首页
社区
课程
招聘
[分享]一款OD插件,名曰“寄存神搜”是我从上百款插件中试出来并汉化的
发表于: 2014-7-10 18:30 7270

[分享]一款OD插件,名曰“寄存神搜”是我从上百款插件中试出来并汉化的

2014-7-10 18:30
7270
简直是重启类软件的 噩梦
手工汉化了下


OllyStepNSearch v0.6.2 plugin
2006 Didier Stevens https://DidierStevens.com
2010 Mark D. Adams http://myblog.org

This plugin allows you to search for a given text when automatically
stepping through the debugged program.

When the plugin is enabled, it will step automatically through the debugged
program once a step command (like Step Into) is issued.
Enabling the plugin is done with the "Options" menu command.
After enabling, press F7 to start.

After each step, the plugin will check which registers have changed.
If a changed register points to a string, it is logged.
If a search string has been defined and it is contained in the string
pointed to by the register or the Information pane, the stepping is paused.
Comparison is case sensitive.

A search string is defined by entering it with the "Options" menu command.
It is remembered in the OllyDbg INI file.
Entering an empty string disables the break on string command.
OllyStepNSearch can search in strings pointed to by registers (Search Registers toggle)
and it can search in the Information pane of the CPU window (Search Information toggle).
Read the "Information window" help section of the OllyDbg v1.10 help file if you're not familiar
with the Information pane.

If the search string is not found, debugging is resumed. If the current address
is lower than the limit address (by default 0x10000000) a step into command is
issued. A step over command is issued if the current address is higher than the
limit address, or if the current command is a call/jump to an address higher
than the limit address.
The limit address can be changed in the Options dialog.

The plugin can be disabled automatically when the search string is found (Disable after break toggle).
I added this option because I usually want to single step after finding the search string,
but often forgot to disable the plugin before single stepping.

Restarting the debugged program disables the plugin.

★★调试样例★★★
- Start OllyDbg and load the ftp.exe program (in system32 directory)
- Start the OllyStepNSearch plugin "Options" menu command
- Enter "google" as Search string (without the double quotes, of course)
- Enable StepNSearch
- Click OK
- Press F7 to start debugging
- Go to the FTP window and type "open google.com" and press enter
- The StepNSearch plugin will stop debugging when a register points to
a string containing google.
On my Windows XP SP2, this happens when EAX points to "open google.com".
- You can continue with F7 and see how ftp.exe parses the "open google.com" command.


[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

上传的附件:
收藏
免费 0
支持
分享
最新回复 (12)
雪    币: 13186
活跃值: (4246)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
不用一直盯着按F7了
2014-7-10 19:14
0
雪    币: 1844
活跃值: (35)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
3
看了一下介绍,说真的,没什么用 。。。。。。。
2014-7-10 19:52
0
雪    币: 3277
活跃值: (1992)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
好像作用不大啊。
2014-7-10 22:58
0
雪    币: 2325
活跃值: (4832)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
这个 只是 显示 那个字符串的?
2014-7-10 22:59
0
雪    币: 163
活跃值: (45)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
Mark
2014-7-10 23:03
0
雪    币: 217
活跃值: (14)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
看了一下介绍, 感觉作用,谢了
2014-7-11 00:29
0
雪    币: 22
活跃值: (443)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
8
有点意思!!
2014-7-11 09:43
0
雪    币: 35
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
好东西,谢谢楼主。
2014-7-11 10:04
0
雪    币: 2401
活跃值: (1402)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
10
存在即合理,
对某些朋友,应该是有帮助的。
2014-7-11 10:48
0
雪    币: 62
活跃值: (971)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
11
不错,但是只支持字符串?如果是能搜索寄存器特定的值多好。
2014-7-11 11:10
0
雪    币: 3
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
对某些朋友,应该是有帮助的。
2018-2-1 18:33
0
雪    币: 16386
活跃值: (1600)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
wonderzdh 不错,但是只支持字符串?如果是能搜索寄存器特定的值多好。
可以的
2018-4-29 11:52
0
游客
登录 | 注册 方可回帖
返回
//