Log in

View Full Version : OllyDbg, usage hints


IcyDee
May 21st, 2002, 17:15
OllyDbg looks to be a very useful tool, with some excellent features that SoftIce does not have. However, I am having great difficulty doing the simplest of things. For example, how can I set a breakpoint on an API, for example MessageBoxA. All I can find in the help file is to use F2, but this only works if I am displaying the code in the disassembler window. It is all so counter intuitive!

snaker
May 21st, 2002, 17:35
Right click on the debugger text
Search For/Name(label)
find wat you want


The_Philosopher
May 22nd, 2002, 06:44
Hi

Go to Olly's homepage and there you will find help page with all shortcuts program have. Print it and you will know how.

The_Philosopher

Lord_Soth
May 23rd, 2002, 01:01
WOW!!!

I wanted to ask just THAT!!
Who's reading my mind ??

The Svin
May 25th, 2002, 23:06
Quote:
For example, how can I set a breakpoint on an API, for example MessageBoxA

If you mean breakpoint on execution MessageBoxA in the programm you are loaded into Ollydbg - you have to find all calls to it and set breakpoints in found places (or on some of them)
OllyDbg can not do what you can do in SoftIce - I mean to write just once bpx MessageBoxA and be sure that all calls to the API func will be intercepted.
If you mean to set system wide bp on MessageBoxA - that is not possible at all with OllyDbg.

peterg70
May 25th, 2002, 23:57
With Ollydbg you can put a Break point on MessageBoxA that is reference from a program quite easily.

Instead of finding all the reference in the program just bring up the modules loaded (i.e. all the DLL etc that are referenced) then choose names on that DLL and it will list all referenced procedures. Then you can put a break point or a conditional break point on it.

I.e. Break if EAX="Hello World".

Note if the DLL is not loaded when you start ollydbg. it will appear once the program is running. I.e. If a loadlibrary is called it will then appear in the listing.

You can also get ollydbg to break on DLL load and Unload. More and more options

peterg