[Settings]
Check DLL versions=0
Show toolbar=1
Status in toolbar=1
Use hardware breakpoints to step=0
Restore windows=105759
Scroll MDI=0
Horizontal scroll=0
Topmost window=0
Index of default font=1
Index of default colours=0
Index of default syntax highlighting=0
Log buffer size index=0
Run trace buffer size index=7
Group adjacent commands in profile=1
Highlighted trace register=-1
IDEAL disassembling mode=0
Disassemble in lowercase=0
Separate arguments with TAB=0
Extra space between arguments=0
Show default segments=1
NEAR jump modifiers=0
Use short form of string commands=0
Use RET instead of RETN=0
Size sensitive mnemonics=1
SSE size decoding mode=0
Top of FPU stack=1
Always show memory size=1
Decode registers for any IP=0
Show symbolic addresses=1
Show local module names=1
Gray data used as filling=1
Show jump direction=1
Show jump path=1
Show jumpfrom path=1
Show path if jump is not taken=1
Underline fixups=1
Center FOLLOWed command=0
Show stack frames=1
Show local names in stack=1
Extended stack trace=1
Synchronize source with CPU=0
Include SFX extractor in code=0
SFX trace mode=0
Use real SFX entry from previous run=1
Ignore SFX exceptions=0
First pause=1
Stop on new DLL=0
Stop on DLL unload=0
Stop on new thread=0
Stop on thread end=0
Stop on debug string=0
Decode SSE registers=0
Enable last error=1
Ignore access violations in KERNEL32=1
Ignore INT3=0
Ignore TRAP=0
Ignore access violations=0
Step in unknown commands=1
Ignore division by 0=0
Ignore illegal instructions=0
Ignore all FPU exceptions=0
Warn when frequent breaks=0
Warn when break not in code=1
Autoreturn=0
Save original command in trace=0
Show traced ESP=0
Show traced flags=0
Animate over system DLLs=1
Trace over string commands=0
Synchronize CPU and Run trace=0
Ignore custom exceptions=0
Smart update=1
Set high priority=1
Append arguments=1
Use ExitProcess=1
Allow injection to get WinProc=0
Sort WM_XXX by name=0
Type of last WinProc breakpoint=0
Snow-free drawing=0
Demangle symbolic names=1
Keep ordinal in name=1
Only ASCII printable in dump=0
Allow diacritical symbols=0
String decoding=0
Warn if not administrator=1
Warn when terminating process=0
Align dialogs=1
Use font of calling window=0
Specified dialog font=0
Number of lines that follow EIP=0
Restore window positions=1
Restore width of columns=0
Highlight sorted column=0
Compress analysis data=1
Backup UDD files=1
Fill rest of command with NOPs=1
Reference search mode=0
Global search=0
Aligned search=0
Allow error margin=0
Keep size of hex edit selection=1
Modify tag of FPU register=1
Hex inspector limits=1
MMX display mode=0
Last selected options card=5
Last selected appearance card=0
Ignore case in text search=1
Letter key in Disassembler=1
Looseness of code analysis=1
Decode pascal strings=1
Guess number of arguments=1
Accept far calls and returns=0
Accept direct segment modifications=0
Decode VxD calls=0
Accept privileged commands=0
Accept I/O commands=0
Accept NOPs=1
Accept shifts out of range=0
Accept superfluous prefixes=0
Accept LOCK prefixes=0
Accept unaligned stack operations=1
Accept non-standard command forms=1
Show ARG and LOCAL in procedures=0
Save analysis to file=1
Analyse main module automatically=1
Analyse code structure=1
Decode ifs as switches=0
Save trace to file=0
Trace contents of registers=1
Functions preserve registers=0
Decode tricks=0
Automatically select register type=0
Show decoded arguments=1
Show decoded arguments in stack=1
Show arguments in call stack=1
Show induced calls=0
Label display mode=0
Label includes module name=1
Highlight symbolic labels=1
Highlight RETURNs in stack=1
Ignore path in user data file=0
Ignore timestamp in user data file=1
Ignore CRC in user data file=0
Default sort mode in Names=1
Save out-of-module user data=0
Tabulate columns in log file=0
Append data to existing log file=0
Flush gathered data to log file=0
Skip spaces in source comments=1
Hide non-existing source files=0
Tab stops=8
File graph mode=2
Show internal handle names=0
Hide irrelevant handles=0
[System]
Options position=518,274
[History]

View file=
View text file=D:\masm32\examples\debug\Control.asm
Object file=
Import library=.\LIB\MFC42.LIB
Log file=log.txt
Run trace file=rtrace.txt
API help file=D:\破解工具箱\动态调试\OllyDBG 汉化第三版\WIN32.HLP
Text save file=
Symbolic data path=C:\debug
UDD path=D:\Program Files\tools\OllyDBG 3+\UDD
Plugin path=D:\Program Files\tools\OllyDBG 3+\plugin
Executable[1]=Z:\userdata\360极速浏览器\360极速浏览器.exe
Executable[2]=D:\Program Files\Navicat for SQLite\navicat.exe
Executable[3]=Z:\HDTunePro.exe
Executable[4]=E:\常用软件\360极速浏览器\360Chrome\Chrome\Application\360chrome.exe
Executable[5]=H:\MyCode\ALink\fasmw17164\SOURCE\WIN32\FASM.EXE
Executable[0]=Z:\YunConfig\YunConfig.exe
[Arguments]
Executable[1]=
Executable[2]=
Executable[3]=
Executable[4]=
Executable[5]=z:\test.asm
Executable[0]=
Argument[0]=z:\test.asm
Argument[1]=/c /coff z:\test.asm
Argument[2]=H:\MyCode\ALink\Example\SyntaxTest\macros.asm
Argument[3]=H:\MyCode\ALink\fasmw17164\EXAMPLES\test\test.asm
Argument[4]=H:\MyCode\ALink\fasmw17164\EXAMPLES\BEER\BEER.ASM
Argument[5]=H:\MyCode\ALink\fasmw17164\EXAMPLES\BEER\beer.asm
Argument[6]=H:\MyCode\ALink\fasmw17164\EXAMPLES\BEER\BEER.asm
Argument[7]=H:\MyCode\ALink\fasmw17164\EXAMPLES\BEER
Argument[8]=H:\MyCode\ALink\fasmw17162\EXAMPLES\DIALOG\DIALOG.ASM
Argument[9]=H:\MyCode\ALink\fasmw17162\EXAMPLES\BEER\BEER.ASM
Argument[10]=H:\MyCode\ALink\MasmSource\alink.apr
Argument[11]=H:\MyCode\ALink\fasmw17162\SOURCE\WIN32\fasm.asm
Argument[12]=8888 127.0.0.1 43981
Argument[13]=hn6-feapp.lol.qq.com -t
Argument[14]=www.baidu.com
Argument[15]=-run
Argument[16]=*.obj /out:%libname%.lib
Argument[17]=32.exe
Argument[18]=/Start
Argument[19]=/service
Argument[20]=-start
Argument[21]=Teeth_In_The_Grass
[Placement]
OllyTest=787,97,1133,917,1
CPU=0,0,892,804,3
CPU subwindows=856,1396,850,1396,471,758,421,658
记录数据=204,116,376,287,1
Breakpoints=663,188,629,376,1
Memory map=896,184,390,574,1
超级字串参考=558,434,524,228,1
Log data=555,152,378,288,1
Executable modules=255,146,636,228,1
References=356,176,618,312,1
脚本运行窗口=235,143,691,228,1
Call stack=369,210,516,228,1
Watch expressions=66,81,540,228,1
中间文件列表=66,81,876,228,1
Threads=315,248,492,168,1
Patches=180,131,840,228,1
SEH chain=733,334,270,228,1
Call tree=231,300,792,228,1
Windows=240,208,618,365,1
脚本日志窗口=372,291,678,228,1
Run trace=588,102,432,228,1
Handles=334,286,648,228,1
统计=427,355,624,228,1
Source=386,296,371,267,1
Source files=184,108,473,223,1
块=22,22,659,223,1
书签管理 +=44,44,1016,223,1
[Appearance]
CPU scheme=7
CPU Disassembler=1,7,1,0,4
CPU Dump=1,7,1,0,4353,4
CPU Stack=1,7,1,0
CPU Info=1,7,0,0
CPU Registers=1,7,1,0
记录数据=1,0,1,0,0
Breakpoints=1,7,1,0,0
Memory map=1,7,1,0,0
超级字串参考=1,0,1,0,0
Log data=1,7,1,0,0
Executable modules=1,7,1,0,0
References=1,7,1,0,0
脚本运行窗口=1,7,1,0,0
Call stack=1,7,1,0,0
Watch expressions=1,0,1,0,0
中间文件列表=1,0,1,0,0
Threads=1,0,1,0,0
Patches=1,0,1,0,0
SEH chain=1,0,1,0,0
Call tree=1,0,1,0,0
Windows=1,7,1,0,0
脚本日志窗口=1,0,1,0,0
Run trace=1,0,1,0,0
Handles=1,7,1,0,0
统计=1,0,1,0,0
Source=1,0,0,0,0
Source files=1,0,1,1,0
块=1,0,1,0,0
书签管理 +=1,0,1,0,0
[Columns]
CPU Disassembler=54,102,240,1536
CPU Dump=54,288,102
CPU Stack=54,60,1536
记录数据=54,1536
Breakpoints=54,54,150,290,1536
Memory map=54,54,54,54,72,30,48,48,1536
超级字串参考=54,240,1536
Log data=54,1536
Executable modules=54,54,54,54,96,1536
References=54,240,1536
脚本运行窗口=30,240,90,54,600
Call stack=54,54,216,168,54
Watch expressions=216,1536
中间文件列表=180,480,192
Threads=54,54,66,108,60,54,72,72
Patches=54,30,48,192,192,1536
SEH chain=54,192
Call tree=192,192,192,192
Windows=78,192,54,54,54,54,54,54,54,1536
脚本日志窗口=54,600
Run trace=54,54,54,54,192,1536
Handles=54,90,36,54,18,72,1536
统计=54,54,192,1536
Source=48,1536
Source files=54,96,1536
块=54,90,192,1536
书签管理 +=192,66,240,240,192,240
[Colours]
Scheme[0]=0,12,8,18,7,8,7,13
Scheme name[0]=白底黑字
Scheme[1]=14,12,7,1,3,7,3,13
Scheme name[1]=蓝底黄字
Scheme[2]=1,12,3,11,14,2,7,13
Scheme name[2]=海军蓝
Scheme[3]=15,12,7,0,8,11,7,13
Scheme name[3]=普通黑
Scheme[4]=0,12,8,18,7,8,7,13
Scheme name[4]=方案 4
Scheme[5]=14,12,7,1,3,7,3,13
Scheme name[5]=方案 5
Scheme[6]=1,12,3,11,14,2,7,13
Scheme name[6]=方案 6
Scheme[7]=8,12,3,0,1,4,19,13
Scheme name[7]=方案 7
[Fonts]
Font[0]=16,8,400,0,0,0,134,2,49,0
Face name[0]=Terminal
Font name[0]=OEM 等宽字体
Font[1]=-12,0,400,0,0,0,134,1,49,0
Face name[1]=新宋体
Font name[1]=Terminal 6
Font[2]=16,8,400,0,0,0,134,2,49,0
Face name[2]=Fixedsys
Font name[2]=系统等宽字体
Font[3]=14,0,400,0,0,0,1,2,5,0
Face name[3]=Courier New
Font name[3]=Courier (UNICODE)
Font[4]=10,6,400,0,0,0,1,2,5,0
Face name[4]=Lucida Console
Font name[4]=Lucida (UNICODE)
Font[5]=9,6,700,0,0,0,255,0,48,0
Face name[5]=Terminal
Font name[5]=字体 5
Font[6]=16,8,400,0,0,0,134,2,49,0
Face name[6]=Fixedsys
Font name[6]=字体 6
Font[7]=14,0,400,0,0,0,1,2,5,0
Face name[7]=Courier New
Font name[7]=字体 7
[Syntax]
Commands[0]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Operands[0]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[0]=不高亮
Commands[1]=0,4,124,112,9,64,64,13,111,12,12,0,0,0
Operands[1]=1,0,4,13,65,1,112,6,0,0,0,0,0,0
Scheme name[1]=Christmas tree
Commands[2]=0,0,124,112,0,64,64,0,96,0,0,0,0,0
Operands[2]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[2]=跳转及调用
Commands[3]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Operands[3]=0,0,0,0,0,0,0,0,0,0,0,0,0,0
Scheme name[3]=高亮 3
Commands[4]=2,4,112,112,19,28,12,13,111,12,12,0,0,0
Operands[4]=1,3,4,13,6,5,6,7,0,0,0,0,0,0
Scheme name[4]=Hilite 4
[Plugin ODbgScript]
恢复脚本窗口=0
恢复脚本记录=0
Restore Script window=0
Restore Script Log=0
ScriptDir=E:\反编译_反汇编\OllyDBG 3+\Scripts\anti-debug_lastex.txt
MRU1=E:\反编译_反汇编\OllyDBG 3+\Scripts\anti-debug_lastex.txt
MRU2=E:\反编译_反汇编\OllyDBG 3+\Scripts\OllyScipt Editor\更新说明.txt
MRU3=
MRU4=
MRU5=
NRU1=E:\反编译_反汇编\OllyDBG 3+\Scripts\anti-debug_lastex.txt
NRU2=E:\反编译_反汇编\OllyDBG 3+\Scripts\OllyScipt Editor\更新说明.txt
[Plugin 书签]
恢复书签窗口=0
[Plugin 超级字串参考＋]
恢复 UStrRef 窗口=0
[Plugin Olly Advanced]
varbps=1
copytoexecutable=1
usetoolhelp=0
pausedex=0
pluginexpand=1
keepalteredcrc=0
ignorechangedbp=0
advancedctrlg=1
numofrva=1
followindisassembler=0
analysisbug=1
Entrypointwarning=1
antiattachkill=1
winupack=1
antiattachkill2=1
killps=1
toomanypatches=0
compressedcode=1
dllloading=1
compressedcodehandling=2
dllloadmethod=1
ctrlgstate=1
showalljumpsfix=1
TerminateProcess=0
HideDebugBit=1
NtGlobalFlag=0
Antihwbp=0
HeapFlags=0
ForceFlags=0
maxolly=1
Writememory=0
Readmemory=0
Process32Next=0
UnhandledExceptionFilter=0
Module32Next=0
CheckRemoteDebuggerPresent=0
ZwSetInformationThread=0
GetTickCount=1
GetTickCountCounter=1
ZwQuerySystemInformation=0
ZwOpenProcess=0
FindWindow=0
Anti-RDTSCenabled=0
Anti-RDTSC=0
Anti-RDTSC2=0
ZwQueryInformationProcess=1
codebasefix=0
ignoreexporttable=0
ZwQueryObject=0
scrambleexporttable=0
maxallollywindows=0
x64compat=0
SuspendThread=0
BlockInput=0
viewfilefix=1
BreakOnTls=0
alwaysenableshowalljumpsandcalls=1
fixc08bug=0
fixtermination=0
lasttab=4
modulepointer=0
[Plugin 书签管理 +]
Restore bookmarks window=0
[Plugin 超级字串参考]
Restore UStrRef Window=1
[Plugin 隐藏标题]
启动时隐藏标题=1
没有粗厚框架=0
计数=1
HCW0=CPU - 主线程 - 模块 - aaaa
[Plugin IsDebugPresent]
idb_Sleeptime=1000
idb_Autoload=0
idb_Extra=1
[Plugin HideOD]
HideNtDebugBit=1
UnhandledExceptionFilter=1
ZwSetInformationThread=1
OutDebugStringA=1
CheckRemoteDebuggerPresent=1
SetDebugPrivilege=1
Process32Next=1
AutoRun=0
ZwQueryInformationProcess=1
[Plugin DebugPrivilege]
AutoDisable=1
Sleeptime=500
[Import libraries]
Implib[0]=.\LIB\MFC42.Lib
Implib[1]=.\LIB\mfc71.Lib
[Plugin SkyPatch]

[AeDebug]
Debugger="C:\Windows\system32\vsjitdebugger.exe" -p %ld -e %ld
[Exceptions]
Custom[0]=000006A6,000006A6
Custom[1]=000006EF,000006EF
