t_dump

OllyDbg Plugin API

t_dump

Type of dump descriptor.

typedef struct t_dump { // Current status of dump window

t_table table; // Treat dump window as custom table

int dimmed; // Draw in lowcolor if nonzero

ulong threadid; // Use decoding and registers if not 0

int dumptype; // Current dump type, DU_xxx+count+size

SPECFUNC *specdump; // Decoder of DU_SPEC dump types

int menutype; // Standard menus, MT_xxx

int itemwidth; // Length of displayed item, characters

int showstackframes; // Show stack frames in address dump

int showstacklocals; // Show names of locals in stack

int showsource; // Show source as comment in disassembler

char filename[MAXPATH]; // Name of displayed or backup file

ulong base; // Start of memory block or file

ulong size; // Size of memory block or file

ulong addr; // Address of first displayed byte

ulong lastaddr; // Address of last displayed byte + 1

ulong sel0; // Address of first selected byte

ulong sel1; // Last selected byte (not included!)

ulong startsel; // Start of last selection

int captured; // Mouse is captured by dump

ulong reladdr; // Addresses relative to this

char relname[SHORTLEN]; // Symbol for relative zero address base

char *filecopy; // Copy of the file or NULL

char *backup; // Old backup of memory/file or NULL

int runtraceoffset; // Offset back in run trace

ulong reserved[8]; // Reserved for the future extentions

} t_dump;

Members:

table - structure that describes dump window as a custom table;

threadid - if non-zero, window belongs to CPU and shuld use thread's registers when disassembling data;

dumptype - current dump type, combination of dump type (one of DU_xxx), number of items per line ((n<<8) & DU_COUNT) and size of single item (l & DU_SIZE). Additionally can be ORed with onbe of the following bits:

DU_ESCAPABLE Dump window will close on ESC key
DU_BACKUP Dump window displays backup data

For variable-length types the size is 1. See description of Createdumpwindow for a list of commonly used dump types;

base - base address of displayed memory in the memory size of debugged process, usually 0 for file dump;

size - size of displayed file or memory area;

addr - address or offset of the first displayed byte;

sel0 - address or offset of the first selected byte (included);

sel1 - address or offset of the last selected byte (not included);

filecopy - pointer to copy of displayed file, or NULL if this is memory dump;

backup - pointer to local backup of dump data, or NULL if backup is absent;

runtraceoffset - step back in run trace, or 0 if inactive.

See also: Createdumpwindow, ODBG_Pluginuddrecord, ODBG_Pluginmenu, ODBG_Pluginaction