OllyDBG v2.xx plugin - OllyExt

[Newbie_Cracker]

Originally Posted by ferrit.rce

I've debugged thousands of hours with 1.1 and that was the reason why I've decided to use the new version
Even if it has also some bugs it has 2 advantages for me:
1. It's not crashing so much
2. Oleh will fix these problems

I agree with you, but lack of some features pushes me to use v1.10, specially for unpacking. But because of lack of comprehensive workable anti-anti plugin, I'm in trouble

I think you need do some modification in you code for OD1.1 PDK, API patching is the same. Isn't it?

[ferrit.rce]

API patching is exactly the same but the PDK interface and feature set is really different. A lot of used new features doesn't exist on 1.1. I can take a look at once again but can't promise anything...
BTW what is missing from 2.x?

Originally Posted by Newbie_Cracker

I agree with you, but lack of some features pushes me to use v1.10, specially for unpacking. But because of lack of comprehensive workable anti-anti plugin, I'm in trouble

I think you need do some modification in you code for OD1.1 PDK, API patching is the same. Isn't it?

[Newbie_Cracker]

Originally Posted by ferrit.rce

API patching is exactly the same but the PDK interface and feature set is really different. A lot of used new features doesn't exist on 1.1. I can take a look at once again but can't promise anything...
BTW what is missing from 2.x?

Thanks for checking the possibility.

For the features, it's not the right topic to discuss about the features missing but small things that I use heavily:

- Mem BP on Write on PE sections,memory regions (very handy for unpacking, reversing)
- Handles window button (I hate extra clicks)
- Patches window (not critical, but comes handy sometimes)


I've found some bugs but now remember these:

- Show Symbolic address is too stupid in OD2.x for CALL DWORD[adr]. If you press space on such codes OD shows

CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] instead of CALL DWORD PTR DS:[4080AC].

I really hate it !

- Some unknown exception while loading packed files.
- OD2.x fails to show pe sections seperately in Execryptor packed files, even in unpacked files (interesting bug)

and all plugins which exist for OD 1.1

So I still use OD1.10

[quygia128]

Originally Posted by Newbie_Cracker

I've found some bugs but now remember these:

- Show Symbolic address is too stupid in OD2.x for CALL DWORD[adr]. If you press space on such codes OD shows

CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] instead of CALL DWORD PTR DS:[4080AC].

I really hate it !

I will code a plugin to Fix this problem automatic way when you run OllyDbg, please wait.

BR,
quygia128

[ferrit.rce]

New v1.6 is out. Changes:

- CreateThread
- Version information resource added