The normal method of use is to load a packed program, making note of which section in the memory map will be executing when the unpacking is finished, then setting the break-on-execute flag for that section. When the protected page is accessed by the CPU for execution, the INT1 handler is called, returning control to OllyDbg. Assembles commands into the shortest binary formĭownload takes advantage of the split TLB architecture of Intel processors to protect memory pages from execution but still allow read/write access.īasically OllyBonE consists of a Windows kernel driver that implements the page protection for arbitrary memory pages, and an OllyDbg plugin that communicates with the driver.Examines and modifies memory, sets breakpoints and pauses program on-the-fly.Finds references to constant or address range.Searches for imprecise commands and masked binary sequences.Traces program execution, logs arguments of known functions.Sets conditional, logging, memory and hardware breakpoints.Gives context-sensitive help on API functions from external help file.Decodes calls to more than 1900 standard API and 400 C functions.Recognizes complex code constructs, like call to jump to procedure.Dynamically recognizes ASCII and UNICODE strings – also in Delphi format!.MMX, 3DNow! and SSE data types and instructions, including Athlon extensions.

Configurable disassembler, supports both MASM and IDEAL formats.No installation – no trash in registry or system directories.Open architecture – many third-party plugins are available.Saves patches between sessions, writes them back to executable file and updates fixups.Understands debugging information in Borland ® format.Allows for user-defined labels, comments and function descriptions.Object file scanning – locates routines from object files and libraries.

Code analysis – traces registers, recognizes procedures, loops, API calls, switches, tables, constants and strings.

Intuitive user interface, no cryptical commands.

OllyDbg is a shareware, but you can download and use it for free. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg is a 32-bit assembler level analysing debugger for Microsoft ® Windows ®.

Ollydbg find start of program