2

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?

In IDA, I'm using the WinDbg debugger back-end.

4

To put it very simply, there are two primary methods of analysis:

Static Analysis: Analyzing an executable while it's not running.

Dynamic Analysis: Analyzing an executable while it's running.

IDA is primarily geared towards static analysis (though it does have dynamic debugging functionality, as you've noted), where OllyDbg (and x32dbg/x64dbg, Immunity Debugger, WinDbg, Cheat Engine, etc.) is geared towards dynamic analysis.

It's not uncommon that you would run IDA and OllyDbg simultaneously. If you would like a great example of use cases to see both in action (individually and together), consider the following workshop: Reverse Engineering for Beginners (specifically, the final section regarding hacking Minesweeper)

3

OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis.

IDA is the de-facto tool for doing static analysis and also supports dynamic analysis (i.e.: debugging) for several architectures, backends and operating systems.

OllyDbg doesn't have any real advantage over IDA other than, most of the time, the people using OllyDbg are used to use OllyDbg since long ago. Actually, it isn't maintained any more (or is it?) while IDA is actively maintained. One real advantage over IDA, however, is that OllyDbg is freeware while IDA is a commercial application and its freeware version lacks debugging capabilities.

  • OllyDbg is also much more lightweight and portable than a full IDA installation, it doesn't even require installation – Elian Kamal Jul 25 '18 at 8:02
  • 2
    Neither IDA, copying the directory is enough. – joxeankoret Jul 25 '18 at 9:57
  • Oh nice I didn't know. However Olly is still significantly smaller, but I guess this is rarely relevant today unless it's ancient hardware that you need to reverse on. – Elian Kamal Jul 25 '18 at 10:42
  • Olly is much smaller because it doesn't have all the functionality that IDA has in it. – joxeankoret Jul 25 '18 at 10:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.