Ollydbg
Ollydbg
Ollydbg
Ignore INT3=1
Ignore TRAP=1
Ignore access violations=1
Ignore division by 0=1
Ignore illegal instructions=1
Ignore all FPU exceptions=1
Ignore all service exceptions=1
Ignore custom exception ranges=0
Call UnhandledExceptionFilter=0
Report ignored exceptions to log=1
Autoreturn=0
Use DebugBreakProcess=0
Use ExitProcess=1
Warn when frequent breaks=1
Allow command emulation=1
Debug child processes=0
Animation delay index=0
Stop on new DLL=1
Stop on DLL unload=0
Stop only on selected modules=1
Stop on debug string=0
Stop on new thread=0
Stop on thread end=0
Enable use of debugging data=1
Use dbghelp to walk stack=0
Use Microsoft Symbol Server=1
Hide missing source files=1
Hide internal compiler names=1
Skip leading spaces from source=1
Hide Call DLL window on call=1
Pause after call to DLL is finished=1
Allow .NET debugging=0
Scan registry for GUIDs on starup=0
Run trace protocolling options=0
Run trace buffer size index=2
Trace over system DLLs=0
Trace over string commands=1
Save traced commands=1
Save accessed memory to trace=1
Save FPU registers to trace=1
Synchronize CPU and Run trace=1
Set breakpoints on callbacks in hit trace=1
Hit trace mode for indirect jumps=0
Stop hit trace if not command=0
Hit trace outside the code section=2
Keep hit trace between sessions=1
Show symbolic names in protocol range list=0
Allow automatic SFX extraction=0
SFX extraction mode=0
Use real SFX entry from previous run=0
Ignore SFX exceptions=1
Use predictions in search=1
References include indirect jumps=1
Add origin to search results=1
Default resource language=9
Gray inactive windows=1
Gray register names=0
Center FOLLOWed command=1
Decode registers for any IP=1
Hide current registers warning=0
[CPU Info]
Appearance=1,0,0,0,0
[CPU registers]
Appearance=1,0,1,0,0
Local=0,67334
[CPU Dump]
Appearance=1,0,1,0,0
Columns=54,102,240,1536
Local=000C0110
[CPU Stack]
Appearance=1,0,0,0,0
Columns=54,60,30,1536
Local=000A0104
[Modules]
Placement=121,239,1055,460,1
Appearance=1,0,1,0,0
Columns=54,54,54,96,72,96,240,1536
Sort=0
[Namelist[1]]
Placement=75,75,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[OllyExt]
IsDebuggerPresent=1
NtGlobalFlag=1
HeapFlags=1
ForceFlags=1
CheckRemoteDebuggerPresent=1
OutputDebugString=1
CloseHandle=1
SeDebugPrivilege=1
BlockInput=1
ProcessDebugFlags=1
ProcessDebugObjectHandle=1
TerminateProcess=1
NtSetInformationThread=1
NtQueryObject=1
FindWindow=1
NtOpenProcess=1
Process32First=1
Process32Next=1
ParentProcess=1
GetTickCount=1
TimeGetTime=1
QueryPerformanceCounter=1
ZwGetContextThread=1
NtSetContextThread=1
KdDebuggerNotPresent=1
KdDebuggerEnabled=1
NtSetDebugFilterState=1
ProtectDRX=1
HideDRX=1
DbgPrompt=1
CreateThread=1
Caption=1
KillAntiAttach=1
CodeRipperSyntax=0
DataRipperSyntax=0
[Search]
Placement=150,150,939,500,1
[Search tab]
Appearance[3]=1,0,1,0,0
Columns[3]=54,240,1536
Sort[3]=0
Appearance[1]=1,0,1,0,0
Columns[1]=54,240,1536
Sort[1]=0
[INT3 breakpoints]
Placement=0,543,873,142,1
Appearance=1,0,1,0,0
Columns=54,54,72,240,1536
Sort=0
[Hardware breakpoints]
Placement=1,0,828,224,1
Appearance=1,0,1,0,0
Columns=30,54,54,54,72,240,1536
Sort=0
[Memory breakpoints]
Placement=70,26,1055,186,1
Appearance=1,0,1,0,0
Columns=54,54,54,30,72,1536
Sort=0
[Watches]
Placement=75,75,513,186,1
Appearance=1,0,1,0,0
Columns=240,240
Sort=0
[Command help]
Placement=390,10,409,226,1
Appearance=1,0,0,0,0
[Dump]
Appearance=1,0,1,0,0
Placement=179,148,729,229,1
[Goto]
Appearance=1,0,0,0,0
[Run trace data]
Placement=13,93,1245,592,1
Appearance=1,0,1,0,0
Columns=54,48,54,54,240,144,1536
Sort=0
[Threads]
Placement=623,0,470,171,1
Appearance=1,0,1,0,0
Columns=36,54,108,108,54,54,54,72,72,72
Sort=0
[Windows]
Placement=960,513,320,171,1
Appearance=1,0,1,0,0
Columns=78,192,54,54,54,48,54,54,54,54,72
Sort=0
[Memory]
Placement=6,90,1055,460,1
Appearance=1,0,1,0,0
Columns=54,54,96,60,144,30,48,48,1536
Sort=0
[Profile]
Placement=200,200,735,186,1
Appearance=1,0,1,0,0
Columns=54,54,54,240,1536
Sort=0
[Filedump]
Appearance=1,0,1,0,0
Placement=75,75,729,186,1
[List of libraries]
Appearance=1,0,1,0,0
Columns=300,1536
Sort=0
[Dump[2]]
Placement=373,11,729,186,1
[Dump[2]]
Appearance=1,0,1,0,0
[Dump[4]]
Placement=175,175,729,186,1
[Dump[4]]
Appearance=1,0,1,0,0
[Dump[3]]
Placement=150,150,729,186,1
[Dump[3]]
Appearance=1,0,1,0,0
[Dump[1]]
Placement=466,128,729,186,1
[Dump[1]]
Appearance=1,0,1,0,0
[Dump[1]]
Placement=370,265,729,186,1
[Dump[1]]
Appearance=1,0,1,0,0
[Structure]
Placement=503,113,656,266,1
Appearance=1,0,1,0,0
[Dump[2]]
Placement=25,25,477,186,1
[Dump[2]]
Appearance=1,0,1,0,0
[Dump[4]]
Placement=0,0,729,186,1
[Dump[4]]
Appearance=1,0,1,0,0
[Dump[3]]
Placement=34,4,477,186,1
[Dump[3]]
Appearance=1,0,1,0,0
[Dump[1]]
Placement=627,-9,570,186,1
[Dump[1]]
Appearance=1,0,1,0,0
[Source files]
Placement=75,75,501,186,1
Appearance=1,0,1,0,0
Columns=72,96,1536
Sort=0
[Dump[2]]
Placement=746,58,477,186,1
[Dump[2]]
Appearance=1,0,1,0,0
[Call DLL]
Placement=10,10
[Dump[1]]
Placement=0,0,609,234,1
[Dump[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Placement=225,225,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=4
[Registers]
Placement=100,100,333,186,1
Appearance=1,0,1,0,0
Local=0,0
[Call stack]
Placement=25,25,633,186,1
Appearance=1,0,1,0,0
Columns=54,54,270,168,54
Sort=0
[Namelist[1]]
Placement=100,100,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=125,125,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=150,150,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=175,175,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=25,25,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=50,50,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=75,75,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=125,125,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=150,150,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=175,175,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=200,200,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Namelist[1]]
Placement=225,225,795,186,1
[Namelist[1]]
Appearance=1,0,1,0,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Pause on module]
Module[0]=C50032
[Colour schemes]
Scheme name[0]=Black on white
Foreground_1[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[0]=0
Modified commands[0]=0
Scheme name[1]=Yellow on blue
Foreground_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[1]=0
Modified commands[1]=0
Scheme name[2]=Marine
Foreground_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[2]=0
Modified commands[2]=0
Scheme name[3]=Mostly black
Foreground_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[3]=0
Modified commands[3]=0
Scheme name[4]=Scheme 4
Foreground_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[4]=0
Modified commands[4]=0
Scheme name[5]=Scheme 5
Foreground_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[5]=0
Modified commands[5]=0
Scheme name[6]=Scheme 6
Foreground_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[6]=0
Modified commands[6]=0
Scheme name[7]=Scheme 7
Foreground_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[7]=0
Modified commands[7]=0
[Highlighting schemes]
Scheme name[1]=Christmas tree
Foreground_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[1]=1
Modified commands[1]=1
Scheme name[2]=Jumps and calls
Foreground_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[2]=0
Modified commands[2]=0
Scheme name[3]=Memory access
Foreground_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[3]=1
Modified commands[3]=1
Scheme name[4]=Hilite 4
Foreground_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[4]=0
Modified commands[4]=0
Scheme name[5]=Hilite 5
Foreground_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[5]=0
Modified commands[5]=0
Scheme name[6]=Hilite 6
Foreground_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[6]=0
Modified commands[6]=0
Scheme name[7]=Hilite 7
Foreground_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[7]=0
Modified commands[7]=0
[Fonts]
Font name[0]=OEM fixed font
Font data[0]=0,0,0,0,0,0,0,0,0,0,0,10
Face name[0]=
Font name[1]=Terminal 6
Font data[1]=9,6,700,0,0,0,255,0,1,1,0,0
Face name[1]=Terminal
Font name[2]=System fixed font
Font data[2]=0,0,0,0,0,0,0,0,0,0,0,16
Face name[2]=
Font name[3]=Courier (UNICODE)
Font data[3]=14,0,400,0,0,0,1,2,5,-2,0,0
Face name[3]=Courier New