Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  How come I cannot find a string reference

Topic created on: February 13, 2013 12:36 CST by amaw .

I tried to search for a string but I cannot find it. Is it possible that the string was created at runtime? If it was, is it possible to view at any registers?
FYI: exe file is not packed.

Thanks

  Olivier   February 20, 2013 18:32.49 CST
> amaw: I tried to search for a string but I cannot find it. Is it possible that the string was created at runtime? If it was, is it possible to view at any registers?
> FYI: exe file is not packed.
>
Can you provide details and binary drop?
> Thanks

  SteveIRQL   March 6, 2013 12:16.47 CST
There are many many ways to reference a string at compile time that might make it difficult for an RE to find a direct reference to the string.

Im assuming that you are parsing through assembly looking for a direct code reference.

Things like pointer tables and structs can often make a string references a little more abstract.

Try searching the binary view for the Little Endian byte notation of the string address. If you find a match, search for a reference to the address containing the string pointer.



For instance:

Let's say the string "Hello World" was stored at 0x12345678. Instead of searching for a direct reference to 0x12345678 try actually searching for the byte sequence 78 56 34 12 in memory. If you find it, search for a reference to the address that the match was found instead of the direct reference to the string.

This might help you map the data to the code.

Additionally, if the string is part of a large pointer table it might be indexed using something like [0x00041000+ecx*4] where 0x00041000 is the base address of the pointer table and ecx contains the index number. It won't always be 0x00041000 and ecx respectively, but you get the idea.

Note: Registration is required to post to the forums.

There are 31,314 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit