• Tools: OllyDBG – the original (ver. 1.10) - Debugger OllyDBG – R4ndom’s version (with scripts and plugins) - Debugger [-] CmpDisasm - Compare binary disassemblies, as well as hex and PE headers. Detect It Easy (DIE) - PE Packer identifier PeID - PE Packer identifier RDG - PE Packer identifier exeinfoPE - PE Packer identifier ImpREC - Import Re-constructor LordPE - PE verifier, dumper, editor etc. PEBrowse - PE viewer/editor/disassembler Peditor - PE viewer/editor PEView - PE viewer/editor ShowString - Shows all ASCII strings in a binary Resource Hacker - Allows modifying resources in binaries Armadillo KeyTool - A great tool by eXoDia for analyzing Armadillo packed binaries. CFF Explorer Suite - Great PE and hex editor. dUP2 - Universal patcher by diablo2002. ShellOp Converter - Convert shellcode to opcodes and disassembly by Levis. • Olly Plugins: TLSCatch - New version 0.3 by waliedassar. MUltimate Assembler - Multi line assembler by RaMMicHaeL. Olly Callstack - Call stack plugin by Zer0Flag (2.0 only). +BP-Olly - Open up a new ‘floating’ toolbar at the top of Olly. AnalyzeThis+ - Allow OllyDbg’s analysis function to operate outside of the marked code segment Anti-Anti Hardware BP - Hooks ntdll to restore the Drx registers after a Structured Exception Handler. API Break - This plugin allows you to set a breakpoint on many popular Windows API’s Ascii Table - quickly displays the ASCII chart in hex, decimal, octal and ascii. Attach Anyway - A PoC OllyDbg plugin designed to remove a process’ hook on NtContinue. Bookmark - This handy plugin allows the user to set bookmarks Code Ripper - Allows you to copy code from the binary in a nicely formatted way. Command Bar - Allows quickly applying breakpoints, finding API’s etc. Hide Debugger - Hides OllyDbg from many debugger detection tricks. HideOD - Allows Olly to be hiden from the debugged application. IDAFicator - . IsDebugPresent - Hides debugger from IsDebuggerPresent Windows API. Mnemonic Help - Displays information about the currently selected opcode mnemonic. NanoWrite - Helps you write code injection. Olly Advanced - A ‘must have’. Fixes bugs and adds functionality Olly Breakpoint Manager - Provides breakpoint exporting, importing and automatic breakpoint loading. Olly Toolbar Manager - Allows you to create your own toolbar. OllyDump - Allows you to dump the debugged process after you have modified it. OllyPad - Lets you create notes for the currently debugged application and stores them for later use. OllybonE - Break-on-Execute for OllyDbg. OllyDBG Script - Allows Olly to run of the thousands of scripts written for Olly. StrongOD - A ‘Swiss army knife’ of functionality. Ultra String Reference - A supped-up version of the built in “search for String References“. • Texts: The Art Of Assembly - Best ASM instructional book out there. PC Assembly Language - Another classic. Win32asm Tutorial - A very good beginning tutorial by Thomas Bleeker Windows Messages - All Windows messages with their hex values Anti-Debugging- A Developer’s View - Very complete text on anti-debugging Anti Reverse Engineering Guide - Down and dirty guide Methods of Code Obfuscation - Very detailed guide to obfuscation OllyDBG Detection Techniques - Ways of specifically detecting Olly Ultimate Anti-Debugging Reference - Most complete guide I’ve seen