Русский / Russian English / Английский

Сейчас на форуме: ==DJ==[ZLO], Mishar_Hacker (+1 невидимый пользователь)
 · Начало · Статистика · Регистрация · Поиск · ПРАВИЛА ФОРУМА · Язык · RSS ·

 eXeL@B —› Софт, инструменты —› Modified CmdLine Plug-in
Посл.ответ Сообщение

Ранг: 1045.7 (!!!!)
Статус: Участник

Создано: 30 апреля 2007 16:56 New!
Цитата · Личное сообщение · #1

This plug-in is a modified version of the default command line plugin and offers the following enhancements:

- Added a printing functionality to Cmdline.dll

- Can evaluate multiple expressions on conditional Log breakPoints and log them

- Can accept arguments as comma seperated values. Ex:

print eax,ecx,edx,byte ptr ds:[eax],hex 403000

- Can accept dot notation in Conditional Log BreakPoints for silent logging and continuation. Ex:

.print eax,ecx
.next command (.ti,.to,.si,.so,.run)


added one more command loaddll

on the commandline type loaddll "your_dll" (dll should be in search path) or loadlll fully qualified path to your dll (path length <= MAX_PATH) to load any dlls in debugees process space

a sample usage attaching piotr banias efilter.dll to an arbitrary process

10001234 Debug string: [*] Efilter by Piotr Bania <> is now loading
1000125F Debug string: [*] Efilter: Attached to WIN.EXE - pid: 0xFFF8C575
10001266 Debug string: ---------------------------------------------------------------------
00401000 Program entry point
Loaded c:\windows\desktop\efilter.dll

you can load dlls while process is running or stopped


added third command

loadplugin "yourplugin"
can load plugins dynamically without having to
copy plugin to either pluginpath or without restarting
the session also if you have already 32 plugins loaded
you can free the last plugin and replace it with your new plugin


added fourth command
you can load symbol files from microsoft symbol server
set _NT_SYMBOL_PATH environment variable
copy the dbghlp.dll and symsrv.dll to ollydbg directory
(these are redistributable files from windbg installation version)
inside ollydbg
do ALT+F1 type loadpdb c:\windows\system32\ntdll.dll
thats all for now

Ранг: 230.5 (наставник)
Статус: Участник

Создано: 30 апреля 2007 17:20 New!
Цитата · Личное сообщение · #2

спасибо,щас посмотрим,то под висту мало пашет плагинов для ольки (

 eXeL@B —› Софт, инструменты —› Modified CmdLine Plug-in

Видеокурс ВЗЛОМ