I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?
1 Answer
are you looking for finding all of these in one go ? that is not possible ollydbg search is not text grep copy paste the disassembly to text and use grep
CPU Disasm
Address Hex dump Command
00743F61 00 DB 00
00743F62 00 DB 00
00743F63 3E:C785 80000000 03000000 MOV DWORD PTR DS:[EBP+80], 3
00743F6E 3E:66:C785 80000000 0300 MOV WORD PTR DS:[EBP+80], 3
00743F78 3E:C685 80000000 03 MOV BYTE PTR DS:[EBP+80], 3
00743F80 3E:FFB5 80000000 PUSH DWORD PTR DS:[EBP+80]
00743F87 FFB0 80000000 PUSH DWORD PTR DS:[EAX+80]
00743F8D 36:8180 80000000 FF000000 ADD DWORD PTR SS:[EAX+80], 0FF
00743F98 0000 ADD BYTE PTR DS:[EAX], AL
00743F9A 0000 ADD BYTE PTR DS:[EAX], AL
but if you are looking for finding all one kind of instruction
like let's say
push dword ptr anyseg:[ANY register +SOMECONST] (the keyword being the mnemonic) or
mov dword ptr ANYSEG:[ANYREGISTER + SOMECONST] (again it is mov that drives the search not the operand
then it is possible either ctrl+f and type PUSH [R32+CONST]
or right click search for all commands and type push [r32+CONST]
the search for PUSH [R32+CONST] yields ~4500 hits whereas PUSH [eax+80] yields one hit
>wc -l search.txt
4581 search.txt
>grep -i +80 search.txt | wc -l
19
>grep -i EAX+80 search.txt | wc -l
1
>grep -i EAX+80 search.txt
00743F87 PUSH DWORD PTR DS:[EAX+80]
>grep -i EbX+80 search.txt | wc -l
0
>grep -i ECX+80 search.txt | wc -l
1
>grep -i ECX+80 search.txt
00728460 PUSH DWORD PTR DS:[ECX+80]
here is another example
searching for mov [r32+CONST] , CONST
:\>wc -l srch.txt
925 srch.txt
:\>head -n 3 srch.txt
Search - Commands found in calc:.text
Address Command Comments
006F16F1 MOV DWORD PTR SS:[EBP-0CF0], 30
:\>tail -n 3 srch.txt
00743F70 MOV DWORD PTR SS:[EBP+80], C63E0003
00743F78 MOV BYTE PTR DS:[EBP+80], 3
00743F79 MOV BYTE PTR SS:[EBP+80], 3
:\>grep -i 80 srch.txt | wc -l
54
:\>grep -i ebp+80 srch.txt | wc -l
7
:\>grep -i ebp+80 srch.txt
00743F63 MOV DWORD PTR DS:[EBP+80], 3
00743F64 MOV DWORD PTR SS:[EBP+80], 3
00743F6E MOV WORD PTR DS:[EBP+80], 3
00743F6F MOV WORD PTR SS:[EBP+80], 3
00743F70 MOV DWORD PTR SS:[EBP+80], C63E0003
00743F78 MOV BYTE PTR DS:[EBP+80], 3
00743F79 MOV BYTE PTR SS:[EBP+80], 3