0

I'm trying to get to know OllyDbg (1.10) a bit, but one specific setting I couldn't find. I saw in a tutorial movie the following:

POP ECX       ; Test.00627CB

But in my version of Olly, I just see the POP ECX. No commenting. I checked all the settings, but it did not appear...

Maybe it's a plugin?

Thanks!

Steven Van Ingelgem
  • 872
  • 2
  • 9
  • 25
  • You mean that at that certain address (0x00627CB) you find a different instruction? Because that is normal. I think there is an option to turn on/off commenting in olly. – Dominik Antal Jun 30 '14 at 09:08

2 Answers2

1

For OllyDbg1.10 try 'Analyze This' Plugin

AnalyzeThis! is an OllyDbg plugin to allow OllyDbg's analysis function to operate outside of the marked code segment, by telling OllyDbg the current segment is the code segment.

Another way would be to switch to OllyDbg 2 -> MUCH better analysis; and more comments in Comment Column

PS: Analysis depends upon the executable type (c++, vb6, Delphi), so the Comment section may vary

Nik theGeeK
  • 181
  • 12
0
options -> registers -> check mark -> decode registers for any IP

enabling this will show the comment but be aware that this can be higly misleading

ollydbg will automatically decode register content when you are on the instruction by enabling this option ollydbg decodes reister values without any consideration to the current instruction pointer

blabb
  • 8,674
  • 1
  • 18
  • 27