Searching instructions in OllyDbg

Question

I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?

Answer 1

are you looking for finding all of these in one go ? that is not possible ollydbg search is not text grep copy paste the disassembly to text and use grep

CPU Disasm
Address   Hex dump                             Command         
00743F61      00                               DB      00
00743F62      00                               DB      00
00743F63      3E:C785 80000000 03000000        MOV     DWORD PTR DS:[EBP+80], 3
00743F6E      3E:66:C785 80000000 0300         MOV     WORD PTR DS:[EBP+80], 3
00743F78      3E:C685 80000000 03              MOV     BYTE PTR DS:[EBP+80], 3
00743F80      3E:FFB5 80000000                 PUSH    DWORD PTR DS:[EBP+80]
00743F87      FFB0 80000000                    PUSH    DWORD PTR DS:[EAX+80]
00743F8D      36:8180 80000000 FF000000        ADD     DWORD PTR SS:[EAX+80], 0FF
00743F98      0000                             ADD     BYTE PTR DS:[EAX], AL
00743F9A      0000                             ADD     BYTE PTR DS:[EAX], AL

but if you are looking for finding all one kind of instruction
like let's say

push dword ptr anyseg:[ANY register +SOMECONST] (the keyword being the mnemonic) or

mov dword ptr ANYSEG:[ANYREGISTER + SOMECONST] (again it is mov that drives the search not the operand

then it is possible either ctrl+f and type PUSH [R32+CONST]

or right click search for all commands and type push [r32+CONST]

the search for PUSH [R32+CONST] yields ~4500 hits whereas PUSH [eax+80] yields one hit

>wc -l search.txt
4581 search.txt

>grep -i +80 search.txt | wc -l
19

>grep -i EAX+80 search.txt | wc -l
1

>grep -i EAX+80 search.txt
00743F87  PUSH    DWORD PTR DS:[EAX+80]

>grep -i EbX+80 search.txt | wc -l
0

>grep -i ECX+80 search.txt | wc -l
1

>grep -i ECX+80 search.txt
00728460  PUSH    DWORD PTR DS:[ECX+80]

here is another example

searching for mov [r32+CONST] , CONST

:\>wc -l srch.txt
925 srch.txt

:\>head -n 3 srch.txt
Search - Commands found in calc:.text
Address   Command                                  Comments
006F16F1  MOV     DWORD PTR SS:[EBP-0CF0], 30

:\>tail -n 3 srch.txt
00743F70  MOV     DWORD PTR SS:[EBP+80], C63E0003
00743F78  MOV     BYTE PTR DS:[EBP+80], 3
00743F79  MOV     BYTE PTR SS:[EBP+80], 3

:\>grep -i 80 srch.txt | wc -l
54

:\>grep -i ebp+80 srch.txt | wc -l
7

:\>grep -i ebp+80 srch.txt
00743F63  MOV     DWORD PTR DS:[EBP+80], 3
00743F64  MOV     DWORD PTR SS:[EBP+80], 3
00743F6E  MOV     WORD PTR DS:[EBP+80], 3
00743F6F  MOV     WORD PTR SS:[EBP+80], 3
00743F70  MOV     DWORD PTR SS:[EBP+80], C63E0003
00743F78  MOV     BYTE PTR DS:[EBP+80], 3
00743F79  MOV     BYTE PTR SS:[EBP+80], 3