![]() |
|
#7
|
|||
|
|||
|
bp Translatemessage condition string is you are using commandline plugin
some thing like bp Translatemessage "[ESP+###] == WM_COMMAND" i dont have tools to give you right command atm may be will edit this post later the general graphical way is to find names -->TranslateMessage in kernel32.dll right click follow in disassembler you will mostly be at a push ebp instruction hit shift+f4 (conditional log break point) set the condition you prefer using the stack parameters (the arguments to the proc will be on stack top+4 [esp+4] when you have stopped on break point so condition like [ESP+###] == "WM_WHATEVER OR ES_WHATEVER OR WHATEVR_WHATEVER" should trigger the break only on conditions if it triggers always that means you are not setting a conditional break point but a hard break point (see the color hard means red colour conditional means pink or yello colour marker will be there) also you can ask olly dbg to never pause on any thing but log everything or log only on condition pause and log on condition etc etc Dispatch Spelling may be wrong it may be Despatch or just ansi version is available use find names (ctrl+n) on kernel32.dll and start typing d and look for the api "unknown identifier means you asked ollydbg to look for some rubbish name and it says hey that name is rubbish it doesnt exist go find the right name dont give me rubbish names" second question i didnot understand any part of it you set break point according to your need or set break point on everything and when it hit remove them one by one if the hit is not what you are looking for for example right click find command->call r32-->enter ---> right click -> set log break points on all referance would set 10000 of break points at one |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Where's OllyDbg | imagin | General Discussion | 5 | 06-11-2005 20:07 |