ollydbg.ini

[Settings]
Check DLL versions=0
Topmost window=0
Show main menu items that don't apply=0
Show popup items that don't apply=0
Show toolbar=1
Use system colours in toolbar=0
Status in toolbar=0
Flash duration=2
Autoupdate interval=4
Mode of main window=0
Restore windows=1
Bring OllyDbg to top on pause=1
Restore window positions=1
Restore width of columns=1
Restore sorting criterium=1
Highlight sorted column=1
Right click selects=1
Index of default font=1
Index of default UNICODE font=1
Index of default colours=0
Code highlighting=0
Horizontal scroll=1
Snow-free drawing=1
Append arguments=1
Allow diacritical symbols=1
Decode pascal strings=1
Use IsTextUnicode=0
String decoding=1
File graph mode=1
Put ASCII text to clipboard=0
Dialog font mode=0
Font in dialogs=0
Align dialogs=1
Global search=1
Aligned search=0
Ignore case=1
Search direction=1
Floating search with margin=0
Allow extra commands in sequence=1
Allow jumps into the sequence=0
Keep size of hex edit selection=0
List sorting mode=0
Modify FPU tag=0
MMX display mode=0
Show tooltips in dialog windows=1
X options coordinate=392
Y options coordinate=119
Last selected options pane=3
Last edited font in options=1
Last edited scheme in options=7
Last edited colour index in options=0
Last edited highlighting in options=1
Last edited highlighting index in options=10
Warnmode when not administrator=0
Warnmode for packed code in Analyzer=6
Warnmode when INT3 breakpoint is corrupt=1
Warnmode when breakpoint set on non-command=6
Warnmode when EIP set on non-command=0
Warnmode when clipboard size too large=0
Warnmode when all threads are suspended=0
Warnmode when thread is changed=1
Warnmode when process is still running=6
Warnmode when active when closing OllyDbg=6
Warnmode when unable to close process=1
Warnmode when executable differs from udd=6
Warnmode when INT3 in udd has different cmd=1
Warnmode when fixups are modified=1
Warnmode when copy of executable file changed=1
Warnmode when memory breakpoint on stack=0
Warnmode when modified debug registers=1
Warnmode when launching loaddll=6
Warnmode when EIP inside the patch=0
Only ASCII printable in dump=1
Code page for ASCII dumps=1252
Underline fixups=1
Show jump direction=1
Show jump path=1
Show grayed path if jump is not taken=1
Fill rest of command with NOPs=0
Action on letter key in Disassembler=2
Wide characters in UNICODE dumps=1
Automatically backup user code=1
Visible lines when scrolling disasm=1
IDEAL disassembling mode=0
Disassemble in lowercase=0
Separate arguments with TAB=0
Extra space between arguments=0
Show default segments=1
Always show memory size=1
NEAR jump modifiers=1
Use short form of string commands=0
Use RET instead of RETN=1
SSE size decoding mode=0
Jump hint decoding mode=0
Size sensitive mnemonics=1
Top of FPU stack=0
Show symbolic addresses=1
Show local module names=1
Demangle symbolic names=1
Use hardware breakpoints for stepping=1
First pause=2
Pause on attach=1
Pause on Loaddll=1
Assume flat selectors=0
Ignore access violations in KERNEL32=1
Ignore INT3=1
Ignore TRAP=1
Ignore access violations=1
Ignore division by 0=1
Ignore illegal instructions=1
Ignore all FPU exceptions=1
Ignore all service exceptions=1
Ignore custom exception ranges=1
Call UnhandledExceptionFilter=1
Report ignored exceptions to log=1
Autoreturn=0
Use DebugBreakProcess=0
Use ExitProcess=0
Warn when frequent breaks=1
Allow command emulation=1
Debug child processes=0
Animation delay index=0
Stop on new DLL=0
Stop on DLL unload=0
Stop only on selected modules=0
Stop on debug string=0
Stop on new thread=0
Stop on thread end=0
Enable use of debugging data=1
Use dbghelp to walk stack=1
Use Microsoft Symbol Server=0
Hide missing source files=0
Hide internal compiler names=0
Skip leading spaces from source=0
Hide Call DLL window on call=0
Pause after call to DLL is finished=1
Allow .NET debugging=0
Scan registry for GUIDs on starup=1
Run trace protocolling options=0
Run trace buffer size index=2
Trace over system DLLs=1
Trace over string commands=1
Save traced commands=1
Save accessed memory to trace=1
Save FPU registers to trace=1
Synchronize CPU and Run trace=1
Set breakpoints on callbacks in hit trace=0
Hit trace mode for indirect jumps=0
Stop hit trace if not command=0
Hit trace outside the code section=2
Show symbolic names in protocol range list=0
Allow automatic SFX extraction=0
SFX extraction mode=1
Use real SFX entry from previous run=1
Ignore SFX exceptions=0
Use predictions in search=1
References include indirect jumps=1
Add origin to search results=1
Default resource language=9
Gray inactive windows=1
Gray register names=1
Center FOLLOWed command=1
Decode registers for any IP=1
Remove code hilite on register hilite=1
Automatically select register type=0
Enable SSE registers=1
Label display mode=0
Highlight symbolic labels=1
Log buffer size index=2
Tabulate columns in log file=0
Append data to existing log file=0
Auto analysis=2
No predicted registers in system DLLs=1
Fuzzy analysis=1
Report problems during analysis=0
Decode tricks=1
Mark tricks=0
Decode ifs as switches=1
Mark only important operands=0
Functions preserve registers=2
Ignore braces in udd path=1
Guess number of arguments=1
Guess arguments from mangled names=1
Guess meaning of guessed arguments=1
Show uncertain arguments=1
Rename value dependent arguments=1
Show predicted values=1
Show ARG and LOCAL in disassembly=1
Use symbolic names for ARG and LOCAL=1
Show ARG and LOCAL in comments=1
Show loops=1
Accept far calls and returns=1
Accept direct segment modifications=1
Accept privileged commands=1
Accept I/O commands=1
Accept NOPs=1
Accept shifts out of range=1
Accept superfluous prefixes=1
Accept default prefixes=1
Accept valid LOCK prefixes=1
Accept unaligned stack operations=1
Accept suspicious ESP operations=1
Accept non-standard command forms=1
Accept access to nonexisting memory=1
Accept interrupt commands=1
Block external WM_CLOSE=1
Activate speech=0
Translate commands and registers=0
Skip leading zeros in hex numbers=0
Monitor internal memory allocation=0
Alternative forms of conditional commands=0
Permanent breakpoints on system code=0
Ignore INT3 in MSCORWKS=1
Keep hit trace between sessions=1
GUI language=0
Search accuracy=0
Warnmode when IAT is copied back to exe=0
Warnmode when IAT is autocopied back to exe=0
Code page for multibyte dumps=65001
Disable GDI scripting support=0
Show call arguments=0
Type of break command=0
Hide unimportant handles=0
Show original handle names=0
Hide current registers warning=0
Search for library functions=1

[OllyDbg]
Placement=251,38,1066,704,0

[History]
Log file=log.txt
Trace save file=trace.txt
Data directory=.\Udds
Plugin directory=.\Plugins
API help file=
Last viewed file=
Last keyboard shortcuts file=shortcuts.ini
Previous JIT=
Debug data directory[0]=
Debug data directory[1]=
Debug data directory[2]=
Standard library directory=.\Udls
Alternative initialization file=
Last object or library file=
Last image library file=

[Vic Plug-In 2]
Transparent ollydbg window=230
Hide the PEB=1
Maximize ollydbg window=0
Maximize current MDI window=1
Show toolbar on ollydbg title=2

[OllyExt]
IsDebuggerPresent=0
NtGlobalFlag=0
HeapFlags=0
ForceFlags=0
CheckRemoteDebuggerPresent=0
OutputDebugString=0
CloseHandle=0
SeDebugPrivilege=0
BlockInput=0
ProcessDebugFlags=0
ProcessDebugObjectHandle=0
TerminateProcess=0
NtSetInformationThread=0
NtQueryObject=0
FindWindow=0
NtOpenProcess=0
Process32First=0
Process32Next=0
ParentProcess=0
GetTickCount=0
TimeGetTime=0
QueryPerformanceCounter=0
ZwGetContextThread=0
NtSetContextThread=0
KdDebuggerNotPresent=0
KdDebuggerEnabled=0
NtSetDebugFilterState=0
ProtectDRX=0
HideDRX=0
DbgPrompt=0
Caption=1
KillAntiAttach=0
CodeRipperSyntax=0
DataRipperSyntax=0

[OllyGraph]
Wingraph32 path=.\Plugins\wingraph32.exe

[CPU]
Placement=0,5,945,538,3
Offset[0]=42
Offset[1]=96
Offset[2]=0
Offset[3]=-180

[CPU Disasm]
Appearance=1,0,1,0,1
Columns=56,96,326,1536

[CPU Info]
Appearance=1,0,0,0,1

[CPU registers]
Appearance=1,0,1,0,0
Local=0,68097

[CPU Dump]
Appearance=1,0,1,0,1
Columns=54,144,54
Local=00010801

[CPU Stack]
Appearance=1,0,1,0,1
Columns=54,60,1536
Local=00090104

[Modules]
Placement=0,69,999,461,1
Appearance=1,0,1,1,0
Columns=54,54,54,96,72,96,240,1536
Sort=0

[Log data]
Placement=18,54,774,440,1
Appearance=1,0,1,0,0
Columns=54,1536
Sort=0

[Memory]
Placement=206,35,867,404,1
Appearance=1,0,1,0,0
Columns=54,54,96,60,144,30,48,48,1536
Sort=0

[Windows]
Placement=130,130,801,187,1
Appearance=1,0,1,0,0
Columns=78,192,54,54,54,48,54,54,54,54,72
Sort=0

[Threads]
Placement=156,156,753,365,1
Appearance=1,0,1,0,0
Columns=36,54,108,108,54,54,54,72,72,72
Sort=0

[Dialog placement]
Assemble=692,294
Enter string=658,203
Enter new command line arguments=108,96
Edit data=754,317
Set breakpoint=695,21
Search for data=594,88
Enter search string=906,50
Select range of exception codes=638,214
Create standard function library=125,71
Change last error=986,118
Command search=605,125
Select structure=1016,354
Edit register=1136,27

[Watches]
Placement=26,26,513,187,1
Appearance=1,0,1,0,0
Columns=240,240
Sort=0

[Search]
Placement=124,49,888,508,1

[Search tab]
Appearance=1,0,1,0,0
Columns=
Sort=0
Appearance[3]=1,0,1,1,0
Columns[3]=54,240,1536
Sort[3]=0
Appearance[8]=1,0,1,1,0
Columns[8]=54,240,54,210,1536
Sort[8]=0
Appearance[7]=1,0,1,1,0
Columns[7]=54,240,1536
Sort[7]=0
Appearance[1]=1,0,1,1,0
Columns[1]=54,240,1536
Sort[1]=0

[Run trace data]
Placement=62,12,927,187,1
Appearance=1,0,1,0,0
Columns=54,48,54,54,240,144,1536
Sort=0

[Patches]
Placement=104,104,903,187,1
Appearance=1,0,1,0,0
Columns=54,54,30,48,192,192,1536
Sort=0

[Memory breakpoints]
Placement=130,130,597,187,1
Appearance=1,0,1,0,0
Columns=54,54,54,30,72,1536
Sort=0

[INT3 breakpoints]
Placement=236,111,753,187,1
Appearance=1,0,1,0,0
Columns=54,54,72,240,1536
Sort=0

[Source files]
Placement=0,0,501,187,1
Appearance=1,0,1,0,0
Columns=72,96,1536
Sort=0

[Hardware breakpoints]
Placement=26,26,837,187,1
Appearance=1,0,1,0,0
Columns=30,54,54,54,72,240,1536
Sort=0

[Trace API]
Restore window=0
Protocol API calls=0
Skip GDI32=0
Skip USER32=0
Skip KERNEL32=0
Skip MSVC=0
Protocol returned values=1
Placement=117,70,507,400,1
Appearance=1,0,1,1,0
Columns=54,243,54,1536
Sort=0

[Filedump]
Appearance=1,0,1,1,1

[Attach]
Appearance=1,0,1,1,0
Columns=54,72,168,1536
Sort=0

[Call Stack]
Placement=92,61,732,271,1
Appearance=1,0,1,1,0
Columns=54,54,240,240,54
Sort=0

[Dump]
Appearance=1,0,1,1,1
Placement=26,26,729,204,1

[Goto]
Appearance=1,0,0,1,0

[Namelist]
Appearance=1,0,1,1,0
Sort=2
Placement=0,46,795,335,1
Columns=54,54,66,48,240,1536

[Command help]
Placement=239,129,471,202,1
Appearance=1,0,0,1,0

[Registers]
Placement=156,156,333,204,1
Appearance=1,0,1,1,0
Local=0,0





[OllyID]
Database path=.\Plugins\userdb.txt
Scan on analysis=0
Scan EP only=0
Log level=2
Show results msgbox=1
[List of libraries]
Appearance=1,0,1,1,0
Columns=300,1536
Sort=0
[Multiline Ultimate Assembler]
tabs_path=.\multiasm
pos_x=809
pos_y=197
pos_w=498
pos_h=354
disasm_rva=1
disasm_rva_reloconly=1
disasm_label=1
disasm_extjmp=1
disasm_hex=2
disasm_labelgen=1
asm_comments=1
asm_labels=1
edit_savepos=1
edit_tabwidth=0
[Namelist[1]]
Placement=78,78,795,204,1
[Namelist[1]]
Appearance=1,0,1,1,0
[Namelist[1]]
Columns=54,54,66,48,240,1536
[Namelist[1]]
Sort=0
[Hit Trace Difference]
Placement=52,52,567,204,1
Appearance=1,0,1,1,0
Columns=54,480
Sort=0
[Structure]
Placement=0,65,748,366,1
Appearance=1,0,1,1,0
[Structure[1]]
Placement=-82,41,609,245,1
[Structure[1]]
Appearance=1,0,1,1,0
[Ignored exceptions]
Range[0]=0 ffffffff
[Colour schemes]
Scheme name[0]=vic4key
Foreground_1[0]=FF00,FF00,FFFF00,0,*,8000,FFFF00,*,FF00,*,*,*,*,*,*,*
Foreground_2[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[0]=0,0,0,FF00,*,0,808080,*,FF,800000,*,*,*,*,*,*
Background_2[0]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[0]=0
Modified commands[0]=0
Scheme name[1]=BFRE Team's Black
Foreground_1[1]=FFFFFF,*,*,*,*,*,*,*,FFFFFF,*,*,*,*,*,*,*
Foreground_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[1]=0,0,0,808080,*,*,*,C0C0C0,0,800080,*,*,*,*,*,*
Background_2[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[1]=0
Modified commands[1]=0
Scheme name[2]=Marine
Foreground_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[2]=0
Modified commands[2]=0
Scheme name[3]=Mostly black
Foreground_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[3]=0
Modified commands[3]=0
Scheme name[4]=Scheme 4
Foreground_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[4]=0
Modified commands[4]=0
Scheme name[5]=Scheme 5
Foreground_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[5]=0
Modified commands[5]=0
Scheme name[6]=Scheme 6
Foreground_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[6]=0
Modified commands[6]=0
Scheme name[7]=Scheme 7
Foreground_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[7]=0
Modified commands[7]=0
[Highlighting schemes]
Scheme name[1]=vic4key
Foreground_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,FFFF00,FFFF,FFFF,FF00FF
Foreground_2[1]=FFFF,FF,FFFF00,FF,FF,FF,*,*,FFFFFF,800000,808080,FFFF00,FFFFFF,FFFF,FF,*
Background_1[1]=*,*,*,*,*,*,*,*,*,*,*,*,*,FFFFFFFF,FFFFFFFF,*
Background_2[1]=FFFFFFFF,FFFFFFFF,*,FFFFFFFF,*,FFFF,*,*,*,*,*,FFFFFFFF,FFFFFFFF,FFFFFFFF,FFFFFFFF,*
Operands[1]=1
Modified commands[1]=1
Scheme name[2]=BFRE Team's Highlight
Foreground_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,FFFF,FFFF,*,*
Foreground_2[2]=FFFF,*,*,FF00FF,*,FF,*,*,FF00,*,*,FFFF00,FF00FF,FFFF00,8080,*
Background_1[2]=*,*,*,*,*,*,*,*,*,*,*,*,*,FFFFFFFF,*,*
Background_2[2]=FF,*,*,*,*,FFFFFFFF,*,*,*,*,*,*,*,*,*,*
Operands[2]=1
Modified commands[2]=1
Scheme name[3]=Memory access
Foreground_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[3]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[3]=1
Modified commands[3]=1
Scheme name[4]=Hilite 4
Foreground_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[4]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[4]=0
Modified commands[4]=0
Scheme name[5]=Hilite 5
Foreground_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[5]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[5]=0
Modified commands[5]=0
Scheme name[6]=Hilite 6
Foreground_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[6]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[6]=0
Modified commands[6]=0
Scheme name[7]=Hilite 7
Foreground_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Foreground_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_1[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Background_2[7]=*,*,*,*,*,*,*,*,*,*,*,*,*,*,*,*
Operands[7]=0
Modified commands[7]=0
[Fonts]
Font name[0]=OEM fixed font
Font data[0]=0,0,0,0,0,0,0,0,0,0,0,10
Face name[0]=
Font name[1]=vic4key
Font data[1]=9,6,700,0,0,0,255,0,1,1,0,0
Face name[1]=Terminal
Font name[2]=System fixed font
Font data[2]=0,0,0,0,0,0,0,0,0,0,0,16
Face name[2]=
Font name[3]=Courier (UNICODE)
Font data[3]=14,0,400,0,0,0,1,2,5,-2,0,0
Face name[3]=Courier New
Font name[4]=Lucida (UNICODE)
Font data[4]=10,6,400,0,0,0,1,2,5,0,0,0
Face name[4]=Lucida Console
Font name[5]=BFRE Team's Font
Font data[5]=-16,0,400,0,0,0,134,1,49,0,0,0
Face name[5]=Fixedsys
Font name[6]=Font 6
Font data[6]=0,0,0,0,0,0,0,0,0,0,0,16
Face name[6]=
Font name[7]=Font 7
Font data[7]=14,0,400,0,0,0,1,2,5,-2,0,0
Face name[7]=Courier New
[Shortcuts]
Close OllyDbg=060058 (Ctrl+Shift+X)
Open Patches window=080050 (Alt+P)
Copy=0
Repeat last search=08004E (Alt+N)
Copy address=040043 (Ctrl+C)
Save file to disk=040053 (Ctrl+S)
Enable or disable INT3 breakpoint=040020 (Ctrl+Space)
Search for all intermodular calls=060043 (Ctrl+Shift+C)
Search for all referenced strings=060053 (Ctrl+Shift+S)
Remove analysis from the module=060041 (Ctrl+Shift+A)
Help on command=000070 (F1)