No need to install it, only Download ODB Hexer and extract it.
Now you can open it by doubleclick the Exe File.
PrePs.: You also can use this simple Tool to only edit some Files Hex like the HxD Editor does.
OllyDbg 2.0 supports all 80x86 commands, FPU, MMX, 3DNow!, SSE, SSE2, SSE3, SSSE3 and SSE4 extensions.
Please note following peculiarities and deviations from Intel's standard:
• REP RET (AMD branch prediction bugfix) is supported;
• Multibyte NOPs (like NOP [EAX]) are supported. However, Assembler always attempts to select the shortest possible form, therefore it's hard to set the required NOP length;
• FWAIT is always separated from the following FPU command. Assembler never adds FWAIT, for example, FINIT is in fact translated to FNINIT etc.;
• No-operand forms of binary FPU commands are not supported, use two-operand forms (FADDP ST(1),ST instead of FADDP);
• LFENCE: only form with E8 is accepted (0F AE E8);
• MFENCE: only form with F0 is accepted (0F AE F0);
• SFENCE: only form with F8 is accepted (0F AE F8);
• PINSRW: register is decoded as 16-bit (only low 16 bits are used anyway);
• PEXTRW: memory operand is not allowed, according to Intel;
• SMSW: register is decoded as 16-bit (only low 16 bits are used anyway);
• INSERTPS: source XMM register is commented only as a low float, whereas command may use any float;
• Some FPU, MMX and SSE commands accept either register only or memory only in ModRM byte. If counterpart is not defined, Disassembler reports it as an unknown command. Integer commands, like LES, report in this case invalid operands.
• SSE4 commands that use register XMM0 as a third operand are available both in 2- and in 3-operand formats, but Disassembler will show only the full 3-operand form;
• Assembler accepts CBW, CWD, CDQ, CWDE with explicit AL/AX/EAX as operand. Disassembler, however, uses only implicit no-operand form.
OllyDbg supports four different decoding modes: MASM, Ideal, HLA and AT&T.
MASM is the de facto standard of the assembler programming.
Ideal mode, introduced by Borland, is very similar to MASM but differently decodes memory addresses.
High Level Assembly language, created by Randall Hyde, uses yet another, functional syntax where first operand is a source and operands are taken into the brackets.
AT&T syntax is popular among the Linux programmers.
OllyDbg recognizes several undocumented 80x86 commands:
Command Hex code Comments
INT1 (ICEBP) F1 1-byte breakpoint
SAL D0 /6, D2 /6, C0 /6
Arithmetic shift, identical with D0 /4 etc.
SALC D6 Set AL on Carry Flag
TEST F6 /1 Logical Test, identical with F6 /0
REPNE LODS, REPNE MOVS, ...
F2:AD, F2:A5, ...
String operations, REPNE is interpreted the same way as REP
FFREEP DF /0 Free Floating-Point Register
UD1 0F B9 Intentionally undefined instruction
Disassembler supports all mentioned commands. Assembler will not generate non-standard SAL and TEST commands; if necessary, use binary edit to create binary codes.
All constants in the OllyDbg are hexadecimal by default. If you want to specify decimal constant, follow it with the point:
MOV EAX,1000. translates to MOV EAX,3E8
Hexadecimal constant may begin with a letter (A-F), but symbolic labels have higher priority than hex numbers. Assume that you have defined label DEF at address 0x00401017. In this case,
MOV EAX,ABC translates to MOV EAX,0ABC
MOV EAX,DEF translates to MOV EAX,401017
To avoid ambiguity, precede hexadecimal constants with 0 or 0x: MOV EAX,0DEF .
There are only few exceptions to this rule. Indices of arguments and local variables are decimal. For example, ARG.10 is the address of the tenth call argument with offset 1010·4=4010=0x28. To memorize this rule, note that ARG and index are separated with a decimal point.
Ordinals are also in decimal. COMCTL32.#332 means export with ordinal 33210.
Other useful threds you can compare to this:
I D A 6.6
ARM Hex Translator