1

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been made. Unfortunately, I lost this list. Can someone get me these instructions please. I only remember lstrcmpiA.

Improve this question
3
  • Do you mean strcmp?
    – sudhackar
    Mar 28 at 5:55
  • Thank you... Are there few more instructions which compare two strings that has "str" or "cmp" in it?
    – Kıvanç Cantimur
    Mar 28 at 9:26
  • 1
    @KıvançCantimur not exactly instructions. Those are functions you seem to be looking for.
    – 0xC0000022L ♦
    Mar 28 at 10:29

1 Answer 1

Reset to default
3

Hmm this probably isn't an exhaustive list, but feel free to add to it:

  • C runtime (header <string.h> or <cstring>:
    • strcmp, strncmp, wcscmp, wcsncmp (with <wchar.h>)
      • case-insensitive: strcasecmp, strncasecmp
        • wcscasecmp (with <wchar.h>)
      • also known as: stricmp, strcmpi
    • memcmp, wmemcmp (with <wchar.h>), bcmp (unlikely on Windows)
      • memicmp (and similar)
    • Depending on your runtime there may also be l varieties such as strlcmp of the aforementioned functions (l for length)
  • Windows API (header winbase.h):
    • lstrcmp (expands to lstrcmpA or lstrcmpW)
      • case insensitive: lstrcmpi (expands to lstrcmpiA or lstrcmpiW)
  • Windows via <shlwapi.h>, offering different comparison semantics:
    • StrCmp (expands to StrCmpA or StrCmpW)
    • StrCmpC (expands to StrCmpCA or StrCmpCW)
    • StrCmpI (expands to StrCmpIA or StrCmpIW)
    • StrCmpIC (expands to StrCmpICA or StrCmpICW)
    • StrCmpNC (expands to StrCmpNCA or StrCmpNCW)
    • StrCmpNI (expands to StrCmpNIA or StrCmpNIW)
    • StrCmpNIC (expands to StrCmpNICA or StrCmpNICW)
    • StrCmpN (expands to StrCmpNA or StrCmpNW)
  • Windows kernel mode and NT native:
    • RtlCompareUnicodeString
    • RtlEqualUnicodeString

But in all likelihood you are looking for the C runtime ones. The n variety usually is counted (n being the number of characters)

Also beware that there exist a number of related functions. E.g. with Windows conventionally you can build with _UNICODE defined or not, using <tchar.h>. This will then alias the respective "bare" function names to those with trailing A (ANSI) or W (wide character, i.e. "Unicode") version.

On Windows you will also encounter instead of str...something (e.g. strcmp) functions prefixed:

  • _tcs, i.e. _TCHAR/TCHAR character string ... where the meaning toggles (via <tchar.h>) between char and wchar_t (if _UNICODE defined)
  • _mbs, i.e. multi-byte character string (code pages such as some Asian locales where a single byte isn't enough to represent one code point, which predates wide use of Unicode proper)
  • wcs, i.e. "wide character string"
Improve this answer
2
  • 0xC0000022L, I tried each and every comparison function above but I couldn't find which function is responsible for comparing two strings. I want to crack the serial number. Is there have any other clue of how to find the functions if the "String references" window doesn't show any helpful strings to look for?
    – Kıvanç Cantimur
    Apr 3 at 6:17
  • @KıvançCantimur it's hard to help any further without having a sample at hand. As far as a crack is concerned: it could be that your string is used as input to a function whose output is then compared to an expected value or range. It could just as well be that the respective functions have been inlined. In particular the C runtime functions will often have compiler runtime counterparts which will be used rather than an imported symbol (via DLL/shared object). But I am afraid without some actual code I cannot help. Also, please use a separate question (but feel free to reference this one).
    – 0xC0000022L ♦
    Apr 4 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.