In this line of code:
mov eax,dword ptr [eax+8];
eax+8 contains a long string of text, I want to find out where it originally came from.
In either OllyDbg or x32dbg, how can I break when
eax contains a certain word e.g. "haxxor"
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
You are searching for Conditional Breakpoints
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Displays dialog window asking user to set or modify parameters of simple conditional INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. [Source: Official Documentation]
If you want to set a conditional breakpoint when EAX points to "haxxor", press Shift+F2 and then enter:
UNICODE[EAX] == "haxxor"
Conditional Log Breakpoint
Displays dialog window asking user to set or modify parameters of conditional logging INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. Logging breakpoint may conditionally pause execution, protocol expressions, function arguments or returned value etc. [Source: Official Documentation]
This option has more functionality and allows you to see outputs on the
log window (Alt+L)
Press Shift+F4 and then enter:
UNICODE[EAX] == "haxxor"
Modify the dialog settings to fit best to your needs.
Currently, as far as I know, there's no support for conditional breakpoints on strings. The feature is planned though and I hope we'll get to see it soon. Meantime, check cndSteroids plugin which you may find helpful.
More information about Conditional Breakpoints on x64dbg you can find in the official documentation.
NOTE! I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great!
GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions.
For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using
break *0xdeadbeef if strcmp(*($eax+8), "haxxor") == 0
This line will stop if you are executing the instruction located at
0xdeadbeef and that the value of the string located at
If you want to break whenever the value of the string is '"haxxor"', then it will be a bit more difficult. Personally, I would set a watchpoint to each character with a condition such as:
watch *0xdeadbeef if *0xdeadbeef == 'h'
And thus, for each character of the string.