OllyDbg

Overview of OllyDbg (x64/x32 debugger for windows)

OllyDbg is a handy and reliable assembler level analyzing debugger worth having when you need to examine and modify program executions. The application is able to perform code analysis and to display information about registers, loops, API calls, switches and many others. It focuses on binary code analysis, and can reveal important data, especially when the source is unavailable.

OllyDbg can provide information about the log data (address, message), executable modules (size, entry, name, file version, path), memory map (address, size, owner, access), threads (entry, last error, entry, TIB, priority), and CPU (registers, address). Moreover, it allows users to set conditional, logging, memory and hardware breakpoints.

It sports a clean interface, and you can easily access its main features directly from the main window. You can drag and drop the applications into the main window, or add them by using the built-in browse function.

Features of OllyDbg:

• Intuitive user interface, no cryptical commands
• Code analysis - traces registers, recognizes procedures, loops, API calls, switches, tables, constants and strings
• Directly loads and debugs DLLs
• Object file scanning - locates routines from object files and libraries
• Allows for user-defined labels, comments and function descriptions
• Understands debugging information in Borland® format
• Saves patches between sessions, writes them back to executable file and updates fixups
• Open architecture - many third-party plugins are available
• No installation - no trash in registry or system directories
• Debugs multithread applications
• Attaches to running programs
• Configurable disassembler, supports both MASM and IDEAL formats
• MMX, 3DNow! and SSE data types and instructions, including Athlon extensions
• Full UNICODE support
• Dynamically recognizes ASCII and UNICODE strings - also in Delphi format!
• Recognizes complex code constructs, like call to jump to procedure
• Decodes calls to more than 1900 standard API and 400 C functions
• Gives context-sensitive help on API functions from external help file
• Sets conditional, logging, memory and hardware breakpoints
• Traces program execution, logs arguments of known functions
• Shows fixups
• Dynamically traces stack frames
• Searches for imprecise commands and masked binary sequences
• Searches whole allocated memory
• Finds references to constant or address range
• Examines and modifies memory, sets breakpoints and pauses program on-the-fly
• Assembles commands into the shortest binary form
• Starts from the floppy disk