OllyDbg (named after its author, Oleh Yuschuk) was an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries. It has a user friendly interface, and its functionality can be extended by third-party plugins. Version 1.10 is the final 1.x release. Version 2.0 was released in June 2010, and OllyDbg has been rewritten from the ground up in this release. Although the current version of OllyDbg cannot disassemble binaries compiled for 64-bit processors, a 64-bit version of the debugger has been promised.[3]
We will also be adding a couple tricks to our arsenal for reverse engineering. One note, if you are running these tutorials under 64-bit windows 7 (like I am), Olly 1.10, even my version, the call stack trick will not work. My suggestion is to do what I do: Run Olly 2.0 just to perform the trick (and get the correct address) then switch back over to my version of Olly for the rest of it. Or just use Olly 2.0- there are a lot of nice features in it and it has been fixed to work properly with 64-bit operating systems.
Ollydbg 1.10 64 Bit
This plugin makes your copy of OllyDbg portable, which means that you can copy the OllyDbg folder to another location without having to fix ollydbg.ini manually.OllyDbg v1.10 and OllyDbg v2 are supported.
Intuitive user interface, no cryptical commands Code analysis - traces registers, recognizes procedures, loops, API calls, switches, tables, constants and strings Directly loads and debugs DLLs Object file scanning - locates routines from object files and libraries Allows for user-defined labels, comments and function descriptions Understands debugging information in Borland format Saves patches between sessions, writes them back to executable file and updates fixups Open architecture - many third-party plugins are available No installation - no trash in registry or system directories Debugs multithread applications Attaches to running programs Configurable disassembler, supports both MASM and IDEAL formats MMX, 3DNow! and SSE data types and instructions, including Athlon extensions Full UNICODE support Dynamically recognizes ASCII and UNICODE strings - also in Delphi ormat! Recognizes complex code constructs, like call to jump to procedure Decodes calls to more than 1900 standard API and 400 C functions Gives context-sensitive help on API functions from external help file Sets conditional, logging, memory and hardware breakpoints Traces program execution, logs arguments of known functions Shows fixups Dynamically traces stack frames Searches for imprecise commands and masked binary sequences Searches whole allocated memory Finds references to constant or address range Examines and modifies memory, sets breakpoints and pauses program on-the-fly Assembles commands into the shortest binary form Starts from the floppy diskOllyDbg 1.10 Requirements:
OllyDbg là một trình gỡ lỗi (ở tầng ring 3) sử dụng hợp ngữ trên nền Windows 32-bit chú trọng đến việc phân tích mã nhị phân và rất hữu dụng để gỡ lỗi những chương trình không được cung cấp mã nguồn. Nó dò xét các thanh ghi, nhận diện các thủ tục, các lời gọi hàm API, các khóa chuyển, các bảng, hằng số và các chuỗi, cũng như chỉ ra vị trí các routines từ các tập tin đối tượng và các thư viện. Theo như trong tập tin trợ giúp của chương trình, phiên bản 1.10 là bản cuối cùng của dòng phiên bản 1.x. Bản 2.xx đang được phát triển và phiên bản đầu tiên là 2.01 đã ra đời vào cuối tháng 9/2013. Phần mềm là miễn phí (và đầy đủ chức năng, không có giới hạn thời gian sử dụng, v.v...), nhưng có thông báo đăng ký với tác giả như ở các dạng phần mềm dùng thử.[2] Phiên bản hiện tại của OllyDbg không thể thao tác được các tập tin biên dịch cho các bộ vi xử lý 64-bit.
OllyDbg has a pretty friendly interface and it can be extended by plugins to make it exactly how you would like it.Version 1.10 is the final release from the 1.x versions of OllyDbg, and v2.0 has been released not so really long ago.The current version of OllyDbg cannot disassemble binaries compiled for 64-bit processors, altough a 64-bit version of the debugger has been promised by the author Oleg Yuschuk. 2ff7e9595c
Comments