4

I want to find specific string in the EXE file but when I open the EXE file with OllyDBG and search for the All Referenced Strings I get bunch of texts in the comment area which are like this :

 ASCII "\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7"...

What should I do? What if I don't find the text in OllyDBG through search but I know it exists in the application (EXE file) ?

2 Answers 2

5

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode.

If the text is generated on runtime, you can use a tool that prevents process termination(such as this). Run your file. If your file is now in the memory, you can use WinHex or HxD to search for the string in memory. Just open your running process in the mentioned Hex viewers and do a search (Ctrl+F). Try the search for both ASCII and Unicode.

0

in ollybbg goto View>>select Memory or press alt+M righclick in memory window and select search. you do this way after and before run program,if text not found.also you can search stack window and dump window, these are below the CPU window. sorry my english is poor

2
  • also you can use the PEiD>>plugins>>String Viewer
    – user11623
    Commented Jan 31, 2015 at 9:19
  • Cheat Engine is also an option to search string values. Commented Feb 2, 2015 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.