Forums >> Debuggers >> How come I cannot find a string reference
Topic created on: February 13, 2013 12:36 CST by amaw.
I tried to search for a string but I cannot find it. Is it possible that the string was created at runtime? If it was, is it possible to view at any registers?
FYI: exe file is not packed.
> amaw: I tried to search for a string but I cannot find it. Is it possible that the string was created at runtime? If it was, is it possible to view at any registers?
> FYI: exe file is not packed.
>
Can you provide details and binary drop?
> Thanks
There are many many ways to reference a string at compile time that might make it difficult for an RE to find a direct reference to the string.
Im assuming that you are parsing through assembly looking for a direct code reference.
Things like pointer tables and structs can often make a string references a little more abstract.
Try searching the binary view for the Little Endian byte notation of the string address. If you find a match, search for a reference to the address containing the string pointer.
For instance:
Let's say the string "Hello World" was stored at 0x12345678. Instead of searching for a direct reference to 0x12345678 try actually searching for the byte sequence 78 56 34 12 in memory. If you find it, search for a reference to the address that the match was found instead of the direct reference to the string.
This might help you map the data to the code.
Additionally, if the string is part of a large pointer table it might be indexed using something like [0x00041000+ecx*4] where 0x00041000 is the base address of the pointer table and ecx contains the index number. It won't always be 0x00041000 and ecx respectively, but you get the idea.
Note: Registration is required to post to the forums.