Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

findcmd problem

Bugs/suggestions/scripts/... for OllyScript plugin
Locked
Noxerus

findcmd problem

Post by Noxerus »

I'm having a strange problem with findcmd in ODbgScript 1.64.
I want to find the closest appearance of a certain asm command after eip, so I use the following script:

Code: Select all

findcmd eip, "push 100"
gref 1
msg $RESULT
The problem is that the result I get appears much before eip...
Investigating this problem, I opened the references window and found that Olly has searched for my command in a large block which has eip at its center. When I call "gref 1", instead of getting back the address of the first instance of "push 100" after eip, I get the first instance of "push 100" in the current memory block.
What can I do to fix this?

Thanks in advance.
Externalist
Member
Posts: 57
Joined: Wed Dec 26, 2007 8:00 am

Post by Externalist »

Try using ODbgScript 1.65.4, or use findop instead...?
Noxerus

Post by Noxerus »

Thank you for your suggestion, but it's still not working, even after upgrading to the latest version of ODbgScript... and findop is not a good solution (except for this specific case) because it does not really support approximate commands. Any other suggestions?
By the way, why aren't any versions newer than 1.64 uploaded to the official SourceForge site?
Epsylon3
Senior Member
Posts: 129
Joined: Fri May 26, 2006 5:10 pm
Location: France

Post by Epsylon3 »

1.65.4 is a chinese version, and i dont have sources...
Locked