OllyDbgReferenceCard

OllyDbgisa32bitassemblerlevelanalysingdebugger Disasemblershortcuts: F2 Togglebreakpoint forMicrosoftWindows.Emphasisonbinarycode Shift+F2 Setconditionalbreakpoint analysismakesitparticularlyusefulincaseswhere F4 Runtoselection sourceisunavailable.OllyDbgisashareware,butyou Alt+F7 Gotopreviousreference candownloadanduseitforfree. Alt+F8 Gotonextreference Globalshortcuts:
Ctrl+F2 Alt+F2 F3 F5 Alt+F5 F7 Ctrl+F7 F8 Ctrl+F8 F9 Shift+F9 Ctrl+F9 Alt+F9 Ctrl+F11 F12 Ctrl+F12 Alt+B Alt+C Alt+E Alt+L Alt+M Alt+O Ctrl+T Alt+X Restartprogram Closeprogram Opennewprogram Maximize/restoreactivewindow MakeOllyDbgtopmost Stepinto(enteringfunctions) Animateinto(enteringfunctions) Stepover(executingfunctioncallsatonce) Animateover(executingfunctioncallsatonce) Run Passexceptiontostandardhandlerandrun Executetillreturn Executetillusercode Traceinto Pause Traceover OpenBreakpointswindow OpenCPUwindow OpenModuleswindow OpenLogwindow OpenMemorywindow OpenOptionsdialog SetconditiontopauseRuntrace CloseOllyDbg Ctrl+A Ctrl+B Ctrl+C Ctrl+E Ctrl+F Ctrl+G Ctrl+J Ctrl+K Ctrl+L Ctrl+N Ctrl+O Ctrl+R Ctrl+S Asterisk(*) Enter Plus(+) Minus() Space() Colon(:) Semicolon(;) Analysecode Startbinarysearch Copyselectiontoclipboard Editselectioninbinaryformat Searchforacommand Followexpression Showlistofjumpstoselectedline Viewcalltree Repeatlastsearch Openlistoflabels(names) Scanobjectfiles Findreferencestoselectedcommand Searchforasequenceofcommands Origin Followjumporcall Gotonextlocation/nextruntraceitem Gotopreviouslocation/previousruntraceitem Assemble Addlabel Addcomment

http://www.ollydbg.de

FunctionCallingConventions: cdecl: argumentsonstackrighttoleft(reverseorder) retinEAX callercleansupthestack stdcall calleecleansupthestack usedinWIN32API fastcall parametersinregisters extraparametersonstack callercleansupthestack thiscall usedinC++ similtocdecl ECXholdsthispointer thispointerpushedontostacklast(GNU)

IndirectAddressingMemory(AddrCalculated:akaEffectiveAddr)

evalinstrw/omodifyvaluesinoperands cmpisimpliedsub testisimpliedand

Commonx86registers
EIP=pointtoinstructiontoexecute;updatedalsowhenbranching ESP=pointtolastitemonstack;changeswitheachpush/pop ECX=counterforlooping; EBP=basepointerforreferencingfunctionargumentsandlocal variables;EBPvalue=localvar,EBP+value=parameter;EBPis theframepointer; EAX=addition,multiplication,functionresults; ESI/EDI=formemorytransfer; EFLAGS=bitsthatrepresentstheoutcomeofcomputation, controlsCPUoperation generalpurposeregisters: EAX,EBX,ECX,EDX,EBP,ESP,ESI,EDI SS,GS,FS,ES,DS,CS=memorysegmentregisters; CSdefaultwhenfetchinginstr DSforaccessingdatawithESI/EDI SSforaccessingdatawithESP

Looping(LOOPccinstr): examinesECXreg Z=0,E=eq.,N=not loopnz=loopifECXisnot0 loop=loopifECXisnot0(shortjumps<128bytes) autodecrementECX XCHGexchange2regs(swapthevalue) Shiftxbit: SHRalsodivby2^xbit SHLalsomulby2^xbit LEA(LoadEffectiveAddress) usedtocalculateanaddress(notverified) resultstoredinregister morethan1calculusin1instr.

OllyDbgtutorialsavailableat:

RunTracehttp://www.ollydbg.de/Tut_rtr.htm LoadDLL http://www.ollydbg.de/Loaddll.htm

2008AntonioMerolalicensedunderthetermsoftheGFDLGNUFreeDocumentationLicensev1.2orlater.