OllyDbg2.0英文版

OllyDbg 2.0 Brief Help

Table of contents

Table of contents ........................................................................................................................................... 1

Introduction.................................................................................................................................................... 2

Differences between versions 1.10 and 2.00............................................................................................. 2

OllyDbg 2.0 overview ................................................................................................................................. 2

(No) registration ......................................................................................................................................... 4

Legal part ................................................................................................................................................... 5

Installation.................................................................................................................................................. 6

Analyser....................................................................................................................................................... 11

Procedures............................................................................................................................................... 11

Stack variables......................................................................................................................................... 11

Known functions....................................................................................................................................... 13

Loops ....................................................................................................................................................... 13

Switches and cascaded IFs ..................................................................................................................... 14

Prediction of registers .............................................................................................................................. 15

Memory map................................................................................................................................................ 17

General information ................................................................................................................................. 17

Kernel memory......................................................................................................................................... 17

Attaching to running processes................................................................................................................ 19

Detaching from the debugging process ................................................................................................... 19

Debugging of child processes.................................................................................................................. 20

Breakpoints .............................................................................................................................................. 20

Run trace and profiling............................................................................................................................. 21

Hit trace.................................................................................................................................................... 24

Help ............................................................................................................................................................. 27

Help on commands .................................................................................................................................. 27

Help on API functions .............................................................................................................................. 27

Search ......................................................................................................................................................... 28

Apologies..................................................................................................................................................... 32

© squashed bug 2.0

OllyDbg © 2000-2010 Oleh Yuschuk, All Rights Reserved

All brand names and product names used in OllyDbg, accompanying files or in this help are trademarks, registered trademarks, or trade names of their

respective holders. You are free to make excerpts from this file, provided that you mention the source.

Introduction

This guide is not a detailed description of the OllyDbg 2.0. Rather, it highlights some interesting and non-

obvious features of the new debugger.

Differences between versions 1.10 and 2.00

• Execution of commands in the context of debugger, allowing run trace speed - with conditions and

protocolling! - of up to 1,000,000 commands per second;

• Unlimited number of memory breakpoints;

• Conditional memory and hardware breakpoints;

• Reliable, analysis-independent hit trace;

• Analyser that recognizes the number (and sometimes the meaning) of the arguments of unknown

functions;

• Detaching from debugged process;

• Debugging of child processes;

• Built-in help for integer and FPU commands;

under any 32-bit Windows version: 95, 98, ME, NT, 2000, XP, 2003 Server, Vista, Windows 7 and so on.

Version 2.00 will not work under 64-bit Windows yet! For a comfortable debugging you will need at least

500-MHz processor. OllyDbg is memory hungry. If you debug large application with all features enabled, it

may allocate 200-300 megabytes for backup and analysis data.

Supported instruction sets. OllyDbg 2.0 supports all existing 80x86-compatible CPUs: MMX, 3DNow!,

including Athlon extensions, and SSE instructions up to SSSE3 and SSE4.

Configurability. More than 120 options (oh, no! This time it's definitely too much!) control OllyDbg's

behaviour and appearance.

Data formats. Dump windows display data in all common formats: hexadecimal, ASCII, UNICODE, 16-

and 32-bit signed/unsigned/hexadecimal integers, 32/64/80-bit floats, addresses, disassembly (MASM,

OllyDbg, restart last debugged program or attach to already running application. OllyDbg supports just-in-

time debugging and debugging of child processes. You can detach from the debugged process, and it will

continue execution. Installation is not necessary!

Code highlighting. Disassembler can highlight different types of commands (jumps, conditional jumps,

pushes and pops, calls, returns, privileged and invalid) and different operands (general, FPU/SSE or

segment/system registers, memory operands on stack or in other memory, constants). You can create

custom highlighting schemes.

Threads. OllyDbg can debug multithread applications. You can switch from one thread to another,

suspend, resume and kill threads or change their priorities. Threads window displays errors for each

thread (as returned by call to GetLastError).

Full UNICODE support. All operations available for ASCII strings are also available for UNICODE, and

vice versa. OllyDbg is able to recognize UTF-8 strings.

Names. OllyDbg knows symbolic names of many (currently 7800) constants, like window messages, error

codes or bit fields, and decodes them in calls to known functions.

Known functions. OllyDbg recognizes by name more than 2200 frequently used Windows API functions

and decodes their arguments. You can add your own descriptions. You may set logging breakpoint on a

known or guessed function and protocol arguments to the log.

Calls. OllyDbg can backtrace nested calls on the stack even when debugging information is unavailable

and procedures use non-standard prologs and epilogs.

Stack. In the Stack window, OllyDbg uses heuristics to recognize return addresses and stack frames.

intermodular calls, for masked binary sequence in the whole allocated memory and so on. If multiple

locations are found, you can quickly navigate between them.

Breakpoints. OllyDbg supports all common kinds of breakpoints: INT3, memory and hardware. You may

specify number of passes and set conditions for pause. Breakpoints may conditionally protocol data to the

log. Number of INT3 and memory breakpoints is unlimited: in the extreme case of hit trace, OllyDbg

sometimes sets more than 100000 INT3 breakpoints. On a fast CPU, OllyDbg can process up to 20-30

thousand breakpoints per second.

Watches. Watch is an expression evaluated each time the program pauses. You can use registers,

constants, address expressions, boolean and algebraic operations of any complexity.

system API call back to the user code. When application runs, you keep full control over it. For example,

you can view memory, set breakpoints and even modify code "on-the-fly". At any time, you can pause or

restart the debugged program.

circular buffer. Run trace is fast: when fast command emulation is enabled, OllyDbg traces up to 1 million

may specify the condition to stop run trace, like address range, expression or command. You can save run

trace to the file and compare two independent runs. Run trace allows to backtrack and analyse history of

execution in details, millions and millions of commands.

Profiling. Profiler calculates how many times some instruction is listed in the run trace buffer. With

Patching. Built-in assembler automatically selects the shortest possible code. Binary editor shows data

Automatic backup allows to undo changes. You can copy modifications directly to executable file, OllyDbg

will even adjust fixups.

UDD. OllyDbg saves all program- and module-related information to the individual file and restores it when

module is reloaded. This information includes labels, comments, breakpoints, watches, analysis data,

conditions and so on.

Customization. You can specify custom fonts, colour and highlighting schemes.

And much more! This list is far from complete, there are many features that make OllyDbg 2.0 the

friendly debugger.