View Single Post
  #7  
Old 08-30-2005, 20:11
JuneMouse
 
Posts: n/a
bp Translatemessage condition string is you are using commandline plugin
some thing like
bp Translatemessage "[ESP+###] == WM_COMMAND"
i dont have tools to give you right command atm may be will edit this post later

the general graphical way is to
find names -->TranslateMessage in kernel32.dll
right click follow in disassembler
you will mostly be at a push ebp instruction
hit shift+f4 (conditional log break point)
set the condition you prefer using the stack parameters (the arguments to the proc will be on stack top+4 [esp+4] when you have stopped on break point

so condition like [ESP+###] == "WM_WHATEVER OR ES_WHATEVER OR WHATEVR_WHATEVER" should trigger the break only on conditions

if it triggers always that means you are not setting a conditional break point but
a hard break point (see the color hard means red colour conditional means pink or yello colour marker will be there)

also you can ask olly dbg to never pause on any thing but log everything or log only on condition pause and log on condition etc etc

Dispatch Spelling may be wrong it may be Despatch or just ansi version is available
use find names (ctrl+n) on kernel32.dll and start typing d and look for the api
"unknown identifier means you asked ollydbg to look for some rubbish name and it says
hey that name is rubbish it doesnt exist go find the right name dont give me rubbish names"

second question i didnot understand any part of it
you set break point according to your need or set break point on everything and when it hit remove them one by one if the hit is not what you are looking for

for example
right click
find command->call r32-->enter ---> right click -> set log break points on all referance
would set 10000 of break points at one
Reply With Quote