ollydbg.exe - OllyDbg - Free 32-bit Analysing Debugger

info
MZ
PE
resources
strings
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ollydbg.exe
size	1768960 (0x1afe00)
md5	1ba145c11f089b40bdfc508b32af8d1b

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x200

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x4ce84060
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10e
Magic	0x10b
LinkerVersion	5.0
SizeOfCode	0xbb000
SizeOfInitializedData	0xdd000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0xbc000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x230000
SizeOfHeaders	0x600
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Borland C++ for Win32 1999

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xbb000	0xbaa00	R-X CODE
.data	0xbc000	0xdd000	0x62400	RW- IDATA
.tls	0x199000	0x1000	0x200	RW- IDATA
.rdata	0x19a000	0x1000	0x200	R-- IDATA SHARED
.idata	0x19b000	0x3000	0x2200	R-- IDATA
.edata	0x19e000	0x1000	0x200	R-- IDATA
.rsrc	0x19f000	0x83000	0x82a00	R-- IDATA
.reloc	0x222000	0xe000	0xd800	R-- IDATA SHARED

Data Directory

type	va	size
EXPORT	0x19e000	0x6b
IMPORT	0x19b000	0x2022
RESOURCE	0x19f000	0x82a00
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x222000	0xd628
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x19a000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x599000	0x5990b4	0x51e318	0x59a010	0	0

show previews

type	name	size
KNOWNRESTYPE	RES_KNOWN	499934
LOADDLLTYPE	RES_LOADDLL	2498
CURSOR	#1	308
BITMAP	BPHARD	308
BITMAP	BPMEM	308
BITMAP	BPOINTS	308
BITMAP	CLOSE	308
BITMAP	CPU	308
BITMAP	LOG	308
BITMAP	MEMORY	308
BITMAP	MODULES	308
BITMAP	OPEN	308
BITMAP	OPTIONS	308
BITMAP	PAUSE	308
BITMAP	RESTART	308
BITMAP	RUN	308
BITMAP	RUNTHREAD	308
BITMAP	STEPIN	308
BITMAP	STEPOVER	308
BITMAP	THREADS	308
BITMAP	TILLRET	308
BITMAP	TILLUSER	308
BITMAP	TRACE	308
BITMAP	TRIN	308
BITMAP	TROVER	308
ICON	#1	744
ICON	#2	296
ICON	#3	744
ICON	#4	744
ICON	#5	744
ICON	#6	744
ICON	#7	744
ICON	#8	744
ICON	#9	744
ICON	#10	744
ICON	#11	744
ICON	#12	744
ICON	#13	744
ICON	#14	744
ICON	#15	744
ICON	#16	744
ICON	#17	744
ICON	#18	744
ICON	#19	744
ICON	#20	744
DIALOG	DIA_ABOUT	242
DIALOG	DIA_ATTACH	210
DIALOG	DIA_CONDERR	282
DIALOG	DIA_CONDYESNO	252
DIALOG	DIA_EMPTY	70
DIALOG	DIA_OFNHOOK_EXE	158
DIALOG	DIA_OFNHOOK_GROUP	284
DIALOG	DIA_OFNHOOK_TEXT	306
STRING	#4092	220
STRING	#4093	228
STRING	#4094	580
STRING	#4095	868
STRING	#4096	672
RCDATA	DVCLAL	16
GROUP_CURSOR	CURS_SIZE	20
GROUP_ICON	ICO_AAAMAIN	34
GROUP_ICON	ICO_B	20
GROUP_ICON	ICO_B_YELLOW	20
GROUP_ICON	ICO_C	20
GROUP_ICON	ICO_D	20
GROUP_ICON	ICO_E	20
GROUP_ICON	ICO_H	20
GROUP_ICON	ICO_H_YELLOW	20
GROUP_ICON	ICO_L	20
GROUP_ICON	ICO_M	20
GROUP_ICON	ICO_M_YELLOW	20
GROUP_ICON	ICO_N	20
GROUP_ICON	ICO_P	20
GROUP_ICON	ICO_QUEST	20
GROUP_ICON	ICO_R	20
GROUP_ICON	ICO_RTRACE	20
GROUP_ICON	ICO_S	20
GROUP_ICON	ICO_T	20
GROUP_ICON	MAINICON	20
VERSION	#1	848

id	lang	string
65456	0	December
65457	0	Sun
65458	0	Mon
65459	0	Tue
65460	0	Wed
65461	0	Thu
65462	0	Fri
65463	0	Sat
65464	0	Sunday
65465	0	Monday
65466	0	Tuesday
65467	0	Wednesday
65468	0	Thursday
65469	0	Friday
65470	0	Saturday
65472	0	Aug
65473	0	Sep
65474	0	Oct
65475	0	Nov
65476	0	Dec
65477	0	January
65478	0	February
65479	0	March
65480	0	April
65481	0	May
65482	0	June
65483	0	July
65484	0	August
65485	0	September
65486	0	October
65487	0	November
65488	0	Variant is not an array
65489	0	Variant array index out of bounds
65490	0	External exception %x
65491	0	Assertion failed
65492	0	Interface not supported
65493	0	Exception in safecall method
65494	0	%s (%s, line %d)
65495	0	Abstract Error
65496	0	Access violation at address %p in module '%s'. %s of address %p
65497	0	Jan
65498	0	Feb
65499	0	Mar
65500	0	Apr
65501	0	May
65502	0	Jun
65503	0	Jul
65504	0	Invalid pointer operation
65505	0	Invalid class typecast
65506	0	Access violation at address %p. %s of address %p
65507	0	Stack overflow
65508	0	Control-C hit
65509	0	Privileged instruction
65510	0	Exception %s in module %s at %p. %s%s
65511	0	Application Error
65512	0	Format '%s' invalid or incompatible with argument
65513	0	No argument for format '%s'
65514	0	Invalid variant type conversion
65515	0	Invalid variant operation
65516	0	Variant method calls not supported
65517	0	Read
65518	0	Write
65519	0	Error creating variant array
65520	0	Out of memory
65521	0	I/O error %d
65522	0	File not found
65523	0	Invalid filename
65524	0	Too many open files
65525	0	File access denied
65526	0	Read beyond end of file
65527	0	Disk full
65528	0	Invalid numeric input
65529	0	Division by zero
65530	0	Range check error
65531	0	Integer overflow
65532	0	Invalid floating point operation
65533	0	Floating point division by zero
65534	0	Floating point overflow
65535	0	Floating point underflow

module_name	ord	function_name
ADVAPI32.DLL		RegCloseKey
ADVAPI32.DLL		RegEnumKeyW
ADVAPI32.DLL		RegOpenKeyExA
ADVAPI32.DLL		RegOpenKeyExW
ADVAPI32.DLL		RegQueryValueExA
ADVAPI32.DLL		RegQueryValueExW
ADVAPI32.DLL		RegSetValueExW
KERNEL32.DLL		CloseHandle
KERNEL32.DLL		ContinueDebugEvent
KERNEL32.DLL		CreateFileA
KERNEL32.DLL		CreateFileMappingW
KERNEL32.DLL		CreateFileW
KERNEL32.DLL		CreateProcessW
KERNEL32.DLL		DebugActiveProcess
KERNEL32.DLL		DeleteCriticalSection
KERNEL32.DLL		DeleteFileA
KERNEL32.DLL		DeleteFileW
KERNEL32.DLL		DuplicateHandle
KERNEL32.DLL		EnterCriticalSection
KERNEL32.DLL		EnumCalendarInfoA
KERNEL32.DLL		ExitProcess
KERNEL32.DLL		FindClose
KERNEL32.DLL		FindFirstFileA
KERNEL32.DLL		FindFirstFileW
KERNEL32.DLL		FindNextFileW
KERNEL32.DLL		FindResourceW
KERNEL32.DLL		FlushInstructionCache
KERNEL32.DLL		FreeLibrary
KERNEL32.DLL		GetACP
KERNEL32.DLL		GetCPInfo
KERNEL32.DLL		GetCommandLineA
KERNEL32.DLL		GetCommandLineW
KERNEL32.DLL		GetCurrentProcess
KERNEL32.DLL		GetCurrentProcessId
KERNEL32.DLL		GetCurrentThread
KERNEL32.DLL		GetCurrentThreadId
KERNEL32.DLL		GetDiskFreeSpaceA
KERNEL32.DLL		GetEnvironmentStrings
KERNEL32.DLL		GetEnvironmentStringsW
KERNEL32.DLL		GetFileAttributesA
KERNEL32.DLL		GetFileAttributesW
KERNEL32.DLL		GetFileInformationByHandle
KERNEL32.DLL		GetFileSize
KERNEL32.DLL		GetFileType
KERNEL32.DLL		GetLastError
KERNEL32.DLL		GetLocalTime
KERNEL32.DLL		GetLocaleInfoA
KERNEL32.DLL		GetModuleFileNameA
KERNEL32.DLL		GetModuleFileNameW
KERNEL32.DLL		GetModuleHandleA
KERNEL32.DLL		GetModuleHandleW
KERNEL32.DLL		GetOEMCP
KERNEL32.DLL		GetPrivateProfileStringW
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		GetProcessHeap
KERNEL32.DLL		GetStartupInfoA
KERNEL32.DLL		GetStdHandle
KERNEL32.DLL		GetStringTypeW
KERNEL32.DLL		GetSystemDirectoryW
KERNEL32.DLL		GetThreadContext
KERNEL32.DLL		GetThreadLocale
KERNEL32.DLL		GetThreadPriority
KERNEL32.DLL		GetThreadSelectorEntry
KERNEL32.DLL		GetTickCount
KERNEL32.DLL		GetVersion
KERNEL32.DLL		GetVersionExA
KERNEL32.DLL		GetVersionExW
KERNEL32.DLL		GetWindowsDirectoryW
KERNEL32.DLL		GlobalAlloc
KERNEL32.DLL		GlobalFree
KERNEL32.DLL		GlobalLock
KERNEL32.DLL		GlobalMemoryStatus
KERNEL32.DLL		GlobalReAlloc
KERNEL32.DLL		GlobalSize
KERNEL32.DLL		GlobalUnlock
KERNEL32.DLL		HeapAlloc
KERNEL32.DLL		HeapFree
KERNEL32.DLL		InitializeCriticalSection
KERNEL32.DLL		InterlockedDecrement
KERNEL32.DLL		InterlockedIncrement
KERNEL32.DLL		IsBadReadPtr
KERNEL32.DLL		LCMapStringA
KERNEL32.DLL		LCMapStringW
KERNEL32.DLL		LeaveCriticalSection
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		LoadLibraryExA
KERNEL32.DLL		LoadLibraryW
KERNEL32.DLL		LoadResource
KERNEL32.DLL		LocalAlloc
KERNEL32.DLL		LocalFree
KERNEL32.DLL		LockResource
KERNEL32.DLL		MapViewOfFile
KERNEL32.DLL		MoveFileW
KERNEL32.DLL		MulDiv
KERNEL32.DLL		MultiByteToWideChar
KERNEL32.DLL		OpenProcess
KERNEL32.DLL		QueryDosDeviceW
KERNEL32.DLL		RaiseException
KERNEL32.DLL		ReadFile
KERNEL32.DLL		ReadProcessMemory
KERNEL32.DLL		ResumeThread
KERNEL32.DLL		RtlUnwind
KERNEL32.DLL		SearchPathW
KERNEL32.DLL		SetConsoleCtrlHandler
KERNEL32.DLL		SetEndOfFile
KERNEL32.DLL		SetEvent
KERNEL32.DLL		SetFilePointer
KERNEL32.DLL		SetHandleCount
KERNEL32.DLL		SetLastError
KERNEL32.DLL		SetThreadContext
KERNEL32.DLL		SetThreadPriority
KERNEL32.DLL		SetUnhandledExceptionFilter
KERNEL32.DLL		SizeofResource
KERNEL32.DLL		Sleep
KERNEL32.DLL		SuspendThread
KERNEL32.DLL		TerminateProcess
KERNEL32.DLL		TerminateThread
KERNEL32.DLL		TlsAlloc
KERNEL32.DLL		TlsFree
KERNEL32.DLL		TlsGetValue
KERNEL32.DLL		TlsSetValue
KERNEL32.DLL		UnhandledExceptionFilter
KERNEL32.DLL		UnmapViewOfFile
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		VirtualProtectEx
KERNEL32.DLL		VirtualQuery
KERNEL32.DLL		VirtualQueryEx
KERNEL32.DLL		WaitForDebugEvent
KERNEL32.DLL		WideCharToMultiByte
KERNEL32.DLL		WriteFile
KERNEL32.DLL		WritePrivateProfileStringW
KERNEL32.DLL		WriteProcessMemory
KERNEL32.DLL		lstrcpyA
KERNEL32.DLL		lstrcpynA
KERNEL32.DLL		lstrlenA
VERSION.DLL		GetFileVersionInfoSizeW
VERSION.DLL		GetFileVersionInfoW
VERSION.DLL		VerQueryValueW
COMCTL32.DLL	17
COMDLG32.DLL		ChooseColorW
COMDLG32.DLL		ChooseFontW
COMDLG32.DLL		CommDlgExtendedError
COMDLG32.DLL		GetOpenFileNameW
COMDLG32.DLL		GetSaveFileNameW
GDI32.DLL		AddFontResourceW
GDI32.DLL		BitBlt
GDI32.DLL		CreateCompatibleBitmap
GDI32.DLL		CreateCompatibleDC
GDI32.DLL		CreateFontIndirectW
GDI32.DLL		CreatePen
GDI32.DLL		CreateRectRgn
GDI32.DLL		CreateSolidBrush
GDI32.DLL		DeleteDC
GDI32.DLL		DeleteObject
GDI32.DLL		EnumFontFamiliesW
GDI32.DLL		ExcludeClipRect
GDI32.DLL		ExtTextOutW
GDI32.DLL		GetNearestColor
GDI32.DLL		GetObjectW
GDI32.DLL		GetStockObject
GDI32.DLL		GetTextExtentExPointW
GDI32.DLL		GetTextExtentPoint32W
GDI32.DLL		GetTextMetricsW
GDI32.DLL		LineTo
GDI32.DLL		MoveToEx
GDI32.DLL		RemoveFontResourceW
GDI32.DLL		SelectClipRgn
GDI32.DLL		SelectObject
GDI32.DLL		SetBkColor
GDI32.DLL		SetPixel
GDI32.DLL		SetTextAlign
GDI32.DLL		SetTextColor
SHELL32.DLL		CommandLineToArgvW
SHELL32.DLL		DragAcceptFiles
SHELL32.DLL		DragFinish
SHELL32.DLL		DragQueryFileW
SHELL32.DLL		ShellExecuteW
USER32.DLL		AdjustWindowRect
USER32.DLL		AppendMenuW
USER32.DLL		BeginDeferWindowPos
USER32.DLL		BeginPaint
USER32.DLL		CallWindowProcW
USER32.DLL		CharNextA
USER32.DLL		CheckDlgButton
USER32.DLL		CheckRadioButton
USER32.DLL		ClientToScreen
USER32.DLL		CloseClipboard
USER32.DLL		CreateCaret
USER32.DLL		CreateDialogParamW
USER32.DLL		CreateMDIWindowW
USER32.DLL		CreateMenu
USER32.DLL		CreatePopupMenu
USER32.DLL		CreateWindowExW
USER32.DLL		DefFrameProcW
USER32.DLL		DefMDIChildProcW
USER32.DLL		DefWindowProcW
USER32.DLL		DeferWindowPos
USER32.DLL		DeleteMenu
USER32.DLL		DestroyCaret
USER32.DLL		DestroyMenu
USER32.DLL		DestroyWindow
USER32.DLL		DialogBoxParamW
USER32.DLL		DispatchMessageW
USER32.DLL		DrawEdge
USER32.DLL		DrawMenuBar
USER32.DLL		EmptyClipboard
USER32.DLL		EnableMenuItem
USER32.DLL		EnableWindow
USER32.DLL		EndDeferWindowPos
USER32.DLL		EndDialog
USER32.DLL		EndPaint
USER32.DLL		EnumChildWindows
USER32.DLL		EnumThreadWindows
USER32.DLL		EnumWindows
USER32.DLL		FillRect
USER32.DLL		FrameRect
USER32.DLL		GetActiveWindow
USER32.DLL		GetCapture
USER32.DLL		GetClassInfoW
USER32.DLL		GetClassNameW
USER32.DLL		GetClientRect
USER32.DLL		GetClipboardData
USER32.DLL		GetCursorPos
USER32.DLL		GetDC
USER32.DLL		GetDesktopWindow
USER32.DLL		GetDlgCtrlID
USER32.DLL		GetDlgItem
USER32.DLL		GetDlgItemInt
USER32.DLL		GetDlgItemTextW
USER32.DLL		GetFocus
USER32.DLL		GetKeyState
USER32.DLL		GetKeyboardType
USER32.DLL		GetMenu
USER32.DLL		GetMenuItemCount
USER32.DLL		GetMenuItemID
USER32.DLL		GetParent
USER32.DLL		GetScrollInfo
USER32.DLL		GetSubMenu
USER32.DLL		GetSysColor
USER32.DLL		GetSysColorBrush
USER32.DLL		GetSystemMetrics
USER32.DLL		GetWindowLongW
USER32.DLL		GetWindowPlacement
USER32.DLL		GetWindowRect
USER32.DLL		GetWindowTextW
USER32.DLL		GetWindowThreadProcessId
USER32.DLL		InSendMessage
USER32.DLL		InsertMenuW
USER32.DLL		IntersectRect
USER32.DLL		InvalidateRect
USER32.DLL		IsDialogMessageW
USER32.DLL		IsDlgButtonChecked
USER32.DLL		IsIconic
USER32.DLL		IsWindowVisible
USER32.DLL		IsZoomed
USER32.DLL		KillTimer
USER32.DLL		LoadBitmapW
USER32.DLL		LoadCursorW
USER32.DLL		LoadIconW
USER32.DLL		LoadStringA
USER32.DLL		MessageBoxA
USER32.DLL		MessageBoxW
USER32.DLL		MoveWindow
USER32.DLL		OpenClipboard
USER32.DLL		OpenIcon
USER32.DLL		PeekMessageW
USER32.DLL		PostMessageW
USER32.DLL		PostQuitMessage
USER32.DLL		PostThreadMessageW
USER32.DLL		RedrawWindow
USER32.DLL		RegisterClassW
USER32.DLL		ReleaseCapture
USER32.DLL		ReleaseDC
USER32.DLL		ScreenToClient
USER32.DLL		SendDlgItemMessageW
USER32.DLL		SendMessageW
USER32.DLL		SetCapture
USER32.DLL		SetCaretPos
USER32.DLL		SetClipboardData
USER32.DLL		SetCursor
USER32.DLL		SetDlgItemTextW
USER32.DLL		SetFocus
USER32.DLL		SetForegroundWindow
USER32.DLL		SetMenu
USER32.DLL		SetScrollInfo
USER32.DLL		SetTimer
USER32.DLL		SetWindowLongW
USER32.DLL		SetWindowPos
USER32.DLL		SetWindowTextW
USER32.DLL		ShowCaret
USER32.DLL		ShowScrollBar
USER32.DLL		ShowWindow
USER32.DLL		TrackPopupMenu
USER32.DLL		TranslateMDISysAccel
USER32.DLL		TranslateMessage
USER32.DLL		UnregisterClassW
USER32.DLL		UpdateWindow
USER32.DLL		WinHelpW
USER32.DLL		WindowFromDC
USER32.DLL		WindowFromPoint
USER32.DLL		wsprintfA
OLE32.DLL		CoCreateInstance
OLE32.DLL		CoInitialize
OLE32.DLL		CoUninitialize
OLEAUT32.DLL		SysAllocStringLen
OLEAUT32.DLL		SysFreeString
OLEAUT32.DLL		SysStringLen
OLEAUT32.DLL		VariantChangeTypeEx
OLEAUT32.DLL		VariantClear
OLEAUT32.DLL		VariantCopyInd

ord	entry_va	function_name
1	0x1059	__GetExceptDLLinfo
2	0xbc1f0	___CPPdebugHook

module_name	ollydbg.exe
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x19e030
Functions(2)	0x19e028
NameOrdinals(2)	0x19e038

StringTable 040904E4

CompanyName	Softwareentwicklung Yuschuk
FileDescription	Free 32-bit Analysing Debugger
FileVersion	2.0.1.0
InternalName	OllyDbg
LegalCopyright	Copyright (C) 2000-2010 Oleh Yuschuk
LegalTrademarks
OriginalFilename	OllyDbg
ProductName	OllyDbg
ProductVersion	2.0.1.0
Comments

VS_FIXEDFILEINFO

FileVersion	2.0.1.0
ProductVersion	2.0.1.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	1768960	EXE	11/20/2010 21:40:48	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

ollydbg.exe-

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904E4

VS_FIXEDFILEINFO

ollydbg.exe
-