now loading
1000125F   Debug string: [*] Efilter: Attached to WIN.EXE - pid: 0xFFF8C575
10001266   Debug string: ---------------------------------------------------------------------
BFEE0000   Module C:\WINDOWS\SYSTEM\NTDLL.DLL
00401000   Program entry point
           Loaded c:\windows\desktop\efilter.dll


you can load dlls while process is running or stopped

==========================================

added third command

loadplugin "yourplugin"
can load plugins dynamically without having to
copy plugin to either pluginpath or without restarting
the session also if you have already 32 plugins loaded
you can free the last plugin and replace it with your new plugin

==========================================


added fourth command
Loadpdb

you can load symbol files from microsoft symbol server
set _NT_SYMBOL_PATH  environment variable
copy the dbghlp.dll and symsrv.dll to ollydbg directory
(these are redistributable files from windbg installation 6.6.7.5 version)
inside ollydbg
do ALT+F1  type loadpdb c:\windows\system32\ntdll.dll

thats all for now

=================================================
childdbg

added fifth command to the plugin on 16-08-2008

childbg

hit alt+f1 -> type childdbg 1 to enable debugging the child process

type childdbg 0 to disable debugging the child process

====================================================



There are 31,310 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit