Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #5  
Old 05-08-2006, 21:53
JuneMouse
 
Posts: n/a
noramlly olly would only find string that are referanced if a string is not referanced directly olly will not list them if you are using rightclick ->search for referanced text string

because looking for strings of all types and all lengths including both ascii and unicode can be a very time consuming and slow task

but if you know a string for example "hit" in tha above example you can use the

alt+m ctrl+b type in "hit" on ascii and hit enter olly will find all strings that have hit on them
Code:
0040D0C0  48 69 74 20 61 6E 79 20 6B 65 79 20 74 6F 20 63  Hit any key to c
0040D0D0  6F 6E 74 69 6E 75 65 00                          ontinue.
Code:
80887042  48 69 74 20 61 6E 79 20 6B 65 79 20 74 6F 20 63  Hit any key to c
80887052  6F 6E 74 69 6E 75 65 0D 0A 2E 3F 41 56 69 6F 73  ontinue...?AVios
80887062  5F 62 61 73 65 40 73 74 64 40 40 0D 0A 2E 3F 41  _base@std@@...?A
Code:
809D0A69  68 69 74 65 62 6F 61 72 64 2E 2E 2E 00 00 00 7E  hiteboard......~
Code:
80B42FFB  68 69 74 65 62 6F 61 72 64 2E 2E 2E 2E 2E 2E 7E  hiteboard......~
80B4300B  0D 0A 0D 0A 00 1D 3F 1C 56 74 00 69 00 6E 00 75  .....?Vt.i.n.u
Code:
817477FC  68 69 74 81 68 69 74 81                          hit�hit�


826E70BA  68 69 74 65 2E 69 63 6F 00 00 00                 hite.ico...


8314B0C5  68 69 74 65 3B 62 61 63 6B 67 72 6F 75 6E 64 2D  hite;background-
8314B0D5  69 6D 61 67 65 3A 6E 6F 6E 65 7D 0D              image:none}.


8314B4D0  68 69 74 65 3B 62 61 63 6B 67 72 6F 75 6E 64 2D  hite;background-
8314B4E0  69 6D 61 67 65 3A 75 72 6C 28 2E 2E 2F 2E 2E 2F  image:url(../../
8314B4F0  63 6F 6E 74 72 6F 6C 73 2F 69 6D 61 67 65 73 2F  controls/images/
8314B500  63 61 72 61 74 2D 6F 70 65 6E 2E 67 69 66 29 7D  carat-open.gif)}
and all else use ctrl+l to search for next


noramlly i use sysinternals strings or bintext by foundstone for looking at all strings

Code:
Strings v2.2
Copyright (C) 1999-2005 Mark Russinovich
Sysinternals - www.sysinternals.com

         (((((                  H
!This program cannot be run in DOS mode.
Rich
$]D
.text

<-----snip----->
jE@
PAUSE
"This will be gone"
Hit any key to continue
.?AVios_base@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
<----snip---->
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Strings plugin for x64dbg hors Developer Section 0 03-16-2019 01:42
Problem debugging 32 bit system process with Olly MCKSys Argentina General Discussion 4 02-11-2015 03:35
Allocating BSTR strings in IE9 r00t General Discussion 4 01-31-2013 12:47
Is it possible for UPX to scramble referenced text strings? Nilrem General Discussion 12 01-18-2004 23:56


All times are GMT +8. The time now is 18:16.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )