1

I have the following program:

int main() {
    char buff[11] = "helloitbd9";
    int x = 4;
    printf("%d", x);

    return 0;
}

I can see the string "helloitbd9" through a hexdump of the binary, in the beginning of the data section. However, what I don't understand is why when I search for "all referenced strings" I only get "%d" as a result? Is it because the search only looks for strings which are used in functions? Is there a way to search for all "strings" in the data section?

Image: enter image description here

3

From my experience, OllyDbg is not so good with handling string references.

Is it because the search only looks for strings which are used in functions?

As far as I know, "Search for >> All referenced text strings" is searching, well, for strings which are referenced in the assembly. It is not searching for a strings in the whole binary, even if they're exist somewhere in the binary. If you want to search for strings in the whole binary you can use your favorite hex-editor or other utilities such as Sysinternals' strings.

We should keep in mind, though, that whether or not a string which is being used in the code itself (e.g, just assigned to a variable which is never used in the program) will be showed in the binary, might changed in different compilers. Some of them would show the assigning even though the variable is never used, some would still keep the string in the binary but you won't see it in the assembly and others would ignore it entirely and would not include the string in the binary at all.

Another thing that worth mentioning is that disassemblers sometimes not recognizing strings and would mistake it with hexadecimal values. In such cases you might see something like this:

...
mov     eax, 6C6C6568h
...
mov     eax, 6274696Fh
...
mov     eax, 3964h 

Instead of showing it as mov eax, "helloitbd9".

Is there a way to search for all "strings" in the data section?

You said that you saw the string with a hex editor, you should be able to find it with OllyDbg through looking at the memory maps. Go to View >> Memory and double click the memory map you're interested in which is in your case -- .data. In the opened window press Ctrl+b and search for your string, you should find it there. If you don't find it you can also search for it in another memory maps such as .rdata.


On a personal note, I highly recommend to use x64dbg which is an active open-source project, unlike Ollydbg which is absolutely outdated. Moreover, x64dbg is inspired by OllyDbg so you should not have too many problems with migrating to it.

Here are some resources:

  • " It is not searching for a strings in the whole binary" can you elaborate that? I mean how does olly determine if a string is in fact being used by the binary? – Trey Oct 20 '17 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.