Createdumpwindow

OllyDbg Plugin API

Createdumpwindow

Creates new dump window that can show either context of file or memory range of debugged program in one of predefined dump formats. Returns handle of created window or NULL on error. Number of simultaneously displayed dump windows is (theoretically) unlimited.

HWND Createdumpwindow(char *name,ulong base,ulong size,ulong addr,int type,SPECFUNC *specdump);

Parameters:

name - if parameter size is 0, name of file to display, otherwise window's title or NULL, in this last case OllyDbg generates title automatically;

base - if size is 0, base is ignored, otherwise this is the base address of displayed memory range;

size - 0 if window should dump contents of file, or size of displayed memory range otherwise;

addr - address or offset of the first element displayed after window is created;

type - combination of dump type (one of DU_xxx), number of items per line ((n<<8) & DU_COUNT) and size of single item (l & DU_SIZE). For variable-length types size is 1. See table below for a list of commonly used dump types;

specdump - function that performs special data decoding, set to NULL.

Commonly used dump types:

0x01101 Hex/ASCII (16 bytes)
0x01081 Hex/ASCII (8 bytes)
0x0A101 Hex/UNICODE (16 bytes)
0x0A081 Hex/UNICODE (8 bytes)
0x02401 ASCII (64 chars)
0x02201 ASCII (32 chars)
0x03402 UNICODE (64 chars)
0x03202 UNICODE (32 chars)
0x04082 Signed short decimal
0x05082 Unsigned short decimal
0x06082 Short hex
0x04044 Signed long decimal
0x05044 Unsigned long decimal
0x06044 Long hex
0x08014 Address
0x0B041 Address with ASCII dump
0x0C041 Address with UNICODE dump
0x07044 32-bit float
0x07028 64-bit double
0x0701A 80-bit long double
0x09011 Disassemble
0x0D001 PE header

See also: Setdumptype, Dumpbackup