OK master Yoda, Reprimand taken :P
I'll read your posts thoroughly at least three times before answering.
This is an excerpt of the code OLLY is cycling through:
Code:
004395F9 > 833D 5C5A4D00 >CMP DWORD PTR DS:[4D5A5C],3
00439600 . 74 14 JE SHORT OLLYDBG.00439616
00439602 . 6A 00 PUSH 0 ; /Arg1 = 00000000
00439604 . E8 43D50500 CALL OLLYDBG.00496B4C ; \OLLYDBG.00496B4C
00439609 . 59 POP ECX
0043960A . 6A 01 PUSH 1 ; /Timeout = 1. ms
0043960C . E8 AB5B0700 CALL <JMP.&KERNEL32.Sleep> ; \Sleep
00439611 . E9 D80C0000 JMP OLLYDBG.0043A2EE
00439616 > 6A 00 PUSH 0 ; /Timeout = 0. ms
00439618 . 68 14574D00 PUSH OLLYDBG.004D5714 ; |pDebugEvent = OLLYDBG.004D5714
0043961D . E8 E85B0700 CALL <JMP.&KERNEL32.WaitForDebugEvent> ; \WaitForDebugEvent
00439622 . 85C0 TEST EAX,EAX
00439624 . 75 44 JNZ SHORT OLLYDBG.0043966A
00439626 . 833D 543B4E00 >CMP DWORD PTR DS:[4E3B54],0
0043962D . 74 27 JE SHORT OLLYDBG.00439656
0043962F . 8B0D 583B4E00 MOV ECX,DWORD PTR DS:[4E3B58]
00439635 . 83C1 64 ADD ECX,64
00439638 . 3B4D CC CMP ECX,DWORD PTR SS:[EBP-34]
0043963B . 73 19 JNB SHORT OLLYDBG.00439656
0043963D . 6A 00 PUSH 0 ; /lParam = 0
0043963F . 6A 00 PUSH 0 ; |wParam = 0
00439641 . 6A 00 PUSH 0 ; |Message = WM_NULL
00439643 . A1 5C3B4E00 MOV EAX,DWORD PTR DS:[4E3B5C] ; |
00439648 . 50 PUSH EAX ; |ThreadId => 0
00439649 . E8 F25E0700 CALL <JMP.&USER32.PostThreadMessageA> ; \PostThreadMessageA
0043964E . 33D2 XOR EDX,EDX
from here it goes and peek some messages a few lines below then loops to itself somewhere above.
so yes, OLLY uses a loop to Query for both windows messages and check for debug events every few ms
Bookmarks