Practical Malware Analysis

Assistance Features

OllyDbg provides many mechanisms to help with analysis, including the following:

• Logging. OllyDbg keeps a log of events constantly available. To access them, select View ▶ Log. This log shows which executable modules were loaded, which breakpoints were hit, and other information. The log can be useful during your analysis to figure out which steps you took to get to a certain state.

• Watches window. OllyDbg supports the use of a Watches window, which allows you to watch the value of an expression that you generate. This expression is constantly updated in this window, which can be accessed by selecting View ▶ Watches. You can set an expression in the Watches window by pressing the spacebar.

• Help. The OllyDbg Help ▶ Contents option ...