Jump to content
Tuts 4 You

Help With Writing Olly Plugin.


Recommended Posts

Hi All, I was wondering if someone could have a look at my src and tell help figure out what I have done wrong or am missing with my plugin code.


the dialog boxes don't appear correctly, and the patch just crashes olly when he tries to load a file.

here is the src. It is in masm and winasm studio.

It is a plugin to patch GetSystemTime, to hide olly from various techniques that read it and do some other things, like int3 or checking how long some code takes to execute.

thx :D

Edited by Fungus
Link to comment

Not much only a little problem

i fixed you had inc eax just after xor eax,eax

is caused the problem i removed it and the dialog appeares

normally now i hope it's working too bro' please check it can you ?!

Dialog appeares well now i'am only

checking why ollydbg crashes so try the

attached file and check dialog i'll see the other problem......


Edited by Angel-55
Link to comment

Angel-55: thanks alot! Will check immediate :)

It's my first serious x86 code, so I really appreciate your help very much.

Link to comment
Its nice that you share your source code Fungus :thumbsup:

zako; glad to , aren't we supposed to be helping each other here? :D

Ok, here is my newest src (deleted the previous)

ok, I got it working, but it only patches GetSystemTime in Olly's Process, not in the Debugged Process. Any clues?



Link to comment

Fungus can you explain more please

i don't understand what you mean 100%

so a bit more explaination is better and any

target to try it with the plugin ?? "CrackMe or similar"

thanx' in advanced and congratulations

for your working Plugin "nice work bro' keep it" !!


Link to comment

Because GetSystemTime is pretty constant in all apps, you can get the address of it with GetProcAddress. If you want you can even get the patch addresses from Olly's context. Then, to patch the code in the debuggee you can use Writememory.

Link to comment

Angel 55: oh like xADT, it has a plugin for GetSystemTime and int, it sets SEH, invokes GetSystemTime, executes an int3, then invokes GetSystemTime again, and subtracts the results from each other,

if seconds > 0, then I am being debugged.

MOID: do you have an example to use writememory for this? thx :)

Link to comment

I cant download the src i get an error

The error returned was:

Sorry, some required files are missing, if you intended to view a topic, it's possible that it's been moved or deleted. Please go back and try again.

any clue on why this is?

Link to comment

Because Teddy changed host yesterday or so, and there is bound to be some errors :)

I can ul somewhere if you wanna look.

I have expanded it to handle GetLocalTime aswell, but I'm still trying to figure out how to set the segment properly, so I write to the debugged process. I checked the src code of Is Debugger Present 1.4, but the way he is setting the segment base isn't making any sense to me :D

I don't understand the assume directive of MASM yet.

It looks like this....

get_byte_location proc
push ebx
invoke Getcputhreadid
.if (eax)
invoke Findthread,eax ;retreive thread info
assume eax:ptr t_thread
push [eax].reg.base[4*4] ;base of FS
pop ebx
add ebx,30h
invoke Readmemory,addr dw_buffer,ebx,4,MM_RESTORE
mov eax,dw_buffer
add eax,2h
pop ebx

if someone could explain how it works exactly, that would be really cool. The docs on in the SDK don't say much about Findthread, let alone how to set the segment base.

Edited by Fungus
Link to comment

Fungus do you get any errors while

using this method ?? if so then could you

please wriet what WinASM says to you and thanx' again .......

the IsDebuggerPresent source isn't with me

i fsome one could upload it it would be nice and

thanx' in advanced and to attach cause there is a problem !!

Link to comment

Ted. i have one question why doesn't this link work ??

Link: www.tut4you.com

and thanx' for fixing the attachment problem

it works now perfectly good job !! :)

Link to comment

No Ted. it's a writting mistake it still

doesn't work check it your self here i get this message !!

"This directory no longer exists, please go to: http://www.tuts4you.com/"

I go to that ink and same message like a loop "Endless One"

do you mind checkign it please and thanx' :)

Edited by Angel-55
Link to comment
Teddy Rogers

Maybe a DNS between you and the host still needs to be updated. It looks to me from the link you are trying to go to:


Which, is a directory that does not exist.

If you want to continue this it may be better to start a new topic in Site Bug Reports forum...


Link to comment

Angel: I haven't tried it yet, I don't understand how the segment base works (guess I spoke too soon in another thread eh?) I keep researching until I figure it out...

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...