0

I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the memory address of this string will be at runtime, so I can search the binary file for this address to find the instruction that references the string. How should I proceed?

I am using a Windows x64 AMD architecture. The executable in question is also 64-bit.

  • You may try this Strings tool from sysinternals: docs.microsoft.com/en-us/sysinternals/downloads/strings – Biswapriyo Apr 4 '18 at 20:39
  • Thanks, but I have already found the location of the string within the executable file; I'm asking for a way to find the runtime memory address, since I think that is different from the byte offset in the actual file. – Anonymous1847 Apr 4 '18 at 21:07
1

You can use the OllyDbg software (http://www.ollydbg.de/). This software is for debug and dissasembler binary programs.

One of feature is search all referenced string, you can see this image:

OllyDbg search all referenced strings

So, in the next window, you can see all strings with an address. Like this:

enter image description here

  • Apparently this only works with 32-bit executables, while the executable in question is 64-bit. (I tried loading it, it didn't work.) Probably should edit my question to clarify that. Is there an equivalent piece of software that works for 64-bit executables? – Anonymous1847 Apr 5 '18 at 21:42
  • There is x64dbg thwt works on windowsx64. Olydbg does have a x64 version , but Oleh isn't really active in it's development , so It's sort of in a dead state. – Qndel Apr 16 '18 at 7:04
0

Search for all string references and you should be able to find your string and go to the instruction referencing it from there.

  • ....but how exactly do I search for all string references? Do I need to install some specific software? – Anonymous1847 Apr 4 '18 at 16:49
  • Yes, ollydbg, like incode said can do the job. You have a lot of disassemblers, the best is probably IDA (free and premium version). – sebastien finor Jun 5 '18 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.