I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the memory address of this string will be at runtime, so I can search the binary file for this address to find the instruction that references the string. How should I proceed?

I am using a Windows x64 AMD architecture. The executable in question is also 64-bit.

  • You may try this Strings tool from sysinternals: docs.microsoft.com/en-us/sysinternals/downloads/strings
    – Biswapriyo
    Commented Apr 4, 2018 at 20:39
  • Thanks, but I have already found the location of the string within the executable file; I'm asking for a way to find the runtime memory address, since I think that is different from the byte offset in the actual file. Commented Apr 4, 2018 at 21:07

2 Answers 2


You can use the OllyDbg software (http://www.ollydbg.de/). This software is for debug and dissasembler binary programs.

One of feature is search all referenced string, you can see this image:

OllyDbg search all referenced strings

So, in the next window, you can see all strings with an address. Like this:

enter image description here

  • Apparently this only works with 32-bit executables, while the executable in question is 64-bit. (I tried loading it, it didn't work.) Probably should edit my question to clarify that. Is there an equivalent piece of software that works for 64-bit executables? Commented Apr 5, 2018 at 21:42
  • There is x64dbg thwt works on windowsx64. Olydbg does have a x64 version , but Oleh isn't really active in it's development , so It's sort of in a dead state.
    – LUser
    Commented Apr 16, 2018 at 7:04

Search for all string references and you should be able to find your string and go to the instruction referencing it from there.

  • ....but how exactly do I search for all string references? Do I need to install some specific software? Commented Apr 4, 2018 at 16:49
  • Yes, ollydbg, like incode said can do the job. You have a lot of disassemblers, the best is probably IDA (free and premium version). Commented Jun 5, 2018 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.