Name functions

OllyDbg Plugin API

Name functions

Any zero-terminated ASCII string that is shorter than TEXTLEN characters can be a name from the OllyDbg's point of view. Every name has associated 32-bit address and 8-bit type. OllyDbg stores all names in a huge centralized dynamical buffer that can keep up to 10,000,000 names, provided of course that you have enough memory. When used correctly, name functions are very fast.

Several name types are predefined:

NM_NONAME Undefined name
NM_ANYNAME Name of any type

Names that are stored in the .udd file of module where they appear:

NM_LABEL User-defined label
NM_EXPORT Exported (global) name
NM_IMPORT Imported name
NM_LIBRARY Name extracted from library, object file or debug data
NM_CONST User-defined constant (currently not implemented)
NM_COMMENT User-defined comment
NM_LIBCOMM Automatically generated comment from library or object file
NM_BREAK Condition related with breakpoint
NM_ARG Arguments decoded by analyser
NM_ANALYSE Comment added by analyser
NM_BREAKEXPR Expression related with breakpoint
NM_BREAKEXPL Explanation related with breakpoint
NM_ASSUME Assume function with known arguments
NM_STRUCT Code structure decoded by analyzer
NM_CASE Case description decoded by analyzer
NM_PLUGCMD Plugin commands to execute at breakpoint

Names that are stored in the .udd file of main module:

NM_INSPECT Several last entered inspect expressions
NM_WATCH Watch expressions
NM_ASM Several last entered assembled strings
NM_FINDASM Several last entered assembler search strings
NM_LASTWATCH Several last entered watch expressions
NM_SOURCE Several last entered source search strings
NM_REFTXT Several last entered reference text search strings
NM_GOTO Several last expressions to follow in Disassembler
NM_GOTODUMP Several last expressions to follow in Dump
NM_TRPAUSE Several last expresions to pause run trace
NM_LABEL|NMHISTORY Several last entered user-defined labels
NM_COMMENT|NMHISTORY Several last entered user-defined comments
NM_BREAK|NMHISTORY Several last entered breakpoint conditions
NM_BREAKEXPR|NMHISTORY Several last entered breakpoint expressions
NM_BREAKEXPL|NMHISTORY Several last entered breakpoint explanations

If you need unique name type for your plugin, please contact the author of OllyDbg.

To find name by its address, OllyDbg uses binary search on contiguous sorted index array. For this reason, search is extermely fast, but adding new names to the table may take significant time. If you need to add multiple names at once, use Quickinsertname. Names added in this way are unaccessible until you call Mergequicknames. As a rule of thumb, this method is preferrable if number of names exceeds 10-15.

int Insertname(ulong addr,int type,char *name);

int Quickinsertname(ulong addr,int type,char *name);

void Mergequicknames(void);

void Discardquicknames(void);

int Findname(ulong addr,int type,char *name);

int Decodename(ulong addr,int type,char *name);

ulong Findnextname(char *name);

int Findlabel(ulong addr,char *name);

void Deletenamerange(ulong addr0,ulong addr1,int type);

int Findlabelbyname(char *name,ulong *addr,ulong addr0,ulong addr1);

ulong Findimportbyname(char *name,ulong addr0,ulong addr1);

int Demanglename(char *name,int type,char *undecorated);

int Findsymbolicname(ulong addr,char *fname);