ODBG2_Pluginexception
Optional plugin callback function, called each time when OllyDbg
receives debugging event of type EXCEPTION_DEBUG_EVENT
from the debugged application. In general, plugins should not set or
remove breakpoints at the address of exception, directly call
functions from Windows debugging API like ContinueDebugEvent(), or call OllyDbg functions like Run() or Setstatus(). Any of the listed actions may make the internal OllyDbg debugging engine unstable.
When OllyDbg traces debugged application in the command emulation mode (option Debugging | Allow fast command emulation is checked), ODBG2_Pluginexception()
is called on each emulated command. Usually the emulation is fully
transparent for plugins. Note that OllyDbg updates CONTEXT structure associated with the thread only when OllyDbg switches from the emulation back to the execution.
If defined by plugin, ODBG2_Pluginexception() may slow down the debugging.
int ODBG2_Pluginexception(t_run *prun,const t_disasm *da,t_thread *pthr,t_reg *preg,wchar_t *message);
Parameters:
prun
(in)
Pointer to the structure of type t_run containing detailed description of the debugging event. Plugin should not modify this structure directly
da
(in)
Pointer to the structure of type t_disasm which contains disassembled command that caused exception. Disassembly was done in DA_MEMORY mode, text and comments are not available. Plugin should not modify this structure directly
pthr
(in)
Pointer to the structure of type t_thread that identifies thread in which exception occured. Plugin should avoid direct modifications of this structure
preg
(in/out)
Pointer to the structure of type t_reg
containing current state of the registers in the thread where exception
was detected. If plugin modifies this structure (CARE!), it must also
call Registermodifiedbyuser() and set, if necessary, flags RV_SSEMOD, RV_ERRMOD and RV_DBGMOD in preg->status. Attention, careless register modifications may influence the functioning of the debugging engine!
message
(out)
Pointer to the UNICODE buffer of length TEXTLEN wide characters. If plugin returns PE_PAUSE, it should fill this buffer with the explanation why execution was paused
Return
values:
This callback should return one of the following values:
PE_IGNORED - exception was not caused by plugin and therefore was ignored
PE_CONTINUE - exception caused by plugin, OllyDbg should continue execution
PE_STEP - exception caused by plugin. OllyDbg should set temporary breakpoint (INT3 or hardware) with action flag BA_PLUGIN on the next command and continue execution
PE_PAUSE - exception caused by plugin. OllyDbg should pause debugged program
See
also: