OllyScript - the OllyDbg scripting plugin

Last updated 15 Jul 2004 |

# Status

After switching servers all membership data for the OllyScript
mailing list has been erased... Sorry. Please re-register!
OllyScript v0.92 released
+ New commands: ASK, BPL, BPLCND, COB, COE, EVAL, EXEC/ENDE, GN, TICND, TOCND
+ Execution of code in the target process context
+ String concateration with ADD or EVAL
+ Input box
+ Logging breakpoints
+ Removal of EOB and EOE
+ Tracing with condition
+ Get name of address
+ MOV a string to a memory address
# ASM now returns assembled length in $RESULT
# Fixed pause crash bug
# Fixed bug with JBE, hopefully it was the last of the Jxx bugs
# Fixed synchronization bugs
# OllyScript now REQUIRES OllyDbg v1.10. No other versions are officially supported.
I'm in need of ideas for additional functionality.
If you have any, please enter them into the box below.
Right now on queue for next version:
* Nothing

# Download

You can download OllyScript plugin below (11193 downloads since first release):
OllyDbg v1.10 is required for OllyScript v0.6 and above!
- OllyScript v0.92 (downloaded 659 times) 16 Jul 2004
- OllyScript v0.85 (downloaded 3410 times) 03 Jun 2004
- OllyScript v0.7 (downloaded 1708 times) 12 Apr 2004
- OllyScript v0.621 (downloaded 2301 times) 12 Mar 2004
- OllyScript v0.52 (downloaded 1508 times) 09 Feb 2004
- OllyScript v0.4 (downloaded 796 times) 26 Jan 2004
- OllyScript v0.3 (downloaded 444 times) 19 Jan 2004
- OllyScript v0.2 (downloaded 367 times) 14 Jan 2004
- OllyPad v1.1 (downloaded 757 times) 12 Jun 2004
Please use the links above to download the plugin, don't put the .zip on your own site. I want to see the download count which will influence my decision on whether to continue developing this plugin. Please link to this page!

# Scripts

Here are some scripts that might prove useful:
- ALL SCRIPTS (PACKED) 06 Jul 2004
- Armadillo v3.7 - find target's OEP (by Volx)
- Armadillo #1 - detach parent from client (by hipu)
- Armadillo #2 - unpack client (by hipu)
- Aspack - find target's OEP (by lownoise)
- Aspack v1.08.02 - find target's OEP (by Sebby)
- Aspack v2.12 - find target's OEP (by hacnho/VCT2k4)
- Asprotect v1.23 RC4 - find target's OEP (by arz)
- Asprotect v1.3b - find stolen code (by loveboom)
- Asprotect 1.30b - import recovery & OEP / tempOEP finder - Delphi (by Mario555)
- Asprotect 1.31b - import recovery & OEP / tempOEP finder - Delphi (by Mario555)
- Asprotect (generic) - OEP finder and import recovery (by Orion)
- Asprotect #1 - set bp on the right address after the last exception (by Britedream)
- Asprotect #2 - stop in the area of stolen bytes (by Britedream)
- Asprotect #3 - stop on the last exception (by Britedream)
- Asprotect #4 - find target's OEP (by Britedream)
- Asprotect #5 - stop on the last exception with anti-debug (by arz)
- DBPE v2.x - find target's OEP (by loveboom)
- DBPE v2.x - find target's OEP and fix imports (by loveboom)
- ExeCryptor v1.5x - find target's OEP (by loveboom)
- ExeStealth v2.7 - find target's OEP (by FEUERRADER)
- ExeStealth v2.74 - find target's OEP (by loveboom)
- EXE Shield v0.5-->0.8 (ARM Protector v0.1) - find target's OEP (by hacnho/VCT2k4)
- EZip v1.0 - find target's OEP (by hacnho/VCT2k4)
- FSG v1.33 - find target's OEP (by FEUERRADER)
- FSG v1.33 - find target's OEP (by loveboom)
- FSG v2.0 - find target's OEP (by SMoKE)
- Krypton v0.5 - find target's OEP (by loveboom)
- Mew 10 exe-coder v1.0 - find target's OEP (by SMoKE)
- MoleBox v2.x.x - find target's OEP (by loveboom)
- Morphine v1.2 - find target's OEP (by loveboom)
- Morphine v1.3 - find target's OEP (by hacnho/VCT2k4)
- Neolite - find target's OEP (by lownoise)
- Obsidium v1.0061 - find target's OEP, fix imports, patch (by loveboom)
- PC Guard v1.50 - find target's OEP (by loveboom)
- PEBundle 2.0x - 2.4x - find target's OEP (by hacnho/VCT2k4)
- Pecompact v1.76 - find target's OEP (by R@dier)
- Pecompact v1.84 - find target's OEP (by FEUERRADER)
- PE-Diminisher v1.0 - find target's OEP (by FEUERRADER)
- PElock v2.04 - find target's OEP (by hacnho/VCT2k4)
- PE-pack v1.0 - find target's OEP (by SHaG)
- PEShield v0.25 - find target's OEP (by Harding)
- Petite v2.2 - find target's OEP (by R@dier)
- PESpin v0.3 - find target's OEP (by loveboom)
- PESpin v0.3 and v0.4 VB only - find target's OEP (by loveboom)
- PESpin v0.7 - find target's OEP (by hacnho/VCT2k4)
- PeX v0.99 - find target's OEP (by FEUERRADER)
- PKLite32 v1.1 - find target's OEP (by R@dier)
- Protection Plus - find target's OEP (by Britedream)
- SVKP - find target's OEP (by Britedream)
- SVKP v1.3x - find target's OEP (by loveboom)
- tElock v0.98 - find target's OEP (by SHaG)
- tElock v0.9 - 1.0 private - find target's OEP (by loveboom)
- UltraProtect 1.x/ACprotect 1.22 - find target's OEP (by loveboom)
- UltraProtect 1.x/ACprotect 1.22 for VB - find target's OEP (by loveboom)
- UPX - find target's OEP (by SHaG)
- UPX Scrambler RC1 - find target's OEP (by Sebby)
- UPXshit v0.06 - find target's OEP (by mimas)
- UPX with UPX protector - find target's OEP (by FEUERRADER)
- UPX Protector 1.0x - find target's OEP (by hacnho/VCT2k4)
- Virogen Crypt v0.75 - find target's OEP (by hacnho/VCT2k4)
- Y0da's Crypter v1.2 - find target's OEP (by FEUERRADER)

# Documentation

Documentation in CHM format is available here. (Thanks to Jeremy Lopez!)
The latest readme.txt is available here.
Installation instructions are available here.

# Mailing list

Please click here to subscribe to the OllyScript mailing list. Share scripts and get notified of new versions, bugfixes etc.

# Forum

There is a section of OllyDbg users' board reserved for OllyScript.

# About OllyScript

OllyScript is a plugin for OllyDbg, which is, in my opinion, the best application-mode debugger out there. One of the best features of this debugger is the plugin architecture which allows users to extend its functionality. OllyScript is a plugin meant to let you automate OllyDbg by writing scripts in an assembly-like language. Many tasks involve a lot of repetitive work just to get to some point in the debugged application. By using my plugin you can write a script once and for all.

# Contact me

To contact me you can post logon to IRC and message SHaG on EFnet.
You can also send an email to shag@apsvans.com.

# Thanks!

I'd like to thank:
- OllyDbg forum members for helping me with many explanations and ideas.
- All script writers and bug reporters
- Jeremy Lopez for making my readme into a nice CHM
- R@dier for the nice dumping engine
- Hex for the byte pattern replacement algo
- And of course Olly, the man who wrote the magnificent debugger!

© SHaG