Geek Answers Handbook

OllyDbg 2.01 - Search for a command that references a static string

I recently used cracks and rebuilds with the executables OllyDbg 2.01 and crackmes.

So, in this particular crackme, I looped through the commands and noticed PUSH with the ASCII string "& File" (this is the menu bar):

one

So, I thought: "If I can find this information just by scrolling, there must surely be an automatic way to find a command that references a specific line."

So, I get to the top of the program, press CTRL + B and look for the ASCII “File” to hope to find it again:

2

After clicking OK, OllyDbg does not find an earlier PUSH. Instead, I get the following:

3

Mmm ... Okay, this is not what I expected, but let's see what is there. so I right click => Follow in Dump and I get the following:

4

So, we found our line in the dump. However, I still have not found my original PUSH. You may also notice that the string address matches the PUSH argument (40512C).

As a last attempt, I right-click on the letter at 40512C, select "Find links", but no: the link was not found.

So TL; Question with DR: how do I automatically find a command that references a string? Because, obviously, I will not scroll the entire stack of commands every time I want to find a line.

PS: the line is also not indicated in the "text lines".

Thanks in advance for your help.

EDIT: ok, so I found a solution. I searched for the code for "2C 51 40 00", which is the address back, and again I found PUSH. This is a bit of hacks, anyone who has a more effective solution can be shared.

+7
debugging ollydbg
source share
1 answer

So there are several ways to do this. I prefer the following: Ctrl+G and go to your line in the dump. (0x0040512C) Select the first byte and press Ctrl+R This will give you a list referenced by a particular string. You can also put a hardware checkpoint in the first byte of the & string, and then you will break every time something accesses it. You can also look for constants (address or ascii characters themselves).

By the way, there is a subsection dedicated to reverseengineering :)

+4
source share

More articles:


All Articles