1

Please note that I am new to x64dbg.

As you can be seen in the picture below, the error message has the string

[ebp+8]:L"The information you have entered is invalid!\n..."

address with string

However, when I do Search For > All Modules > String References, it does not pop up:

no results found

I am wondering why this searching only works for some strings, not all strings.

1 Answer 1

1

Just because a particular string is presented in your process memory during the execution of your program, it doesn't mean that it was prepared in advance (on disk) before you launch a program.

There are many other possibilities, how your program may load a "non-existing" string, for example:

  • The string is combined (e.g. concatenated) from others,
  • the string is entered by user,
  • the string is created from its encrypted form,
  • the string is from dynamically loaded DLL,
  • the string is loaded from resources,
  • the string is read from an external file,
  • the string is loaded from an environmental variable,
  • ... and so on.

Searching for a particular string is one of the simplest method in reverse engineering, but in the same time one of the least reliable method.

2
  • Great, thank you. How may I search a dynamically loaded string? As shown in my case above. Apr 18 at 23:28
  • @MahmoudMaarouf, searching for dynamically loaded strings has no meaning, you will have no success with this method.
    – MarianD
    Apr 19 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.