I just started playing around with reverse engineering and Ghidra, so please bear with me.
I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ISO, the other one does. As a learning exercise, I wanted to try patching the latter anyway: https://archive.org/download/Loewe2/Loewe2.iso/Setup%2FWinRoot%2FTerzio%2FLoewenzahn%202%2FLoewenzahn%202.exe
When I run the exe without the ISO mounted I get the error message Bitte die CD-ROM "Löwenzahn 2" einlegen!, which means Please insert CD-ROM "Löwenzahn 2"!.
So I ran
strings -t x Loewenzahn\ 2.exe | grep einlegen and got the output
17020 einlegen!. I found the same address using the hex-editor Okteta.
file Loewenzahn\ 2.exe gives the following output:
Loewenzahn 2.exe: PE32 executable (GUI) Intel 80386, for MS Windows
Now when I import Loewenzahn 2.exe into Ghidra and run all analyzers, there's a discrepancy between the addresses and I can't find the string "einlegen" via Search > For Strings....
Why is there an offset and can I configure Ghidra to start at 0? Can I configure Ghidra to show the raw strings, like "Th is program canno t be run in DOS mode"? And how can I find it using the String search?