Really easy scripting with ODbgScript

ODbgScript is an extension for OllyDbg debugger (note to myself: so mr smartass there’s life except SoftICE heh πŸ™‚).

I was always a little bit afraid of using it becouse i thought it’s easier to write separate application than to code in this weird scripting language.

But today i need a tool to dump decrypted strings from one application (while it’s running). I wanted to start coding live dumper based on WinApi’s debug functions but i though what the heck, let’s try to do it in ODbgScript.

Here’s the result:

; declare variables
        var     string_ptr
        var     file_name
        var     file_index
        var     file_size
        var     x
 
; set breakpoint at the instruction where we
; intercepts decrypted strings
        bp     401020
 
; initialize file_index variable
        mov     file_index, 0
 
; run application after setting the breakpoint
again:
        run
 
; if we're here, it means application hit the breakpoint
; continue to execute script after breakpoint is hit
; (don't stop in OllyDbg)
        cob
 
; pointer to the encrypted string is stored
; at [ebp-14] let's grab it
        mov     x, ebp
        sub     x, 14
        mov     x, [x]
 
        mov     string_ptr, x
 
; strings are null terminated, let's find its
; size so we can dump it (LEN command didn't work
; here, it always returns 0FFh)
        find    string_ptr, #00#
 
        cmp     $RESULT, 0
        je      skip_file
 
; calculate string size
        mov     x, $RESULT
        sub     x, string_ptr
 
        mov     file_size, x
 
; format file name for decrypted string, name it using
; file_index value and .txt extension, eval works almost
; like wsprintf
        eval    "C:\Test\{file_index}.txt"
        mov     file_name, $RESULT
 
; dump memory area to the file
        dm      string_ptr, file_size, file_name
 
; log action
        eval    "{file_index} - VA = {string_ptr},
                 SIZE = {file_size}"
        log     $RESULT;
 
; increase index value
        inc     file_index
 
skip_file:
 
; run application again after dumping
        jmp     again

At first it might look confusing, but after playing with it for 5 minutes you will love it, especially if you know how to code in assembler.

And if you make mistakes in the script, don’t worry, it has its own, built-in debugger, available directly from OllyDbg so you can spot every mistake you did, trace down the script, modify its variables etc.

In other words viva la ODbgScript πŸ™‚

PS. And don’t ask me why i didn’t use it before πŸ˜‰

SSE5 on the way

With the introduction of SSE5, many new 128-bit instructions have been added to the existing instruction set detailed in the AMD64 Architecture Programmer’s Manuals. Included are 46 base instructions that expand to 170 total instructions, enabling improved performance and reduced loads.

Source:
http://developer.amd.com/tools-and-sdks/archive/legacy-cpu-gpu-tools/128-bit-sse5-instruction-set/

PDF Documentation:
AMD64 Technology 128-Bit SSE5 Instruction Set

I wonder in how many years will it be used as a default set of instructions?

MultiExtractor v2.50a is out

A new version of MultiExtractor has been released. What’s new in 2.5.0a?

  • ICL icon extraction (now you can extract icons from ICL files)
  • Added MID, MPG, TIFF, EMF, WMF formats
  • Possibility of unpack CAB (also InstallShield CAB’s)
  • Image buffering (faster displaying of visited images)
  • Naming of files through numbering (Explorer option)
  • Upgraded conversion support (bitmap to bitmap with another background color)

MultiExtractor vs C: drive

MultiExtractor v2.50a

MultiExtractor v2.50a

Safari browser is broken

Last weekend i’ve been playing with an iMac, i was checking my website against its Safari browser and i was very pleased to see it works pretty good (all things were rendered correctly).

Now Apple made Safari browser available for Windows too, but its rendering is pretty much broken, most of the sites (except apple.com) are rendered incorrectly (compared to the results from IE, Opera and FF) one way or another.

My website is missing some pieces in Safari (headers, navigation tabs):

PELock website broken in Safari

At first i thought it’s my fault (some incorrect CSS styling or smth), but then i’ve realized even Google’s site is broken (blank spaces):

GoogleҀ™s website broken in Safari

I wonder did they even test it in Windows before the release?

PayPal madness

Ok, today i wanted to check status of my unused PayPal account, everything went fine until i read that my account is limited becouse i didn’t sign upgraded license terms. So i wanted to sign this god damn thing but i couldn’t find it on their website, instead i found this:

PayPal limited

Especially i like the “cannot be appealed” term πŸ™‚

I thought, let’s close my current account and create a new one, but it’s not possible with limited accounts πŸ™‚

PayPal close account

So i can’t use my account, i can’t close it and i can’t create a new account using my current data πŸ™‚

Update: already fixed, all i had to do was to read 1MB of documentation πŸ˜‰