Here, for example, is what I believe to be the top function for the LIBC printf() function, called by CALL 00401010: CPU DisasmĠ0401012 |. I know that the compiler will generate OS dependent setup and teardown stuff (like the windows version #, heap, etc), but I figure that after a few programs and learning the PE program standard I should be able to recognize that (plus Olly takes you past that to the application code anyways). EXE is filled with lots of other code that I'd like to be able to recognized and distinguish the application from LIBC functions like printf().

So those assembly instructions above is all that correspond to the C code I wrote. #include Īnd in Olly here is the assembly for my main() function: CPU DisasmĠ0401000 /$ 68 30604000 PUSH OFFSET 00406030 ASCII 'blah blah' I recognize the main() function and see string variables being put on the stack and can deduce the function at 00401010 is printf(), confirmed by IDA if I look at the 'Names Window' for that address, but Olly doesn't explicitly tell me. I can see the chain of events starting with things like kernel32.dll calls to get the Windows version number, set up the heap, get the command line, etc. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I'm just learning Olly/IDA and writing simple programs in C and looking at the.

Udd ollydbg