For some reason i can't find any string matching the MessageBox text of a program when searching with "search all reference strings" , why is that?
There are many, many possible reasons:
- the MessageBox text may be combined from several shorter snippets before being used
- the text may be hidden in the resource part of the executable
- the text may be loaded from a resource file at runtime, possibly depending on the language of the windows installation
- the text may be in the executable file in an uncommon format; for example, if the software was written in chinese first, then translated to english, the strings may be in some UTF-16 or even UTF-32 format instead of the more common ASCII/UTF-8/ISO-8859-X formats
- the application may be a client/server application, where the client retrieves the text from the server, and never stores/produces it itself
- the text may have been deliberately obfuscated/encrypted in the executable file, to prevent people with ollydbg searching for it
- and much more that doesn't come to mind right now.
Probably you can't find the string you are looking for because strings are encrypted in that executable.
This is a common thing, and is done in the attempt to make the life of reverse engineers much harder.
It can be a simple encryption like
xor-ing the strings, or some much more complex encryption.