信息窗口［Information window］
Information pane of CPU window decodes arguments of the first command selected in Disassembler pane. Information displays also implicit arguments, like AL and ECX in REPE SCASB , or top of stack in RETN. For analyzed code, it displays list of commands that jump to the current location. If debugging information is available, it also displays source line corresponding to the selection. From here, you can follow addresses in Dump or Disassembler and modify arguments, or open source file.
Any program uses registers very intensively, so their contents continually vary. By default, OllyDbg assumes that registers are valid only for the currently executed command. If you want to decode arguments for all commands, please activate the option Decode registers for any IP.
If you backtrace the run trace log, Information pane gets grayed to emphasize that displayed registers are not actual but taken from the trace data. Notice that run trace does not save contents of memory, all displayed memory contents is actual.
Depending on the selection, pop-up menu of information window may include following items:
Copy pane to clipboard - copies all non-empty lines to clipboard.
Modify register - allows you to change the contents of the selected register.
Follow address in Disassembler - follows address in Disassembler pane.
Follow value in Disassembler - follows contents of doubleword memory pointed to by selected address in Disassembler pane.
Follow address in Dump- follows address in Dump pane of CPU window.
Follow value in Dump - follows contents of doubleword memory pointed to by selected address in Dump pane of CPU window.
Go to CALL from xxxx,
Go to JMP from xxxx,
Go to JNZ from xxxx,
Go to JMP [ ] from xxxx etc. - goes to command that jumps to or calls current location. This can be direct or indirect local (intramodular) call, direct unconditional jump, conditional jump or table switch. Notice that calls from different modules are not listed, even if they are present in call tree.
Show all jumps and local calls - if number of jumps to the current location exceeds 16, this menu item opens dialog that lists all found jumps.
Show source - opens source file at the position corresponding to selected command. Alternatively, doubleclick source line in the Information window.
Appearance - see detailed description here.
$#K寄存器窗口［Registers window］
Registers window displays and interpretes the contents of CPU registers for currently selected thread. It also allows to modify registers and follow addresses in other CPU panes. Pop-up menus associated with each register are self-explanatory, and I will not describe them here.
Following EFL are the suffixes of conditional commands that satisfy current flags. If, for example, you see:
EFL 00000A86 (O,NB,NE,A,S,PE,GE,G),
this means that JO and JNE will be taken whereas JB and JPO not.
In the same manner, following FST is the decoding of FPU flags C0, C2 and C3 as if the last FPU operation were a comparison.
When debugged program pauses execution, OllyDbg highlights all differences since previous pause. If you modify any item, OllyDbg highlights all modified items.
To toggle value of some flag, doubleclick it, or select and press return. Doubleclicking on register invokes dialog where you can modify its contents. To change integer or FPU registers, start typing new contents. Keys Plus (+) and Minus (-) increment and decrement selected integer registers.
You can choose either floating-point, MMX or 3DNow! decoding of FPU registers. If window contains bar, pressing the bar will loop through these three formats. You can also let OllyDbg change this presentation automatically, based on the type of the command where last break occured. Alternatively, register window can display debug registers DR0..DR3, DR6 and DR7. However, you can't modify debug registers.
If you are debugging SSE code, activate option "Decode SSE registers" to view 128-bit SSE registers. Notice that this option is slow and sometimes dangerous (especially when application is multithread), don't use it unless absolutely necessary.
If you backtrace the run trace log, Registers window gets grayed to emphasize that displayed registers are not actual but taken from the trace data. Run trace does not save contents of memory, SSE and debug registers and reads actual memory of debugged process to decode memory pointers.
You can display last error detected by a thread (as returned by call to API function GetLastError). This feature is controlled by option "Show last error". If activated, last error is saved to run race log, but may significantly (up to 20%) slow down the tracing speed.
You can scroll regiser pane by pressing left mouse button somewhere in the window and moving mouse.
------------翻译完成后，请将翻译内容回贴---------------
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
