2

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows:

enter image description here

When compared to the image on the tutorial for the step, I found that the column headings of my window are : Address Command Comments where as according to the tutorial it is supposed to be: Address Disassembly Text String (It is not seen on the tutorial but I dig the internet before making this post).

I am using Windows 8.1. I have run Ollydbg as administrator with compatibility mode for Windows 7 and Windows XP SP3, used Ollydbg 1.10 and 2.0 but I get same results. The module loaded is also the correct (not the ntdll). The exe version is a different one but I installed it and the overall functionality of the new version is still the same - gives out the exactly same error message for invalid registration.

What am I doing wrong/missing here?? What might be the reason of this and how can I overcome it?

Improve this question
1
  • If i had written a software and found there's a tutorial how to crack it on the internet, i'd change a few things to break the tutorial. This is the thing you're missing.
    – Guntram Blohm
    Commented Apr 9, 2015 at 5:44

3 Answers 3

Reset to default
3

possibilities:

  1. Maybe the protection has been changed as @Guntram Blohm said.
  2. Have you checked your OllyDBG version. I guess this problem might have been occurred because your version doesn't support OS architecture or to be more specific, it doesn't have the proper plugins.

Suggestions:

  • Try to use "R4ndoms_OllyDBG" mod of OllyDBG... it's compatible with Win 7/8 x86/x64.
  • Don't go after strings, try to go after the api (that you think it's being implemented), or you can look in the stack.
  • Use another debugger like x64dbg or IDA Pro.
Improve this answer
3
  • I checked out the R4ndoms tutorial on reverse engineering and it using the OllyDbg on the blog, I could do it and did not find any problems with the labels. It was way before you posted the comment but since it worked for me, I am marking this right.
    – mathakoot
    Commented Jun 15, 2015 at 17:04
  • Could you suggest some tutorial/study blog where I can explore the API related technique that you've mentioned?
    – mathakoot
    Commented Jun 15, 2015 at 17:06
  • Lena's tutorials are the best. Watch the first 20 videos because each one has great amount of info.If you just want to find that specfic tutorial, you'll find it easily because it has an appendix (ex. html file) listing the most important APIs. Also, you can use IDAFactor plugin to do so, still I advice you to watch the series to know exactly what you are doing.
    – Yaser Alnajjar
    Commented Jun 16, 2015 at 16:16
3

There are a lot of way to hide strings to the debugger. A simple encryption at runtime can daunt new reverser to work on it.

Try this plugin sometimes it helps to find strings that Ollydbg doesn't show:

https://tuts4you.com/download.php?view.107

If also with Ultra string reference you don't get results, run the software in the debugger and then search for the string in Memory, then you can Memory breakpoint that area and understand where the software work with it and if there are encryptions to defeat.

Improve this answer
2

The windows that says disassembly is from ollydbg version 1.10.
The windows that says command the one you are looking at is from ollydbg 2.01.

enter image description here

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.