I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. is the binary not containing this string? and then the author has used the Resource Hacker to search for the string. and he gets the string. but how? what is resource doing that the disassembler isn't? And one more question, what is that constant "873". why does it has the value of the string? Please if someone knows, tell me.

  • 1
    x64dbg was searching for string references, not for strings. Since strings contained in resources aren’t referenced directly, but by ID, x64dbg doesn’t display them.
    – bart1e
    Sep 22, 2020 at 14:33
  • 2
    And since strings in STRINGTABLE are accessed by calling LoadString which takes ID as a parameter, this ID (873 in this case) has to be present somewhere in the code.
    – bart1e
    Sep 22, 2020 at 14:41
  • @bart1e Do you know how the resource hacker is producing that integer in decimal that holds the string? Sep 23, 2020 at 9:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.