能力值:
( LV2,RANK:10 )
|
-
-
3 楼
就是写一个插件,让OD单步走,就和F7效果一样,我需要获取CPU寄存器的值,所以需要让OD不停的以单步运行,但是我看手册上面的函数,里面有个运行到某地址的地址,类似F4的效果吧,我不知道下个指令的地址是哪里,也不知道怎么计算,总是,就是让插件做到按F7一样的效果
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
虽然这几天自己勉强解决了问题,但是插件的效率自己实在不敢恭维,其实我需要的就是监视FPU,当出现指定的浮点数的时候中断,所以需要让OD不停单步运行,我的做法是调用Sendshortcut,使用快捷键来完成,但是速度极慢,我记得OD的内存断点也是每执行一步就会进行判断的,但是速度起码比我用快捷键的方式快很多,还有一个原因,内存断点他只会在后台不断的判断,但是我这种方法每运行一步都会显示到界面上去,拖慢速度,所以我希望能像内存断点那样,不知道那是怎么实现的.希望高手指点下!
// OD_FPU.cpp : Defines the entry point for the DLL application.
//
#include "stdafx.h"
#include "Plugin.h"
#include "stdio.h"
#include "math.h"
#include <memory.h>
#include <string.h>
char g_szPluginName[] = "OD_FPU";
HANDLE hinst; // DLL instance
HWND hwmain; // Handle of main OllyDbg window
bool test=false;
static unsigned char FstEnvSave[32];
static char Fst_0_str[200];
double fst_0;
long int top;
double RelativeError=0.01;
double DesDouble=0.0;
bool Debug=false;
bool find=false;
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
hinst=hModule;
return TRUE;
}
extc int _export cdecl ODBG_Plugindata(char shortname[32])
{
strcpy(shortname, g_szPluginName); //插件名
return PLUGIN_VERSION; //版本
}
//插件初始化函数
extc int _export ODBG_Plugininit(int ollydbgversion,HWND hw,ulong *features)
{
hwmain=hw;
return 0;
}
extc int _export cdecl ODBG_Pluginmenu(int origin, char data[4096], void *item)
{
if (origin == PM_MAIN)
{
strcpy(data, "0 误差, | 1 关于");
return 1;
}
else if (origin == PM_CPUREGS )
{
if (Debug==FALSE)
{
strcpy(data, "0 FPU断点");
}
else
{
strcpy(data, "0 FPU_PLUGIN 停止");
}
return 1;
}
return 0;
}
extc void _export cdecl ODBG_Pluginaction(int origin, int action, void *item)
{
if (PM_MAIN == origin && 0 == action )
{
_Getfloat("误差范围",(void *) &RelativeError,8,0,0);
}
else if (origin == PM_MAIN && action == 1)
{
MessageBox(0,"\tOD_FPU_PLUGIN ver1.0\t\t\n\t\tby no comment\n","OD_FPU_PLUGIN",MB_OK);
return ;
}
else if (origin == PM_CPUREGS && action ==0 )
{
if (Debug==FALSE)
{
_Getfloat("设定浮点数",(void *) &DesDouble,8,0,0);
Debug=TRUE;
_Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F7);
}
else
{
Debug=FALSE;
}
}
return ;
}
int ODBG_Paused(int reason, t_reg *reg)
{
switch(reason)
{
case PP_EVENT: //暂停于调试事件
{
if (!Debug) //未开启调试功能
{
return 1;
}
t_thread *pthread;
ulong pid;
find =false;
pid=_Plugingetvalue(VAL_MAINTHREADID);
pthread=_Findthread(pid);
if (pthread!=NULL)
{
__asm FSTENV [FstEnvSave]
unsigned char *pStart,*pEnd;
pStart= (unsigned char *) &pthread->context.FloatSave.RegisterArea[0];
pEnd = (unsigned char *) &pthread->context.FloatSave.RegisterArea[80];
for (;pStart<pEnd;pStart+=10)
{
__asm
{
push eax
mov eax,[pStart]
fld tbyte ptr [eax]
fstp qword ptr [fst_0]
pop eax
}
_Printfloat8(Fst_0_str,fst_0);
fst_0=atof(Fst_0_str);
if (fabs(fst_0 - DesDouble)<RelativeError)
{
find=true;
}
}
__asm FLDENV [FstEnvSave];
}
if (find)
{
_Sendshortcut(PM_DISASM ,0,WM_KEYDOWN,0,0,VK_F2);
//MessageBox(0,"FInd","t",MB_OK);
Debug=FALSE;
}
else
{
_Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F7);
}
}
break;
case PP_PAUSE: //暂停于用户请求
// MessageBox(0,"break","o",MB_OK);
break;
case PP_TERMINATED: //应用程序终止
//MessageBox(0,"3","o",MB_OK);
break;
}
return 1;
}
|