Ein Click auf das Plus in der Disky List fhrt zur Sequenz:
 Address=100075D0 Section=.text Type=Export
 Name=a3kOpenDir
 
Names in A3KFSIO, item 19 Address=10007C40 Section=.text Type=Export
 Name=a3kFOpen

Names in A3KFSIO, item 13  Address=10008870  Section=.text  Type=Export
  Name=a3kFGetDataType

Names in A3KFSIO, item 39 Address=10007AD0 Section=.text Type=Export
 Name=a3kReadDirEnt
(wird mehrfach aufgrufen) liest ber EBP Register die Volumes ein

Names in A3KFSIO, item 13 Address=10008870 Section=.text Type=Export
 Name=a3kFGetDataType
 
 hier ein zusammenhngeder String  vor a3kReadDirEnt
 
 EAX 0012F9E8
 ECX 94646972
 EDX 94640000
 EBX 00000000
 ESP 0012F9CC
 EBP 0012FA40 ASCII "SBNK"
 ESI 0012FB27 ASCII "2:6:0\HR-16         02\SBNK\"
 EDI 00000000
 EIP 10007AD0 A3KFSIO.a3kReadDirEnt
 C 0  ES 0023 32bit 0(FFFFFFFF)
 P 1  CS 001B 32bit 0(FFFFFFFF)
 A 0  SS 0023 32bit 0(FFFFFFFF)
 Z 1  DS 0023 32bit 0(FFFFFFFF)
 S 0  FS 0038 32bit 7FFDE000(FFF)
 T 0  GS 0000 NULL
 D 0
 O 0  LastErr ERROR_ACCESS_DENIED (00000005)
 EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
 ST0 empty 2.8306754764642293760e+4648
 ST1 empty 1.9460334308841658880e-4931
 ST2 empty +UNORM 0EE0 00000000 00000000
 ST3 empty 5.1083860178129408000e-3786
 ST4 empty -1.2374261223195217920e-692
 ST5 empty 0.0100000000000000000
 ST6 empty 300.00000000000000000
 ST7 empty 33.333333333333335040
                3 2 1 0      E S P U O Z D I
 FST 0020  Cond 0 0 0 0  Err 0 0 1 0 0 0 0 0  (GT)
 FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0

Names in A3KFSIO, item 39
 Address=10007AD0
 Section=.text
 Type=Export
 Name=a3kReadDirEnt
(wird mehrfach aufgrufen) liest ber EBP Register die Volumes ein


Gesamter Ablauf:
Log data
Address    Message
           OllyDbg v1.10
           Bookmarks sample plugin v1.06 (plugin demo)
             Copyright (C) 2001, 2002 Oleh Yuschuk
           Command line plugin v1.10
             Written by Oleh Yuschuk

           File 'C:\Programme\TekLab Custom Software\A3kDiskyPC\A3kDisky.exe'
           New process with ID 000003A8 created
00490304   Main thread with ID 00000DA0 created
00320000   Module C:\WINDOWS\system32\SHLWAPI.dll
00400000   Module C:\Programme\TekLab Custom Software\A3kDiskyPC\A3kDisky.exe
76350000   Module C:\WINDOWS\system32\comdlg32.dll
76AF0000   Module C:\WINDOWS\System32\winmm.dll
770F0000   Module C:\WINDOWS\system32\oleaut32.dll
77180000   Module C:\WINDOWS\system32\OLE32.DLL
77310000   Module C:\WINDOWS\system32\comctl32.dll
773A0000   Module C:\WINDOWS\system32\SHELL32.dll
77BB0000   Module C:\WINDOWS\System32\msacm32.dll
77BD0000   Module C:\WINDOWS\system32\version.dll
77BE0000   Module C:\WINDOWS\system32\MSVCRT.DLL
77C40000   Module C:\WINDOWS\system32\GDI32.dll
77D10000   Module C:\WINDOWS\system32\user32.dll
77DA0000   Module C:\WINDOWS\system32\ADVAPI32.dll
77E40000   Module C:\WINDOWS\system32\kernel32.dll
77F40000   Module C:\WINDOWS\System32\ntdll.dll
78000000   Module C:\WINDOWS\system32\RPCRT4.dll
003E0000   Module C:\WINDOWS\System32\myokent.dll
78090000   Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
00490304   Program entry point
           Analysing A3kDisky
             2675 heuristical procedures
             1972 calls to known, 797 calls to guessed functions
             478 loops, 159 switches
77E5D342   New thread with ID 00000F08 created
77E5D342   New thread with ID 00000A00 created
015C0000   Module C:\WINDOWS\System32\wnaspi32.dll
10000000   Module C:\Programme\TekLab Custom Software\A3kDiskyPC\A3KFSIO.DLL
015C0000   Unload C:\WINDOWS\System32\wnaspi32.dll
10000000   Unload C:\Programme\TekLab Custom Software\A3kDiskyPC\A3KFSIO.DLL
00320000   Unload C:\WINDOWS\system32\SHLWAPI.dll
003E0000   Unload C:\WINDOWS\System32\myokent.dll
00400000   Unload C:\Programme\TekLab Custom Software\A3kDiskyPC\A3kDisky.exe
76350000   Unload C:\WINDOWS\system32\comdlg32.dll
76AF0000   Unload C:\WINDOWS\System32\winmm.dll
770F0000   Unload C:\WINDOWS\system32\oleaut32.dll
77180000   Unload C:\WINDOWS\system32\OLE32.DLL
77310000   Unload C:\WINDOWS\system32\comctl32.dll
773A0000   Unload C:\WINDOWS\system32\SHELL32.dll
77BB0000   Unload C:\WINDOWS\System32\msacm32.dll
77BD0000   Unload C:\WINDOWS\system32\version.dll
77BE0000   Unload C:\WINDOWS\system32\MSVCRT.DLL
77C40000   Unload C:\WINDOWS\system32\GDI32.dll
77D10000   Unload C:\WINDOWS\system32\user32.dll
77DA0000   Unload C:\WINDOWS\system32\ADVAPI32.dll
77E40000   Unload C:\WINDOWS\system32\kernel32.dll
77F40000   Unload C:\WINDOWS\System32\ntdll.dll
78000000   Unload C:\WINDOWS\system32\RPCRT4.dll
78090000   Unload C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
           Process terminated

           File 'C:\Programme\TekLab Custom Software\A3kDiskyPC\A3kDisky.exe'
           New process with ID 00000FEC created
00490304   Main thread with ID 00000FC0 created
00320000   Module C:\WINDOWS\system32\SHLWAPI.dll
00400000   Module C:\Programme\TekLab Custom Software\A3kDiskyPC\A3kDisky.exe
76350000   Module C:\WINDOWS\system32\comdlg32.dll
76AF0000   Module C:\WINDOWS\System32\winmm.dll
770F0000   Module C:\WINDOWS\system32\oleaut32.dll
77180000   Module C:\WINDOWS\system32\OLE32.DLL
77310000   Module C:\WINDOWS\system32\comctl32.dll
773A0000   Module C:\WINDOWS\system32\SHELL32.dll
77BB0000   Module C:\WINDOWS\System32\msacm32.dll
77BD0000   Module C:\WINDOWS\system32\version.dll
77BE0000   Module C:\WINDOWS\system32\MSVCRT.DLL
77C40000   Module C:\WINDOWS\system32\GDI32.dll
77D10000   Module C:\WINDOWS\system32\user32.dll
77DA0000   Module C:\WINDOWS\system32\ADVAPI32.dll
77E40000   Module C:\WINDOWS\system32\kernel32.dll
77F40000   Module C:\WINDOWS\System32\ntdll.dll
78000000   Module C:\WINDOWS\system32\RPCRT4.dll
003E0000   Module C:\WINDOWS\System32\myokent.dll
78090000   Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
00490304   Program entry point
77E5D342   New thread with ID 00000BE4 created
0049037B   Breakpoint at A3kDisky.0049037B
77E5D342   New thread with ID 00000318 created
015C0000   Module C:\WINDOWS\System32\wnaspi32.dll
10000000   Module C:\Programme\TekLab Custom Software\A3kDiskyPC\A3KFSIO.DLL
100075D0   Breakpoint at A3KFSIO.a3kOpenDir
10007C40   Breakpoint at A3KFSIO.a3kFOpen
10008870   Breakpoint at A3KFSIO.a3kFGetDataType
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10008870   Breakpoint at A3KFSIO.a3kFGetDataType
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
77E5D342   New thread with ID 000008CC created
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007670   Breakpoint at A3KFSIO.a3kCloseDir
100075D0   Breakpoint at A3KFSIO.a3kOpenDir
10007C40   Breakpoint at A3KFSIO.a3kFOpen
10008870   Breakpoint at A3KFSIO.a3kFGetDataType
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10008870   Breakpoint at A3KFSIO.a3kFGetDataType
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007AD0   Breakpoint at A3KFSIO.a3kReadDirEnt
10007670   Breakpoint at A3KFSIO.a3kCloseDir

jetzt ist der Tree aufgeklappt worden.

