For some reason i can't find any string matching the MessageBox text of a program when searching with "search all reference strings" , why is that?
2 Answers
There are many, many possible reasons:
- the MessageBox text may be combined from several shorter snippets before being used
- the text may be hidden in the resource part of the executable
- the text may be loaded from a resource file at runtime, possibly depending on the language of the windows installation
- the text may be in the executable file in an uncommon format; for example, if the software was written in chinese first, then translated to english, the strings may be in some UTF-16 or even UTF-32 format instead of the more common ASCII/UTF-8/ISO-8859-X formats
- the application may be a client/server application, where the client retrieves the text from the server, and never stores/produces it itself
- the text may have been deliberately obfuscated/encrypted in the executable file, to prevent people with ollydbg searching for it
- and much more that doesn't come to mind right now.
answered Apr 13, 2016 at 17:37
-
It probably has to do something with networking, as it checks if updates has been found. Apr 13, 2016 at 17:44
-
@CorneliusAurel: well the string could also be retrieved from the update server, when checking for an update, sure. But you provide too few details to be able to tell the exact cause. Unless you improve your answer a lot, Guntram's answer is along the lines of what you can expect. And a good answer at that.– 0xC0000022L ♦Apr 14, 2016 at 11:57
Probably you can't find the string you are looking for because strings are encrypted in that executable.
This is a common thing, and is done in the attempt to make the life of reverse engineers much harder.
It can be a simple encryption like xor-ing the strings, or some much more complex encryption.
