How to break when specific text is found

Question

In this line of code:

mov        eax,dword ptr [eax+8];

eax+8 contains a long string of text, I want to find out where it originally came from.

In either OllyDbg or x32dbg, how can I break when eax contains a certain word e.g. "haxxor"

Thanks!

Answer 1

You are searching for Conditional Breakpoints

OllyDBG

It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00

Conditional Breakpoint

Displays dialog window asking user to set or modify parameters of simple conditional INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. [Source: Official Documentation]

If you want to set a conditional breakpoint when EAX points to "haxxor", press Shift+F2 and then enter: UNICODE[EAX] == "haxxor"

Conditional Log Breakpoint

Displays dialog window asking user to set or modify parameters of conditional logging INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. Logging breakpoint may conditionally pause execution, protocol expressions, function arguments or returned value etc. [Source: Official Documentation]

This option has more functionality and allows you to see outputs on the log window (Alt+L)
Press Shift+F4 and then enter: UNICODE[EAX] == "haxxor"

Modify the dialog settings to fit best to your needs.

---

x64dbg

Currently, as far as I know, there's no support for conditional breakpoints on strings. The feature is planned though and I hope we'll get to see it soon. Meantime, check cndSteroids plugin which you may find helpful.

More information about Conditional Breakpoints on x64dbg you can find in the official documentation.

Answer 2

NOTE! I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great!

---

GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions.

For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using strcmp()):

break *0xdeadbeef if strcmp(*($eax+8), "haxxor") == 0

This line will stop if you are executing the instruction located at 0xdeadbeef and that the value of the string located at $eax+8 is "haxxor".

If you want to break whenever the value of the string is '"haxxor"', then it will be a bit more difficult. Personally, I would set a watchpoint to each character with a condition such as:

watch *0xdeadbeef if *0xdeadbeef == 'h'

And thus, for each character of the string.