Log in

View Full Version : Feature request - disassemble mode (no debug)


Anonymous
December 28th, 2002, 01:32
I need to analyse an export from inside ntoskrnl.exe. Unfortunately, as OllyDbg tries to open the file for debugging, it's unable to disassemble it - all I get is an error message from OllyDbg saying "Unable to open file for debugging".

It would be soooo good if OllyDbg had modes, eg. "Disassemble" and "Debug". In the disassemble mode, the debugging capabilities wouldn't be available, but disassembly/analysis still is. This would allow me to at least see what is going on, even if I can't debug it. I know OllyDbg is a debugger, but its disassembly and code-analysis features are superb on their own!

Anonymous
December 30th, 2002, 05:29
If you just want to analyse an export, a far better tool would be IDA. The current version is 4.30, but 4.17 has been leaked to hundreds of websites and is still very capable (much better than ollydbg) for analysing disassembled listings. In fact that's all it was made for - it can't do any kind of debugging.

Actually, for just analysing a small amount of code, downloading the demo version of 4.30 may well be enough on it's own.

Anonymous
December 30th, 2002, 23:38
But OllyDbg _is_ probably already capable of doing this
The only reason it can't at the moment is that it tries to load the process. If it didn't do that - and just disassembled - it would be able to disassemble ntoskrnl, dlls, vxds, etc etc ...

Anonymous
January 1st, 2003, 12:14
Yes, Olly is already capable of doing what you ask, but it's a case of the wrong tool for the job. The right tool would be one built for disassembling a file, rather than debugging it. I've already mentioned such a tool. Most of Olly's intelligence depends on what the state the current registers are in, and of course it knows this info because it's debugging the program. It would require a lot of work to do the same to a dead-listing. That's why disassemblers and debuggers are kept completely seperate from each other.

(Actually the best approach would be to built a brilliant disassembler, such as IDA, and then lay your debugger on top of that )

Anonymous
January 3rd, 2003, 10:07
Well man did you ever try to download DEMO version of ida 4.30? If you success my respect.

Anonymous
January 4th, 2003, 03:36
It's very easy to download demo version of 4.30, both the "original" version and the hacked version that has many of the features re-enabled. Google is your friend