I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10. I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here. My plan is: I send a request to IIS, then observe what functions are called. So I know how IIS handles a request. But I dont want to do it manually. Is there anyway to record function calls for a attached process?

OS: Win2K SP1


1 Answer 1


ollydbg version 2.01

c:\> ollydbg calc

alt + e (executable modules)
ctrl+ p (set protocol)
select radio button call destination first 
then select add range 
in the start enter (alt+e-> your Module base)
int the end enter (alt+e -> Your module base + size)

enter image description here

and start tracing with ctrl+f11 (trace in ) ollydbg should show you all the calls like this


main calc.__security_init_cookie
main calc._SEH_prolog4
main calc._initterm_e
main calc.000B3942
main calc._get_image_app_type
main calc.RtlpImageNtHeader
main calc._SEH_prolog4
main calc._SEH_epilog4
main calc.CCalculatorDialog::GetDlgProc
main calc._setdefaultprecision
main calc.__CxxSetUnhandledExceptionFilter
main calc.CScaledResourceFactory::_LoadUsingWIC
main calc.CreateDecoderFromResource
main calc.FindRawResource
main calc.CScaledResourceFactory::_SelectFrameByDPI
main calc.CScaledResourceFactory::_ScaleSource
main calc.GetPixelFormatInfo
main calc.WICFormatToBpp
main calc.__security_check_cookie
main calc.WICBitmapToHBITMAP
main calc.GetPixelFormatInfo
main calc.WICFormatToBpp
main calc.__security_check_cookie
main calc.CreateHBITMAP
main calc.CScaledResourceFactory::Release
main calc.CScaledResourceFactory::`scalar
main calc.CScaledResourceFactory::~CScaledResourceFactory
main calc.operator
main calc.CCalcHelper::LoadImageScaledX
main calc.LoadImageScaled
main calc.CScaledResourceFactory::s_CreateInstance
main calc.operator

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.