Decodeaddress

OllyDbg Plugin API

Decodeaddress

Decodes memory address to text string and optionally comments it. Returns length of decoded string (not including terminal 0), or 0 on error. The decoding is strongly influenced by addrmode and may vary from simple 01234567 to constructs like <JMP.&USER32.GetSystemMetrics>. If address has both module- and user-defined names, user-defined name has priority and module-defined name is placed in comment.

int Decodeaddress(ulong addr,ulong base,int addrmode,char *symb,int nsymb,char *comment);

Parameters:

addr - address to decode in address space of debugged program;

base - address belonging to the module selected as current or 0 if there is no current module. Necessary if you set bits ADC_SAMEMOD or ADC_DIFFMOD;

addrmode - combination of ADC_xxx bits listed below, determines how to decode addr. Note that Decodeaddress does not support some of ADC_xxx declared in plugin.h:

ADC_VALID decode address only if it points to allocated memory or has associated symbolic name;
ADC_INMODULE decode address only if it points to some module or has associated symbolic name. If you want to avoid cases when some address points to gap between two memory blocks belonging to a module, specify both ADC_VALID and ADC_INMODULE flags;
ADC_SAMEMOD decode address only if it points to module defined by parameter base or has associated symbolic name (constant or name belonging to different mnodule). Condition ADC_INMODULE is automatically true and flag need not to be explicitely specified.
ADC_SYMBOL decode address only if it has symbolic name or if ADC_JUMP bit is set and address points to JMP to symbolic name;
ADC_JUMP check whether addr points to JMP to address placed on some import address and decode it as <JMP.&MODULE.ImportName>;
ADC_DIFFMOD display module name only if addr belongs to module which differs from the current (specified by base);
ADC_NOMODNAME never display module name. If neither ADC_DIFFMOD nor ADC_NOMODNAME bits specified, module name is displayed when address belongs to some module;
ADC_OFFSET if address has a symbolic name and points to data section, add word OFFSET before this name (for ex., OFFSET MODULE.DataName);
ADC_STRING decode to comment the case when address points to ASCII or UNICODE string;
ADC_ENTRY decode to comment the case when address is an entry point of some subroutine without symbolic name;

symb - pointer to buffer of length at least nsymb bytes where Decodeaddress places decoded string;

nsymb - length, in characters, of buffer symb;

comment - pointer to string of length at least TEXTLEN bytes or NULL, receives comment asociated with addr.

See also: Decoderelativeoffset, Disasm, Decodeascii, Decodeunicode