ODBG2_Pluginnotify

Optional plugin callback function, receives notifications on relatively infrequent events that may be of interest to plugin.


void ODBG2_Pluginnotify(int code,void *data,ulong parm1,ulong parm2);


Parameters:

code
(in) Notification code, one of the constants PN_xxx. See detailed explanation below 
data
(in) Pointer to the internal OllyDbg structure associated with this notification or NULL
parm1
(in) First parameter
parm2
(in) Second parameter


Return values:

None


ODBG2_Pluginnotify() may receive following notifications:

code data parm1 parm2 Comments
PN_NEWPROC NULL Process ID 0 OllyDbg starts new process. This notification is sent while processing CREATE_PROCESS_DEBUG_EVENT
PN_ENDPROC NULL Process ID Exit code Debugged process terminated but is still in the memory. This notification is sent while processing EXIT_PROCESS_DEBUG_EVENT
PN_NEWTHR t_thread * Thread ID 0 New thread is created and about to start. This notification is sent while processing CREATE_PROCESS_DEBUG_EVENT (main thread) or CREATE_THREAD_DEBUG_EVENT before thread begins to execute in user mode. Note that thread may be temporary (created by Windows to pause debugged application). Such threads have t_thread.ordinal set to 0
PN_ENDTHR t_thread * Thread ID Exit code Thread terminated, but related data is still in the OllyDbg tables. This notification is never sent for the last thread that remains active when process terminates (PN_ENDPROC)
PN_PREMOD t_premod * 0 0 New module is reported by Windows (CREATE_PROCESS_DEBUG_EVENT, LOAD_DLL_DEBUG_EVENT), reported by .NET debugging API, or hidden module is detected by OllyDbg. Module may still be missing in the memory and OllyDbg may be unable to restore breakpoints or analyse code. Therefore it adds it to the table of preliminary modules (premod) and if necessary, sets single-step trap and postpones module processing till the next debug event. Most probably, notification PN_NEWMOD will follow
PN_NEWMOD t_module * 0 0 Module is already in the memory and OllyDbg has attempted to restore .udd data. (If module is self-extractable, restoration may be postponed till module is extracted). PN_NEWMOD may be missing if DLL fails to initialize
PN_ENDMOD t_module * 0 0 Module is removed from the memory or is about to be removed. Plugin receives this notification when module-related data is saved to the .udd file but is not yet removed from the OllyDbg tables. PN_ENDMOD may be missing if DLL fails to initialize
PN_STATUS NULL Status 0 Debuggee's execution status has changed. parm1 contains new status (enumeration of type t_status). This notification comes when debugging engine is in the stable state and plugins are allowed to use all available API functions
PN_RUN t_status * Pass flag 0 User requests to continue execution. data points to the requested status (for example, STAT_RUNNING if all threads should run at full speed). Plugin can change this value. parm1 is the same as the parameter pass in the call to Run()
PN_REMOVE NULL Address Size OllyDbg removes analysis data from the memory range parm1 .. parm1+parm2 (the last byte is not included). This notification is sent, for example, when user modifies memory contents or starts new analysis, but not when module or memory block is removed from the memory


See also:
Plugins, t_module, t_premod, t_thread, ODBG2_Pluginexception(), ODBG2_Pluginmainloop()