OllyDbg+OllyICE调试工具

OllyDbg 2.01 Brief Help

Table of contents

Table of contents............................................................................................................................................1

Introduction.....................................................................................................................................................3

Differences between versions 1.10 and 2.xx..............................................................................................3

OllyDbg 2.01 overview................................................................................................................................3

(No) registration ..........................................................................................................................................5

Legal part ....................................................................................................................................................6

Installation...................................................................................................................................................7

Lesson 3 - Run trace ................................................................................................................................16

Test.exe........................................................................................................................................................18

Assembler and disassembler .......................................................................................................................21

General information ..................................................................................................................................21

Disassembling modes...............................................................................................................................21

Demangling of symbolic names................................................................................................................22

Conditional commands .............................................................................................................................23

Assembler syntax......................................................................................................................................23

Undocumented 80x86 commands............................................................................................................24

Memory map.................................................................................................................................................26

Search for binary pattern ..........................................................................................................................30

Search for references ...............................................................................................................................31

Search for referenced strings ...................................................................................................................32

Search for a constant................................................................................................................................33

Search for a command or a sequence of commands...............................................................................33

Search for all items ...................................................................................................................................36

Search for all intermodular calls ...............................................................................................................36

Threads ........................................................................................................................................................38

General information ..................................................................................................................................38

Stepping in multithreaded applications.....................................................................................................38

Operations ................................................................................................................................................44

Multiple expressions .................................................................................................................................45

String operations.......................................................................................................................................45

2

Analysis ........................................................................................................................................................46

Procedures................................................................................................................................................46

Stack variables..........................................................................................................................................47

Loops ........................................................................................................................................................48

Switches and cascaded IFs......................................................................................................................48

Prediction of registers ...............................................................................................................................51

Debugging of child processes...................................................................................................................57

Breakpoints ...............................................................................................................................................57

Run trace and profiling..............................................................................................................................61

Hit trace.....................................................................................................................................................64

Direct DLL debugging...................................................................................................................................65

Loaddll.exe................................................................................................................................................65

Help ..............................................................................................................................................................67

Help on commands...................................................................................................................................67

Help on API functions ...............................................................................................................................67

Customization...............................................................................................................................................68

Apologies......................................................................................................................................................77

3

© squashed bug 2.0

OllyDbg © 2000-2013 Oleh Yuschuk, All Rights Reserved

All brand names and product names used in OllyDbg, accompanying files or this help are trademarks, registered trademarks, or trade names of their

respective holders. You are free to make excerpts from this help file, provided that you mention the source.

A journey of a thousand li begins with a Single Step

- Chinese proverb

• Execution of commands in the context of debugger, allowing run trace speed - with conditions and

• Unlimited number of memory breakpoints;

• Conditional memory and hardware breakpoints;

• Reliable, analysis-independent hit trace;

• Analyser that recognizes the number (and sometimes the meaning) of the arguments of unknown

• Detaching from debugged process;

• Debugging of child processes;

• Option to pause on TLS callback;

if source code is not available or when you experience problems with your compiler.

Requirements. Developed and tested mainly under Windows XP, but should work under any 32-bit

Windows version: NT, 2000, XP, 2003 Server, Vista, Windows 7 and so on. Old DOS-based versions (95,

98, ME) are no longer supported. That is, if you install Microsoft Layer for UNICODE, you will be able to

start OllyDbg and even set breakpoints, but I can't promise stable operation. Version 2.01 will not work

under 64-bit Windows yet! For a comfortable debugging you will need at least 1-GHz processor. OllyDbg

is memory hungry. If you debug large application with all features enabled, it may easily allocate 200-300

megabytes for backup and analysis data.

Supported instruction sets. OllyDbg 2.01 supports all existing 80x86-compatible CPUs: MMX, 3DNow!,

including Athlon extensions, SSE instructions up to SSSE3 and SSE4, and AVX instructions.

4

behaviour and appearance.

UNICODE, 16- and 32-bit signed/unsigned/hexadecimal integers, 32/64/80-bit floats, addresses,

disassembly (MASM, IDEAL, HLA or AT&T). It also decodes and comments many Windows-specific

OllyDbg, restart last debugged program or attach to already running application. OllyDbg supports just-in-

time debugging and debugging of child processes. You can detach from the debugged process, and it will

continue execution. Installation is not necessary!

pushes and pops, calls, returns, privileged and invalid) and different operands (general, FPU/SSE or

segment/system registers, memory operands on stack or in other memory, constants). You can create

custom highlighting schemes.

Threads. OllyDbg can debug multithread applications. You can switch from one thread to another,

Analysis. Analyzer is one of the most significant parts of OllyDbg. It recognizes procedures, loops,

switches, tables, GUIDs, constants and strings embedded in code, tricky constructs, calls to API functions,

number of function’s arguments, import sections and so on. It attempts to determine not only the number

of stack arguments in the unknown functions, but even their meaning. Analysis makes binary code much

more readable, facilitates debugging and reduces probability of misinterpretations and crashes. It is not

compiler-oriented and works equally good with any PE program.

Full UNICODE support. All operations available for ASCII strings are also available for UNICODE, and

vice versa. OllyDbg is able to recognize UTF-8 strings.

Names. OllyDbg knows symbolic names of many (currently 10800) constants, like window messages,

error codes or bit fields, and decodes them in calls to known functions.

program is paused on the known function, stack window decodes arguments of known and guessed

functions. Stack also traces and displays the chain of SE handlers. If integrated stack walk fails, you may

switch to Dbghelp.dll.

Search. Plenty of possibilities! Search for command (exact or imprecise) or sequence of commands, for

constant, binary or text string (not necessarily contiguous), for all commands that reference address,

constant or address range, for all jumps to selected location, for all referenced text strings, for all

intermodular calls, for masked binary sequence in the whole allocated memory, for integer or floating-point

number and so on. If multiple locations are found, you can quickly navigate between them.

Breakpoints. OllyDbg supports all common kinds of breakpoints: soft (INT3 or several other commands),

5

memory and hardware. You may specify number of passes and set conditions for pause. Breakpoints

may conditionally protocol data to the log. Number of soft and memory breakpoints is unlimited: in the

extreme case of hit trace, OllyDbg may set hundreds of thousands INT3 breakpoints. On a fast CPU,

OllyDbg can process up to 20-30 thousand breakpoints per second.

Watches. Watch is an expression evaluated each time the program pauses. You can use registers,

restart the debugged program.

branches of your code. Hit trace starts from the actual location and sets soft breakpoints on all branches

that were not traced so far. The breakpoints are removed when command is reached (hit).

circular buffer. Run trace is fast: when fast command emulation is enabled, OllyDbg traces up to 1 million

commands per second! Run trace protocols registers (except for SSE/AVX), flags, contents of accessed

memory, thread errors and - for the case that your code is self-modifying - the original commands. You

simultaneously in ASCII, UNICODE and hexadecimal form. Old good copy-and-paste is also available.

Automatic backup allows to undo changes. You can copy modifications directly to executable file, OllyDbg

will even adjust fixups.

UDD. OllyDbg saves all program- and module-related information to the individual file and restores it when

module is reloaded. This information includes labels, comments, breakpoints, watches, analysis data,