API Tracing by ollydbg

来源：互联网发布：心电图数据正常值编辑：程序博客网时间：2024/05/17 09:27

right click -> search for all intermodular calls --> right click --> set log break point on every command

if log function arguments radio button is greyed out
analyse the exe or dll or module first

after that you will see the log function arguments radio button is enabled

for example ollydbg -> calc.exe -> alt+e comctl32.dll -> right click follow entry point + ctrl+a --> right click -> search for all intermodular calls -> right click set log break point on every command -> log function arguments -->

log window -> right click --> log to file --> f9

result

01012475 Program entry point Analysing calc 158 heuristical procedures 273 calls to known, 167 calls to guessed functions 91 loops, 22 switches 71950000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll Analysing comctl32 2338 heuristical procedures 6475 calls to known, 3224 calls to guessed functions 739 loops, 260 switches 5AD70000 Module C:\WINDOWS\System32\uxtheme.dll 7197E147 CALL to GetWindowLongW hWnd = 001001D8 (class='Edit') Index = 0. 7197E165 CALL to DefWindowProcW hWnd = 001001D8 (class='Edit') Message = WM_GETMINMAXINFO wParam = 0 pMinMax = 0006F840 7197E147 CALL to GetWindowLongW hWnd = 001001D8 (class='Edit') Index = 0. 7197E5AB CALL to GetProcessHeap 7197E5B2 CALL to HeapAlloc hHeap = 00090000 Flags = HEAP_ZERO_MEMORY HeapSize = 124 (292.) 7197E5C7 CALL to SetWindowLongW hWnd = 001001D8 (class='Edit') Index = 0. NewValue = 94978 719A9C93 CALL to GetWindowLongW hWnd = 001001D8 (class='Edit') Index = -1. 7197C096 CALL to GetVersionExW pVersionInformation = 0006F58C 719A9D8E CALL to LocalAlloc Flags = LHND Size = 40 (64.) 71954296 CALL to LoadLibraryA FileName = "UxTheme.dll" 719542F7 CALL to GetProcAddress hModule = 5AD70000 (uxtheme) ProcNameOrOrdinal = "OpenThemeData" 719A9DD7 CALL to DefWindowProcW hWnd = 001001D8 (class='Edit') Message = WM_NCCREATE wParam = 0 pCreate = 0006F838 7197E147 CALL to GetWindowLongW hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') Index = 0. 719B7B46 CALL to DefWindowProcW hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') Message = WM_NCCALCSIZE CalcFlag = FALSE Data = 0006F860 7197E147 CALL to GetWindowLongW hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') Index = 0. 7197CDB1 CALL to GetDC hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') 7197CD03 CALL to CopyRect pRectDst = 0006F568 pRectSrc = 000949B8 {0.,0.,0.,0.} 7197CD42 CALL to GetClientRect hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') pRect = 0006F558 7197CD78 CALL to IntersectRect pRectDst = 0006F558 pRect1 = 0006F558 {0.,0.,762.,498.} pRect2 = 0006F568 {0.,0.,0.,0.} 7197CD8D CALL to IntersectClipRect hDC = 34010635 Left = 0 Top = 0 Right = 0 Bottom = 0 719AAB9F CALL to GetTextCharset hDC = 34010635 7197CDF2 CALL to ReleaseDC hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') hDC = 34010635 719AABB6 CALL to GetKeyboardLayout ThreadID = 0 719AAD57 CALL to GetDC hWnd = 001001D8 ('CalcMsgPumpWnd',class='Edit') 719A9B87 CALL to GetTextFaceW hDC = 34010635 MaxFaceName = 20 (32.) pFaceName = 0006F4D8 7197D434 CALL to GetTextCharsetInfo hDC = 34010635 pSignature = 0006F50C Flags = 0 stripped off 453 kb of further garbage --------------------------------------------------------------------------------------------------------------

bmazic:

Expanding on my previous post, here is a solution to creating custom breakpoint sets for OllyDbg. The procedure is as follows: A) Using OllyDbg, export a list of names in a DLL. To do that, do the following: 1. Alt-E (View|Executable modules) 2. Select the module you are interested in 3. Ctrl-N (Right click|View names) 4. Right click|Copy to clipboard|Whole table 5. Paste the copied text to a text editor, then add the module's base address to the first line saying, e.g. Names in kernel32, Base=7C800000 NOTE: Make sure you resize all columns properly (so all text in a column becomes clearly visible) before copying the function names to the clipboard. B) With the file created, you can now run the provided python script to generate the *.obp file (Pedram Amini's Breakpoint Manager file format), e.g. python names2obp.py < kernel32.txt > kernel32.obp C) Modify the provided python script to change the breakpoint type or filter out the exports you want breakpoints on Tweak the expresion parameter in the source of the python script to change the type of breakpoints generated. The 'Q' means conditional log breakpoint with the following options selected (Pause program: Never, Log value of expression:Never, Log function arguments: Always). Modify the not_filtered() function to change the way the input list is filtered. The current implementation will filter out all but file management functions from kernel32.dll. Keep that in mind when you run it for the first time. D) Having made sure you have Pedram Amini's Breakpoint Manager plugin already installed, run the target and load the breakpoint set(s) Alt-B (View|Breakpoints) Right-click|Breakpoint Manager|Import Breakpoints That's it. Boris The python script source follows: %<------%<------%<--CUT_HERE----%<------%<------%<------%<

#### File:       names2obp.py# Author:     Boris Mazic# Date:       19/02/2008##"""Convert OllyDbg's module name list (a list of exported and forwarded functions) to Pedram Amini's Breakpoint Manager *.obp file format. You can filter outthe list to include only certain exports by modifying the script below.To create a list of exported functions do the following in OllyDbg:1. Alt-E (View|Executable modules)2. Select the module you are interested in3. Ctrl-N (Right click|View names)4. Right click|Copy to clipboard|Whole table5. Paste the copied text to a text editor, then add the module's baseaddress to the first line saying, e.g.Names in kernel32, Base=7C800000With the file created, you can now run this python script to generate the *.obp file, e.g.names2obp.py < kernel32.txt > kernel32.obpTweak the expresion parameter in the source below to change the type of breakpoint generated. The 'Q' means conditional log breakpoint with the following options selected (Pause program: Never, Log value of expression:Never, Log function arguments: Always).NOTE: Make sure you resize all columns properly (so all text in a column becomes clearly visible) before copying the function names to the clipboard. """import sys, re, string# Typical input:"""Names in kernel32, Base=7C800000Address    Section    Type    (Known)                        Name                                                    Comment7C80A634   .text      Export                                 ActivateActCtx7C8231D5   .text      Export  (Known)                        WriteProfileStringW"""RE_title = re.compile(r'^Names in (\S+), Base=([0-9a-fA-F]+)')RE_heading = re.compile(r'^Address\s+Section\s+Type\s+\(Known\)\s+Name\s+Comment')RE_api_info = re.compile(r"""    ^([0-9a-fA-F]+)     # Address    \s+    (\S+)               # Section    \s+    ((\S+)(\s+\(Known\))?)  # Type    \s+    (\S+)               # Name    (\s+(\S+))?         # Comment    """, re.VERBOSE | re.MULTILINE)file_management = 'AreFileApisANSI|CheckNameLegalDOS8Dot3|CloseHandle|CopyFile|CopyFileEx|CreateFile|CreateHardLink|DeleteFile|FindClose|FindFirstFile|FindFirstFileEx|FindFirstStreamW|FindNextFile|FindNextStreamW|GetBinaryType|GetCompressedFileSize|GetFileAttributes|GetFileAttributesEx|GetFileInformationByHandle|GetFileSize|GetFileSizeEx|GetFileTime|GetFileType|GetFullPathName|GetLongPathName|GetShortPathName|GetTempFileName|GetTempPath|MoveFile|MoveFileEx|MoveFileWithProgress|ReOpenFile|ReplaceFile|SearchPath|SetFileApisToANSI|SetFileApisToOEM|SetFileAttributes|SetFileSecurity|SetFileShortName|SetFileTime|SetFileValidData|'file_io = 'CancelIo|CreateIoCompletionPort|FlushFileBuffers|GetQueuedCompletionStatus|LockFile|LockFileEx|PostQueuedCompletionStatus|ReadFile|ReadFileEx|ReadFileScatter|SetEndOfFile|SetFilePointer|SetFilePointerEx|UnlockFile|UnlockFileEx|WriteFile|WriteFileEx|WriteFileGather|'file_mapping = 'CreateFileMapping|FlushViewOfFile|MapViewOfFile|MapViewOfFileEx|OpenFileMapping|UnmapViewOfFile|'memory_management = 'CopyMemory|CreateMemoryResourceNotification|FillMemory|GetLargePageMinimum|GetWriteWatch|GlobalMemoryStatus|GlobalMemoryStatusEx|IsBadCodePtr|IsBadReadPtr|IsBadStringPtr|IsBadWritePtr|MoveMemory|QueryMemoryResourceNotification|ResetWriteWatch|SecureZeroMemory|ZeroMemory|'memory_global_and_local = 'GlobalAlloc|GlobalDiscard|GlobalFlags|GlobalFree|GlobalHandle|GlobalLock|GlobalReAlloc|GlobalSize|GlobalUnlock|LocalAlloc|LocalDiscard|LocalFlags|LocalFree|LocalHandle|LocalLock|LocalReAlloc|LocalSize|LocalUnlock|'memory_heap = 'GetProcessHeap|GetProcessHeaps|HeapAlloc|HeapCompact|HeapCreate|HeapDestroy|HeapFree|HeapLock|HeapQueryInformation|HeapReAlloc|HeapSetInformation|HeapSize|HeapUnlock|HeapValidate|HeapWalk|'memory_virtual = 'VirtualAlloc|VirtualAllocEx|VirtualFree|VirtualFreeEx|VirtualLock|VirtualProtect|VirtualProtectEx|VirtualQuery|VirtualQueryEx|VirtualUnlock|'dynamic_linking = 'DisableThreadLibraryCalls|DllMain|FreeLibrary|FreeLibraryAndExitThread|GetDllDirectory|GetModuleFileName|GetModuleFileNameEx|GetModuleHandle|GetModuleHandleEx|GetProcAddress|LoadLibrary|LoadLibraryEx|SetDllDirectory|LoadModule|'process_management = 'CreateProcess|CreateProcessAsUser|CreateProcessWithLogonW|CreateProcessWithTokenW|ExitProcess|FreeEnvironmentStrings|GetCommandLine|GetCurrentProcess|GetCurrentProcessId|GetCurrentProcessorNumber|GetEnvironmentStrings|GetEnvironmentVariable|GetExitCodeProcess|GetGuiResources|GetLogicalProcessorInformation|GetPriorityClass|GetProcessAffinityMask|GetProcessHandleCount|GetProcessId|GetProcessIdOfThread|GetProcessIoCounters|GetProcessPriorityBoost|GetProcessShutdownParameters|GetProcessTimes|GetProcessVersion|GetProcessWorkingSetSize|GetProcessWorkingSetSizeEx|GetStartupInfo|NeedCurrentDirectoryForExePath|OpenProcess|SetEnvironmentVariable|SetPriorityClass|SetProcessAffinityMask|SetProcessPriorityBoost|SetProcessShutdownParameters|SetProcessWorkingSetSize|SetProcessWorkingSetSizeEx|TerminateProcess|WinExec|'process_enumerate = 'EnumProcesses|Process32First|Process32Next|WTSEnumerateProcesses|'thread_management = 'AttachThreadInput|CreateRemoteThread|CreateThread|ExitThread|GetCurrentThread|GetCurrentThreadId|GetExitCodeThread|GetThreadId|GetThreadIOPendingFlag|GetThreadPriority|GetThreadPriorityBoost|GetThreadTimes|OpenThread|ResumeThread|SetThreadAffinityMask|SetThreadIdealProcessor|SetThreadPriority|SetThreadPriorityBoost|SetThreadStackGuarantee|Sleep|SleepEx|SuspendThread|SwitchToThread|TerminateThread|ThreadProc|TlsAlloc|TlsFree|TlsGetValue|TlsSetValue|WaitForInputIdle|'### Create a filter for API calls we want to place a breakpoint on##filter = '|'filter += file_management + file_io + file_mapping#filter += memory_management + memory_global_and_local + memory_heap + memory_virtual#filter += dynamic_linking#filter += process_management + process_enumerate + thread_managementdef not_filtered(address, section, type, apicall, comment):    if(type != 'Export'):         return 0    f = apicall     if(apicall[-1] in ['A', 'W']):         f = apicall[0:-1]    if(filter.find('|' + f + '|') >= 0):        return 1    return 0def main():    base_address = 0    expression = 'Q'    f = sys.stdin    line = f.readline()     # Names in kernel32    m = RE_title.match(line)    if(not m):        print "ERROR: invalid 1st line\n%s" % line        return 1    module, base_address = m.group(1,2)    base_address = long(base_address, 16)    line = f.readline()     # Address Section Type (Known) Name Comment    m = RE_heading.match(line)    if(not m):        print "ERROR: invalid 2nd line\n%s" % line        return 1    while 1:        line = f.readline()        if(not line): break        m = RE_api_info.match(line)        if(not m): break        address, section, type, apicall, comment = m.group(1, 2, 4, 6, 8)        address = long(address, 16)        if(not_filtered(address, section, type, apicall, comment)):            print "%s:%08X:%s:%s" % (module, address-base_address, expression, apicall)    return 0main()

%<------%<------%<--CUT_HERE----%<------%<------%<------%<