Results 1 to 2 of 2

Thread: Question about "Find references to "

  1. #1

    Question Question about "Find references to "

    CPU pane 's the context menu in ollydbg has an item: "Find references to ".
    "Find references to " contains 2 the subitems: "selected command" and "selected address" .

    However,I feel the feature of the subitems is same, but why does ollydbg name them different names?

    When I looked up ollydbg's help, an explanation about the items is "first select address ". oh! I consider the explanation is confusing. what does it mean?

    Could someone tell me which differences are between "selected command" and "selected address" ?

    Thanks!

  2. #2
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,114
    Blog Entries
    5
    Hi

    I believe I have an explanation for that, but I think it would be more fun to pose it as a little challenge for anyone who wants to try it, since it will expose a bit of how Olly works and maybe as a useful tidbit for writing plugins.

    Start with disassembling Olly in IDA and search for those 2 commands (View/Open subviews/Strings). As you surmised they are very similar, but only 1 menu item will be shown at any one time, depending on a previous condition.

    The previous condition(s) that will produce one or the other menu items is easily discerned from the disassembly as an absolute value (constant), but what isn't explained of course is the *meaning* of those constants.

    However, if you search for those constants in plugin.h in the development kit you will find their meanings.

    It appears that the "selected command" menu item is the one that will occur most often in a normal analysis. I couldn't find a normal instruction which would produce the "selected address" menu without altering the Analysis mode.


    So the challenge then is to produce a situation (unless you can find an existing instruction - which you'll probably be able to once you understand the difference) which will cause the "selected address" menu item to appear on an instruction. You should be able to do this by studying the relevant plugin.h constants and by altering the Analysis heuristics. When you can do this, and revert back to the original condition, the difference between the two menu items should become more apparent


    Cheers,
    Kayaker

Similar Threads

  1. Replies: 0
    Last Post: February 13th, 2014, 07:42
  2. Question about "Test"
    By yosef07212 in forum The Newbie Forum
    Replies: 4
    Last Post: September 26th, 2011, 00:03
  3. Replies: 1
    Last Post: December 14th, 2007, 13:35
  4. Question to: "trace over system dll"
    By Anonymous in forum OllyDbg Support Forums
    Replies: 3
    Last Post: February 13th, 2005, 04:17
  5. Find "EXE is damaged" by NetCaptor v7.01
    By Solomon in forum Advanced Reversing and Programming
    Replies: 17
    Last Post: September 15th, 2002, 08:16

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •