📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  OllyDBG Plugin - Handling the Events and Speed

Topic created on: December 22, 2007 07:24 CST by Piotr .

Well today i tried to make some ollydbg plugin, and i was pretty confused when i tried to handle breakpoints inside ODBG_Pluginmainloop. The Go() function from SDK continued the process but with DBG_EXCEPTION_NOT_HANDLED, instead of DBG_CONTINUE and even after playing with a hella t_regs/t_thread options i got the same effect. It almost seems patching the orginal debugger would be a simplier task then doing it clearly :) Anyway i have done the following task with help of ODBG_Pausedex callback (and now the Go() function continues the process with the correct options), however it's still  doesnt suit my needs. Because its damn slow, and all these window CPU/REGS/MEM updates slow the process even more (i tried to play with some window functions and broadcasting but with no proper effect). One of the dirty solutions maybe hooking the WaitForDebugEvent but like i said before i want to do it in clear way (if it can be done). So this is a question for olly plugin fanatics, can it be done? :) Lets assume i want to handle access violation inside of the plugin and continue the debugging process without ollydbg chipping in.

  anonymouse     December 22, 2007 10:45.09 CST
there is a parameter in go() int givechance
did you play with it

pluginmainloop comes with a caveat that it would be slow

PausedEx is a better alternative also in pausedEx you can either return 1 or 0 after calling Go() 1 means no time consuming redraws

pausedEx will come with event PP_ACCESS on AccessViolation

  Piotr     December 22, 2007 11:12.12 CST
I've played with givechance parameter, but it didnt work for me.

I've also checked the return 0/return 1 in ODBG_Pausedex, the windows are still updating (stack window/cpu/registers values). I've checked the timing of ret0/ret1 and it seems when i do "return 1" it's faster. But like i said i'm still loosing the time at these windows "updates". Hm any other ideas? Thanks.

  anonymouse     December 22, 2007 11:51.40 CST
i never used Go() much preferring to use SendShortCut instead as advised

i have used PausedEx a lot and i never found it being too much slow in heavy usages too

i have used pausedex in modified commandline pluginthats here for download with something like this


#pragma argsused
int ODBG_Pausedex(int reason, int extdata, t_reg *reg, DEBUG_EVENT *debugevent)
{

        if (reg != 0)
        {
        if(debugevent !=0)
        {

                debev = *debugevent;
                currentreg = *reg;

                if(debev.u.Exception.ExceptionRecord.ExceptionCode != EXCEPTION_BREAKPOINT)
                {
                return 0;
                }


and i have hit about a million breakpoints (yes thats MILLION )and processed them in without any apparent slowdown

ican take a peek if you can show me the relevent parts

  Piotr     December 22, 2007 12:16.37 CST

Well, most of the slowing problems in my case comes because i've put a lot of exception generatings in WindowProc of a target application, so as you can see everytime an event for the target window occurs MOUSEMOVE etc. etc., i'm experiencing a slow down because those "exceptions" are parsed by the debuggee. It's generally not the Olly fold itself, but i'm trying to speed this thing as much as possible. Anyway i got my solution, i've hooked the WaitForDebugEvent and i only let olly know of the events i dont mind.

Laters and marry xmas.

  anonymouse     December 23, 2007 10:49.21 CST
sure laters merry christmas and happy new year to you as well all openrcer's as well

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit