Hardware breakpoint To implement a software breakpoint, right click on the line where you want to set the breakpoint and select 'Breakpoint > Hardware, on Execution'. Software breakpoint To implement a software breakpoint, go to the line you want the program to pause and hit F2 or right click and select 'Breakpoint > Toggle'. Refer to this page for more information about breakpoints. Go to the address of the function ( Ctrl+ G), right click and select 'New origin here': It consists of modifying the EIP to point to the address of the function to be executed. Will cause the program to run until the execution returns to compiled malware code (typically the. Useful during malware analysis if you get lost in the code. Useful when you want a program to pause immediately after the current function is finished executing Will pause execution just before the current function is set to return. In the previous example, step over will make the debugger pause at the next line: If the instruction is a function, does not dive into the function's instructions Step into will follow the function and the debugger will pause at the first instruction of the called function:Įxecute a single instruction and pause. Suppose we are analyzing the following code: Enables to pause the analyzed executableĮxecute a single instruction and pause.

Executing the malware Run (F9)Ĭommonly used to run the analyzed executable immediately or after a breakpoint has been reached. This section/article is being written and is therefore not complete. Shows modifications (patches) that have been applied to the code. If you double click on a row, it will bring you to the memory dump of the section. The Memory Map window displays all memory blocks allocated by the debugged program. Memory dump window: dump of live memory for the debugged processĭisplays a list of executable modules loaded with the debugged program.Stack window: current state of the stack in memory.Information window: brings information about the current line of code (e.g.You can modify the value of these registers but right-clicking on the value. Registers window: shows the registers along with their value in real time (when a value is changed, it appears in red).Disassembler window: shows the disassembled code as it is executed.OllyDbg's main interface is split into 5 different regions as follows: Version 2: more advanced with new features but not all plugins have been ported yet for this version.

Version 1: this version is still in use by many analysts because the majority of the plugins have been developped for this release.There are 2 main versions available for OllyDbg: OllyDbg is commonly used by malware analysts and reverse engineers because it's easy to use and it has many plug-ins that extend its capabilities. OllyDbg is an x86 debugger developed by Oleh Yuschuk.

Ollydbg phantom