Jump to content
Tuts 4 You

OllyDbg2 Issue - Table Window with Sorted Data


Recommended Posts

I'm developing another plugin for OllyDbg2 and for some reason, after I populate my table with the sorted data (anywhere from 1,500 to 4,00 records or so), I can't use the scroll bar on the side of that window to scroll through all of the data. When I drag the scroll bar down, I can view through a small portion of the data (140 records); as soon as I release the left mouse button the scroll bar immediately returns to the top, but the view doesn't change. When I click to drag the scroll bar again, the view of the data automatically displays the first record at the top of the window and I can scroll through those first 140 records. Now if I use the Page Up/Down or Arrow Up/Down keys, I can look through all of the data, but the scroll bar still doesn't move, so no matter where I am in the list as soon as I click the scroll bar, the view goes back to the first entry and I can only scroll the first 140 records. This issue happens no matter the size of the table window or whether it's maximized or restored.


Anyone seen this issue before?


First I create my sorted data:

Createsorteddata(&logtable.sorted, sizeof(LOGDATA), 1, (SORTFUNC *)log_window_sort_proc, NULL, SDM_NOSIZE) 

Then I prepare the t_table struct:

void create_log_window(void)
StrcopyW(logtable.name, SHORTNAME, OLLYRESREFS_NAME);
logtable.bar.visible = 1; logtable.bar.name[0] = L"Address";
logtable.bar.expl[0] = L"";
logtable.bar.mode[0] = BAR_SORT;
logtable.bar.defdx[0] = 9; logtable.bar.name[1] = L"Command";
logtable.bar.expl[1] = L"";
logtable.bar.mode[1] = BAR_SORT;
logtable.bar.defdx[1] = 10; logtable.bar.name[2] = L"Item Text";
logtable.bar.expl[2] = L"";
logtable.bar.mode[2] = BAR_SORT;
logtable.bar.defdx[2] = 80; logtable.bar.name[3] = L"Resource Type";
logtable.bar.expl[3] = L"";
logtable.bar.mode[3] = BAR_SORT;
logtable.bar.defdx[3] = 34; logtable.bar.nbar = 4;
logtable.tabfunc = (TABFUNC*)log_window_proc;
logtable.custommode = 0;
logtable.customdata = NULL;
logtable.updatefunc = NULL;
logtable.drawfunc = (DRAWFUNC*)log_window_draw;
logtable.tableselfunc = NULL;
logtable.menu = (t_menu*)log_window_popup_menu;

Then create the window (before filling it with the data):

Createtablewindow(&logtable, 0, logtable.bar.nbar, NULL, L"ICO_PLUGIN", OLLYRESREFS_NAME)

What am I missing?



Link to comment
  • 3 weeks later...

Here are the procedures.


Processing window messages:

LRESULT CALLBACK log_window_proc(t_table *pTable, HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
switch (uMsg)
pLogData = (LPLOGDATA)Getsortedbyselection(&pTable->sorted, pTable->sorted.selected);
if (pLogData != NULL) {
Setcpu(0, pLogData->address, 0, 0, 0, CPU_ASMHIST|CPU_ASMCENTER|CPU_ASMFOCUS);
return 1;
return 0;

and for the draw procedure:

long log_window_draw(wchar_t *pszBuffer, uchar *pMask, int *pSelect, t_table *pTable, t_drawheader *pHeader, int iColumn, void *pCache)
int str_len = 0;
LPLOGDATA pLogData = (LPLOGDATA)pHeader; switch (iColumn)
case 0: /* address of reference */
str_len = Simpleaddress(pszBuffer, pLogData->address, pMask, pSelect);
case 1: /* command that references resource */
                str_len = swprintf(pszBuffer, L"%ls", pLogData->command);
case 2: /* text of resource item */
str_len = swprintf(pszBuffer, L"%ls", pLogData->item_text);
case 3: /* type of resource */
                str_len = swprintf(pszBuffer, L"%ls", pLogData->resource_type);
return str_len;

Link to comment
  • 1 month later...

This is rather embarrassing on my part, but I wanted to let everyone know the fix in case you ever run into this problem.
the log_window_proc is specified as (TABFUNC*) which is TYPEDEF long in the OllyDbg PDK.
I had the function return type as LRESULT CALLBACK as if it was a windows API procedure routine

LRESULT CALLBACK log_window_proc(t_table* pTable, HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)

Once I changed my return type to long, as it should be, everything worked fine.

long log_window_proc(t_table* pTable, HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...