4

In this line of code:

mov        eax,dword ptr [eax+8];

eax+8 contains a long string of text, I want to find out where it originally came from.

In either OllyDbg or x32dbg, how can I break when eax contains a certain word e.g. "haxxor"

Thanks!

2 Answers 2

7

You are searching for Conditional Breakpoints

OllyDBG

It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00

Conditional Breakpoint

Displays dialog window asking user to set or modify parameters of simple conditional INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. [Source: Official Documentation]

If you want to set a conditional breakpoint when EAX points to "haxxor", press Shift+F2 and then enter: UNICODE[EAX] == "haxxor"

Conditional Log Breakpoint

Displays dialog window asking user to set or modify parameters of conditional logging INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. Logging breakpoint may conditionally pause execution, protocol expressions, function arguments or returned value etc. [Source: Official Documentation]

This option has more functionality and allows you to see outputs on the log window (Alt+L)
Press Shift+F4 and then enter: UNICODE[EAX] == "haxxor"

Condional Log Breakpoint window

Modify the dialog settings to fit best to your needs.


x64dbg

Currently, as far as I know, there's no support for conditional breakpoints on strings. The feature is planned though and I hope we'll get to see it soon. Meantime, check cndSteroids plugin which you may find helpful.

More information about Conditional Breakpoints on x64dbg you can find in the official documentation.

2
  • Am I correct in saying this adds a conditional breakpoint on this line only, ie when eax at this exact location contains this string then break? I am trying to find the original of this value, ie at line #7752606 I know eax contains this string, but where and when did that value come from
    – Raz Razman
    Aug 23, 2017 at 3:49
  • Just for the record, there is a better string matching plugin available now: github.com/x64dbg/strmatch
    – mrexodia
    Aug 26, 2017 at 10:58
2

NOTE! I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great!


GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions.

For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using strcmp()):

break *0xdeadbeef if strcmp(*($eax+8), "haxxor") == 0

This line will stop if you are executing the instruction located at 0xdeadbeef and that the value of the string located at $eax+8 is "haxxor".

If you want to break whenever the value of the string is '"haxxor"', then it will be a bit more difficult. Personally, I would set a watchpoint to each character with a condition such as:

watch *0xdeadbeef if *0xdeadbeef == 'h'

And thus, for each character of the string.

2
  • 3
    It's worth noting that calling functions in this way does leave all the side effects it can, first of all changes of data in the proximity of the stack pointer (due to local variables and return address)(not in the stack per se though). This may or may not matter to particular debugging session. Also, this can result in spurious signals like SIGSEGV on *nix/Access Violation on Windows, unless you set unwindonsignal on (e.g. when EAX has bad pointer in your first breakpoint example).
    – Ruslan
    Aug 22, 2017 at 11:58
  • Yes, this is more or less like attaching a debug code to the running program "on-line". So, it may break the whole thing. Thanks for mentioning it!
    – perror
    Aug 22, 2017 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.