4

So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, which is why this is driving me crazy. I'd like to know how or where I can find the Strings then or if there is another method of finding a given Assembly Line where I could start.

Thank you already :)

Edit: If you need any more information, just ask and I'll deliver it.

Improve this question
1
  • 1
    I know this thread is old but in case this can help someone: I am new to reverse engineering myself but one thing I've learned recently when I can't find useful strings in the program I am debugging (either because of encryption or any other form of protection) is to look at names of external functions that the program is calling. Certain functions are particularly interesting and can give a good starting point to reverse the code. "Search for → All intermodular calls"
    – Mynah
    Aug 31, 2018 at 11:24

2 Answers 2

Reset to default
2

OllyDbg isn't very good at finding "referenced strings".

I'd recommend doing the following:

  1. Use a hex editor to search for the given string, in both ASCII and Unicode formats.
  2. If you find the static string in your hex editor, then disassemble the binary in IDA, go to the string's address in IDA, and see if IDA found any static cross-references to that string. And if IDA didn't find any static cross-references to that string, use OllyDbg to set a hardware-read-breakpoint on the first byte of that string to find what code references it at runtime.
Improve this answer
0

Your program is either packed or strings are encrypted. Since strings can be a starting point in reverse engineering, some programs store encrypted strings in binary and only decrypt them at startup or right before usage.

Either way, the easiest way to check is to attach the debugger to a running application and try to “Search for → All referenced text strings” in a main program module.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.