Disassembly functions

OllyDbg Plugin API

Disassembly functions

Disasm is the most important OllyDbg function, and one of the most complicated. In version 1.06, its C code together with declarations, service subroutines and tables is 4291 lines (210 K bytes) long! Almost every part of OllyDbg calls Disasm, directly or indirectly.

Disasm requires that you supply binary code of the command to disassemble. Readcommand allows you to easily read command from the memory of debugged process.

Two other disassembly functions, Disassembleforward and Disassembleback, allow walking through the binary code, command by command. Note that 80x86 commands have variable length. Disassembleback use heuristical methods to separate commands and in some (astoundingly rare!) cases may return invalid answer. To avoid risks of invaling backward walking, use analysis data.

Functions Issuspicious and Isfilling can determine whether command is potentially invalid or equivalent to NOP.

ulong Disasm(char *src,ulong srcsize,ulong srcip,char *srcdec,t_disasm *disasm,int disasmmode,ulong threadid);

ulong Readcommand(ulong ip,char *cmd);

ulong Disassembleback(char *block,ulong base,ulong size,ulong ip,int n,int usedec);

ulong Disassembleforward(char *block,ulong base,ulong size,ulong ip,int n,int usedec);

ulong Followcall(ulong addr);

int Issuspicious(char *cmd,ulong size,ulong ip,ulong threadid,t_reg *preg,char *s);

int Isfilling(ulong offset,char *data,ulong size,ulong align);

int Isprefix(int c);