Find a string that I entered in ollydbg

Question

Say, there's an input box and I enter a text. Can I somehow find the location that text is entered?

Answer 1

Set breakpoints on GetWindowText() and GetDlgItemText() and have the target program read your input text. If the breakpoint is hit, you can trace up the call-stack to see what code is reading your input text and where in memory it's being stored. If neither breakpoint is hit, you can try setting a conditional breakpoint on SendMessage(), filtering it to only break on the WM_GETTEXT message.

If the above methods fail, you may want to statically analyze the program to find where it's creating the text box window and how it's handling input to the text box. Searching for window creation API calls and/or cross-references to strings related to the text box (static labels, error message strings, etc.) can be helpful.

Answer 2

In addition to what Jason said, I'd add that there is another potentially helpful way:

• Breakpoint on ExitProcess() (and probably HeapFree() too)
• Enter in the input box some test - "bla bla bla"
• Search the memory of the process for that string and try to analyze the code that is referencing that place.

I agree that this could be an overkill, but still could be helpful in some situations.

Answer 3

in addition to all the above solutions after you have entered your text string press f12 and pause the debuggee
now there are several options to search for the string view call stack (ctl+k) and set a break point on the return address in the stack and press f9 to run
ollydbg will most probably break on some system call
when it breaks you can search the entire memory of the process
(alt+m right click search ctrl+l for repeating)for the string you entered
set an access breakpoint (hardware break point on read) on the location if the application is not much obfuscated call stack may show you the applications code where it entered system you can also follow from there
if the application hasn't sub classed its controls setting a break point on windowproc or classproc will also get you the right context to follow your string if the app uses directx you can set breaks at SendInput() apis or DrawText(...) apis