[Settings]
Check DLL versions=0
Show toolbar=1
Status in toolbar=1
Use hardware breakpoints to step=1
Restore windows=1
Scroll MDI=0
Horizontal scroll=0
Topmost window=0
Index of default font=1
Index of default colours=0
Index of default syntax highlighting=2
Log buffer size index=5
Run trace buffer size index=7
Group adjacent commands in profile=1
Highlighted trace register=-1
IDEAL disassembling mode=0
Disassemble in lowercase=0
Separate arguments with TAB=0
Extra space between arguments=1
Show default segments=0
NEAR jump modifiers=0
Use short form of string commands=0
Use RET instead of RETN=0
Size sensitive mnemonics=1
SSE size decoding mode=0
Top of FPU stack=1
Always show memory size=1
Decode registers for any IP=0
Show symbolic addresses=1
Show local module names=1
Gray data used as filling=1
Show jump direction=1
Show jump path=1
Show jumpfrom path=1
Show path if jump is not taken=1
Underline fixups=0
Center FOLLOWed command=0
Show stack frames=1
Show local names in stack=1
Extended stack trace=0
Synchronize source with CPU=0
Include SFX extractor in code=0
SFX trace mode=0
Use real SFX entry from previous run=1
Ignore SFX exceptions=0
First pause=1
Stop on new DLL=0
Stop on DLL unload=0
Stop on new thread=0
Stop on thread end=0
Stop on debug string=0
Decode SSE registers=0
Enable last error=1
Ignore access violations in KERNEL32=1
Ignore INT3=1
Ignore TRAP=1
Ignore access violations=0
Step in unknown commands=1
Ignore division by 0=1
Ignore illegal instructions=1
Ignore all FPU exceptions=1
Warn when frequent breaks=0
Warn when break not in code=0
Autoreturn=0
Save original command in trace=0
Show traced ESP=0
Show traced flags=0
Animate over system DLLs=1
Trace over string commands=0
Synchronize CPU and Run trace=1
Ignore custom exceptions=1
Smart update=1
Set high priority=1
Append arguments=1
Use ExitProcess=1
Allow injection to get WinProc=0
Sort WM_XXX by name=0
Type of last WinProc breakpoint=0
Snow-free drawing=0
Demangle symbolic names=0
Keep ordinal in name=1
Only ASCII printable in dump=0
Allow diacritical symbols=1
String decoding=1
Warn if not administrator=0
Warn when terminating process=0
Align dialogs=1
Use font of calling window=2
Specified dialog font=2
Number of lines that follow EIP=0
Restore window positions=1
Restore width of columns=1
Highlight sorted column=1
Compress analysis data=1
Backup UDD files=1
Fill rest of command with NOPs=1
Reference search mode=0
Global search=1
Aligned search=0
Allow error margin=0
Keep size of hex edit selection=0
Modify tag of FPU register=1
Hex inspector limits=1
MMX display mode=0
Last selected options card=3
Last selected appearance card=3
Ignore case in text search=1
Letter key in Disassembler=0
Looseness of code analysis=1
Decode pascal strings=1
Guess number of arguments=1
Accept far calls and returns=0
Accept direct segment modifications=0
Decode VxD calls=0
Accept privileged commands=0
Accept I/O commands=0
Accept NOPs=1
Accept shifts out of range=0
Accept superfluous prefixes=0
Accept LOCK prefixes=0
Accept unaligned stack operations=1
Accept non-standard command forms=1
Show ARG and LOCAL in procedures=0
Save analysis to file=1
Analyse main module automatically=0
Analyse code structure=1
Decode ifs as switches=1
Save trace to file=0
Trace contents of registers=0
Functions preserve registers=0
Decode tricks=0
Automatically select register type=1
Show decoded arguments=1
Show decoded arguments in stack=1
Show arguments in call stack=1
Show induced calls=1
Label display mode=0
Label includes module name=0
Highlight symbolic labels=1
Highlight RETURNs in stack=1
Ignore path in user data file=1
Ignore timestamp in user data file=1
Ignore CRC in user data file=1
Default sort mode in Names=1
Save out-of-module user data=1
Tabulate columns in log file=0
Append data to existing log file=0
Flush gathered data to log file=0
Skip spaces in source comments=1
Hide non-existing source files=0
Tab stops=8
File graph mode=2
Show internal handle names=0
Hide irrelevant handles=0
[Placement]
OllyTest=455,142,1134,764,1
CPU=0,4,1926,932,1
CPU subwindows=601,1227,550,807,610,1440,544,1280
References=305,189,1158,624,1
Ultra String Reference Plugin=337,268,1068,573,1
Log data=192,43,1383,761,1
Executable modules=313,208,1218,555,1
Memory map=279,139,1375,635,1
Threads=528,255,936,387,1
Windows=394,198,1206,535,1
Handles=154,203,1616,453,1
SEH chain=432,215,974,422,1
Patches=371,235,1093,423,1
Call stack=453,233,934,434,1
Breakpoints=345,183,1032,557,1
Watch expressions=489,263,912,271,1
Run trace=543,204,886,462,1
Source=414,250,1001,506,1
Source files=353,210,1054,475,1
Call tree=110,145,792,182,1
Script Log Window=301,184,1114,561,1
Script Execution=300,115,1429,706,1
Session File List=408,257,992,330,1
[History]
View file=
View text file=
Object file=
Import library=
Log file=log.txt
Run trace file=rtrace.txt
API help file=
Text save file=
Symbolic data path=
UDD path=UDD
Plugin path=Plugin
Executable[1]=
Executable[2]=
Executable[3]=
Executable[4]=
Executable[5]=
Executable[0]=
[Colours]
Scheme[0]=0,12,1,15,11,9,9,13
Scheme name[0]=Black on white
Scheme[1]=14,12,7,1,3,7,3,13
Scheme name[1]=Yellow on blue
Scheme[2]=1,12,3,11,14,2,7,13
Scheme name[2]=Marine
Scheme[3]=15,12,7,0,8,11,7,13
Scheme name[3]=Mostly black
Scheme[4]=0,12,8,18,7,8,7,13
Scheme name[4]=Scheme 4
Scheme[5]=14,12,7,1,3,7,3,13
Scheme name[5]=Scheme 5
Scheme[6]=1,12,3,11,14,2,7,13
Scheme name[6]=Scheme 6
Scheme[7]=15,12,7,0,8,11,7,13
Scheme name[7]=Scheme 7
[Fonts]
Font[0]=12,8,400,0,0,0,255,2,49,0
Face name[0]=Terminal
Font name[0]=OEM fixed font
Font[1]=9,6,700,0,0,0,255,0,48,1
Face name[1]=Terminal
Font name[1]=Terminal 6
Font[2]=16,8,400,0,0,0,204,2,33,0
Face name[2]=Fixedsys
Font name[2]=System fixed font
Font[3]=14,0,400,0,0,0,1,2,5,0
Face name[3]=Courier New
Font name[3]=Courier (UNICODE)
Font[4]=10,6,400,0,0,0,1,2,5,0
Face name[4]=Lucida Console
Font name[4]=Lucida (UNICODE)
Font[5]=9,6,700,0,0,0,255,0,48,0
Face name[5]=Terminal
Font name[5]=Font 5
Font[6]=16,8,400,0,0,0,204,2,33,0
Face name[6]=Fixedsys
Font name[6]=Font 6
Font[7]=14,0,400,0,0,0,1,2,5,0
Face name[7]=Courier New
Font name[7]=Font 7
[Syntax]
Commands[0]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Operands[0]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[0]=No highlighting
Commands[1]=96,4,124,112,9,64,64,13,111,8,12,0,0,0
Operands[1]=1,0,4,13,65,1,112,6,0,0,0,0,0,0
Scheme name[1]=Christmas tree
Commands[2]=1,0,124,44,1,92,96,0,96,0,12,0,0,0
Operands[2]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[2]=Jumps'n'calls
Commands[3]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Operands[3]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[3]=Hilite 3
Commands[4]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Operands[4]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[4]=Hilite 4
[System]
Options position=750,350
[Arguments]
Executable[1]=
Executable[2]=
Executable[3]=
Executable[4]=
Executable[5]=
Executable[0]=
[Appearance]
CPU scheme=0
CPU Disassembler=2,0,0,0,2
CPU Dump=2,0,1,0,4353,0
CPU Stack=2,0,0,0
CPU Info=2,0,0,0
CPU Registers=2,0,1,0
References=2,0,1,0,0
Ultra String Reference Plugin=2,0,1,0,0
ADUMPFILE=2,0,0,0,0
Log data=2,0,1,0,0
Executable modules=2,0,1,0,0
Memory map=2,0,1,0,0
Threads=2,0,1,0,0
Windows=2,0,1,0,0
Handles=2,0,1,0,0
SEH chain=2,0,1,0,0
Patches=2,0,1,0,0
Call stack=2,0,1,0,0
Breakpoints=2,0,1,0,0
Watch expressions=2,0,1,0,0
Run trace=2,0,1,0,0
Source=2,0,0,0,0
Source files=2,0,1,0,0
ANAME=2,0,1,0,0
ADUMP=2,0,0,0,0
Call tree=1,0,1,0,0
Script Log Window=0,0,1,0,0
Script Execution=2,0,1,0,0
Session File List=2,0,1,0,0
[Columns]
CPU Disassembler=91,206,479,2048
CPU Dump=90,480,170
CPU Stack=90,100,2560
References=128,320,2048
Ultra String Reference Plugin=72,320,2048
ADUMPFILE=72,136,320,2048
Log data=109,2048
Executable modules=72,72,72,72,128,2048
Memory map=101,93,94,119,197,57,64,64,2048
Threads=72,72,88,224,80,72,96,96
Windows=104,256,72,72,72,72,72,72,72,2048
Handles=72,120,48,72,24,96,2048
SEH chain=72,256
Patches=72,40,64,256,256,2048
Call stack=72,72,288,224,72
Breakpoints=362,144,201,288,2048
Watch expressions=288,2048
Run trace=72,72,72,72,256,2048
Source=64,2048
Source files=72,128,2048
ANAME=72,72,72,304,2048
ADUMP=90,130,200,2560
Call tree=192,192,192,192
Script Log Window=72,1040
Script Execution=105,458,150,90,1000
Session File List=240,640,256
[Plugin Command line]
Command line window X=0
Command line window Y=0
Restore command line window=0
[Plugin Olly Advanced]
lasttab=0
varbps=0
showalljumpsfix=0
TerminateProcess=0
HideDebugBit=0
NtGlobalFlag=0
Antihwbp=0
HeapFlags=0
ForceFlags=0
maxolly=0
Writememory=0
Readmemory=0
Process32Next=0
UnhandledExceptionFilter=0
Module32Next=0
CheckRemoteDebuggerPresent=0
ZwSetInformationThread=0
GetTickCount=0
GetTickCountCounter=1
ZwQuerySystemInformation=0
ZwOpenProcess=0
FindWindow=0
Anti-RDTSCenabled=0
Anti-RDTSC=0
Anti-RDTSC2=0
ZwQueryInformationProcess=0
codebasefix=0
ignoreexporttable=0
ZwQueryObject=0
scrambleexporttable=0
maxallollywindows=0
x64compat=0
SuspendThread=0
BlockInput=0
viewfilefix=1
copytoexecutable=1
usetoolhelp=0
pausedex=0
pluginexpand=0
keepalteredcrc=0
ignorechangedbp=0
advancedctrlg=1
numofrva=0
followindisassembler=1
analysisbug=1
Entrypointwarning=1
antiattachkill=0
winupack=0
BreakOnTls=0
killps=0
alwaysenableshowalljumpsandcalls=0
fixc08bug=1
fixtermination=0
toomanypatches=1
patchtype=1
compressedcode=1
compressedcodehandling=2
dllloading=1
dllloadmethod=1
ctrlgstate=1
[Plugin PhantOm]
PEB=1
GETCOUNT=0
DRX=1
SETCONTEXT=0
DEBSTRING=0
WINVER=0
GETTIMES=0
REMOVEEP=0
HANDLE=1
WINDOWS=0
DRIVER=0
CAPTION=0
RDTSC=0
VERSION=185
DELTARDTSC=33000
HIDENAME=extremhide
RDTSCNAME=rdtsc
CAPTEXT=Phant0m
PRETEXT=yOo
SINGLE=0
BLOCK=0
BUG=1
COMP64=0
NEWBREAK=1
ZWQIP=1
[Plugin ODbgScript]
Restore Script window=0
Restore Script Log=0
ScriptDir=
NRU1=
BP_FILE=
BP_0001=
NRU2=
NRU3=
NRU4=
NRU5=
BP_0002=
NRU6=
NRU7=
NRU8=
NRU9=
NRU:=
[Plugin Plugins Manager]
HideOD.dll=HideOD
StrongOD.dll=StrongOD
DeJunk.dll=DeJunk
advancedolly.dll=Olly Advanced
analyzeThis.dll=Analyze This
CleanupEx.dll=CleanupEx
OllyCScan.dll=SnD Crypto Scanner
OllyDump.dll=OllyDump
pedumper.dll=OllyDbg PE Dumper
TBAR.dll=OllyTbar Manager
ustrref.dll=Ultra String Reference Plugin
windowjuggler.dll=WindowJuggler
[Plugin StrongOD]
CreateProcessMode=0
HidePEB=0
IsPatchFloat=0
IsAdvGoto=0
KernelMode=0
KillPEBug=0
SuperEnumMod=0
AdvAttach=0
SkipExpection=0
OrdFirst=0
BreakOnLdr=0
BreakOnTls=0
RemoveEpOneShot=0
ShowBar=0
LoadSym=0
AutoUpdate=0
HideWindow=1
HideProcess=1
ProtectProcess=1
DriverKey=-82693034
DriverName=fengyue0
UpdateURL=http://117.41.16.240:7777/sod/update.txt
[Plugin Ultra String Reference Plugin]
Restore UStrRef Window=0
[Exceptions]
Custom[0]=00000000,00FFFFFF
Custom[1]=0EEDFADE,0EEDFADE
